tun/linux: coalesce WriteGSO into single write() to avoid 4.19 UAF

The scatter-gather writev path in WriteGSO triggered a kernel-side use-after-free in tun_chr_write_iter → sock_alloc_send_pskb → skb_set_owner_w on Linux 4.19 TUN when the virtio_net_hdr requested TSO segmentation. The skb write-memory refcount (sk_wmem_alloc) underflowed, producing paired traces of refcount_t: addition on 0 (in the write path) and refcount_t: underflow (in the paired recv socket), reliably rebooting UBIOS UXG-Pro routers under iperf3 -R. Match wireguard-go's design: coalesce the virtio_net_hdr, IP/TCP header, and all payload fragments into a single contiguous per-queue scratch buffer, then emit the superpacket with a single write() syscall. wireguard-go's offload path handles GRO-merged TSO superpackets this way and has no equivalent failure mode (see tun/tun_linux.go Write — it writes bufs[bufsI][offset:] with a single tunFile.Write call after coalesce). Cost: one extra memcpy per superpacket (bounded at ~64KiB by the virtio spec). Unit tests pass (go test ./overlay/tio/...). Field testing on UXG-Pro (4.19) pending.
be safer
2026-09-30 12:56:39 +02:00 · 2026-04-24 22:21:51 +00:00 · 2026-04-24 16:48:52 -05:00 · 2026-04-24 16:27:23 -05:00 · 2026-04-23 17:32:49 -05:00 · 2026-04-23 13:12:24 -05:00
280 changed files with 9349 additions and 34044 deletions
@@ -1,123 +0,0 @@
 name: Code-sign Windows binaries
 description: >
  Sign every .exe under a given path in place via the DefinedNet code-signer
  Lambda. If `role` or `bucket` is empty, logs a notice and skips signing so
  forks and dev branches without AWS access still produce usable builds.
 inputs:
  path:
    description: "Directory whose .exe files should be signed in place"
    required: true
  role:
    description: "IAM role ARN to assume via OIDC; empty disables signing"
    required: false
    default: ""
  bucket:
    description: "S3 staging bucket the code-signer Lambda reads from; empty disables signing"
    required: false
    default: ""
  region:
    description: "AWS region for the role and Lambda"
    required: false
    default: "us-east-2"
  function-name:
    description: "Code-signer Lambda function name"
    required: false
    default: "code-signer"
  key-prefix:
    description: "S3 key prefix to write under; defaults to code-signing/<owner>/<repo> of the calling repo"
    required: false
    default: ""
 runs:
  using: composite
  steps:
    - name: Skip notice
      if: inputs.role == '' || inputs.bucket == ''
      shell: sh
      run: echo "::notice::code-signer role or bucket not set; skipping code signing."
    - name: Configure AWS credentials
      if: inputs.role != '' && inputs.bucket != ''
      uses: aws-actions/configure-aws-credentials@v6
      with:
        role-to-assume: ${{ inputs.role }}
        aws-region: ${{ inputs.region }}
        # An STS secret key with special characters does not survive the
        # pwsh -> make -> MSYS sh -> aws.exe chain, and SigV4 then signs with a
        # key that no longer matches, so the first S3 upload fails with
        # SignatureDoesNotMatch. Retries the assume until it comes back clean.
        # Same fix as DefinedNet/dnclient#867.
        special-characters-workaround: true
        # Overridden by the workaround above and kept for whenever that goes:
        # the default 12 rides out IAM trust-policy propagation, and once the
        # role is stable a real misconfiguration should fail fast.
        retry-max-attempts: 5
    - name: Sign .exe files
      if: inputs.role != '' && inputs.bucket != ''
      shell: sh
      env:
        SIGN_PATH: ${{ inputs.path }}
        BUCKET: ${{ inputs.bucket }}
        FUNCTION_NAME: ${{ inputs.function-name }}
        KEY_PREFIX: ${{ inputs.key-prefix }}
      run: |
        set -eu
        # Default the prefix to this repo so the S3 key attributes the sign correctly.
        # nebula-nightly runs this same action but writes under its own repo's prefix.
        KEY_PREFIX="${KEY_PREFIX:-code-signing/$GITHUB_REPOSITORY}"
        RUN="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
        find "$SIGN_PATH" -name '*.exe' -print | while read -r path
        do
            rel=${path#"$SIGN_PATH"/}
            file=$(basename "$path")
            name=${file%.exe}
            prefix="${KEY_PREFIX}/${RUN}"
            src="${prefix}/unsigned/${rel}"
            dst="${prefix}/signed/${rel}"
            echo "::group::Sign ${rel}"
            echo "Uploading unsigned to s3://${BUCKET}/${src}"
            aws s3 cp --no-progress "$path" "s3://${BUCKET}/${src}" >/dev/null
            echo "Invoking ${FUNCTION_NAME} Lambda"
            payload=$(jq -nc \
                --arg s "$src" \
                --arg d "$dst" \
                --arg p "$name" \
                '{source_key: $s, dest_key: $d, program_name: $p}')
            meta=$(aws lambda invoke \
                --function-name "$FUNCTION_NAME" \
                --cli-binary-format raw-in-base64-out \
                --payload "$payload" \
                --output json \
                /tmp/sign-resp.json)
            if echo "$meta" | jq -e '.FunctionError != null' >/dev/null
            then
                echo "::endgroup::"
                echo "::error::code-signer Lambda failed for ${rel}"
                cat /tmp/sign-resp.json >&2
                exit 1
            fi
            echo "Downloading signed back to ${path}"
            aws s3 cp --no-progress "s3://${BUCKET}/${dst}" "$path" >/dev/null
            aws s3 rm "s3://${BUCKET}/${src}" >/dev/null 2>&1 || true
            aws s3 rm "s3://${BUCKET}/${dst}" >/dev/null 2>&1 || true
            # Sanity-check the bytes we got back actually carry an Authenticode
            # signature that this machine can validate end to end.
            status=$(powershell -NoProfile -Command "(Get-AuthenticodeSignature -FilePath '$path').Status" | tr -d '\r')
            if [ "$status" != "Valid" ]
            then
                echo "::endgroup::"
                echo "::error::${rel} signature status: ${status} (expected Valid)"
                exit 1
            fi
            echo "Signed ${rel} (sha256=$(jq -r '.sha256' /tmp/sign-resp.json), status=${status})"
            echo "::endgroup::"
        done
@@ -0,0 +1,34 @@
 name: gofmt
 on:
  push:
    branches:
      - master
  pull_request:
    paths:
      - '.github/workflows/gofmt.yml'
      - '**.go'
 jobs:
  gofmt:
    name: Run gofmt
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: actions/setup-go@v6
      with:
        go-version: '1.25'
        check-latest: true
    - name: Install goimports
      run: |
        go install golang.org/x/tools/cmd/goimports@latest
    - name: gofmt
      run: |
        if [ "$(find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -l)" ]
        then
          find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -d
          exit 1
        fi
@@ -10,11 +10,11 @@ jobs:
    name: Build Linux/BSD All
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
-          go-version: '1.26'
+          go-version: '1.25'
          check-latest: true
      - name: Build
@@ -24,7 +24,7 @@ jobs:
          mv build/*.tar.gz release
      - name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: linux-latest
          path: release
@@ -32,15 +32,12 @@ jobs:
  build-windows:
    name: Build Windows
    runs-on: windows-latest
    permissions:
      id-token: write
      contents: read
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
-          go-version: '1.26'
+          go-version: '1.25'
          check-latest: true
      - name: Build
@@ -57,15 +54,8 @@ jobs:
          mkdir build\dist\windows
          mv dist\windows\wintun build\dist\windows\
      - name: Code-sign
        uses: ./.github/actions/code-sign
        with:
          path: build
          role: ${{ secrets.DEFINED_CODE_SIGNER_ROLE }}
          bucket: ${{ secrets.DEFINED_CODE_SIGNER_BUCKET }}
      - name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: windows-latest
          path: build
@@ -73,81 +63,27 @@ jobs:
  build-darwin:
    name: Build Universal Darwin
    env:
-      HAS_SIGNING_CREDS: ${{ secrets.APPLE_SIGNING_ROLE_ARN != '' }}
+      HAS_SIGNING_CREDS: ${{ secrets.AC_USERNAME != '' }}
    runs-on: macos-latest
    permissions:
      id-token: write
      contents: read
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
-          go-version: '1.26'
+          go-version: '1.25'
          check-latest: true
      # GitHub holds ARNs, not credentials, and ARNs outlive a rotation
      - name: Configure AWS credentials
        if: env.HAS_SIGNING_CREDS == 'true'
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.APPLE_SIGNING_ROLE_ARN }}
          aws-region: us-east-2
      # parse-json-secrets unpacks into SIGNING_* and ASC_*, masked on the way in
      - name: Fetch signing credentials
        if: env.HAS_SIGNING_CREDS == 'true'
        uses: aws-actions/aws-secretsmanager-get-secrets@v3
        with:
          parse-json-secrets: true
          secret-ids: |
            SIGNING,${{ secrets.APPLE_SIGNING_DEVELOPER_ID_ARN }}
            ASC,${{ secrets.APPLE_NOTARY_KEY_ARN }}
      - name: Import certificates
        if: env.HAS_SIGNING_CREDS == 'true'
-        uses: Apple-Actions/import-codesign-certs@v7
+        uses: Apple-Actions/import-codesign-certs@v6
        with:
-          p12-file-base64: ${{ env.SIGNING_P12_BASE64 }}
+          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
-          p12-password: ${{ env.SIGNING_PASSWORD }}
+          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
      # The action imports but does not check the chain validates, which is how a p12
      # missing its intermediate reaches a failing codesign
      - name: Check the identity is usable
        if: env.HAS_SIGNING_CREDS == 'true'
        run: |
          : "${SIGNING_IDENTITY_SHA1:?empty, so the secret has no identity_sha1}"
          identities=$(security find-identity -v -p codesigning signing_temp.keychain)
          case "$identities" in
          *"$SIGNING_IDENTITY_SHA1"*) ;;
          *) printf '%s\n' "$identities" >&2; exit 1 ;;
          esac
      # notarytool wants the key as a file
      - name: Write the App Store Connect key
        if: env.HAS_SIGNING_CREDS == 'true'
        run: |
          mkdir -p ~/private_keys
          chmod 700 ~/private_keys
          key_path="$HOME/private_keys/AuthKey_${ASC_KEY_ID}.p8"
          (umask 077; printf '%s\n' "$ASC_PRIVATE_KEY" > "$key_path")
          echo "ASC_P8=$key_path" >> "$GITHUB_ENV"
      - name: Drop the credentials from the environment
        if: env.HAS_SIGNING_CREDS == 'true'
        run: |
          # The action's own inventory, so a new field in a secret is covered
          python3 -c '
          import json, os
          raw = os.environ.get("SECRETS_LIST_CLEAN_UP")
          if raw is None and os.environ.get("SIGNING_P12_BASE64"):
              raise SystemExit("SECRETS_LIST_CLEAN_UP is gone, fetched secrets are not being scrubbed")
          keep = {"SIGNING_IDENTITY_SHA1", "ASC_KEY_ID", "ASC_ISSUER_ID"}
          names = [n for n in json.loads(raw or "[]") if n not in keep]
          print("\n".join(f"{n}=" for n in dict.fromkeys(names)))
          ' >> "$GITHUB_ENV"
      - name: Build, sign, and notarize
        env:
          AC_USERNAME: ${{ secrets.AC_USERNAME }}
          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          rm -rf release
          mkdir release
@@ -156,36 +92,19 @@ jobs:
          lipo -create -output ./release/nebula ./build/darwin-amd64/nebula ./build/darwin-arm64/nebula
          lipo -create -output ./release/nebula-cert ./build/darwin-amd64/nebula-cert ./build/darwin-arm64/nebula-cert
-          # Unset in a fork, which has no credentials to sign with
+          if [ -n "$AC_USERNAME" ]; then
-          if [ -n "$SIGNING_IDENTITY_SHA1" ]; then
+            codesign -s "10BC1FDDEB6CE753550156C0669109FAC49E4D1E" -f -v --timestamp --options=runtime -i "net.defined.nebula" ./release/nebula
-            codesign -s "$SIGNING_IDENTITY_SHA1" -f -v --timestamp --options=runtime -i "net.defined.nebula" ./release/nebula
+            codesign -s "10BC1FDDEB6CE753550156C0669109FAC49E4D1E" -f -v --timestamp --options=runtime -i "net.defined.nebula-cert" ./release/nebula-cert
            codesign -s "$SIGNING_IDENTITY_SHA1" -f -v --timestamp --options=runtime -i "net.defined.nebula-cert" ./release/nebula-cert
          fi
          zip -j release/nebula-darwin.zip release/nebula-cert release/nebula
-          if [ -n "$ASC_P8" ]; then
+          if [ -n "$AC_USERNAME" ]; then
-            xcrun notarytool submit ./release/nebula-darwin.zip --key "$ASC_P8" --key-id "$ASC_KEY_ID" --issuer "$ASC_ISSUER_ID" --wait
+            xcrun notarytool submit ./release/nebula-darwin.zip --team-id "576H3XS7FP" --apple-id "$AC_USERNAME" --password "$AC_PASSWORD" --wait
          fi
      - name: Drop the signing key
        if: always() && env.HAS_SIGNING_CREDS == 'true'
        run: |
          # Locked, not deleted: import-codesign-certs deletes it in its own post
          # step and fails the job if it is already gone. Locked is unusable.
          security lock-keychain signing_temp.keychain || true
          rm -f "$ASC_P8"
          # Nothing later in this job needs AWS
          python3 -c '
          import json, os
          names = json.loads(os.environ.get("SECRETS_LIST_CLEAN_UP") or "[]")
          names += ["ASC_P8", "SIGNING_IDENTITY_SHA1", "ASC_KEY_ID", "ASC_ISSUER_ID",
                    "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
          print("\n".join(f"{n}=" for n in dict.fromkeys(names)))
          ' >> "$GITHUB_ENV"
      - name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
        with:
          name: darwin-latest
          path: ./release/*
@@ -205,25 +124,25 @@ jobs:
      # be overwritten
      - name: Checkout code
        if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
      - name: Download artifacts
        if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v7
        with:
          name: linux-latest
          path: artifacts
      - name: Login to Docker Hub
        if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Set up Docker Buildx
        if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
      - name: Build and push images
        if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
@@ -234,20 +153,17 @@ jobs:
          mkdir -p build/linux-{amd64,arm64}
          tar -zxvf artifacts/nebula-linux-amd64.tar.gz -C build/linux-amd64/
          tar -zxvf artifacts/nebula-linux-arm64.tar.gz -C build/linux-arm64/
-          docker buildx build . --push -f docker/Dockerfile --platform linux/amd64,linux/arm64 \
+          docker buildx build . --push -f docker/Dockerfile --platform linux/amd64,linux/arm64 --tag "${DOCKER_IMAGE_REPO}:${DOCKER_IMAGE_TAG}" --tag "${DOCKER_IMAGE_REPO}:${GITHUB_REF#refs/tags/v}"
            --build-arg VERSION="${GITHUB_REF#refs/tags/v}" \
            --build-arg REVISION="${GITHUB_SHA}" \
            --tag "${DOCKER_IMAGE_REPO}:${DOCKER_IMAGE_TAG}" --tag "${DOCKER_IMAGE_REPO}:${GITHUB_REF#refs/tags/v}"
  release:
    name: Create and Upload Release
    needs: [build-linux, build-darwin, build-windows]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
      - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v7
        with:
          path: artifacts
@@ -14,27 +14,19 @@ on:
      - 'go.sum'
 jobs:
-  smoke-extra-libvirt:
+  smoke-extra:
    if: github.ref == 'refs/heads/master' || contains(github.event.pull_request.labels.*.name, 'smoke-test-extra')
-    name: ${{ matrix.target }}
+    name: Run extra smoke tests
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - freebsd-amd64
          - openbsd-amd64
          - netbsd-amd64
          - linux-amd64-ipv6disable
    env:
      VAGRANT_DEFAULT_PROVIDER: libvirt
    steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true
    - name: add hashicorp source
@@ -48,85 +40,28 @@ jobs:
        sudo chmod 666 /var/run/libvirt/libvirt-sock
        vagrant plugin install vagrant-libvirt
-    - name: ${{ matrix.target }}
+    - name: freebsd-amd64
-      run: make smoke-vagrant/${{ matrix.target }}
+      run: make smoke-vagrant/freebsd-amd64
-    timeout-minutes: 30
+    - name: openbsd-amd64
      run: make smoke-vagrant/openbsd-amd64
-  # linux-386 needs VirtualBox, which conflicts with KVM/libvirt -- isolated job.
+    - name: netbsd-amd64
-  smoke-extra-virtualbox:
+      run: make smoke-vagrant/netbsd-amd64
    if: github.ref == 'refs/heads/master' || contains(github.event.pull_request.labels.*.name, 'smoke-test-extra')
    name: linux-386
    runs-on: ubuntu-latest
    env:
      VAGRANT_DEFAULT_PROVIDER: virtualbox
    steps:
-    - uses: actions/checkout@v7
+    - name: linux-amd64-ipv6disable
      run: make smoke-vagrant/linux-amd64-ipv6disable
-    - uses: actions/setup-go@v7
+    # linux-386 runs last because it requires disabling KVM to use VirtualBox,
-      with:
+    # which prevents libvirt (used by the other tests) from working after this point.
-        go-version: '1.26'
+    - name: install virtualbox for i386 test
        check-latest: true
    - name: add hashicorp source
      run: wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg && echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
    - name: install vagrant and virtualbox
      run: |
-        sudo apt-get update && sudo apt-get install -y vagrant virtualbox
+        sudo apt-get install -y virtualbox
        sudo rmmod kvm_amd kvm_intel kvm 2>/dev/null || true
    - name: linux-386
      env:
        VAGRANT_DEFAULT_PROVIDER: virtualbox
      run: make smoke-vagrant/linux-386
    timeout-minutes: 30
  smoke-windows:
    if: github.ref == 'refs/heads/master' || contains(github.event.pull_request.labels.*.name, 'smoke-test-extra')
    name: Run windows smoke test
    runs-on: windows-latest
    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-go@v7
      with:
        go-version: '1.26'
        check-latest: true
    # WSL2 + Ubuntu so the smoke can run a real linux peer with its own
    # netns. iputils-ping is needed for the in-WSL ping check. WSL1 has no
    # real kernel and would lack /dev/net/tun, so we have to force WSL2.
    - uses: Vampire/setup-wsl@v3
      with:
        distribution: Ubuntu-24.04
        additional-packages: iputils-ping iproute2
    # Vampire/setup-wsl provisions WSL1 even when the WSL2 platform is present.
    # Convert the distro to WSL2 explicitly before we try to use /dev/net/tun.
    - name: convert distro to WSL2
      shell: pwsh
      run: |
        wsl --set-version Ubuntu-24.04 2
        wsl --shutdown
        wsl --list --verbose
    - name: build windows nebula
      run: make bin-windows
    - name: build linux nebula for WSL
      shell: bash
      env:
        GOOS: linux
        GOARCH: amd64
      run: |
        mkdir -p build/linux-amd64
        go build -o build/linux-amd64/nebula ./cmd/nebula
    - name: run smoke-windows
      shell: pwsh
      working-directory: ./.github/workflows/smoke
      run: ./smoke-windows.ps1
    timeout-minutes: 15
@@ -18,47 +18,38 @@ jobs:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true
    - name: Smoke Docker
      run: make smoke-docker
    - name: Smoke Docker IPv6 overlay
      run: make smoke-docker-ipv6
    - name: Smoke Relay Docker
      run: make smoke-relay-docker
    - name: Smoke Docker boringcrypto
      run: make boringcrypto smoke-docker
    - name: Smoke Docker fips140
      run: make fips140-all GOALS=smoke-docker
    timeout-minutes: 10
  smoke-self:
    name: Run self traffic smoke test on macOS
    runs-on: macos-latest
    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-go@v7
      with:
        go-version: '1.26'
        check-latest: true
    - name: build
-      run: make bin
+      run: make bin-docker CGO_ENABLED=1 BUILD_ARGS=-race
-    - name: run smoke-self
+    - name: setup docker image
      working-directory: ./.github/workflows/smoke
-      run: ./smoke-self.sh
+      run: ./build.sh
    - name: run smoke
      working-directory: ./.github/workflows/smoke
      run: ./smoke.sh
    - name: setup relay docker image
      working-directory: ./.github/workflows/smoke
      run: ./build-relay.sh
    - name: run smoke relay
      working-directory: ./.github/workflows/smoke
      run: ./smoke-relay.sh
    - name: setup docker image for P256
      working-directory: ./.github/workflows/smoke
      run: NAME="smoke-p256" CURVE=P256 ./build.sh
    - name: run smoke-p256
      working-directory: ./.github/workflows/smoke
      run: NAME="smoke-p256" ./smoke.sh
    timeout-minutes: 10
@@ -5,19 +5,6 @@ set -e -x
 rm -rf ./build
 mkdir ./build
 if [ "$SMOKE_OVERLAY_IPV6" ]
 then
    LIGHTHOUSE_NIP="fd00:4242:0:0:0:ffff:c0a8:6401"
    HOST2_NIP="fd00:4242:0:0:0:ffff:c0a8:6402"
    HOST3_NIP="fd00:4242:0:0:0:ffff:c0a8:6403"
    HOST4_NIP="fd00:4242:0:0:0:ffff:c0a8:6404"
 else
    LIGHTHOUSE_NIP="192.168.100.1"
    HOST2_NIP="192.168.100.2"
    HOST3_NIP="192.168.100.3"
    HOST4_NIP="192.168.100.4"
 fi
 # Smoke containers run on a dedicated docker network whose subnet is allocated
 # at smoke time, not known at build time. Configs are written with TEST-NET-3
 # placeholder IPs (RFC 5737) and smoke.sh / smoke-vagrant.sh / smoke-relay.sh
@@ -44,24 +31,24 @@ LIGHTHOUSE_IP="203.0.113.2"
        ../genconfig.sh >lighthouse1.yml
    HOST="host2" \
-        LIGHTHOUSES="$LIGHTHOUSE_NIP $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
        ../genconfig.sh >host2.yml
    HOST="host3" \
-        LIGHTHOUSES="$LIGHTHOUSE_NIP $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
        INBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
        ../genconfig.sh >host3.yml
    HOST="host4" \
-        LIGHTHOUSES="$LIGHTHOUSE_NIP $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
        OUTBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
        ../genconfig.sh >host4.yml
    ../../../../nebula-cert ca -curve "${CURVE:-25519}" -name "Smoke Test"
-    ../../../../nebula-cert sign -name "lighthouse1" -groups "lighthouse,lighthouse1" -ip "$LIGHTHOUSE_NIP/24"
+    ../../../../nebula-cert sign -name "lighthouse1" -groups "lighthouse,lighthouse1" -ip "192.168.100.1/24"
-    ../../../../nebula-cert sign -name "host2" -groups "host,host2" -ip "$HOST2_NIP/24"
+    ../../../../nebula-cert sign -name "host2" -groups "host,host2" -ip "192.168.100.2/24"
-    ../../../../nebula-cert sign -name "host3" -groups "host,host3" -ip "$HOST3_NIP/24"
+    ../../../../nebula-cert sign -name "host3" -groups "host,host3" -ip "192.168.100.3/24"
-    ../../../../nebula-cert sign -name "host4" -groups "host,host4" -ip "$HOST4_NIP/24"
+    ../../../../nebula-cert sign -name "host4" -groups "host,host4" -ip "192.168.100.4/24"
 )
 docker build -t "nebula:${NAME:-smoke}" .
@@ -1,130 +0,0 @@
 #!/bin/bash
 # A host must be able to reach its own overlay address. Where the kernel sends
 # that traffic through the tun rather than over loopback, nebula sees it and
 # hands it straight back (immediatelyForwardToSelf), and whether the kernel
 # accepts what comes back is only answerable against a real kernel. Runs one
 # nebula on this machine as root and aims every probe at its own address.
 set -e -x
 set -o pipefail
 V4=192.0.2.1
 V6=2001:db8::1
 case "$(uname -s)" in
    Darwin) TUN_DEV=utun ;;
    *) TUN_DEV=tun0 ;;
 esac
 ROOT="$(cd ../../.. && pwd)"
 rm -rf build/self
 mkdir -p build/self
 cd build/self
 cleanup() {
    echo
    echo " *** cleanup"
    echo
    set +e
    if [ -n "$NEBULA_PID" ]
    then
        sudo kill "$NEBULA_PID"
    fi
    { kill $(jobs -p); wait; } 2>/dev/null
    sed 's/^/  [self]  /' nebula.log
 }
 trap cleanup EXIT
 # perl is on every platform this runs on; timeout(1) is not.
 alarm() {
    perl -e 'alarm shift; exec @ARGV' "$@"
 }
 RESULTS=""
 FAILED=""
 probe() {
    local name="$1"
    shift
    if "$@"
    then
        RESULTS="$RESULTS $name=ok"
    else
        RESULTS="$RESULTS $name=FAIL"
        FAILED="$FAILED $name"
    fi
 }
 # Send one datagram, then wait for the listener to have written it out.
 udp_probe() {
    echo self | alarm 5 nc -u -w1 "$1" 3000 || true
    set +x
    for _ in $(seq 1 20)
    do
        if grep -q self "$2"
        then
            set -x
            return 0
        fi
        sleep 0.25
    done
    set -x
    return 1
 }
 "$ROOT/nebula-cert" ca -name "Smoke Test"
 "$ROOT/nebula-cert" sign -name self -networks "$V4/24,$V6/64"
 HOST=self AM_LIGHTHOUSE=true TUN_DEV="$TUN_DEV" ../../genconfig.sh >self.yml
 "$ROOT/nebula" -config self.yml -test
 sudo -v
 sudo "$ROOT/nebula" -config self.yml >nebula.log 2>&1 &
 NEBULA_PID=$!
 for _ in $(seq 1 40)
 do
    ifconfig | grep "inet6 $V6 " >/dev/null && break
    sleep 0.25
 done
 ifconfig | grep "inet $V4 "
 ifconfig | grep "inet6 $V6 "
 nc -l "$V4" 2000 >/dev/null &
 nc -l "$V6" 2000 >/dev/null &
 nc -u -l "$V4" 3000 >udp4.txt &
 nc -u -l "$V6" 3000 >udp6.txt &
 sleep 1
 set +x
 echo
 echo " *** Testing self traffic from $V4"
 echo
 set -x
 probe icmp4 alarm 5 ping -c1 "$V4"
 probe tcp4 alarm 5 nc -z "$V4" 2000
 probe udp4 udp_probe "$V4" udp4.txt
 set +x
 echo
 echo " *** Testing self traffic from $V6"
 echo
 set -x
 probe icmp6 alarm 5 ping6 -c1 "$V6"
 probe tcp6 alarm 5 nc -z "$V6" 2000
 probe udp6 udp_probe "$V6" udp6.txt
 set +x
 echo
 echo " *** self traffic:$RESULTS"
 echo
 if [ -n "$FAILED" ]
 then
    echo "self traffic failed:$FAILED" >&2
    exit 1
 fi
@@ -1,301 +0,0 @@
 #!/usr/bin/env pwsh
 # Windows smoke test for the nebula tun + UDP + NLM code paths.
 #
 # Topology:
 #   - lighthouse runs natively on the Windows host (wintun + windows UDP)
 #   - peer runs inside WSL2 (Linux build of nebula, /dev/net/tun)
 #
 # WSL2 gives us a real netns boundary so the loopback fast-path on Windows
 # does not short-circuit the overlay -- when WSL pings the lighthouse VPN IP,
 # Linux has no idea that IP is local to the Windows host, so the packet is
 # forced through nebula. Same in reverse.
 $ErrorActionPreference = 'Stop'
 # wsl.exe emits UTF-16 LE by default which PowerShell reads as bytes, mangling
 # every captured string. WSL_UTF8 makes wsl.exe emit UTF-8 instead.
 $env:WSL_UTF8 = '1'
 $RepoRoot = Resolve-Path "$PSScriptRoot\..\..\.."
 $Nebula = Join-Path $RepoRoot 'nebula.exe'
 $NebulaCert = Join-Path $RepoRoot 'nebula-cert.exe'
 $NebulaLinux = Join-Path $RepoRoot 'build\linux-amd64\nebula'
 if (-not (Test-Path $Nebula)) { throw "missing $Nebula; run 'make bin-windows' first" }
 if (-not (Test-Path $NebulaCert)) { throw "missing $NebulaCert; run 'make bin-windows' first" }
 if (-not (Test-Path $NebulaLinux)) { throw "missing $NebulaLinux; build the linux nebula first" }
 # Matches the distro installed by Vampire/setup-wsl in smoke-extra.yml.
 $Distro = 'Ubuntu-24.04'
 $listed = (wsl --list --quiet 2>$null) -join "`n"
 if ($listed -notmatch [regex]::Escape($Distro)) {
    throw "WSL distro $Distro not registered. Got: $listed"
 }
 Write-Host "Using WSL distro: $Distro"
 # Windows host as seen from inside WSL: WSL's default-route gateway. We extract
 # it with a regex rather than awk fields so PowerShell does not eat any '$N'
 # tokens, and tabs/double-spaces in `ip route` output do not confuse a cut.
 $ipCmd = 'ip route show default | grep -oE "([0-9]+\.){3}[0-9]+" | head -1'
 $WindowsIp = (wsl -d $Distro -- bash -c $ipCmd).Trim()
 if (-not $WindowsIp) { throw "could not determine Windows host IP from WSL" }
 Write-Host "Windows host IP from WSL: $WindowsIp"
 $WorkDir = Join-Path $env:TEMP 'nebula-smoke-windows'
 if (Test-Path $WorkDir) { Remove-Item -Recurse -Force $WorkDir }
 New-Item -ItemType Directory -Path $WorkDir | Out-Null
 $WslDir = '/tmp/nebula-smoke'
 wsl -d $Distro -- bash -c "rm -rf $WslDir && mkdir -p $WslDir" | Out-Null
 $DevName = 'nebula-smoke'
 $Ip1 = '192.168.241.1'
 $Ip2 = '192.168.241.2'
 # Dual stack on purpose: a v4-only overlay never exercises the v6 side of tun.mtu.
 $Ip6_1 = 'fd42:4242:241::1'
 $Ip6_2 = 'fd42:4242:241::2'
 $Mtu = 1300
 $Port = 4242
 & $NebulaCert ca -name 'smoke-ca' -out-crt "$WorkDir\ca.crt" -out-key "$WorkDir\ca.key"
 if ($LASTEXITCODE -ne 0) { throw "nebula-cert ca failed (exit $LASTEXITCODE)" }
 & $NebulaCert sign -name 'lighthouse' -networks "$Ip1/24,$Ip6_1/64" -ca-crt "$WorkDir\ca.crt" -ca-key "$WorkDir\ca.key" -out-crt "$WorkDir\lighthouse.crt" -out-key "$WorkDir\lighthouse.key"
 if ($LASTEXITCODE -ne 0) { throw "nebula-cert sign lighthouse failed (exit $LASTEXITCODE)" }
 & $NebulaCert sign -name 'peer' -networks "$Ip2/24,$Ip6_2/64" -ca-crt "$WorkDir\ca.crt" -ca-key "$WorkDir\ca.key" -out-crt "$WorkDir\peer.crt" -out-key "$WorkDir\peer.key"
 if ($LASTEXITCODE -ne 0) { throw "nebula-cert sign peer failed (exit $LASTEXITCODE)" }
 # Windows lighthouse config.
@"
 pki:
  ca: $WorkDir\ca.crt
  cert: $WorkDir\lighthouse.crt
  key: $WorkDir\lighthouse.key
 static_host_map: {}
 lighthouse:
  am_lighthouse: true
  interval: 60
  hosts: []
 listen:
  host: 0.0.0.0
  port: $Port
 tun:
  disabled: false
  dev: $DevName
  drop_local_broadcast: false
  drop_multicast: false
  tx_queue: 500
  mtu: $Mtu
  network_category: private
 logging:
  level: info
  format: text
 firewall:
  outbound_action: drop
  inbound_action: drop
  conntrack:
    tcp_timeout: 12m
    udp_timeout: 3m
    default_timeout: 10m
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: any
      host: any
 "@ | Out-File -FilePath "$WorkDir\lighthouse.yml" -Encoding utf8
 # WSL peer config (paths are POSIX, deliberately).
@"
 pki:
  ca: $WslDir/ca.crt
  cert: $WslDir/peer.crt
  key: $WslDir/peer.key
 static_host_map:
  "${Ip1}": ["${WindowsIp}:$Port"]
 lighthouse:
  am_lighthouse: false
  interval: 60
  hosts:
    - "${Ip1}"
 listen:
  host: 0.0.0.0
  port: 0
 tun:
  disabled: false
  dev: nebula1
  drop_local_broadcast: false
  drop_multicast: false
  tx_queue: 500
  mtu: $Mtu
 logging:
  level: info
  format: text
 firewall:
  outbound_action: drop
  inbound_action: drop
  conntrack:
    tcp_timeout: 12m
    udp_timeout: 3m
    default_timeout: 10m
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: any
      host: any
 "@ | Out-File -FilePath "$WorkDir\peer.yml" -Encoding utf8
 # Stage WSL artifacts. Convert Windows paths to WSL paths ourselves rather than
 # calling `wslpath`, because PowerShell's argument-passing to external EXEs
 # strips backslashes from path arguments in ways that are hard to escape around.
 function ConvertTo-WslPath {
    param([string]$WindowsPath)
    if ($WindowsPath -notmatch '^([A-Za-z]):\\(.*)$') {
        throw "cannot convert path to WSL: $WindowsPath"
    }
    return "/mnt/$($matches[1].ToLower())/$($matches[2].Replace('\','/'))"
 }
 $WslWorkDir = ConvertTo-WslPath $WorkDir
 $WslNebulaPath = ConvertTo-WslPath $NebulaLinux
 wsl -d $Distro -- bash -c "cp '$WslWorkDir/ca.crt' '$WslWorkDir/peer.crt' '$WslWorkDir/peer.key' '$WslWorkDir/peer.yml' $WslDir/ && cp '$WslNebulaPath' $WslDir/nebula && chmod +x $WslDir/nebula"
 # Make sure WSL has tun support and /dev/net/tun is usable before starting
 # nebula. Diagnostics first so a fail here points at the real problem (e.g.
 # WSL1 distros do not have a real kernel and will not have tun).
 Write-Host '=== WSL diagnostic ==='
 wsl --version 2>&1 | Out-Host
 wsl --list --verbose 2>&1 | Out-Host
 wsl -d $Distro -u root -- uname -a | Out-Host
 wsl -d $Distro -u root -- bash -c "modprobe tun 2>&1 || true; mkdir -p /dev/net; [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200; chmod 600 /dev/net/tun; { echo 0 > /proc/sys/net/ipv6/conf/all/disable_ipv6; echo 0 > /proc/sys/net/ipv6/conf/default/disable_ipv6; } 2>/dev/null || true; ls -l /dev/net/tun"
 if ($LASTEXITCODE -ne 0) { throw "failed to prepare /dev/net/tun in WSL (TUN support missing?)" }
 # Deliberately no New-NetFirewallRule calls here -- nebula's windows_bypass_wdf
 # feature is supposed to install WFP permit filters that let inbound traffic
 # through Windows Defender Firewall on its own. If this smoke regresses, that
 # feature regressed.
 $lhOut = Join-Path $WorkDir 'lighthouse.out.log'
 $lhErr = Join-Path $WorkDir 'lighthouse.err.log'
 $lhProc = Start-Process -FilePath $Nebula -ArgumentList @('-config', "$WorkDir\lighthouse.yml") `
    -PassThru -NoNewWindow `
    -RedirectStandardOutput $lhOut `
    -RedirectStandardError $lhErr
 # Run nebula in WSL as root with no sudo + no shell wrapper. PowerShell's
 # Start-Process arg quoting mangles `bash -c "..."` strings that contain
 # spaces/redirections, so we skip bash entirely and let Start-Process do the
 # stdout/stderr capture itself.
 $peerOut = Join-Path $WorkDir 'peer.out.log'
 $peerErr = Join-Path $WorkDir 'peer.err.log'
 $peerProc = Start-Process -FilePath 'wsl' `
    -ArgumentList @('-d', $Distro, '-u', 'root', '--', "$WslDir/nebula", '-config', "$WslDir/peer.yml") `
    -PassThru -NoNewWindow `
    -RedirectStandardOutput $peerOut `
    -RedirectStandardError $peerErr
 function Wait-Until {
    param([scriptblock]$Predicate, [int]$TimeoutSec, [string]$What)
    $deadline = (Get-Date).AddSeconds($TimeoutSec)
    while ((Get-Date) -lt $deadline) {
        if (& $Predicate) { return }
        Start-Sleep -Milliseconds 500
    }
    throw "timed out waiting for: $What"
 }
 try {
    Wait-Until -TimeoutSec 30 -What "windows wintun adapter $DevName with NetworkCategory=Private" -Predicate {
        if ($lhProc.HasExited) { throw "lighthouse exited (code $($lhProc.ExitCode)) before tun was ready" }
        $p = Get-NetConnectionProfile -InterfaceAlias $DevName -ErrorAction SilentlyContinue
        $p -and ("$($p.NetworkCategory)" -ieq 'Private')
    }
    Write-Host "OK: $DevName NetworkCategory=Private"
    # v6 silently kept the adapter default of 65535 while v4 was correct.
    foreach ($family in @('IPv4', 'IPv6')) {
        Wait-Until -TimeoutSec 30 -What "$DevName $family NlMtu=$Mtu" -Predicate {
            if ($lhProc.HasExited) { throw "lighthouse exited (code $($lhProc.ExitCode)) before $family mtu was set" }
            $rows = @(Get-NetIPInterface -InterfaceAlias $DevName -AddressFamily $family -ErrorAction SilentlyContinue)
            $rows.Count -gt 0 -and -not ($rows | Where-Object { $_.NlMtu -ne $Mtu })
        }
        Write-Host "OK: $DevName $family NlMtu=$Mtu"
    }
    Wait-Until -TimeoutSec 30 -What "WSL nebula1 with $Ip2" -Predicate {
        if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before tun was ready" }
        $r = wsl -d $Distro -u root -- bash -c "ip -o addr show nebula1 2>/dev/null | grep -q 'inet $Ip2' && echo yes"
        ("$r").Trim() -eq 'yes'
    }
    Write-Host "OK: WSL nebula1 has $Ip2"
    Wait-Until -TimeoutSec 30 -What "WSL nebula1 with $Ip6_2" -Predicate {
        if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before the v6 address was up" }
        $r = wsl -d $Distro -u root -- bash -c "ip -o addr show nebula1 2>/dev/null | grep -q 'inet6 $Ip6_2' && echo yes"
        ("$r").Trim() -eq 'yes'
    }
    Write-Host "OK: WSL nebula1 has $Ip6_2"
    Wait-Until -TimeoutSec 30 -What "ping from WSL peer to windows lighthouse ($Ip1)" -Predicate {
        if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before ping succeeded" }
        $r = wsl -d $Distro -u root -- bash -c "ping -c1 -W1 $Ip1 >/dev/null 2>&1 && echo OK"
        ("$r").Trim() -eq 'OK'
    }
    Write-Host "OK: WSL peer -> windows lighthouse"
    Wait-Until -TimeoutSec 30 -What "ping from windows lighthouse to WSL peer ($Ip2)" -Predicate {
        $null = & ping.exe -n 1 -w 1000 $Ip2
        $LASTEXITCODE -eq 0
    }
    Write-Host "OK: windows lighthouse -> WSL peer"
    # Otherwise the v6 networks only prove the interface exists, not that it forwards.
    Wait-Until -TimeoutSec 30 -What "v6 ping from WSL peer to windows lighthouse ($Ip6_1)" -Predicate {
        if ($peerProc.HasExited) { throw "peer exited (code $($peerProc.ExitCode)) before the v6 ping succeeded" }
        $r = wsl -d $Distro -u root -- bash -c "ping -6 -c1 -W1 $Ip6_1 >/dev/null 2>&1 && echo OK"
        ("$r").Trim() -eq 'OK'
    }
    Write-Host "OK: WSL peer -> windows lighthouse over v6"
    Write-Host ''
    Write-Host 'All smoke checks passed.'
 }
 catch {
    Write-Host ''
    Write-Host '=== lighthouse stdout ==='
    Get-Content $lhOut -ErrorAction SilentlyContinue | Out-Host
    Write-Host '=== lighthouse stderr ==='
    Get-Content $lhErr -ErrorAction SilentlyContinue | Out-Host
    Write-Host '=== peer stdout ==='
    Get-Content $peerOut -ErrorAction SilentlyContinue | Out-Host
    Write-Host '=== peer stderr ==='
    Get-Content $peerErr -ErrorAction SilentlyContinue | Out-Host
    Write-Host '=== nebula WFP filters ==='
    # Dump nebula-installed filters so we can verify they got registered with
    # the conditions we expect.
    $wfpDump = Join-Path $WorkDir 'wfp.xml'
    netsh wfp show filters file=$wfpDump 2>&1 | Out-Null
    if (Test-Path $wfpDump) {
        Select-String -Path $wfpDump -Pattern 'Nebula' -Context 0,80 -ErrorAction SilentlyContinue | Out-Host
    }
    throw
 }
 finally {
    if (-not $lhProc.HasExited) {
        Stop-Process -Id $lhProc.Id -Force -ErrorAction SilentlyContinue
        $lhProc.WaitForExit(5000) | Out-Null
    }
    wsl -d $Distro -u root -- bash -c "pkill -f $WslDir/nebula 2>/dev/null; true" | Out-Null
    # pkill returns 1 when no match and wsl propagates that; the smoke is done
    # so we don't want it to leak into the script's exit code.
    $global:LASTEXITCODE = 0
    if ($peerProc -and -not $peerProc.HasExited) {
        Stop-Process -Id $peerProc.Id -Force -ErrorAction SilentlyContinue
    }
 }
@@ -47,19 +47,6 @@ HOST2_IP="$PREFIX.3"
 HOST3_IP="$PREFIX.4"
 HOST4_IP="$PREFIX.5"
 if [ "$SMOKE_OVERLAY_IPV6" ]
 then
    LIGHTHOUSE_NIP="fd00:4242:0:0:0:ffff:c0a8:6401"
    HOST2_NIP="fd00:4242:0:0:0:ffff:c0a8:6402"
    HOST3_NIP="fd00:4242:0:0:0:ffff:c0a8:6403"
    HOST4_NIP="fd00:4242:0:0:0:ffff:c0a8:6404"
 else
    LIGHTHOUSE_NIP="192.168.100.1"
    HOST2_NIP="192.168.100.2"
    HOST3_NIP="192.168.100.3"
    HOST4_NIP="192.168.100.4"
 fi
 # Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
 # build/lighthouse1.yml has no IPs to rewrite so it's skipped.
 for f in build/host2.yml build/host3.yml build/host4.yml; do
@@ -93,28 +80,28 @@ docker exec host3 tcpdump -i eth0 -q -w - -U 2>logs/host3.outside.log >logs/host
 docker exec host4 tcpdump -i tun0 -q -w - -U 2>logs/host4.inside.log >logs/host4.inside.pcap &
 docker exec host4 tcpdump -i eth0 -q -w - -U 2>logs/host4.outside.log >logs/host4.outside.pcap &
-docker exec host2 ncat -nklv 2000 &
+docker exec host2 ncat -nklv 0.0.0.0 2000 &
-docker exec host3 ncat -nklv 2000 &
+docker exec host3 ncat -nklv 0.0.0.0 2000 &
-docker exec host4 ncat -e '/usr/bin/echo helloagainfromhost4' -nkluv 4000 &
+docker exec host4 ncat -nkluv 0.0.0.0 4000 &
-docker exec host2 ncat -e '/usr/bin/echo host2' -nkluv 3000 &
+docker exec host2 ncat -e '/usr/bin/echo host2' -nkluv 0.0.0.0 3000 &
-docker exec host3 ncat -e '/usr/bin/echo host3' -nkluv 3000 &
+docker exec host3 ncat -e '/usr/bin/echo host3' -nkluv 0.0.0.0 3000 &
 set +x
 echo
 echo " *** Testing ping from lighthouse1"
 echo
 set -x
-docker exec lighthouse1 ping -c1 $HOST2_NIP
+docker exec lighthouse1 ping -c1 192.168.100.2
-docker exec lighthouse1 ping -c1 $HOST3_NIP
+docker exec lighthouse1 ping -c1 192.168.100.3
 set +x
 echo
 echo " *** Testing ping from host2"
 echo
 set -x
-docker exec host2 ping -c1 $LIGHTHOUSE_NIP
+docker exec host2 ping -c1 192.168.100.1
 # Should fail because not allowed by host3 inbound firewall
-! docker exec host2 ping -c1 $HOST3_NIP -w5 || exit 1
+! docker exec host2 ping -c1 192.168.100.3 -w5 || exit 1
 set +x
 echo
@@ -122,34 +109,34 @@ echo " *** Testing ncat from host2"
 echo
 set -x
 # Should fail because not allowed by host3 inbound firewall
-! docker exec host2 ncat -nzv -w5 $HOST3_NIP 2000 || exit 1
+! docker exec host2 ncat -nzv -w5 192.168.100.3 2000 || exit 1
-! docker exec host2 ncat -nzuv -w5 $HOST3_NIP 3000 | grep -q host3 || exit 1
+! docker exec host2 ncat -nzuv -w5 192.168.100.3 3000 | grep -q host3 || exit 1
 set +x
 echo
 echo " *** Testing ping from host3"
 echo
 set -x
-docker exec host3 ping -c1 $LIGHTHOUSE_NIP
+docker exec host3 ping -c1 192.168.100.1
-docker exec host3 ping -c1 $HOST2_NIP
+docker exec host3 ping -c1 192.168.100.2
 set +x
 echo
 echo " *** Testing ncat from host3"
 echo
 set -x
-docker exec host3 ncat -nzv -w5 $HOST2_NIP 2000
+docker exec host3 ncat -nzv -w5 192.168.100.2 2000
-docker exec host3 ncat -nzuv -w5 $HOST2_NIP 3000 | grep -q host2
+docker exec host3 ncat -nzuv -w5 192.168.100.2 3000 | grep -q host2
 set +x
 echo
 echo " *** Testing ping from host4"
 echo
 set -x
-docker exec host4 ping -c1 $LIGHTHOUSE_NIP
+docker exec host4 ping -c1 192.168.100.1
 # Should fail because not allowed by host4 outbound firewall
-! docker exec host4 ping -c1 $HOST2_NIP -w5 || exit 1
+! docker exec host4 ping -c1 192.168.100.2 -w5 || exit 1
-! docker exec host4 ping -c1 $HOST3_NIP -w5 || exit 1
+! docker exec host4 ping -c1 192.168.100.3 -w5 || exit 1
 set +x
 echo
@@ -157,10 +144,10 @@ echo " *** Testing ncat from host4"
 echo
 set -x
 # Should fail because not allowed by host4 outbound firewall
-! docker exec host4 ncat -nzv -w5 $HOST2_NIP 2000 || exit 1
+! docker exec host4 ncat -nzv -w5 192.168.100.2 2000 || exit 1
-! docker exec host4 ncat -nzv -w5 $HOST3_NIP 2000 || exit 1
+! docker exec host4 ncat -nzv -w5 192.168.100.3 2000 || exit 1
-! docker exec host4 ncat -nzuv -w5 $HOST2_NIP 3000 | grep -q host2 || exit 1
+! docker exec host4 ncat -nzuv -w5 192.168.100.2 3000 | grep -q host2 || exit 1
-! docker exec host4 ncat -nzuv -w5 $HOST3_NIP 3000 | grep -q host3 || exit 1
+! docker exec host4 ncat -nzuv -w5 192.168.100.3 3000 | grep -q host3 || exit 1
 set +x
 echo
@@ -168,11 +155,11 @@ echo " *** Testing conntrack"
 echo
 set -x
-# host4's outbound firewall only allows ICMP to the lighthouse, so host4
+# host2 speaking to host4 on UDP 4000 should allow it to reply, when firewall rules would normally not permit this
-# cannot initiate UDP to host2. Once host2 initiates a flow to host4:4000,
+docker exec host2 sh -c "/usr/bin/echo host2 | ncat -nuv 192.168.100.4 4000"
-# conntrack must let host4's listener reply on that flow. If it doesn't,
+docker exec host2 ncat -e '/usr/bin/echo helloagainfromhost2' -nkluv 0.0.0.0 4000 &
-# the echo back from host4 never reaches host2.
+sleep 1
-docker exec host2 sh -c "(/usr/bin/echo host2; sleep 2) | ncat -nuv $HOST4_NIP 4000" | grep -q helloagainfromhost4
+docker exec host4 sh -c "/usr/bin/echo host4 | ncat -nuv 192.168.100.2 4000"
 docker exec host4 sh -c 'kill 1'
 docker exec host3 sh -c 'kill 1'
@@ -1,7 +1,7 @@
 # -*- mode: ruby -*-
 # vi: set ft=ruby :
 Vagrant.configure("2") do |config|
-  config.vm.box = "DefinedNet/netbsd10"
+  config.vm.box = "generic/netbsd9"
  config.vm.synced_folder "../build", "/nebula", type: "rsync"
 end
@@ -13,28 +13,20 @@ on:
      - 'go.sum'
 jobs:
-  static:
+  test-linux:
-    name: Static checks
+    name: Build all and test on ubuntu-linux
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true
-    - name: Install goimports
+    - name: Build
-      run: go install golang.org/x/tools/cmd/goimports@latest
+      run: make all
    - name: gofmt
      run: |
        if [ "$(find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -l)" ]
        then
          find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -d
          exit 1
        fi
    - name: Vet
      run: make vet
@@ -42,114 +34,99 @@ jobs:
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v9
      with:
-        version: v2.12
+        version: v2.5
-  test:
+    - name: Test
-    name: Test ${{ matrix.name }}
+      run: make test
-    runs-on: ${{ matrix.os }}
+
-    strategy:
+    - name: End 2 end
-      fail-fast: false
+      run: make e2evv
-      matrix:
+
-        include:
+    - name: Build test mobile
-        - name: linux
+      run: make build-test-mobile
-          os: ubuntu-latest
+
-          build-cmd: go build ./cmd/nebula ./cmd/nebula-cert
+    - uses: actions/upload-artifact@v6
-          test-cmd: make test
+      with:
-          e2e-cmd: make e2evv
+        name: e2e packet flow linux-latest
-        - name: linux-boringcrypto
+        path: e2e/mermaid/linux-latest
-          os: ubuntu-latest
+        if-no-files-found: warn
-          build-cmd: make boringcrypto
+
-          test-cmd: make boringcrypto test
+  test-linux-boringcrypto:
-          e2e-cmd: make boringcrypto e2evv
+    name: Build and test on linux with boringcrypto
-        - name: linux-fips140
+    runs-on: ubuntu-latest
          os: ubuntu-latest
          build-cmd: make fips140-all
          test-cmd: make fips140-all GOALS=test
          e2e-cmd: make fips140-all GOALS=e2evv
        - name: linux-pkcs11
          os: ubuntu-latest
          build-cmd: make bin-pkcs11
          test-cmd: make test-pkcs11
          e2e-cmd: ''
        - name: macos
          os: macos-latest
          build-cmd: go build ./cmd/nebula ./cmd/nebula-cert
          test-cmd: make test
          e2e-cmd: make e2evv
        - name: windows
          os: windows-latest
          build-cmd: go build ./cmd/nebula ./cmd/nebula-cert
          test-cmd: make test
          e2e-cmd: make e2evv
    steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true
    - name: Build
-      run: ${{ matrix.build-cmd }}
+      run: make bin-boringcrypto
    - name: Cross-build darwin-amd64
      if: matrix.name == 'macos'
      run: GOARCH=amd64 go build -o /tmp/nebula-amd64 ./cmd/nebula && GOARCH=amd64 go build -o /tmp/nebula-cert-amd64 ./cmd/nebula-cert
    - name: Test
-      run: ${{ matrix.test-cmd }}
+      run: make test-boringcrypto
    - name: End 2 end
-      if: matrix.e2e-cmd != ''
+      run: make e2e GOEXPERIMENT=boringcrypto CGO_ENABLED=1 TEST_ENV="TEST_LOGS=1" TEST_FLAGS="-v -ldflags -checklinkname=0"
      run: ${{ matrix.e2e-cmd }}
-    - uses: actions/upload-artifact@v7
+  test-linux-pkcs11:
-      if: matrix.e2e-cmd != '' && always()
+    name: Build and test on linux with pkcs11
      with:
        name: e2e packet flow ${{ matrix.name }}
        path: e2e/mermaid/
        if-no-files-found: warn
  cross-build:
    name: Cross-build ${{ matrix.name }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
        - {name: linux-arm,   make-target: all-cross-linux-arm}
        - {name: linux-mips,  make-target: all-cross-linux-mips}
        - {name: linux-other, make-target: all-cross-linux-other}
        - {name: freebsd,     make-target: all-freebsd}
        - {name: openbsd,     make-target: all-openbsd}
        - {name: netbsd,      make-target: all-netbsd}
        - {name: windows,     make-target: all-cross-windows}
        - {name: mobile,      make-target: build-test-mobile}
    steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true
-    - name: Build ${{ matrix.name }}
+    - name: Build
-      run: make -j"$(nproc)" ${{ matrix.make-target }}
+      run: make bin-pkcs11
-  finish:
+    - name: Test
-    name: CI status
+      run: make test-pkcs11
-    if: always()
+
-    needs: [static, test, cross-build]
+  test:
-    runs-on: ubuntu-latest
+    name: Build and test on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [windows-latest, macos-latest]
    steps:
-    - name: Fail if any upstream job failed
+    - uses: actions/checkout@v6
      if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
      run: |
        echo "upstream results: ${{ toJSON(needs) }}"
        exit 1
-    - name: All upstream jobs passed
+    - uses: actions/setup-go@v6
-      run: echo "ok"
+      with:
        go-version: '1.25'
        check-latest: true
    - name: Build nebula
      run: go build ./cmd/nebula
    - name: Build nebula-cert
      run: go build ./cmd/nebula-cert
    - name: Vet
      run: make vet
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v9
      with:
        version: v2.5
    - name: Test
      run: make test
    - name: End 2 end
      run: make e2evv
    - uses: actions/upload-artifact@v6
      with:
        name: e2e packet flow ${{ matrix.os }}
        path: e2e/mermaid/${{ matrix.os }}
        if-no-files-found: warn
@@ -2,21 +2,7 @@ version: "2"
 linters:
  default: none
  enable:
    - sloglint
    - testifylint
  settings:
    sloglint:
      # Enforce key-value pair form for Info/Debug/Warn/Error/Log/With and
      # the package-level slog equivalents. Use l.Log(ctx, level, ...) for
      # custom levels instead of LogAttrs when you can.
      #
      # LogAttrs is also flagged by this rule because it takes ...slog.Attr;
      # the few legitimate sites (where attrs is built up as a []slog.Attr)
      # carry a //nolint:sloglint with rationale.
      kv-only: true
      # no-mixed-args is on by default: forbids mixing kv and attrs in one call.
      # discard-handler is on by default (since Go 1.24): suggests
      # slog.DiscardHandler over slog.NewTextHandler(io.Discard, nil).
  exclusions:
    generated: lax
    presets:
@@ -7,135 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 ### Added
 - New `nebula ctl <command>` subcommand, which runs any of the debug and administrative commands the sshd
  block exposes without requiring an ssh server, a host key, or authorized keys. Nebula serves them over a
  local unix socket, configured by the new `ctl` block and enabled by default at `/run/nebula/ctl.sock` on
  Linux and `/var/run/nebula/ctl.sock` elsewhere. The socket lives in a `0700` directory so filesystem
  permissions are the access control; failing to create it is logged and never prevents nebula from
  starting. Packagers running nebula under systemd will want `RuntimeDirectory=nebula` in the unit so the
  directory exists with the right ownership. Not supported on Windows yet, and never enabled on iOS or
  Android. Reloadable.
 ### Changed
 - The ssh console now reports a real exit status for `ssh <host> <command>` rather than always reporting
  success, so commands run that way are scriptable.
 - The debug and administrative commands moved out of `ssh.go` into `commands.go` and are no longer tied to
  ssh: both the ssh console and `nebula ctl` dispatch against one shared registry, so a command added in
  one place is available over both. Embedders of the `sshd` package are affected: `sshd.NewSSHServer` now
  takes a `*diag.Registry`, `sshd.SSHServer.RegisterCommand` is gone in favor of registering on that
  registry directly, and the command types now live in the `diag` package rather than being re-exported
  from `sshd`.
 ## [1.11.1] - 2026-08-21
 See the [v1.11.1](https://github.com/slackhq/nebula/milestone/30?closed=1) milestone for a complete list of changes.
 ### Changed
 - IPv6 packets whose next header is a protocol Nebula does not parse (SCTP, GRE, IP-in-IP, etc.) are now
  classified as that protocol with no ports, closing a firewall bypass where a crafted payload could steer
  the classifier into reading one as TCP/UDP and matching a TCP/UDP rule. These packets are now matched as
  their true protocol, so only a `proto: any` rule allows them. If you carry one of these protocols over the
  overlay, confirm a `proto: any` rule covers it before upgrading, it may have been passing only through this
  bypass. (#1840)
 - Drop the dependency on `github.com/cyberdelia/go-metrics-graphite`, which has been unmaintained for over ten
  years, by inlining the small amount of code Nebula used. (#1832)
 ### Fixed
 - The ICMPv6 type was read from the wrong byte when classifying IPv6 packets, so the echo identifier used
  for conntrack was never picked up. (#1840)
 - Enforce outbound message counter limits so a tunnel is rehandshaked before the counter can wrap, preventing
  nonce reuse. This is unreachable in practice, but is enforced as a defense-in-depth measure. (#1841)
 - Prevent `nebula-cert ca` from running out of memory on 32bit systems when generating encrypted private keys. (#1834)
 - Tolerate `ErrDumpInterrupted` when listing tun addresses on Linux, so a transient interrupted netlink dump
  no longer aborts startup. (#1835)
 ## [1.11.0] - 2026-07-23
 See the [v1.11.0](https://github.com/slackhq/nebula/milestone/25?closed=1) milestone for a complete list of changes.
 ### Breaking
 - Logging has switched from logrus to Go's structured `slog`. Log output changes: levels are upper case
  (`level=INFO`), trace prints as `level=DEBUG-4`, timestamps are always RFC3339Nano and `logging.timestamp_format`
  is ignored, and some messages were reworded. Review any log parsing before upgrading. This is also an API break
  for embedders, as constructors now take a `*slog.Logger`. (#1672, #1734, #1621)
 - `firewall.inbound_action` and `firewall.outbound_action` (used to set reject vs. drop policy) were each being
  applied to the opposite direction, that is now corrected. This only affects how blocked packets are answered, not
  which packets the firewall allows or denies. If you set either of these you are getting the behavior of the other
  one today and likely want to swap them before upgrading. (#1798)
 - On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and the listener port by default. WFP
  sits below Windows Defender Firewall, so any WDF inbound rules you rely on for either will no longer apply. Set
  `tun.windows_bypass_wdf` and `listen.windows_bypass_wdf` to false to leave WDF in charge. (#1710)
 - On Windows, the nebula device is now set to the `private` network category instead of whatever Windows decided,
  which is usually `Public`. This makes the host firewall less restrictive on the overlay. Set
  `tun.network_category` to `unset` to keep the old behavior. (#1710)
 - Reject packets for non-TCP now use ICMP code 13, communication administratively prohibited, instead of code 3,
  port unreachable. Anything keying off the old code needs updating. (#1766, #1768)
 - The SSH debug server's profiling commands are now confined to `sshd.sandbox_dir`, which defaults to
  `$TMP/nebula-debug`. Relative paths resolve inside it and absolute paths outside it are rejected, so anything
  scripting `start-cpu-profile`, `save-heap-profile`, or `save-mutex-profile` with a path elsewhere needs the
  directory set. The directory is not created for you. (#1622)
 ### Added
 - Sign the Windows release binaries. (#1718)
 - Generate IPv6 reject packets, matching the existing IPv4 behavior. (#1766, #1767, #1768)
 - Accept `-` in `nebula-cert` to read from stdin or write to stdout. (#1714)
 - Search for both `config.yml` and `config.yaml` in service and command line modes. (#1717)
 - Add version labels to the Docker/OCI images. (#1772)
 - Rebind the listener and re-query lighthouses on macOS when the underlay network changes, so devices moving
  between wifi and wired or between networks recover without waiting for dead tunnel detection. Controlled by
  `listen.rebind_on_network_change` (default `true`, not reloadable). (#1816)
 ### Changed
 - Reload the firewall when the unsafe networks in the certificate change. (#1719)
 - Reconfigure, start, and stop the stats listener on a config reload instead of requiring a restart. (#1670)
 - Update a static host's addresses when they change on reload. (#1713)
 - Don't require a port on ICMP firewall rules. (#1609)
 - Connection track ICMP traffic. (#1602)
 - Return `NODATA` instead of `NXDOMAIN` from the DNS server for a name that exists but has no record of the
  requested type, so clients that query `AAAA` first (busybox/Alpine) fall through to `A`. (#1668)
 - Record the local host's details in the DNS server. (#1716)
 - Install Windows unsafe routes as link routes. (#1709)
 - Reduce relay handshake log spam, and only log a handshake send error at error level when the remote list
  changes. (#1733, #1765, #1810)
 - Start, stop, and reload subsystems (DNS, stats, conntrack, ssh, punchy) cleanly without leaking goroutines. (#1640, #1654, #1661, #1667, #1669, #1708, #1806, #1815)
 - `Control` is now safe to stop and wait on from any lifecycle state, and a new `Control.Wait` blocks until nebula
  has fully stopped and returns the first fatal reader error. Failed starts release the udp sockets and tun fd
  instead of leaking them. (#1794)
 - Trigger an immediate lighthouse update when reconnecting to or adding a lighthouse instead of waiting for the next update tick. (#1645)
 - Bring the Darwin and OpenBSD tun implementations in line with the other BSDs. (#1703)
 - Update to build against go v1.26. (#1818)
 - Various dependency updates. (#1586, #1587, #1604, #1617, #1618, #1627, #1628, #1629, #1652, #1664, #1665, #1697, #1721, #1732, #1742, #1743, #1750, #1763, #1771, #1782, #1800, #1807)
 ### Fixed
 - Fix a data race on a host's remote address that could send packets to the wrong address during a roam. (#1773)
 - Fix tunnels that could permanently escape connection manager monitoring. (#1752)
 - Fix a crash when reloading the SSH server's trusted keys. (#1787)
 - Fix hostmap corruption when a host has multiple overlay addresses. Each address now gets its own list instead of
  a single shared chain, which also fixes two latent bugs on the add and makePrimary paths. (#1788, #1790)
 - Apply `remote_allow_list` IPv4 rules to 4-in-6 mapped addresses. (#1786)
 - Don't panic in the DNS server on a short or empty query name. (#1635)
 - Advance the replay window on relayed packets so a relay drops replayed frames instead of re-forwarding them. (#1751)
 - Fix a race in relay state handling. (#1753)
 - Lock replay window updates so concurrent readers can't corrupt it. (#1802)
 - Reject malformed handshakes more reliably, including invalid ed25519 key lengths. (#1601, #1756)
 - Properly handle `closetunnel` packets. (#1638)
 - Fix an IPv6 extension-header length overflow that could make the firewall parse the wrong protocol and ports. (#1789)
 - Fix relay re-establishment when a handshake arrives over a relay entry that a one-sided teardown left
  `Disestablished`, which silently dropped every send until dead tunnel detection forced a re-handshake. (#1805)
 - Don't build new relay state on a tunnel that was just discarded. (#1796)
 - Don't delete the wrong pending hostinfo in the handshake manager. (#1811)
 - Don't call the packet reader after a UDP error on Darwin. (#1755)
 - Open the FreeBSD tun device non blocking. (#1666)
 ## [1.10.3] - 2026-02-06
 ### Security
@@ -917,9 +788,7 @@ created.)
 - Initial public release.
-[Unreleased]: https://github.com/slackhq/nebula/compare/v1.11.1...HEAD
+[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.3...HEAD
 [1.11.1]: https://github.com/slackhq/nebula/releases/tag/v1.11.1
 [1.11.0]: https://github.com/slackhq/nebula/releases/tag/v1.11.0
 [1.10.3]: https://github.com/slackhq/nebula/releases/tag/v1.10.3
 [1.10.2]: https://github.com/slackhq/nebula/releases/tag/v1.10.2
 [1.10.1]: https://github.com/slackhq/nebula/releases/tag/v1.10.1
@@ -60,29 +60,6 @@ ALL = $(ALL_LINUX) \
 	windows-amd64 \
 	windows-arm64
 # Cross-build shards used by .github/workflows/test.yml — same as ALL_*
 # but with the arch that has a native CI runner removed, so the cross-build
 # job is not duplicating coverage the native test jobs already give.
 ALL_CROSS_LINUX = $(filter-out linux-amd64,$(ALL_LINUX))
 # ALL_CROSS_LINUX further split into family sub-shards so each can run on
 # its own CI runner in parallel. Union of the three must equal
 # ALL_CROSS_LINUX; adding a new linux arch goes into the matching family.
 ALL_CROSS_LINUX_ARM   = linux-arm-5 linux-arm-6 linux-arm-7 linux-arm64
 ALL_CROSS_LINUX_MIPS  = linux-mips linux-mipsle linux-mips64 linux-mips64le linux-mips-softfloat
 ALL_CROSS_LINUX_OTHER = linux-386 linux-ppc64le linux-riscv64 linux-loong64
 # Based on section 2.2 of the Go Cryptographic Module CVMP Security Policy #5247
 ALL_FIPS140 = linux-amd64-fips140 \
 	linux-arm64-fips140 \
 	windows-amd64-fips140 \
 	windows-arm64-fips140 \
 	darwin-arm64-fips140 \
 	freebsd-amd64-fips140 \
 	linux-arm-7-fips140 \
 	linux-mips64-fips140 \
 	linux-ppc64le-fips140
 e2e:
 	$(TEST_ENV) go test -tags=e2e_testing -count=1 $(TEST_FLAGS) ./e2e
@@ -105,35 +82,6 @@ DOCKER_BIN = build/linux-amd64/nebula build/linux-amd64/nebula-cert
 all: $(ALL:%=build/%/nebula) $(ALL:%=build/%/nebula-cert)
 all-linux: $(ALL_LINUX:%=build/%/nebula) $(ALL_LINUX:%=build/%/nebula-cert)
 all-freebsd: $(ALL_FREEBSD:%=build/%/nebula) $(ALL_FREEBSD:%=build/%/nebula-cert)
 all-openbsd: $(ALL_OPENBSD:%=build/%/nebula) $(ALL_OPENBSD:%=build/%/nebula-cert)
 all-netbsd: $(ALL_NETBSD:%=build/%/nebula) $(ALL_NETBSD:%=build/%/nebula-cert)
 all-darwin: build/darwin-amd64/nebula build/darwin-amd64/nebula-cert build/darwin-arm64/nebula build/darwin-arm64/nebula-cert
 all-windows: build/windows-amd64/nebula.exe build/windows-amd64/nebula-cert.exe build/windows-arm64/nebula.exe build/windows-arm64/nebula-cert.exe
 # CI cross-build shards. darwin-arm64 is covered by the native macos-latest
 # job; windows-amd64 is covered by the native windows-latest job; both are
 # omitted here to avoid building them a second time. darwin-amd64 stays in
 # all-cross-darwin because intel mac is only a labeled/master-time native
 # job, so PRs still need cross-build coverage for it.
 all-cross-linux: $(ALL_CROSS_LINUX:%=build/%/nebula) $(ALL_CROSS_LINUX:%=build/%/nebula-cert)
 all-cross-linux-arm:   $(ALL_CROSS_LINUX_ARM:%=build/%/nebula)   $(ALL_CROSS_LINUX_ARM:%=build/%/nebula-cert)
 all-cross-linux-mips:  $(ALL_CROSS_LINUX_MIPS:%=build/%/nebula)  $(ALL_CROSS_LINUX_MIPS:%=build/%/nebula-cert)
 all-cross-linux-other: $(ALL_CROSS_LINUX_OTHER:%=build/%/nebula) $(ALL_CROSS_LINUX_OTHER:%=build/%/nebula-cert)
 all-cross-darwin: build/darwin-amd64/nebula build/darwin-amd64/nebula-cert
 all-cross-windows: build/windows-arm64/nebula.exe build/windows-arm64/nebula-cert.exe
 docker: docker/linux-$(shell go env GOARCH)
 release: $(ALL:%=build/nebula-%.tar.gz)
@@ -148,8 +96,6 @@ release-netbsd: $(ALL_NETBSD:%=build/nebula-%.tar.gz)
 release-boringcrypto: build/nebula-linux-$(shell go env GOARCH)-boringcrypto.tar.gz
 release-fips140: $(ALL_FIPS140:%=build/nebula-%.tar.gz)
 BUILD_ARGS += -trimpath
 bin-windows: build/windows-amd64/nebula.exe build/windows-amd64/nebula-cert.exe
@@ -170,24 +116,17 @@ bin-freebsd-arm64: build/freebsd-arm64/nebula build/freebsd-arm64/nebula-cert
 bin-boringcrypto: build/linux-$(shell go env GOARCH)-boringcrypto/nebula build/linux-$(shell go env GOARCH)-boringcrypto/nebula-cert
 	mv $? .
 bin-fips140: build/linux-$(shell go env GOARCH)-fips140/nebula build/linux-$(shell go env GOARCH)-fips140/nebula-cert
 	mv $? .
 bin-pkcs11: BUILD_ARGS += -tags pkcs11
 bin-pkcs11: CGO_ENABLED = 1
 bin-pkcs11: bin
 # Build with the pprof debug server (serves on :6060). See startPprofServer.
 debug: BUILD_ARGS += -tags debug
 debug: bin
 bin:
-	$(GOENV) go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula${NEBULA_CMD_SUFFIX} ${NEBULA_CMD_PATH}
+	go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula${NEBULA_CMD_SUFFIX} ${NEBULA_CMD_PATH}
-	$(GOENV) go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula-cert${NEBULA_CMD_SUFFIX} ./cmd/nebula-cert
+	go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula-cert${NEBULA_CMD_SUFFIX} ./cmd/nebula-cert
 install:
-	$(GOENV) go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ${NEBULA_CMD_PATH}
+	go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ${NEBULA_CMD_PATH}
-	$(GOENV) go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ./cmd/nebula-cert
+	go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ./cmd/nebula-cert
 build/linux-arm-%: GOENV += GOARM=$(word 3, $(subst -, ,$*))
 build/linux-mips-%: GOENV += GOMIPS=$(word 3, $(subst -, ,$*))
@@ -198,11 +137,8 @@ build/linux-mips-softfloat/%: LDFLAGS += -s -w
 # boringcrypto
 build/linux-amd64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1
 build/linux-arm64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1
-
+build/linux-amd64-boringcrypto/%: LDFLAGS += -checklinkname=0
-# fips140
+build/linux-arm64-boringcrypto/%: LDFLAGS += -checklinkname=0
 FIPSVERSION = v1.0.0
 $(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): GOENV += GOFIPS140=$(FIPSVERSION)
 $(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): BUILD_ARGS += -tags fips140enforce
 build/%/nebula: .FORCE
 	GOOS=$(firstword $(subst -, , $*)) \
@@ -233,7 +169,10 @@ vet:
 	go vet $(VET_FLAGS) -v ./...
 test:
-	$(TEST_ENV) go test $(TEST_FLAGS) -v ./...
+	go test -v ./...
 test-boringcrypto:
 	GOEXPERIMENT=boringcrypto CGO_ENABLED=1 go test -ldflags "-checklinkname=0" -v ./...
 test-pkcs11:
 	CGO_ENABLED=1 go test -v -tags pkcs11 ./...
@@ -276,75 +215,26 @@ ifeq ($(words $(MAKECMDGOALS)),1)
 	@$(MAKE) service ${.DEFAULT_GOAL} --no-print-directory
 endif
 # Useful to chain together, like:
 # - make fips140 e2evv
 # - make fips140 smoke-docker
 # Use `release-fips140` to build release binaries
 fips140:
 	@echo > $(NULL_FILE)
 ifeq ($(strip $(GOFIPS140)),)
 	$(eval GOFIPS140 = $(FIPSVERSION))
 endif
 	$(eval GOENV += GOFIPS140=$(GOFIPS140))
 	$(eval BUILD_ARGS += -tags fips140enforce)
 	$(eval TEST_ENV += $(GOENV))
 	$(eval CURVE = P256)
 ifeq ($(words $(MAKECMDGOALS)),1)
 	@$(MAKE) fips140 GOFIPS140=$(GOFIPS140) ${.DEFAULT_GOAL} --no-print-directory
 endif
 # To test the future pending module, use like `make fips140-latest test`
 ALL_GOFIPS140 = v1.0.0 v1.26.0 latest
 define FIPS140_rule
 fips140-$(1): GOFIPS140 = $(1)
 fips140-$(1): fips140
 endef
 $(foreach _rule, $(ALL_GOFIPS140), $(eval $(call FIPS140_rule,$(_rule))))
 # Iterate and run the goals for all fips versions, like `make fips140-all GOALS=test`
 fips140-all:
 	@$(foreach _v,$(ALL_GOFIPS140),$(MAKE) fips140-$(_v) $(GOALS) &&) true
 # Useful to chain together, like:
 # - make boringcrypto e2evv
 # - make boringcrypto smoke-docker
 # Use `release-boringcrypto` or `bin-boringcrypto` to build release binaries
 boringcrypto:
 	@echo > $(NULL_FILE)
 	$(eval GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1)
 	$(eval TEST_ENV += $(GOENV))
 	$(eval CURVE = P256)
 ifeq ($(words $(MAKECMDGOALS)),1)
 	@$(MAKE) boringcrypto ${.DEFAULT_GOAL} --no-print-directory
 endif
 bin-docker: bin build/linux-amd64/nebula build/linux-amd64/nebula-cert
 smoke-docker: BUILD_ARGS += -race
 smoke-docker: GOENV += CGO_ENABLED=1
 smoke-docker: bin-docker
-	# This is so we can limit `fips140` smoke test to just P256 curve.
+	cd .github/workflows/smoke/ && ./build.sh
-	if [ "$(CURVE)" != "P256" ]; then cd .github/workflows/smoke/ && $(GOENV) ./build.sh; fi
+	cd .github/workflows/smoke/ && ./smoke.sh
-	if [ "$(CURVE)" != "P256" ]; then cd .github/workflows/smoke/ && $(GOENV) ./smoke.sh; fi
+	cd .github/workflows/smoke/ && NAME="smoke-p256" CURVE="P256" ./build.sh
-	cd .github/workflows/smoke/ && $(GOENV) NAME="smoke-p256" CURVE="P256" ./build.sh
+	cd .github/workflows/smoke/ && NAME="smoke-p256" ./smoke.sh
 	cd .github/workflows/smoke/ && $(GOENV) NAME="smoke-p256" ./smoke.sh
 smoke-relay-docker: BUILD_ARGS += -race
 smoke-relay-docker: GOENV += CGO_ENABLED=1
 smoke-relay-docker: bin-docker
-	cd .github/workflows/smoke/ && $(GOENV) ./build-relay.sh
+	cd .github/workflows/smoke/ && ./build-relay.sh
-	cd .github/workflows/smoke/ && $(GOENV) ./smoke-relay.sh
+	cd .github/workflows/smoke/ && ./smoke-relay.sh
-smoke-docker-ipv6: export SMOKE_OVERLAY_IPV6 = 1
+smoke-docker-race: BUILD_ARGS = -race
-smoke-docker-ipv6: smoke-docker
+smoke-docker-race: CGO_ENABLED = 1
-
+smoke-docker-race: smoke-docker
 smoke-self: bin
 	cd .github/workflows/smoke/ && ./smoke-self.sh
 smoke-vagrant/%: bin-docker build/%/nebula
 	cd .github/workflows/smoke/ && ./build.sh $*
 	cd .github/workflows/smoke/ && ./smoke-vagrant.sh $*
 .FORCE:
-.PHONY: all all-linux all-freebsd all-openbsd all-netbsd all-darwin all-windows all-cross-linux all-cross-linux-arm all-cross-linux-mips all-cross-linux-other all-cross-darwin all-cross-windows bench bench-cpu bench-cpu-long bin bin-windows bin-windows-arm64 bin-darwin bin-freebsd bin-freebsd-arm64 bin-boringcrypto bin-fips140 bin-pkcs11 bin-docker boringcrypto build-test-mobile debug docker e2e e2ev e2evv e2evvv e2evvvv e2e-bench fips140 fips140-all $(ALL_GOFIPS140:%=fips140-%) install proto release release-linux release-freebsd release-openbsd release-netbsd release-boringcrypto release-fips140 service smoke-docker smoke-relay-docker smoke-docker-ipv6 smoke-self test test-pkcs11 test-cov-html vet smoke-vagrant/%
+.PHONY: bench bench-cpu bench-cpu-long bin build-test-mobile e2e e2ev e2evv e2evvv e2evvvv proto release service smoke-docker smoke-docker-race test test-cov-html smoke-vagrant/%
 .DEFAULT_GOAL := bin
@@ -145,27 +145,17 @@ To build nebula for a specific platform (ex, Windows):
 See the [Makefile](Makefile) for more details on build targets
-## Curve P256 and FIPS 140-3 mode
+## Curve P256 and BoringCrypto
 The default curve used for cryptographic handshakes and signatures is Curve25519. This is the recommended setting for most users. If your deployment has certain compliance requirements, you have the option of creating your CA using `nebula-cert ca -curve P256` to use NIST Curve P256. The CA will then sign certificates using ECDSA P256, and any hosts using these certificates will use P256 for ECDH handshakes.
-Nebula can be built to support the [FIPS 140-3](https://go.dev/doc/security/fips140) mode of Go by running either of the following make targets. (This sets GOFIPS140=v1.0.0, which must be done at compile time so that the correct AES-GCM can be used for FIPS 140-3 enforcement mode).
+In addition, Nebula can be built using the [BoringCrypto GOEXPERIMENT](https://github.com/golang/go/blob/go1.20/src/crypto/internal/boring/README.md) by running either of the following make targets:
 ```sh
 make fips140
 make fips140 test
 make release-fips140
 ```
 Nebula can also be built using the [BoringCrypto GOEXPERIMENT](https://github.com/golang/go/blob/go1.20/src/crypto/internal/boring/README.md) by running either of the following make targets.
 ```sh
 make bin-boringcrypto
 make release-boringcrypto
 ```
 NOTE: boringcrypto support is deprecated and will be removed in the next release. Users should migrate to the native FIPS 140-3 mode described above.
 This is not the recommended default deployment, but may be useful based on your compliance requirements.
 ## Credits
@@ -0,0 +1,70 @@
 package nebula
 import "net/netip"
 // sendBatchCap is the maximum number of encrypted packets accumulated before a
 // flush is forced. TSO superpackets segment to at most ~45 packets on
 // reasonable MTUs, so 128 leaves headroom without bloating the backing
 // allocation.
 const sendBatchCap = 128
 // sendBatch accumulates encrypted UDP packets for a single sendmmsg flush.
 // One sendBatch is owned by each listenIn goroutine; no locking is needed.
 // The backing storage holds up to batchCap packets of slotCap bytes each;
 // bufs and dsts are parallel slices of committed slots.
 type sendBatch struct {
 	bufs     [][]byte
 	dsts     []netip.AddrPort
 	backing  []byte
 	slotCap  int
 	batchCap int
 	nextSlot int
 }
 func newSendBatch(batchCap, slotCap int) *sendBatch {
 	return &sendBatch{
 		bufs:     make([][]byte, 0, batchCap),
 		dsts:     make([]netip.AddrPort, 0, batchCap),
 		backing:  make([]byte, batchCap*slotCap),
 		slotCap:  slotCap,
 		batchCap: batchCap,
 	}
 }
 // Next returns a zero-length slice with slotCap capacity over the next unused
 // slot's backing bytes. The caller writes into the returned slice and then
 // calls Commit with the final length and destination. Next returns nil when
 // the batch is full.
 func (b *sendBatch) Next() []byte {
 	if b.nextSlot >= b.batchCap {
 		return nil
 	}
 	start := b.nextSlot * b.slotCap
 	return b.backing[start : start : start+b.slotCap]
 }
 // Commit records the slot just returned by Next as a packet of length n
 // destined for dst.
 func (b *sendBatch) Commit(n int, dst netip.AddrPort) {
 	start := b.nextSlot * b.slotCap
 	b.bufs = append(b.bufs, b.backing[start:start+n])
 	b.dsts = append(b.dsts, dst)
 	b.nextSlot++
 }
 // Reset clears committed slots; backing storage is retained for reuse.
 func (b *sendBatch) Reset() {
 	b.bufs = b.bufs[:0]
 	b.dsts = b.dsts[:0]
 	b.nextSlot = 0
 }
 // Len returns the number of committed packets.
 func (b *sendBatch) Len() int {
 	return len(b.bufs)
 }
 // Cap returns the maximum number of slots in the batch.
 func (b *sendBatch) Cap() int {
 	return b.batchCap
 }
@@ -0,0 +1,69 @@
 package nebula
 import (
 	"net/netip"
 	"testing"
 )
 func TestSendBatchBookkeeping(t *testing.T) {
 	b := newSendBatch(4, 32)
 	if b.Len() != 0 || b.Cap() != 4 {
 		t.Fatalf("fresh batch: len=%d cap=%d", b.Len(), b.Cap())
 	}
 	ap := netip.MustParseAddrPort("10.0.0.1:4242")
 	for i := 0; i < 4; i++ {
 		slot := b.Next()
 		if slot == nil {
 			t.Fatalf("slot %d: Next returned nil before cap", i)
 		}
 		if cap(slot) != 32 || len(slot) != 0 {
 			t.Fatalf("slot %d: got len=%d cap=%d want len=0 cap=32", i, len(slot), cap(slot))
 		}
 		// Write a marker byte.
 		slot = append(slot, byte(i), byte(i+1), byte(i+2))
 		b.Commit(len(slot), ap)
 	}
 	if b.Next() != nil {
 		t.Fatalf("Next should return nil when full")
 	}
 	if b.Len() != 4 {
 		t.Fatalf("Len=%d want 4", b.Len())
 	}
 	for i, buf := range b.bufs {
 		if len(buf) != 3 || buf[0] != byte(i) {
 			t.Errorf("buf %d: %x", i, buf)
 		}
 		if b.dsts[i] != ap {
 			t.Errorf("dst %d: got %v want %v", i, b.dsts[i], ap)
 		}
 	}
 	// Reset returns empty and Next works again.
 	b.Reset()
 	if b.Len() != 0 {
 		t.Fatalf("after Reset Len=%d want 0", b.Len())
 	}
 	slot := b.Next()
 	if slot == nil || cap(slot) != 32 {
 		t.Fatalf("after Reset Next nil or wrong cap: %v cap=%d", slot == nil, cap(slot))
 	}
 }
 func TestSendBatchSlotsDoNotOverlap(t *testing.T) {
 	b := newSendBatch(3, 8)
 	ap := netip.MustParseAddrPort("10.0.0.1:80")
 	// Fill three slots, each with its own sentinel byte.
 	for i := 0; i < 3; i++ {
 		s := b.Next()
 		s = append(s, byte(0xA0+i), byte(0xB0+i))
 		b.Commit(len(s), ap)
 	}
 	for i, buf := range b.bufs {
 		if buf[0] != byte(0xA0+i) || buf[1] != byte(0xB0+i) {
 			t.Errorf("slot %d corrupted: %x", i, buf)
 		}
 	}
 }
@@ -1,43 +1,23 @@
 package nebula
 import (
 	"context"
 	"fmt"
 	"log/slog"
 	"math"
 	mathbits "math/bits"
 	"github.com/rcrowley/go-metrics"
 	"github.com/sirupsen/logrus"
 )
 const bitsPerWord = 64
 // Bits is a sliding-window anti-replay tracker. The window is stored as a
 // circular bitmap packed into uint64 words (8x denser than a []bool), so a
 // length-N window costs N/8 bytes. length must be a power of two.
 type Bits struct {
 	length             uint64
 	lengthMask         uint64
 	current            uint64
-	bits               []uint64
+	bits               []bool
 	lostCounter        metrics.Counter
 	dupeCounter        metrics.Counter
 	outOfWindowCounter metrics.Counter
 }
-func NewBits(length uint64) *Bits {
+func NewBits(bits uint64) *Bits {
 	if length == 0 || length&(length-1) != 0 {
 		panic(fmt.Sprintf("Bits length must be a power of two, got %d", length))
 	}
 	nWords := length / bitsPerWord
 	if nWords == 0 {
 		nWords = 1
 	}
 	b := &Bits{
-		length:             length,
+		length:             bits,
-		lengthMask:         length - 1,
+		bits:               make([]bool, bits, bits),
 		bits:               make([]uint64, nWords),
 		current:            0,
 		lostCounter:        metrics.GetOrRegisterCounter("network.packets.lost", nil),
 		dupeCounter:        metrics.GetOrRegisterCounter("network.packets.duplicate", nil),
@@ -45,219 +25,88 @@ func NewBits(length uint64) *Bits {
 	}
 	// There is no counter value 0, mark it to avoid counting a lost packet later.
-	b.bits[0] = 1
+	b.bits[0] = true
 	b.current = 0
 	return b
 }
-func (b *Bits) get(i uint64) bool {
+func (b *Bits) Check(l *logrus.Logger, i uint64) bool {
 	pos := i & b.lengthMask
 	//bit-shifting by 6 because i is a bit index, not a u64 index, and we need to find the u64 without bit in it
 	return b.bits[pos>>6]&(uint64(1)<<(pos&63)) != 0
 }
 func (b *Bits) set(i uint64) {
 	pos := i & b.lengthMask
 	b.bits[pos>>6] |= uint64(1) << (pos & 63)
 }
 // clearRange clears `count` bits starting at circular position `startPos`
 // (already masked to [0, length)) and returns how many of them were set
 // before the clear. count must be in [1, length].
 func (b *Bits) clearRange(startPos, count uint64) uint64 {
 	wasSet := uint64(0)
 	if count >= b.length {
 		for _, w := range b.bits {
 			wasSet += uint64(mathbits.OnesCount64(w))
 		}
 		clear(b.bits)
 		return wasSet
 	}
 	pos := startPos
 	remaining := count
 	// handle the potential partial word before pos becomes u64 aligned
 	word := pos >> 6
 	bit := pos & 63
 	take := uint64(64) - bit
 	if take > remaining {
 		take = remaining
 	}
 	if take > b.length-pos {
 		take = b.length - pos
 	}
 	var mask uint64
 	if take == 64 {
 		mask = math.MaxUint64
 	} else {
 		mask = ((uint64(1) << take) - 1) << bit
 	}
 	wasSet += uint64(mathbits.OnesCount64(b.bits[word] & mask))
 	b.bits[word] &^= mask
 	remaining -= take
 	pos = (pos + take) & b.lengthMask
 	// Clear whole words, keeping track of the number of set bits
 	for remaining >= 64 {
 		word = pos >> 6
 		wasSet += uint64(mathbits.OnesCount64(b.bits[word]))
 		b.bits[word] = 0
 		remaining -= 64
 		pos = (pos + 64) & b.lengthMask
 	}
 	// Clear the remaining partial word
 	if remaining > 0 {
 		word = pos >> 6
 		mask = (uint64(1) << remaining) - 1
 		wasSet += uint64(mathbits.OnesCount64(b.bits[word] & mask))
 		b.bits[word] &^= mask
 	}
 	return wasSet
 }
 func (b *Bits) strictlyWithinWindow(i uint64) bool {
 	// Handle the case where the window hasn't slid yet. This avoids u64 underflow.
 	inWarmup := b.current < b.length
 	if i < b.length && inWarmup {
 		return true
 	}
 	// Next, if the packet is in-window, see if we've seen it before
 	if i > b.current-b.length {
 		return true
 	}
 	return false //not within window!
 }
 // Check returns true if i is within (or way out in front of) the window, and not a replay
 func (b *Bits) Check(l *slog.Logger, i uint64) bool {
 	// If i is the next number, return true.
 	if i > b.current {
 		return true
 	}
-	if b.strictlyWithinWindow(i) {
+	// If i is within the window, check if it's been set already.
-		return !b.get(i)
+	if i > b.current-b.length || i < b.length && b.current < b.length {
 		return !b.bits[i%b.length]
 	}
 	// Not within the window
-	if l.Enabled(context.Background(), slog.LevelDebug) {
+	if l.Level >= logrus.DebugLevel {
-		l.Debug("rejected a packet (top)", "current", b.current, "incoming", i)
+		l.Debugf("rejected a packet (top) %d %d\n", b.current, i)
 	}
 	return false
 }
-// Update has three branches:
+func (b *Bits) Update(l *logrus.Logger, i uint64) bool {
-//   - i == b.current+1: fast path; advance the cursor by one and lose-count
+	// If i is the next number, return true and update current.
 //     the slot we just stomped (only past warmup; see the i > b.length guard
 //     below).
 //   - i  >  b.current+1: jump path; clear all slots between current and i
 //     (or up to a full window's worth, whichever is smaller) via clearRange,
 //     then mark i. Two arms here: a warmup arm that handles the very first
 //     window before the cursor has slid, and a steady-state arm that treats
 //     every cleared empty slot as a lost packet.
 //   - i  <= b.current: in-window check for duplicates; out-of-window otherwise.
 //
 // NewBits seeds bits[0]=1 so counter 0 looks "received" — Update never
 // clears that marker during warmup (clearRange skips position 0 when
 // startPos=1), and once b.current >= b.length the marker is no longer
 // consulted. The marker prevents a fictitious "lost" hit on the first real
 // counter.
 func (b *Bits) Update(l *slog.Logger, i uint64) bool {
 	// Fast path: i is the next expected counter. Split out so the function
 	// stays small and avoids paying for the slow paths' slog argument-build
 	// stack frame on every call. The bit read/test/write is inlined to
 	// touch the backing word once.
 	if i == b.current+1 {
-		pos := i & b.lengthMask
+		// Check if the oldest bit was lost since we are shifting the window by 1 and occupying it with this counter
-		word := pos >> 6
+		// The very first window can only be tracked as lost once we are on the 2nd window or greater
-		mask := uint64(1) << (pos & 63)
+		if b.bits[i%b.length] == false && i > b.length {
 		w := b.bits[word]
 		if i > b.length && w&mask == 0 {
 			b.lostCounter.Inc(1)
 		}
-		b.bits[word] = w | mask
+		b.bits[i%b.length] = true
 		b.current = i
 		return true
 	}
 	return b.updateSlow(l, i)
 }
 // updateSlow handles jumps, in-window backfill, dupes, and out-of-window.
 func (b *Bits) updateSlow(l *slog.Logger, i uint64) bool {
 	// If i is a jump, adjust the window, record lost, update current, and return true
 	if i > b.current {
-		end := i
+		lost := int64(0)
-		if end > b.current+b.length {
+		// Zero out the bits between the current and the new counter value, limited by the window size,
-			end = b.current + b.length
+		// since the window is shifting
-		}
+		for n := b.current + 1; n <= min(i, b.current+b.length); n++ {
-		count := end - b.current
+			if b.bits[n%b.length] == false && n > b.length {
-		startPos := (b.current + 1) & b.lengthMask
+				lost++
 		var lost int64
 		if b.current >= b.length {
 			// Steady state: every cleared slot is past warmup, so any unset
 			// bit we evict is a lost packet from the previous cycle.
 			wasSet := b.clearRange(startPos, count)
 			lost = int64(count) - int64(wasSet)
 		} else {
 			// Warmup (the very first window). Some cleared slots represent
 			// packets <= length where eviction is not "lost" in the usual
 			// sense. This branch is taken at most once per connection so we
 			// don't bother optimizing it.
 			for n := b.current + 1; n <= end; n++ {
 				if !b.get(n) && n > b.length {
 					lost++
 				}
 			}
-			b.clearRange(startPos, count)
+			b.bits[n%b.length] = false
 		}
-		// Anything past the new window can never be backfilled, so it's lost.
+		// Only record any skipped packets as a result of the window moving further than the window length
-		if i > b.current+b.length {
+		// Any loss within the new window will be accounted for in future calls
-			lost += int64(i - b.current - b.length)
+		lost += max(0, int64(i-b.current-b.length))
 		}
 		b.lostCounter.Inc(lost)
-		b.set(i)
+		b.bits[i%b.length] = true
 		b.current = i
 		return true
 	}
-	// If i is within the current window but below the current counter, check to see if it's a duplicate
+	// If i is within the current window but below the current counter,
-	if b.strictlyWithinWindow(i) {
+	// Check to see if it's a duplicate
-		pos := i & b.lengthMask
+	if i > b.current-b.length || i < b.length && b.current < b.length {
-		word := pos >> 6
+		if b.current == i || b.bits[i%b.length] == true {
-		mask := uint64(1) << (pos & 63)
+			if l.Level >= logrus.DebugLevel {
-		w := b.bits[word]
+				l.WithField("receiveWindow", m{"accepted": false, "currentCounter": b.current, "incomingCounter": i, "reason": "duplicate"}).
-		if b.current == i || w&mask != 0 {
+					Debug("Receive window")
 			if l.Enabled(context.Background(), slog.LevelDebug) {
 				l.Debug("Receive window",
 					"accepted", false,
 					"currentCounter", b.current,
 					"incomingCounter", i,
 					"reason", "duplicate",
 				)
 			}
 			b.dupeCounter.Inc(1)
 			return false
 		}
-		b.bits[word] = w | mask
+		b.bits[i%b.length] = true
 		return true
 	}
 	// In all other cases, fail and don't change current.
 	b.outOfWindowCounter.Inc(1)
-	if l.Enabled(context.Background(), slog.LevelDebug) {
+	if l.Level >= logrus.DebugLevel {
-		l.Debug("Receive window",
+		l.WithField("accepted", false).
-			"accepted", false,
+			WithField("currentCounter", b.current).
-			"currentCounter", b.current,
+			WithField("incomingCounter", i).
-			"incomingCounter", i,
+			WithField("reason", "nonsense").
-			"reason", "nonsense",
+			Debug("Receive window")
 		)
 	}
 	return false
 }
@@ -7,79 +7,61 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 // snapshot returns the bitmap as a []bool of length b.length, for readable
 // test assertions against the now-packed []uint64 storage.
 func (b *Bits) snapshot() []bool {
 	out := make([]bool, b.length)
 	for i := uint64(0); i < b.length; i++ {
 		out[i] = b.get(i)
 	}
 	return out
 }
 func TestBitsRequiresPowerOfTwo(t *testing.T) {
 	assert.Panics(t, func() { NewBits(10) })
 	assert.Panics(t, func() { NewBits(0) })
 	assert.NotPanics(t, func() { NewBits(1) })
 	assert.NotPanics(t, func() { NewBits(16) })
 	assert.NotPanics(t, func() { NewBits(1024) })
 	assert.NotPanics(t, func() { NewBits(16384) })
 }
 func TestBits(t *testing.T) {
 	l := test.NewLogger()
-	b := NewBits(16)
+	b := NewBits(10)
-	assert.EqualValues(t, 16, b.length)
+
 	// make sure it is the right size
 	assert.Len(t, b.bits, 10)
 	// This is initialized to zero - receive one. This should work.
 	assert.True(t, b.Check(l, 1))
 	assert.True(t, b.Update(l, 1))
 	assert.EqualValues(t, 1, b.current)
-	g := []bool{true, true, false, false, false, false, false, false, false, false, false, false, false, false, false, false}
+	g := []bool{true, true, false, false, false, false, false, false, false, false}
-	assert.Equal(t, g, b.snapshot())
+	assert.Equal(t, g, b.bits)
 	// Receive two
 	assert.True(t, b.Check(l, 2))
 	assert.True(t, b.Update(l, 2))
 	assert.EqualValues(t, 2, b.current)
-	g = []bool{true, true, true, false, false, false, false, false, false, false, false, false, false, false, false, false}
+	g = []bool{true, true, true, false, false, false, false, false, false, false}
-	assert.Equal(t, g, b.snapshot())
+	assert.Equal(t, g, b.bits)
 	// Receive two again - it will fail
 	assert.False(t, b.Check(l, 2))
 	assert.False(t, b.Update(l, 2))
 	assert.EqualValues(t, 2, b.current)
-	// Jump ahead to 25, which clears the window and sets slot 25%16 = 9.
+	// Jump ahead to 15, which should clear everything and set the 6th element
-	assert.True(t, b.Check(l, 25))
+	assert.True(t, b.Check(l, 15))
-	assert.True(t, b.Update(l, 25))
+	assert.True(t, b.Update(l, 15))
-	assert.EqualValues(t, 25, b.current)
+	assert.EqualValues(t, 15, b.current)
-	g = []bool{false, false, false, false, false, false, false, false, false, true, false, false, false, false, false, false}
+	g = []bool{false, false, false, false, false, true, false, false, false, false}
-	assert.Equal(t, g, b.snapshot())
+	assert.Equal(t, g, b.bits)
-	// Mark 24, which is in window (current 25, length 16, window covers [10,25]).
+	// Mark 14, which is allowed because it is in the window
-	assert.True(t, b.Check(l, 24))
+	assert.True(t, b.Check(l, 14))
-	assert.True(t, b.Update(l, 24))
+	assert.True(t, b.Update(l, 14))
-	assert.EqualValues(t, 25, b.current)
+	assert.EqualValues(t, 15, b.current)
-	g = []bool{false, false, false, false, false, false, false, false, true, true, false, false, false, false, false, false}
+	g = []bool{false, false, false, false, true, true, false, false, false, false}
-	assert.Equal(t, g, b.snapshot())
+	assert.Equal(t, g, b.bits)
-	// Mark 5, not allowed because 5 <= current-length (25-16=9).
+	// Mark 5, which is not allowed because it is not in the window
 	assert.False(t, b.Check(l, 5))
 	assert.False(t, b.Update(l, 5))
-	assert.EqualValues(t, 25, b.current)
+	assert.EqualValues(t, 15, b.current)
-	g = []bool{false, false, false, false, false, false, false, false, true, true, false, false, false, false, false, false}
+	g = []bool{false, false, false, false, true, true, false, false, false, false}
-	assert.Equal(t, g, b.snapshot())
+	assert.Equal(t, g, b.bits)
-	// Make sure we handle wrapping around once to the same slot. With
+	// make sure we handle wrapping around once to the current position
-	// length=16, packets 1 and 17 share slot 1.
+	b = NewBits(10)
 	b = NewBits(16)
 	assert.True(t, b.Update(l, 1))
-	assert.True(t, b.Update(l, 17))
+	assert.True(t, b.Update(l, 11))
-	assert.Equal(t, []bool{false, true, false, false, false, false, false, false, false, false, false, false, false, false, false, false}, b.snapshot())
+	assert.Equal(t, []bool{false, true, false, false, false, false, false, false, false, false}, b.bits)
 	// Walk through a few windows in order
-	b = NewBits(16)
+	b = NewBits(10)
 	for i := uint64(1); i <= 100; i++ {
 		assert.True(t, b.Check(l, i), "Error while checking %v", i)
 		assert.True(t, b.Update(l, i), "Error while updating %v", i)
@@ -90,31 +72,24 @@ func TestBits(t *testing.T) {
 func TestBitsLargeJumps(t *testing.T) {
 	l := test.NewLogger()
-
+	b := NewBits(10)
 	// length=16. Update(55) from current=0:
 	//   warmup, per-bit loop sees no n>16 with unset bits (slot 0 was set by
 	//   NewBits and gets re-evaluated when n=16; n=16 is not strictly > 16),
 	//   so the loop contributes 0. The jump exceeds the window so we record
 	//   55 - 0 - 16 = 39 packets fell out the back.
 	b := NewBits(16)
 	b.lostCounter.Clear()
 	assert.True(t, b.Update(l, 55))
 	assert.Equal(t, int64(39), b.lostCounter.Count())
-	// Update(100): clears 16 slots starting at slot 56%16=8. Only slot 7 (for
+	b = NewBits(10)
-	// packet 55) was set, so 16 - 1 = 15 evicted slots had unset bits.
+	b.lostCounter.Clear()
-	// Plus 100 - 55 - 16 = 29 packets fell past the window. Total 44.
+	assert.True(t, b.Update(l, 55)) // We saw packet 55 and can still track 45,46,47,48,49,50,51,52,53,54
-	assert.True(t, b.Update(l, 100))
+	assert.Equal(t, int64(45), b.lostCounter.Count())
 	assert.Equal(t, int64(39+44), b.lostCounter.Count())
-	// Update(200): same shape: 16 - 1 = 15 evicted unset, plus 200 - 100 - 16 = 84 past window. Total 99.
+	assert.True(t, b.Update(l, 100)) // We saw packet 55 and 100 and can still track 90,91,92,93,94,95,96,97,98,99
-	assert.True(t, b.Update(l, 200))
+	assert.Equal(t, int64(89), b.lostCounter.Count())
-	assert.Equal(t, int64(39+44+99), b.lostCounter.Count())
+
 	assert.True(t, b.Update(l, 200)) // We saw packet 55, 100, and 200 and can still track 190,191,192,193,194,195,196,197,198,199
 	assert.Equal(t, int64(188), b.lostCounter.Count())
 }
 func TestBitsDupeCounter(t *testing.T) {
 	l := test.NewLogger()
-	b := NewBits(16)
+	b := NewBits(10)
 	b.lostCounter.Clear()
 	b.dupeCounter.Clear()
 	b.outOfWindowCounter.Clear()
@@ -139,117 +114,120 @@ func TestBitsDupeCounter(t *testing.T) {
 func TestBitsOutOfWindowCounter(t *testing.T) {
 	l := test.NewLogger()
-	b := NewBits(16)
+	b := NewBits(10)
 	b.lostCounter.Clear()
 	b.dupeCounter.Clear()
 	b.outOfWindowCounter.Clear()
 	// Jump to 20 (warmup branch + 4 past-window packets).
 	assert.True(t, b.Update(l, 20))
 	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
-	// 9 single-step advances, each evicts a slot whose bit was cleared during
+	assert.True(t, b.Update(l, 21))
-	// the jump above and whose value was never seen, so each contributes 1
+	assert.True(t, b.Update(l, 22))
-	// to lostCounter.
+	assert.True(t, b.Update(l, 23))
-	for n := uint64(21); n <= 29; n++ {
+	assert.True(t, b.Update(l, 24))
-		assert.True(t, b.Update(l, n))
+	assert.True(t, b.Update(l, 25))
-	}
+	assert.True(t, b.Update(l, 26))
 	assert.True(t, b.Update(l, 27))
 	assert.True(t, b.Update(l, 28))
 	assert.True(t, b.Update(l, 29))
 	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
 	// 0 is below current-length (29-16=13) so it falls outside the window.
 	assert.False(t, b.Update(l, 0))
 	assert.Equal(t, int64(1), b.outOfWindowCounter.Count())
-	// 4 from the Update(20) jump + 9 from 21..29.
+	assert.Equal(t, int64(19), b.lostCounter.Count()) // packet 0 wasn't lost
 	assert.Equal(t, int64(13), b.lostCounter.Count())
 	assert.Equal(t, int64(0), b.dupeCounter.Count())
 	assert.Equal(t, int64(1), b.outOfWindowCounter.Count())
 }
 func TestBitsLostCounter(t *testing.T) {
 	l := test.NewLogger()
-	b := NewBits(16)
+	b := NewBits(10)
 	b.lostCounter.Clear()
 	b.dupeCounter.Clear()
 	b.outOfWindowCounter.Clear()
-	// Walk 20..29 like the original, just with a bigger window. Same
+	assert.True(t, b.Update(l, 20))
-	// reasoning as TestBitsOutOfWindowCounter: 4 past-window from Update(20),
+	assert.True(t, b.Update(l, 21))
-	// then 9 more from the unit advances.
+	assert.True(t, b.Update(l, 22))
-	for n := uint64(20); n <= 29; n++ {
+	assert.True(t, b.Update(l, 23))
-		assert.True(t, b.Update(l, n))
+	assert.True(t, b.Update(l, 24))
-	}
+	assert.True(t, b.Update(l, 25))
-	assert.Equal(t, int64(13), b.lostCounter.Count())
+	assert.True(t, b.Update(l, 26))
 	assert.True(t, b.Update(l, 27))
 	assert.True(t, b.Update(l, 28))
 	assert.True(t, b.Update(l, 29))
 	assert.Equal(t, int64(19), b.lostCounter.Count()) // packet 0 wasn't lost
 	assert.Equal(t, int64(0), b.dupeCounter.Count())
 	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
-	b = NewBits(16)
+	b = NewBits(10)
 	b.lostCounter.Clear()
 	b.dupeCounter.Clear()
 	b.outOfWindowCounter.Clear()
-	// Update(15) clears the warmup window (no lost), sets slot 15.
+	assert.True(t, b.Update(l, 9))
 	assert.True(t, b.Update(l, 15))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
-
+	// 10 will set 0 index, 0 was already set, no lost packets
-	// Update(16): slot 0 was already set (NewBits seeded it), and 16 is not
+	assert.True(t, b.Update(l, 10))
 	// strictly > length, so nothing is recorded as lost.
 	assert.True(t, b.Update(l, 16))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
-
+	// 11 will set 1 index, 1 was missed, we should see 1 packet lost
-	// Update(17): we jumped straight from 0 to 15, so slot 1 was cleared
+	assert.True(t, b.Update(l, 11))
 	// (and never re-set). 17 > 16 is past warmup, so packet 1 is recorded lost.
 	assert.True(t, b.Update(l, 17))
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	// Now let's fill in the window, should end up with 8 lost packets
 	assert.True(t, b.Update(l, 12))
 	assert.True(t, b.Update(l, 13))
 	assert.True(t, b.Update(l, 14))
 	assert.True(t, b.Update(l, 15))
 	assert.True(t, b.Update(l, 16))
 	assert.True(t, b.Update(l, 17))
 	assert.True(t, b.Update(l, 18))
 	assert.True(t, b.Update(l, 19))
 	assert.Equal(t, int64(8), b.lostCounter.Count())
-	// Fill in 18..30 in single steps. Each i evicts slot i%16. Slots 2..14
+	// Jump ahead by a window size
-	// were all cleared during Update(15), and we never re-set any of them,
+	assert.True(t, b.Update(l, 29))
-	// so each i in 18..30 is a fresh lost packet — 13 more.
+	assert.Equal(t, int64(8), b.lostCounter.Count())
-	for n := uint64(18); n <= 30; n++ {
+	// Now lets walk ahead normally through the window, the missed packets should fill in
-		assert.True(t, b.Update(l, n))
+	assert.True(t, b.Update(l, 30))
-	}
+	assert.True(t, b.Update(l, 31))
-	assert.Equal(t, int64(14), b.lostCounter.Count())
+	assert.True(t, b.Update(l, 32))
 	assert.True(t, b.Update(l, 33))
 	assert.True(t, b.Update(l, 34))
 	assert.True(t, b.Update(l, 35))
 	assert.True(t, b.Update(l, 36))
 	assert.True(t, b.Update(l, 37))
 	assert.True(t, b.Update(l, 38))
 	// 39 packets tracked, 22 seen, 17 lost
 	assert.Equal(t, int64(17), b.lostCounter.Count())
-	// Jump ahead by exactly one window size.
+	// Jump ahead by 2 windows, should have recording 1 full window missing
-	assert.True(t, b.Update(l, 46))
+	assert.True(t, b.Update(l, 58))
-	// end = min(46, 30+16) = 46, count = 16, all slots cleared. Before the
+	assert.Equal(t, int64(27), b.lostCounter.Count())
-	// jump every slot 0..15 had been set (Update(15), (16), (17), 18..30),
+	// Now lets walk ahead normally through the window, the missed packets should fill in from this window
-	// so wasSet=16 and 46 == current+length means no past-window slack:
+	assert.True(t, b.Update(l, 59))
-	// lost contribution = 0.
+	assert.True(t, b.Update(l, 60))
-	assert.Equal(t, int64(14), b.lostCounter.Count())
+	assert.True(t, b.Update(l, 61))
-
+	assert.True(t, b.Update(l, 62))
-	// Walk 47..55. The Update(46) jump cleared every slot, so only slot 14
+	assert.True(t, b.Update(l, 63))
-	// (for packet 46) is set when we start. Each subsequent unit step lands
+	assert.True(t, b.Update(l, 64))
-	// on a slot that was cleared and is past warmup, so it counts as lost.
+	assert.True(t, b.Update(l, 65))
-	// 9 more = 23.
+	assert.True(t, b.Update(l, 66))
-	for n := uint64(47); n <= 55; n++ {
+	assert.True(t, b.Update(l, 67))
-		assert.True(t, b.Update(l, n))
+	// 68 packets tracked, 32 seen, 36 missed
-	}
+	assert.Equal(t, int64(36), b.lostCounter.Count())
 	assert.Equal(t, int64(23), b.lostCounter.Count())
 	// Jump ahead by two windows: clears the window plus past-window loss.
 	assert.True(t, b.Update(l, 87))
 	// current=55, length=16. end = min(87, 71) = 71. count=16, all slots
 	// cleared. Slots set before the clear are slots 14,15,0..7 (10 total).
 	// Lost from clear = 16 - 10 = 6. Past window: 87 - 55 - 16 = 16. +22.
 	assert.Equal(t, int64(45), b.lostCounter.Count())
 	assert.Equal(t, int64(0), b.dupeCounter.Count())
 	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
 }
 func TestBitsLostCounterIssue1(t *testing.T) {
 	l := test.NewLogger()
-	b := NewBits(16)
+	b := NewBits(10)
 	b.lostCounter.Clear()
 	b.dupeCounter.Clear()
 	b.outOfWindowCounter.Clear()
 	// Receive 4, backfill 1, then 9, 2, 3, 5, 6, 7 (skip 8), 10, 11, 14.
 	// Then jump to 25 — slot 25%16=9 is being evicted, but it had been set
 	// (we received packet 9), so no spurious lost increment. The original
 	// regression was about double-counting a missing packet when its slot
 	// got cleared on a jump. With the jump path now using clearRange's
 	// word-level wasSet count, the same semantics hold.
 	assert.True(t, b.Update(l, 4))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 1))
@@ -266,7 +244,7 @@ func TestBitsLostCounterIssue1(t *testing.T) {
 	assert.Equal(t, int64(0), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 7))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
-	// Skip packet 8.
+	// assert.True(t, b.Update(l, 8))
 	assert.True(t, b.Update(l, 10))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 11))
@@ -274,23 +252,9 @@ func TestBitsLostCounterIssue1(t *testing.T) {
 	assert.True(t, b.Update(l, 14))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
-
+	// Issue seems to be here, we reset missing packet 8 to false here and don't increment the lost counter
-	// Jump to 25. With length=16, slot 25%16=9 corresponds to packet 9
+	assert.True(t, b.Update(l, 19))
 	// (which we DID receive), so its bit is set and no lost++ from that
 	// eviction. The trace below shows the only loss is packet 8.
 	assert.True(t, b.Update(l, 25))
 	// current was 14, i=25. end=min(25,30)=25. count=11. startPos=15.
 	// steady? current=14<16, so warmup branch: per-bit n=15..25, count those
 	// with !get(n) AND n>16. n=17..25 are >16. Among slots 17%16=1..25%16=9
 	// did we set slots 1..9 (packets 1..9)? Yes for all but slot 8 (packet 8
 	// was skipped). n=24 maps to slot 8 which is FALSE → lost++. All other
 	// n in 17..25 map to slots that are set. n=16 is not strictly > 16. So
 	// lost = 1.
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	// Fill in 12, 13, 15, 16. Each is below current=25 (in-window). 16 must
 	// recheck slot 0 — it was set by NewBits and then cleared by the
 	// Update(25) jump, so 16 backfills cleanly.
 	assert.True(t, b.Update(l, 12))
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 13))
@@ -299,140 +263,29 @@ func TestBitsLostCounterIssue1(t *testing.T) {
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 16))
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 17))
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 18))
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 20))
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 21))
-	// We missed packet 8 above and that loss is still recorded once, never
+	// We missed packet 8 above
 	// double-counted, never zeroed.
 	assert.Equal(t, int64(1), b.lostCounter.Count())
 	assert.Equal(t, int64(0), b.dupeCounter.Count())
 	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
 }
-// TestBitsWarmupOvershoot exercises the jump path's warmup arm with an
+func BenchmarkBits(b *testing.B) {
-// overshoot past one full window. NewBits leaves current=0 with only slot 0
+	z := NewBits(10)
 // "set" by the marker. Jumping straight to length+k must (a) clear every
 // slot the jump straddles, (b) count only past-window slack (not the
 // in-window slots, which never had a "lost" tenant during warmup), and
 // (c) leave the cursor at the new counter so subsequent unit advances
 // count from steady state. The marker bit at slot 0 is irrelevant once
 // current >= length.
 func TestBitsWarmupOvershoot(t *testing.T) {
 	l := test.NewLogger()
 	b := NewBits(16)
 	b.lostCounter.Clear()
 	// Jump from current=0 to i=20 (length=16, overshoot=4).
 	// Warmup arm: counts slots in [1..16] where bit unset and n>length.
 	// Only n=16 was unset and >length: but slot 16%16=0 is the marker,
 	// so b.get(16) reads bits[0]=1 and skips. Result: 0 lost from the loop.
 	// Past-window: i - current - length = 20 - 0 - 16 = 4 lost.
 	assert.True(t, b.Update(l, 20))
 	assert.Equal(t, int64(4), b.lostCounter.Count())
 	assert.Equal(t, uint64(20), b.current)
 	// Steady state now (current=20 >= length=16). Unit advance to 21
 	// stomps slot 21%16=5, which was cleared by the jump and not reset,
 	// so this is +1 lost.
 	assert.True(t, b.Update(l, 21))
 	assert.Equal(t, int64(5), b.lostCounter.Count())
 }
 // TestBitsCheckAcrossWarmupBoundary pins the underflow trick in Check's
 // in-window clause. While in warmup, b.current-b.length underflows uint64
 // to a huge value so the first OR-clause is always false; the second
 // clause (i < length && current < length) carries the in-window check.
 // Once current >= length the regimes flip cleanly.
 func TestBitsCheckAcrossWarmupBoundary(t *testing.T) {
 	l := test.NewLogger()
 	b := NewBits(16)
 	// Warmup: current=0. Check(0) must read the marker (set) and return false.
 	assert.False(t, b.Check(l, 0), "marker slot should look already-received")
 	// Warmup: any 0 < i < length is in-window and unset → accepted.
 	for i := uint64(1); i < 16; i++ {
 		assert.True(t, b.Check(l, i), "warmup in-window i=%d should be accepted", i)
 	}
 	// Warmup: i >= length but > current is "next number" so accepted.
 	assert.True(t, b.Check(l, 16))
 	assert.True(t, b.Check(l, 1_000_000))
 	// Cross into steady state.
 	assert.True(t, b.Update(l, 100))
 	// Now current=100, length=16. In-window range is [85..100].
 	// 84 is just outside: the underflow clause activates; 84 > 100-16=84 is false.
 	// And the warmup clause is false (current >= length). So out of window.
 	assert.False(t, b.Check(l, 84))
 	// 85 sits at the boundary. 85 > 84 is true → in window, unset → accept.
 	assert.True(t, b.Check(l, 85))
 	// 100 is current itself; not strictly greater, in-window, but already set.
 	assert.False(t, b.Check(l, 100))
 	// Way out: clearly out of window.
 	assert.False(t, b.Check(l, 50))
 }
 // TestBitsMarkerInvariant verifies the seeded bits[0]=1 marker behaves
 // correctly across warmup and beyond. Update should never clear the marker
 // during warmup (clearRange skips position 0 when startPos=1), and once
 // current >= length the marker is no longer consulted by Check/Update on
 // the live path — but it must still report counter 0 as a duplicate while
 // we are in warmup.
 func TestBitsMarkerInvariant(t *testing.T) {
 	l := test.NewLogger()
 	b := NewBits(8)
 	// Counter 0 is the seeded marker; Check sees it as already received.
 	assert.False(t, b.Check(l, 0))
 	// Update(0) at current=0 hits the duplicate branch.
 	b.dupeCounter.Clear()
 	assert.False(t, b.Update(l, 0))
 	assert.Equal(t, int64(1), b.dupeCounter.Count())
 	// Walk forward through warmup; the marker must remain set.
 	for n := uint64(1); n <= 7; n++ {
 		assert.True(t, b.Update(l, n))
 	}
 	// Position 0 (the marker) should still read as set because we never
 	// cleared it; Update(0) still looks like a duplicate.
 	assert.False(t, b.Check(l, 0))
 	// Cross into steady state with a unit advance to 8: pos=0, evicts the
 	// marker bit. The lost-counter guard (i > b.length) is false (8 == 8),
 	// so this advance does NOT charge a lost packet — exactly what the
 	// marker is there to prevent.
 	b.lostCounter.Clear()
 	assert.True(t, b.Update(l, 8))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
 	// The slot at pos 0 is now occupied by counter 8.
 	assert.False(t, b.Check(l, 8))
 }
 // BenchmarkBitsUpdateInOrder is the steady-state hot path: each call is
 // i == current+1.
 func BenchmarkBitsUpdateInOrder(b *testing.B) {
 	l := test.NewLogger()
 	z := NewBits(16384)
 	for n := 0; n < b.N; n++ {
-		z.Update(l, uint64(n)+1)
+		for i := range z.bits {
-	}
+			z.bits[i] = true
-}
+		}
 		for i := range z.bits {
 			z.bits[i] = false
 		}
 // BenchmarkBitsUpdateReorder simulates light reorder within the window:
 // every other packet arrives one slot behind its predecessor (forces the
 // in-window backfill branch).
 func BenchmarkBitsUpdateReorder(b *testing.B) {
 	l := test.NewLogger()
 	z := NewBits(16384)
 	for n := 0; n < b.N; n++ {
 		base := uint64(n) * 2
 		z.Update(l, base+2)
 		z.Update(l, base+1)
 	}
 }
 // BenchmarkBitsUpdateLargeJumps stresses the clearRange word-level path.
 func BenchmarkBitsUpdateLargeJumps(b *testing.B) {
 	l := test.NewLogger()
 	z := NewBits(16384)
 	for n := 0; n < b.N; n++ {
 		z.Update(l, uint64(n+1)*1000)
 	}
 }
@@ -217,10 +217,6 @@ func (ncp *CAPool) verify(c Certificate, now time.Time, certFp string, signerFp
 		return nil, err
 	}
 	if signer.Certificate.Curve() != c.Curve() {
 		return nil, ErrCurveMismatch
 	}
 	if signer.Certificate.Expired(now) {
 		return nil, ErrRootExpired
 	}
@@ -654,31 +654,3 @@ func TestCertificateV2_Verify_Subnets(t *testing.T) {
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.NoError(t, err)
 }
 func TestCertificateV2_CurveMismatch(t *testing.T) {
 	caIp1 := mustParsePrefixUnmapped("10.0.0.0/16")
 	caIp2 := mustParsePrefixUnmapped("192.168.0.0/24")
 	ca, _, caKey, _ := NewTestCaCert(Version2, Curve_P256, time.Now(), time.Now().Add(10*time.Minute), []netip.Prefix{caIp1, caIp2}, nil, []string{"test"})
 	caPem, err := ca.MarshalPEM()
 	require.NoError(t, err)
 	caPool := NewCAPool()
 	b, err := caPool.AddCAFromPEM(caPem)
 	require.NoError(t, err)
 	assert.Empty(t, b)
 	// ip is outside the network
 	cIp1 := mustParsePrefixUnmapped("10.0.0.1/24")
 	c, _, _, _ := NewTestCert(Version2, Curve_P256, ca, caKey, "test", time.Now(), time.Now().Add(5*time.Minute), []netip.Prefix{cIp1}, nil, []string{"test"})
 	fp, _ := c.Fingerprint()
 	_, err = caPool.verify(c, time.Now(), fp, c.Issuer())
 	require.NoError(t, err)
 	//
 	c2 := c.(*certificateV2)
 	c2.curve = Curve_CURVE25519
 	fp, _ = c.Fingerprint()
 	_, err = caPool.verify(c, time.Now(), fp, c.Issuer())
 	require.Error(t, err)
 }
@@ -112,9 +112,6 @@ func (c *certificateV1) CheckSignature(key []byte) bool {
 	}
 	switch c.details.curve {
 	case Curve_CURVE25519:
 		if len(key) != ed25519.PublicKeySize {
 			return false //avoids a panic internal to ed25519
 		}
 		return ed25519.Verify(key, b, c.signature)
 	case Curve_P256:
 		pubKey, err := ecdsa.ParseUncompressedPublicKey(elliptic.P256(), key)
@@ -151,9 +151,6 @@ func (c *certificateV2) CheckSignature(key []byte) bool {
 	switch c.curve {
 	case Curve_CURVE25519:
 		if len(key) != ed25519.PublicKeySize {
 			return false //avoids a panic internal to ed25519
 		}
 		return ed25519.Verify(key, b, c.signature)
 	case Curve_P256:
 		pubKey, err := ecdsa.ParseUncompressedPublicKey(elliptic.P256(), key)
@@ -22,7 +22,6 @@ var (
 	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
 	ErrUnknownVersion             = errors.New("certificate version unrecognized")
 	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
 	ErrCurveMismatch              = errors.New("certificate curve does not match CA")
 	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
 	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")
@@ -13,12 +13,6 @@ import (
 	"golang.org/x/crypto/ed25519"
 )
 // testCertNow is the reference "now" used to derive default before/after times
 // in NewTestCaCert and NewTestCert. Holding it fixed for the lifetime of the
 // test binary keeps CA and leaf defaults aligned at the same second, so a leaf
 // signed with default times can never expire after its CA on a rounding race.
 var testCertNow = time.Now().Round(time.Second)
 // NewTestCaCert will create a new ca certificate
 func NewTestCaCert(version Version, curve Curve, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (Certificate, []byte, []byte, []byte) {
 	var err error
@@ -40,10 +34,10 @@ func NewTestCaCert(version Version, curve Curve, before, after time.Time, networ
 	}
 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}
 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}
 	t := &TBSCertificate{
@@ -76,11 +70,11 @@ func NewTestCaCert(version Version, curve Curve, before, after time.Time, networ
 // Expiry times are defaulted if you do not pass them in
 func NewTestCert(v Version, curve Curve, ca Certificate, key []byte, name string, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (Certificate, []byte, []byte, []byte) {
 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}
 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}
 	if len(networks) == 0 {
@@ -148,9 +148,6 @@ func MarshalSigningPublicKeyToPEM(curve Curve, b []byte) []byte {
 	}
 }
 // UnmarshalPublicKeyFromPEM will try to unmarshal the first pem block in a byte array, returning any non
 // consumed data or an error on failure. Only key-agreement (ECDH) public key banners are accepted.
 // Use UnmarshalSigningPublicKeyFromPEM for Ed25519/ECDSA banners.
 func UnmarshalPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	k, r := pem.Decode(b)
 	if k == nil {
@@ -159,10 +156,10 @@ func UnmarshalPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	var expectedLen int
 	var curve Curve
 	switch k.Type {
-	case X25519PublicKeyBanner:
+	case X25519PublicKeyBanner, Ed25519PublicKeyBanner:
 		expectedLen = 32
 		curve = Curve_CURVE25519
-	case P256PublicKeyBanner:
+	case P256PublicKeyBanner, ECDSAP256PublicKeyBanner:
 		// Uncompressed
 		expectedLen = 65
 		curve = Curve_P256
@@ -175,33 +172,6 @@ func UnmarshalPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	return k.Bytes, r, curve, nil
 }
 // UnmarshalSigningPublicKeyFromPEM will try to unmarshal the first pem block in a byte array, returning any non
 // consumed data or an error on failure. Only Ed25519/ECDSA public key banners are accepted.
 // Use UnmarshalPublicKeyFromPEM for X25519/P256 (ECDH) banners.
 func UnmarshalSigningPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	k, r := pem.Decode(b)
 	if k == nil {
 		return nil, r, 0, fmt.Errorf("input did not contain a valid PEM encoded block")
 	}
 	var expectedLen int
 	var curve Curve
 	switch k.Type {
 	case Ed25519PublicKeyBanner:
 		expectedLen = 32
 		curve = Curve_CURVE25519
 	case ECDSAP256PublicKeyBanner:
 		// Uncompressed
 		expectedLen = 65
 		curve = Curve_P256
 	default:
 		return nil, r, 0, fmt.Errorf("bytes did not contain a proper Ed25519/ECDSA public key banner")
 	}
 	if len(k.Bytes) != expectedLen {
 		return nil, r, 0, fmt.Errorf("key was not %d bytes, is invalid %s public key", expectedLen, curve)
 	}
 	return k.Bytes, r, curve, nil
 }
 func MarshalPrivateKeyToPEM(curve Curve, b []byte) []byte {
 	switch curve {
 	case Curve_CURVE25519:
@@ -255,6 +255,60 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 func TestUnmarshalPublicKeyFromPEM(t *testing.T) {
 	t.Parallel()
 	pubKey := []byte(`# A good key
 -----BEGIN NEBULA ED25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA ED25519 PUBLIC KEY-----
 `)
 	shortKey := []byte(`# A short key
 -----BEGIN NEBULA ED25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
 -----END NEBULA ED25519 PUBLIC KEY-----
 `)
 	invalidBanner := []byte(`# Invalid banner
 -----BEGIN NOT A NEBULA PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -----END NOT A NEBULA PUBLIC KEY-----
 `)
 	invalidPem := []byte(`# Not a valid PEM format
 -BEGIN NEBULA ED25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -END NEBULA ED25519 PUBLIC KEY-----`)
 	keyBundle := appendByteSlices(pubKey, shortKey, invalidBanner, invalidPem)
 	// Success test case
 	k, rest, curve, err := UnmarshalPublicKeyFromPEM(keyBundle)
 	assert.Len(t, k, 32)
 	assert.Equal(t, Curve_CURVE25519, curve)
 	require.NoError(t, err)
 	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
 	// Fail due to short key
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, Curve_CURVE25519, curve)
 	assert.Equal(t, rest, appendByteSlices(invalidBanner, invalidPem))
 	require.EqualError(t, err, "key was not 32 bytes, is invalid CURVE25519 public key")
 	// Fail due to invalid banner
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, Curve_CURVE25519, curve)
 	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)
 	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, Curve_CURVE25519, curve)
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "input did not contain a valid PEM encoded block")
 }
 func TestUnmarshalX25519PublicKey(t *testing.T) {
 	t.Parallel()
 	pubKey := []byte(`# A good key
 -----BEGIN NEBULA X25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA X25519 PUBLIC KEY-----
@@ -265,7 +319,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA P256 PUBLIC KEY-----
 `)
-	signingKey := []byte(`# A signing key has the wrong scope for this function
+	oldPubP256Key := []byte(`# A good key
 -----BEGIN NEBULA ECDSA P256 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAAAAAAAAAAAAAAAAA=
@@ -286,118 +340,44 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -END NEBULA X25519 PUBLIC KEY-----`)
-	keyBundle := appendByteSlices(pubKey, pubP256Key, signingKey, shortKey, invalidBanner, invalidPem)
+	keyBundle := appendByteSlices(pubKey, pubP256Key, oldPubP256Key, shortKey, invalidBanner, invalidPem)
-	// X25519 key
+	// Success test case
 	k, rest, curve, err := UnmarshalPublicKeyFromPEM(keyBundle)
 	assert.Len(t, k, 32)
 	require.NoError(t, err)
-	assert.Equal(t, rest, appendByteSlices(pubP256Key, signingKey, shortKey, invalidBanner, invalidPem))
+	assert.Equal(t, rest, appendByteSlices(pubP256Key, oldPubP256Key, shortKey, invalidBanner, invalidPem))
 	assert.Equal(t, Curve_CURVE25519, curve)
-	// P256 key
+	// Success test case
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Len(t, k, 65)
 	require.NoError(t, err)
-	assert.Equal(t, rest, appendByteSlices(signingKey, shortKey, invalidBanner, invalidPem))
+	assert.Equal(t, rest, appendByteSlices(oldPubP256Key, shortKey, invalidBanner, invalidPem))
 	assert.Equal(t, Curve_P256, curve)
-	// Reject a signing public key (Ed25519/ECDSA banner)
+	// Success test case
-	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
 	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	// Fail due to short key
 	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, appendByteSlices(invalidBanner, invalidPem))
 	require.EqualError(t, err, "key was not 32 bytes, is invalid CURVE25519 public key")
 	// Fail due to invalid banner
 	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)
 	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "input did not contain a valid PEM encoded block")
 }
 func TestUnmarshalSigningPublicKeyFromPEM(t *testing.T) {
 	t.Parallel()
 	pubKey := []byte(`# A good key
 -----BEGIN NEBULA ED25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA ED25519 PUBLIC KEY-----
 `)
 	pubP256Key := []byte(`# A good key
 -----BEGIN NEBULA ECDSA P256 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA ECDSA P256 PUBLIC KEY-----
 `)
 	ecdhKey := []byte(`# A key-agreement key has the wrong scope for this function
 -----BEGIN NEBULA X25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA X25519 PUBLIC KEY-----
 `)
 	shortKey := []byte(`# A short key
 -----BEGIN NEBULA ED25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
 -----END NEBULA ED25519 PUBLIC KEY-----
 `)
 	invalidBanner := []byte(`# Invalid banner
 -----BEGIN NOT A NEBULA PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -----END NOT A NEBULA PUBLIC KEY-----
 `)
 	invalidPem := []byte(`# Not a valid PEM format
 -BEGIN NEBULA ED25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -END NEBULA ED25519 PUBLIC KEY-----`)
 	keyBundle := appendByteSlices(pubKey, pubP256Key, ecdhKey, shortKey, invalidBanner, invalidPem)
 	// Ed25519 key
 	k, rest, curve, err := UnmarshalSigningPublicKeyFromPEM(keyBundle)
 	assert.Len(t, k, 32)
 	require.NoError(t, err)
 	assert.Equal(t, rest, appendByteSlices(pubP256Key, ecdhKey, shortKey, invalidBanner, invalidPem))
 	assert.Equal(t, Curve_CURVE25519, curve)
 	// ECDSA P256 key
 	k, rest, curve, err = UnmarshalSigningPublicKeyFromPEM(rest)
 	assert.Len(t, k, 65)
 	require.NoError(t, err)
-	assert.Equal(t, rest, appendByteSlices(ecdhKey, shortKey, invalidBanner, invalidPem))
+	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
 	assert.Equal(t, Curve_P256, curve)
 	// Reject a key-agreement public key (X25519/P256 banner)
 	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
 	require.EqualError(t, err, "bytes did not contain a proper Ed25519/ECDSA public key banner")
 	// Fail due to short key
-	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, appendByteSlices(invalidBanner, invalidPem))
 	require.EqualError(t, err, "key was not 32 bytes, is invalid CURVE25519 public key")
 	// Fail due to invalid banner
-	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
-	require.EqualError(t, err, "bytes did not contain a proper Ed25519/ECDSA public key banner")
+	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)
 	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
-	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "input did not contain a valid PEM encoded block")
@@ -14,12 +14,6 @@ import (
 	"golang.org/x/crypto/ed25519"
 )
 // testCertNow is the reference "now" used to derive default before/after times
 // in NewTestCaCert and NewTestCert. Holding it fixed for the lifetime of the
 // test binary keeps CA and leaf defaults aligned at the same second, so a leaf
 // signed with default times can never expire after its CA on a rounding race.
 var testCertNow = time.Now().Round(time.Second)
 // NewTestCaCert will create a new ca certificate
 func NewTestCaCert(version cert.Version, curve cert.Curve, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (cert.Certificate, []byte, []byte, []byte) {
 	var err error
@@ -41,10 +35,10 @@ func NewTestCaCert(version cert.Version, curve cert.Curve, before, after time.Ti
 	}
 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}
 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}
 	t := &cert.TBSCertificate{
@@ -77,11 +71,11 @@ func NewTestCaCert(version cert.Version, curve cert.Curve, before, after time.Ti
 // Expiry times are defaulted if you do not pass them in
 func NewTestCert(v cert.Version, curve cert.Curve, ca cert.Certificate, key []byte, name string, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (cert.Certificate, []byte, []byte, []byte) {
 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}
 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}
 	var pub, priv []byte
@@ -169,55 +163,3 @@ func P256Keypair() ([]byte, []byte) {
 	pubkey := privkey.PublicKey()
 	return pubkey.Bytes(), privkey.Bytes()
 }
 // DummyCert is a minimal cert.Certificate implementation for testing error paths.
 type DummyCert struct {
 	Version_        cert.Version
 	Curve_          cert.Curve
 	Groups_         []string
 	IsCA_           bool
 	Issuer_         string
 	Name_           string
 	Networks_       []netip.Prefix
 	NotAfter_       time.Time
 	NotBefore_      time.Time
 	PublicKey_      []byte
 	Signature_      []byte
 	UnsafeNetworks_ []netip.Prefix
 }
 func (d *DummyCert) Version() cert.Version                         { return d.Version_ }
 func (d *DummyCert) Curve() cert.Curve                             { return d.Curve_ }
 func (d *DummyCert) Groups() []string                              { return d.Groups_ }
 func (d *DummyCert) IsCA() bool                                    { return d.IsCA_ }
 func (d *DummyCert) Issuer() string                                { return d.Issuer_ }
 func (d *DummyCert) Name() string                                  { return d.Name_ }
 func (d *DummyCert) Networks() []netip.Prefix                      { return d.Networks_ }
 func (d *DummyCert) NotAfter() time.Time                           { return d.NotAfter_ }
 func (d *DummyCert) NotBefore() time.Time                          { return d.NotBefore_ }
 func (d *DummyCert) PublicKey() []byte                             { return d.PublicKey_ }
 func (d *DummyCert) Signature() []byte                             { return d.Signature_ }
 func (d *DummyCert) UnsafeNetworks() []netip.Prefix                { return d.UnsafeNetworks_ }
 func (d *DummyCert) Fingerprint() (string, error)                  { return "", nil }
 func (d *DummyCert) CheckSignature(key []byte) bool                { return false }
 func (d *DummyCert) MarshalForHandshakes() ([]byte, error)         { return nil, nil }
 func (d *DummyCert) MarshalPEM() ([]byte, error)                   { return nil, nil }
 func (d *DummyCert) MarshalJSON() ([]byte, error)                  { return nil, nil }
 func (d *DummyCert) Marshal() ([]byte, error)                      { return nil, nil }
 func (d *DummyCert) String() string                                { return "dummy" }
 func (d *DummyCert) Copy() cert.Certificate                        { return d }
 func (d *DummyCert) VerifyPrivateKey(c cert.Curve, k []byte) error { return nil }
 func (d *DummyCert) Expired(time.Time) bool                        { return false }
 func (d *DummyCert) MarshalPublicKeyPEM() []byte                   { return nil }
 func (d *DummyCert) PublicKeyPEM() []byte                          { return nil }
 // NewTestCAPool creates a CAPool from the given CA certificates, panicking on error.
 func NewTestCAPool(cas ...cert.Certificate) *cert.CAPool {
 	pool := cert.NewCAPool()
 	for _, ca := range cas {
 		if err := pool.AddCA(ca); err != nil {
 			panic(err)
 		}
 	}
 	return pool
 }
@@ -3,14 +3,11 @@ package main
 import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/fips140"
 	"crypto/rand"
 	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"math"
 	"math/bits"
 	"net/netip"
 	"os"
 	"strings"
@@ -46,28 +43,7 @@ type caFlags struct {
 	subnets *string
 }
 func defaultCurve() string {
 	if fips140.Enforced() {
 		return "P256"
 	}
 	return "25519"
 }
 func newCaFlags() *caFlags {
 	// prevent running out of memory on 32-bit systems by defaulting to
 	// RFC9106's recommendation for memory-constrained environments
 	var (
 		defaultArgonMemory     uint
 		defaultArgonIterations uint
 	)
 	if bits.UintSize == 32 {
 		defaultArgonMemory = 64 * 1024
 		defaultArgonIterations = 3
 	} else {
 		defaultArgonMemory = 2 * 1024 * 1024
 		defaultArgonIterations = 1
 	}
 	cf := caFlags{set: flag.NewFlagSet("ca", flag.ContinueOnError)}
 	cf.set.Usage = func() {}
 	cf.name = cf.set.String("name", "", "Required: name of the certificate authority")
@@ -79,11 +55,11 @@ func newCaFlags() *caFlags {
 	cf.groups = cf.set.String("groups", "", "Optional: comma separated list of groups. This will limit which groups subordinate certs can use")
 	cf.networks = cf.set.String("networks", "", "Optional: comma separated list of ip address and network in CIDR notation. This will limit which ip addresses and networks subordinate certs can use in networks")
 	cf.unsafeNetworks = cf.set.String("unsafe-networks", "", "Optional: comma separated list of ip address and network in CIDR notation. This will limit which ip addresses and networks subordinate certs can use in unsafe networks")
-	cf.argonMemory = cf.set.Uint("argon-memory", defaultArgonMemory, "Optional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase")
+	cf.argonMemory = cf.set.Uint("argon-memory", 2*1024*1024, "Optional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase")
 	cf.argonParallelism = cf.set.Uint("argon-parallelism", 4, "Optional: Argon2 parallelism parameter used for encrypted private key passphrase")
-	cf.argonIterations = cf.set.Uint("argon-iterations", defaultArgonIterations, "Optional: Argon2 iterations parameter used for encrypted private key passphrase")
+	cf.argonIterations = cf.set.Uint("argon-iterations", 1, "Optional: Argon2 iterations parameter used for encrypted private key passphrase")
 	cf.encryption = cf.set.Bool("encrypt", false, "Optional: prompt for passphrase and write out-key in an encrypted format")
-	cf.curve = cf.set.String("curve", defaultCurve(), "EdDSA/ECDSA Curve (25519, P256)")
+	cf.curve = cf.set.String("curve", "25519", "EdDSA/ECDSA Curve (25519, P256)")
 	cf.p11url = p11Flag(cf.set)
 	cf.ips = cf.set.String("ips", "", "Deprecated, see -networks")
@@ -121,19 +97,6 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		if err = mustFlagString("out-key", cf.outKeyPath); err != nil {
 			return err
 		}
 	} else {
 		// out-key is meaningless under PKCS#11 because the private key never
 		// leaves the HSM; reject it so we never silently accept or claim a
 		// stdout slot for it.
 		outKeySet := false
 		cf.set.Visit(func(f *flag.Flag) {
 			if f.Name == "out-key" {
 				outKeySet = true
 			}
 		})
 		if outKeySet {
 			return newHelpErrorf("cannot set -out-key with -pkcs11")
 		}
 	}
 	if err := mustFlagString("out-crt", cf.outCertPath); err != nil {
 		return err
@@ -208,21 +171,12 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		}
 	}
 	var claims ioClaims
 	if err := reserveOutputs(&claims,
 		"out-key", *cf.outKeyPath,
 		"out-crt", *cf.outCertPath,
 		"out-qr", *cf.outQRPath,
 	); err != nil {
 		return err
 	}
 	var passphrase []byte
 	if !isP11 && *cf.encryption {
 		passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
 		if len(passphrase) == 0 {
 			for i := 0; i < 5; i++ {
-				errOut.Write([]byte("Enter passphrase: "))
+				out.Write([]byte("Enter passphrase: "))
 				passphrase, err = pr.ReadPassword()
 				if err == ErrNoTerminal {
@@ -268,9 +222,6 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 	} else {
 		switch *cf.curve {
 		case "25519", "X25519", "Curve25519", "CURVE25519":
 			if fips140.Enforced() {
 				return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
 			}
 			curve = cert.Curve_CURVE25519
 			pub, rawPriv, err = ed25519.GenerateKey(rand.Reader)
 			if err != nil {
@@ -310,16 +261,14 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		Curve:          curve,
 	}
-	if !isP11 && !isStdio(*cf.outKeyPath) {
+	if !isP11 {
 		if _, err := os.Stat(*cf.outKeyPath); err == nil {
 			return fmt.Errorf("refusing to overwrite existing CA key: %s", *cf.outKeyPath)
 		}
 	}
-	if !isStdio(*cf.outCertPath) {
+	if _, err := os.Stat(*cf.outCertPath); err == nil {
-		if _, err := os.Stat(*cf.outCertPath); err == nil {
+		return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
 			return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
 		}
 	}
 	var c cert.Certificate
@@ -345,7 +294,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 			b = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)
 		}
-		err = writeOutput(*cf.outKeyPath, b, 0600, out)
+		err = os.WriteFile(*cf.outKeyPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-key: %s", err)
 		}
@@ -356,7 +305,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		return fmt.Errorf("error while marshalling certificate: %s", err)
 	}
-	err = writeOutput(*cf.outCertPath, b, 0600, out)
+	err = os.WriteFile(*cf.outCertPath, b, 0600)
 	if err != nil {
 		return fmt.Errorf("error while writing out-crt: %s", err)
 	}
@@ -367,7 +316,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 			return fmt.Errorf("error while generating qr code: %s", err)
 		}
-		err = writeOutput(*cf.outQRPath, b, 0600, out)
+		err = os.WriteFile(*cf.outQRPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-qr: %s", err)
 		}
@@ -383,7 +332,6 @@ func caSummary() string {
 func caHelp(out io.Writer) {
 	cf := newCaFlags()
 	out.Write([]byte("Usage of " + os.Args[0] + " " + caSummary() + "\n"))
 	out.Write([]byte(stdioHelpText))
 	cf.set.SetOutput(out)
 	cf.set.PrintDefaults()
 }
@@ -7,9 +7,7 @@ import (
 	"bytes"
 	"encoding/pem"
 	"errors"
 	"math/bits"
 	"os"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -24,28 +22,15 @@ func Test_caSummary(t *testing.T) {
 }
 func Test_caHelp(t *testing.T) {
 	var (
 		defaultArgonMemory     string
 		defaultArgonIterations string
 	)
 	if bits.UintSize == 32 {
 		defaultArgonMemory = strconv.Itoa(64 * 1024)
 		defaultArgonIterations = strconv.Itoa(3)
 	} else {
 		defaultArgonMemory = strconv.Itoa(2 * 1024 * 1024)
 		defaultArgonIterations = strconv.Itoa(1)
 	}
 	ob := &bytes.Buffer{}
 	caHelp(ob)
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" ca <flags>: create a self signed certificate authority\n"+
 			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -argon-iterations uint\n"+
-			"    \tOptional: Argon2 iterations parameter used for encrypted private key passphrase (default "+defaultArgonIterations+")\n"+
+			"    \tOptional: Argon2 iterations parameter used for encrypted private key passphrase (default 1)\n"+
 			"  -argon-memory uint\n"+
-			"    \tOptional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase (default "+defaultArgonMemory+")\n"+
+			"    \tOptional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase (default 2097152)\n"+
 			"  -argon-parallelism uint\n"+
 			"    \tOptional: Argon2 parallelism parameter used for encrypted private key passphrase (default 4)\n"+
 			"  -curve string\n"+
@@ -99,7 +84,7 @@ func Test_ca(t *testing.T) {
 		err:      nil,
 	}
-	pwPromptEB := "Enter passphrase: "
+	pwPromptOb := "Enter passphrase: "
 	// required args
 	assertHelpError(t, ca(
@@ -183,8 +168,8 @@ func Test_ca(t *testing.T) {
 	eb.Reset()
 	args = []string{"-version", "1", "-encrypt", "-name", "test", "-duration", "100m", "-groups", "1,2,3,4,5", "-out-crt", crtF.Name(), "-out-key", keyF.Name()}
 	require.NoError(t, ca(args, ob, eb, testpw))
-	assert.Empty(t, ob.String())
+	assert.Equal(t, pwPromptOb, ob.String())
-	assert.Equal(t, pwPromptEB, eb.String())
+	assert.Empty(t, eb.String())
 	// test encrypted key with passphrase environment variable
 	os.Remove(keyF.Name())
@@ -202,16 +187,10 @@ func Test_ca(t *testing.T) {
 	k, _ := pem.Decode(rb)
 	ned, err := cert.UnmarshalNebulaEncryptedData(k.Bytes)
 	require.NoError(t, err)
-
+	// we won't know salt in advance, so just check start of string
-	if bits.UintSize == 32 {
+	assert.Equal(t, uint32(2*1024*1024), ned.EncryptionMetadata.Argon2Parameters.Memory)
 		assert.Equal(t, uint32(64*1024), ned.EncryptionMetadata.Argon2Parameters.Memory)
 		assert.Equal(t, uint32(3), ned.EncryptionMetadata.Argon2Parameters.Iterations)
 	} else {
 		assert.Equal(t, uint32(2*1024*1024), ned.EncryptionMetadata.Argon2Parameters.Memory)
 		assert.Equal(t, uint32(1), ned.EncryptionMetadata.Argon2Parameters.Iterations)
 	}
 	assert.Equal(t, uint8(4), ned.EncryptionMetadata.Argon2Parameters.Parallelism)
 	assert.Equal(t, uint32(1), ned.EncryptionMetadata.Argon2Parameters.Iterations)
 	// verify the key is valid and decrypt-able
 	var curve cert.Curve
@@ -228,8 +207,8 @@ func Test_ca(t *testing.T) {
 	eb.Reset()
 	args = []string{"-version", "1", "-encrypt", "-name", "test", "-duration", "100m", "-groups", "1,2,3,4,5", "-out-crt", crtF.Name(), "-out-key", keyF.Name()}
 	require.Error(t, ca(args, ob, eb, errpw))
-	assert.Empty(t, ob.String())
+	assert.Equal(t, pwPromptOb, ob.String())
-	assert.Equal(t, pwPromptEB, eb.String())
+	assert.Empty(t, eb.String())
 	// test when user fails to enter a password
 	os.Remove(keyF.Name())
@@ -238,8 +217,8 @@ func Test_ca(t *testing.T) {
 	eb.Reset()
 	args = []string{"-version", "1", "-encrypt", "-name", "test", "-duration", "100m", "-groups", "1,2,3,4,5", "-out-crt", crtF.Name(), "-out-key", keyF.Name()}
 	require.EqualError(t, ca(args, ob, eb, nopw), "no passphrase specified, remove -encrypt flag to write out-key in plaintext")
-	assert.Empty(t, ob.String())
+	assert.Equal(t, strings.Repeat(pwPromptOb, 5), ob.String()) // prompts 5 times before giving up
-	assert.Equal(t, strings.Repeat(pwPromptEB, 5), eb.String()) // prompts 5 times before giving up
+	assert.Empty(t, eb.String())
 	// create valid cert/key for overwrite tests
 	os.Remove(keyF.Name())
@@ -268,67 +247,3 @@ func Test_ca(t *testing.T) {
 	os.Remove(keyF.Name())
 }
 func Test_ca_stdio(t *testing.T) {
 	nopw := &StubPasswordReader{}
 	keyF, err := os.CreateTemp("", "ca.key")
 	require.NoError(t, err)
 	os.Remove(keyF.Name())
 	defer os.Remove(keyF.Name())
 	crtF, err := os.CreateTemp("", "ca.crt")
 	require.NoError(t, err)
 	os.Remove(crtF.Name())
 	defer os.Remove(crtF.Name())
 	// out-crt on stdout, out-key on disk
 	ob := &bytes.Buffer{}
 	eb := &bytes.Buffer{}
 	require.NoError(t, ca([]string{"-name", "test-ca", "-duration", "1h", "-out-crt", "-", "-out-key", keyF.Name()}, ob, eb, nopw))
 	assert.Empty(t, eb.String())
 	c, _, err := cert.UnmarshalCertificateFromPEM(ob.Bytes())
 	require.NoError(t, err)
 	assert.True(t, c.IsCA())
 	assert.Equal(t, "test-ca", c.Name())
 	// out-key on stdout, out-crt on disk
 	os.Remove(keyF.Name())
 	ob.Reset()
 	eb.Reset()
 	require.NoError(t, ca([]string{"-name", "test-ca", "-duration", "1h", "-out-crt", crtF.Name(), "-out-key", "-"}, ob, eb, nopw))
 	assert.Empty(t, eb.String())
 	_, _, curve, err := cert.UnmarshalSigningPrivateKeyFromPEM(ob.Bytes())
 	require.NoError(t, err)
 	assert.Equal(t, cert.Curve_CURVE25519, curve)
 	// dual stdout is rejected up front
 	os.Remove(crtF.Name())
 	ob.Reset()
 	eb.Reset()
 	require.EqualError(t,
 		ca([]string{"-name", "test-ca", "-duration", "1h", "-out-crt", "-", "-out-key", "-"}, ob, eb, nopw),
 		`-out-key and -out-crt both set to "-", only one output may write to stdout`)
 	assert.Empty(t, ob.String())
 	// an output conflict combined with -encrypt must error BEFORE prompting
 	// for a passphrase; pr would record any read attempt
 	tracker := &trackingPasswordReader{}
 	ob.Reset()
 	eb.Reset()
 	require.EqualError(t,
 		ca([]string{"-name", "test-ca", "-duration", "1h", "-encrypt", "-out-crt", "-", "-out-key", "-"}, ob, eb, tracker),
 		`-out-key and -out-crt both set to "-", only one output may write to stdout`)
 	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
 	assert.Zero(t, tracker.calls, "passphrase prompt should not have been called")
 }
 type trackingPasswordReader struct {
 	calls int
 }
 func (pr *trackingPasswordReader) ReadPassword() ([]byte, error) {
 	pr.calls++
 	return []byte(""), nil
 }
@@ -1,5 +0,0 @@
 //go:build fips140enforce
 //go:debug fips140=only
 package main
@@ -1,8 +1,6 @@
 package main
 import (
 	"crypto/fips140"
 	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -26,7 +24,7 @@ func newKeygenFlags() *keygenFlags {
 	cf.set.Usage = func() {}
 	cf.outPubPath = cf.set.String("out-pub", "", "Required: path to write the public key to")
 	cf.outKeyPath = cf.set.String("out-key", "", "Required: path to write the private key to")
-	cf.curve = cf.set.String("curve", defaultCurve(), "ECDH Curve (25519, P256)")
+	cf.curve = cf.set.String("curve", "25519", "ECDH Curve (25519, P256)")
 	cf.p11url = p11Flag(cf.set)
 	return &cf
 }
@@ -44,8 +42,6 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 		if err = mustFlagString("out-key", cf.outKeyPath); err != nil {
 			return err
 		}
 	} else if *cf.outKeyPath != "" {
 		return newHelpErrorf("cannot set -out-key with -pkcs11")
 	}
 	if err = mustFlagString("out-pub", cf.outPubPath); err != nil {
 		return err
@@ -63,9 +59,6 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 	} else {
 		switch *cf.curve {
 		case "25519", "X25519", "Curve25519", "CURVE25519":
 			if fips140.Enforced() {
 				return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
 			}
 			pub, rawPriv = x25519Keypair()
 			curve = cert.Curve_CURVE25519
 		case "P256":
@@ -76,14 +69,6 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 		}
 	}
 	var claims ioClaims
 	if err := reserveOutputs(&claims,
 		"out-key", *cf.outKeyPath,
 		"out-pub", *cf.outPubPath,
 	); err != nil {
 		return err
 	}
 	if isP11 {
 		p11Client, err := pkclient.FromUrl(*cf.p11url)
 		if err != nil {
@@ -97,12 +82,12 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 			return fmt.Errorf("error while getting public key: %w", err)
 		}
 	} else {
-		err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
+		err = os.WriteFile(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-key: %s", err)
 		}
 	}
-	err = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)
+	err = os.WriteFile(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600)
 	if err != nil {
 		return fmt.Errorf("error while writing out-pub: %s", err)
 	}
@@ -117,7 +102,6 @@ func keygenSummary() string {
 func keygenHelp(out io.Writer) {
 	cf := newKeygenFlags()
 	_, _ = out.Write([]byte("Usage of " + os.Args[0] + " " + keygenSummary() + "\n"))
 	_, _ = out.Write([]byte(stdioHelpText))
 	cf.set.SetOutput(out)
 	cf.set.PrintDefaults()
 }
@@ -20,7 +20,6 @@ func Test_keygenHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`\n"+
 			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -curve string\n"+
 			"    \tECDH Curve (25519, P256) (default \"25519\")\n"+
 			"  -out-key string\n"+
@@ -94,43 +93,3 @@ func Test_keygen(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, lPub, 32)
 }
 func Test_keygen_stdio(t *testing.T) {
 	keyF, err := os.CreateTemp("", "test.key")
 	require.NoError(t, err)
 	os.Remove(keyF.Name())
 	defer os.Remove(keyF.Name())
 	pubF, err := os.CreateTemp("", "test.pub")
 	require.NoError(t, err)
 	os.Remove(pubF.Name())
 	defer os.Remove(pubF.Name())
 	// out-pub on stdout, out-key on disk
 	ob := &bytes.Buffer{}
 	eb := &bytes.Buffer{}
 	require.NoError(t, keygen([]string{"-out-pub", "-", "-out-key", keyF.Name()}, ob, eb))
 	assert.Empty(t, eb.String())
 	lPub, _, curve, err := cert.UnmarshalPublicKeyFromPEM(ob.Bytes())
 	require.NoError(t, err)
 	assert.Equal(t, cert.Curve_CURVE25519, curve)
 	assert.Len(t, lPub, 32)
 	// out-key on stdout, out-pub on disk
 	os.Remove(keyF.Name())
 	ob.Reset()
 	eb.Reset()
 	require.NoError(t, keygen([]string{"-out-pub", pubF.Name(), "-out-key", "-"}, ob, eb))
 	assert.Empty(t, eb.String())
 	lKey, _, curve, err := cert.UnmarshalPrivateKeyFromPEM(ob.Bytes())
 	require.NoError(t, err)
 	assert.Equal(t, cert.Curve_CURVE25519, curve)
 	assert.Len(t, lKey, 32)
 	// both on stdout is a conflict caught up front
 	ob.Reset()
 	eb.Reset()
 	require.EqualError(t, keygen([]string{"-out-pub", "-", "-out-key", "-"}, ob, eb),
 		`-out-key and -out-pub both set to "-", only one output may write to stdout`)
 	assert.Empty(t, ob.String())
 }
@@ -22,9 +22,7 @@ func (pr StdinPasswordReader) ReadPassword() ([]byte, error) {
 	}
 	password, err := term.ReadPassword(int(os.Stdin.Fd()))
-	// Terminal echo is off while reading, so the user's Enter key does not
+	fmt.Println()
 	// produce a visible newline. Emit one on stderr to match the prompt.
 	fmt.Fprintln(os.Stderr)
 	return password, err
 }
@@ -40,23 +40,11 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 		return err
 	}
-	var claims ioClaims
+	rawCert, err := os.ReadFile(*pf.path)
 	if err := reserveInputs(&claims, "path", *pf.path); err != nil {
 		return err
 	}
 	if err := reserveOutputs(&claims, "out-qr", *pf.outQRPath); err != nil {
 		return err
 	}
 	rawCert, err := readInput("path", *pf.path, &claims)
 	if err != nil {
 		return fmt.Errorf("unable to read cert; %s", err)
 	}
 	// When the QR is going to stdout, suppress the human-readable text/json
 	// output so the binary stream is not contaminated.
 	qrToStdout := isStdio(*pf.outQRPath)
 	var c cert.Certificate
 	var qrBytes []byte
 	part := 0
@@ -69,13 +57,11 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 			return fmt.Errorf("error while unmarshaling cert: %s", err)
 		}
-		if !qrToStdout {
+		if *pf.json {
-			if *pf.json {
+			jsonCerts = append(jsonCerts, c)
-				jsonCerts = append(jsonCerts, c)
+		} else {
-			} else {
+			_, _ = out.Write([]byte(c.String()))
-				_, _ = out.Write([]byte(c.String()))
+			_, _ = out.Write([]byte("\n"))
 				_, _ = out.Write([]byte("\n"))
 			}
 		}
 		if *pf.outQRPath != "" {
@@ -93,7 +79,7 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 		part++
 	}
-	if *pf.json && !qrToStdout {
+	if *pf.json {
 		b, _ := json.Marshal(jsonCerts)
 		_, _ = out.Write(b)
 		_, _ = out.Write([]byte("\n"))
@@ -105,7 +91,7 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 			return fmt.Errorf("error while generating qr code: %s", err)
 		}
-		err = writeOutput(*pf.outQRPath, b, 0600, out)
+		err = os.WriteFile(*pf.outQRPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-qr: %s", err)
 		}
@@ -121,7 +107,6 @@ func printSummary() string {
 func printHelp(out io.Writer) {
 	pf := newPrintFlags()
 	out.Write([]byte("Usage of " + os.Args[0] + " " + printSummary() + "\n"))
 	out.Write([]byte(stdioHelpText))
 	pf.set.SetOutput(out)
 	pf.set.PrintDefaults()
 }
@@ -25,7 +25,6 @@ func Test_printHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" print <flags>: prints details about a certificate\n"+
 			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -json\n"+
 			"    \tOptional: outputs certificates in json format\n"+
 			"  -out-qr string\n"+
@@ -179,44 +178,6 @@ func Test_printCert(t *testing.T) {
 		ob.String(),
 	)
 	assert.Empty(t, eb.String())
 	// read cert from stdin
 	ob.Reset()
 	eb.Reset()
 	withStdin(t, bytes.NewReader(p))
 	err = printCert([]string{"-json", "-path", "-"}, ob, eb)
 	require.NoError(t, err)
 	assert.Equal(
 		t,
 		`[{"details":{"curve":"CURVE25519","groups":["hi"],"isCa":false,"issuer":"`+c.Issuer()+`","name":"test","networks":["10.0.0.123/8"],"notAfter":"0001-01-01T00:00:00Z","notBefore":"0001-01-01T00:00:00Z","publicKey":"`+pk+`","unsafeNetworks":[]},"fingerprint":"`+fp+`","signature":"`+sig+`","version":1}]
 `,
 		ob.String(),
 	)
 	assert.Empty(t, eb.String())
 	// -out-qr - sends only the PNG to stdout, suppressing the cert dump
 	ob.Reset()
 	eb.Reset()
 	withStdin(t, bytes.NewReader(p))
 	err = printCert([]string{"-path", "-", "-out-qr", "-"}, ob, eb)
 	require.NoError(t, err)
 	assert.Empty(t, eb.String())
 	stdout := ob.Bytes()
 	require.NotEmpty(t, stdout)
 	// PNG magic, no PEM/JSON noise prepended
 	assert.Equal(t, []byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a}, stdout[:8])
 	assert.NotContains(t, string(stdout), "NebulaCertificate")
 	assert.NotContains(t, string(stdout), `"details"`)
 	// json + out-qr - still suppresses json
 	ob.Reset()
 	eb.Reset()
 	withStdin(t, bytes.NewReader(p))
 	err = printCert([]string{"-json", "-path", "-", "-out-qr", "-"}, ob, eb)
 	require.NoError(t, err)
 	assert.Empty(t, eb.String())
 	assert.Equal(t, []byte{0x89, 'P', 'N', 'G'}, ob.Bytes()[:4])
 	assert.NotContains(t, ob.String(), `"details"`)
 }
 // NewTestCaCert will generate a CA cert
@@ -2,7 +2,6 @@ package main
 import (
 	"crypto/ecdh"
 	"crypto/fips140"
 	"crypto/rand"
 	"errors"
 	"flag"
@@ -86,9 +85,6 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 	if !isP11 && *sf.inPubPath != "" && *sf.outKeyPath != "" {
 		return newHelpErrorf("cannot set both -in-pub and -out-key")
 	}
 	if isP11 && *sf.outKeyPath != "" {
 		return newHelpErrorf("cannot set -out-key with -pkcs11")
 	}
 	var v4Networks []netip.Prefix
 	var v6Networks []netip.Prefix
@@ -106,35 +102,13 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		return newHelpErrorf("-version must be either %v or %v", cert.Version1, cert.Version2)
 	}
 	if *sf.outKeyPath == "" {
 		*sf.outKeyPath = *sf.name + ".key"
 	}
 	if *sf.outCertPath == "" {
 		*sf.outCertPath = *sf.name + ".crt"
 	}
 	var claims ioClaims
 	if err := reserveInputs(&claims,
 		"ca-key", *sf.caKeyPath,
 		"ca-crt", *sf.caCertPath,
 		"in-pub", *sf.inPubPath,
 	); err != nil {
 		return err
 	}
 	if err := reserveOutputs(&claims,
 		"out-key", *sf.outKeyPath,
 		"out-crt", *sf.outCertPath,
 		"out-qr", *sf.outQRPath,
 	); err != nil {
 		return err
 	}
 	var curve cert.Curve
 	var caKey []byte
 	if !isP11 {
 		var rawCAKey []byte
-		rawCAKey, err = readInput("ca-key", *sf.caKeyPath, &claims)
+		rawCAKey, err := os.ReadFile(*sf.caKeyPath)
 		if err != nil {
 			return fmt.Errorf("error while reading ca-key: %s", err)
 		}
@@ -147,7 +121,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 			if len(passphrase) == 0 {
 				// ask for a passphrase until we get one
 				for i := 0; i < 5; i++ {
-					errOut.Write([]byte("Enter passphrase: "))
+					out.Write([]byte("Enter passphrase: "))
 					passphrase, err = pr.ReadPassword()
 					if errors.Is(err, ErrNoTerminal) {
@@ -173,7 +147,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		}
 	}
-	rawCACert, err := readInput("ca-crt", *sf.caCertPath, &claims)
+	rawCACert, err := os.ReadFile(*sf.caCertPath)
 	if err != nil {
 		return fmt.Errorf("error while reading ca-crt: %s", err)
 	}
@@ -269,13 +243,9 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		}(p11Client)
 	}
 	if fips140.Enforced() && curve == cert.Curve_CURVE25519 {
 		return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
 	}
 	if *sf.inPubPath != "" {
 		var pubCurve cert.Curve
-		rawPub, err := readInput("in-pub", *sf.inPubPath, &claims)
+		rawPub, err := os.ReadFile(*sf.inPubPath)
 		if err != nil {
 			return fmt.Errorf("error while reading in-pub: %s", err)
 		}
@@ -296,10 +266,16 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		pub, rawPriv = newKeypair(curve)
 	}
-	if !isStdio(*sf.outCertPath) {
+	if *sf.outKeyPath == "" {
-		if _, err := os.Stat(*sf.outCertPath); err == nil {
+		*sf.outKeyPath = *sf.name + ".key"
-			return fmt.Errorf("refusing to overwrite existing cert: %s", *sf.outCertPath)
+	}
-		}
+
 	if *sf.outCertPath == "" {
 		*sf.outCertPath = *sf.name + ".crt"
 	}
 	if _, err := os.Stat(*sf.outCertPath); err == nil {
 		return fmt.Errorf("refusing to overwrite existing cert: %s", *sf.outCertPath)
 	}
 	var crts []cert.Certificate
@@ -384,13 +360,11 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 	}
 	if !isP11 && *sf.inPubPath == "" {
-		if !isStdio(*sf.outKeyPath) {
+		if _, err := os.Stat(*sf.outKeyPath); err == nil {
-			if _, err := os.Stat(*sf.outKeyPath); err == nil {
+			return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
 				return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
 			}
 		}
-		err = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
+		err = os.WriteFile(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-key: %s", err)
 		}
@@ -405,7 +379,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		b = append(b, sb...)
 	}
-	err = writeOutput(*sf.outCertPath, b, 0600, out)
+	err = os.WriteFile(*sf.outCertPath, b, 0600)
 	if err != nil {
 		return fmt.Errorf("error while writing out-crt: %s", err)
 	}
@@ -416,7 +390,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 			return fmt.Errorf("error while generating qr code: %s", err)
 		}
-		err = writeOutput(*sf.outQRPath, b, 0600, out)
+		err = os.WriteFile(*sf.outQRPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-qr: %s", err)
 		}
@@ -466,7 +440,6 @@ func signSummary() string {
 func signHelp(out io.Writer) {
 	sf := newSignFlags()
 	out.Write([]byte("Usage of " + os.Args[0] + " " + signSummary() + "\n"))
 	out.Write([]byte(stdioHelpText))
 	sf.set.SetOutput(out)
 	sf.set.PrintDefaults()
 }
@@ -27,7 +27,6 @@ func Test_signHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" sign <flags>: create and sign a certificate\n"+
 			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -ca-crt string\n"+
 			"    \tOptional: path to the signing CA cert (default \"ca.crt\")\n"+
 			"  -ca-key string\n"+
@@ -377,18 +376,15 @@ func Test_signCert(t *testing.T) {
 	// test with the proper password
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.NoError(t, signCert(args, ob, eb, testpw))
-	assert.Empty(t, ob.String())
+	assert.Equal(t, "Enter passphrase: ", ob.String())
-	assert.Equal(t, "Enter passphrase: ", eb.String())
+	assert.Empty(t, eb.String())
 	// test with the proper password in the environment
 	os.Remove(crtF.Name())
 	os.Remove(keyF.Name())
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	os.Setenv("NEBULA_CA_PASSPHRASE", string(passphrase))
 	ob.Reset()
 	eb.Reset()
 	require.NoError(t, signCert(args, ob, eb, testpw))
 	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
 	os.Setenv("NEBULA_CA_PASSPHRASE", "")
@@ -399,8 +395,8 @@ func Test_signCert(t *testing.T) {
 	testpw.password = []byte("invalid password")
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.Error(t, signCert(args, ob, eb, testpw))
-	assert.Empty(t, ob.String())
+	assert.Equal(t, "Enter passphrase: ", ob.String())
-	assert.Equal(t, "Enter passphrase: ", eb.String())
+	assert.Empty(t, eb.String())
 	// test with the wrong password in environment
 	ob.Reset()
@@ -420,8 +416,8 @@ func Test_signCert(t *testing.T) {
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.Error(t, signCert(args, ob, eb, nopw))
 	// normally the user hitting enter on the prompt would add newlines between these
-	assert.Empty(t, ob.String())
+	assert.Equal(t, "Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: ", ob.String())
-	assert.Equal(t, "Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: ", eb.String())
+	assert.Empty(t, eb.String())
 	// test an error condition
 	ob.Reset()
@@ -429,106 +425,6 @@ func Test_signCert(t *testing.T) {
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.Error(t, signCert(args, ob, eb, errpw))
-	assert.Empty(t, ob.String())
+	assert.Equal(t, "Enter passphrase: ", ob.String())
 	assert.Equal(t, "Enter passphrase: ", eb.String())
 }
 func Test_signCert_stdio(t *testing.T) {
 	nopw := &StubPasswordReader{
 		password: []byte(""),
 		err:      nil,
 	}
 	caPub, caPriv, _ := ed25519.GenerateKey(rand.Reader)
 	rawCAKey := cert.MarshalSigningPrivateKeyToPEM(cert.Curve_CURVE25519, caPriv)
 	ca, _ := NewTestCaCert("ca", caPub, caPriv, time.Now(), time.Now().Add(time.Minute*200), nil, nil, nil)
 	rawCACrt, _ := ca.MarshalPEM()
 	caCrtF, err := os.CreateTemp("", "sign-cert.crt")
 	require.NoError(t, err)
 	defer os.Remove(caCrtF.Name())
 	caCrtF.Write(rawCACrt)
 	caKeyF, err := os.CreateTemp("", "sign-cert.key")
 	require.NoError(t, err)
 	defer os.Remove(caKeyF.Name())
 	caKeyF.Write(rawCAKey)
 	keyF, err := os.CreateTemp("", "sign.key")
 	require.NoError(t, err)
 	os.Remove(keyF.Name())
 	defer os.Remove(keyF.Name())
 	// ca-key on stdin, cert to stdout
 	withStdin(t, bytes.NewReader(rawCAKey))
 	ob := &bytes.Buffer{}
 	eb := &bytes.Buffer{}
 	args := []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", "-", "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", "-", "-out-key", keyF.Name(), "-duration", "100m"}
 	require.NoError(t, signCert(args, ob, eb, nopw))
 	assert.Empty(t, eb.String())
 	lCrt, _, err := cert.UnmarshalCertificateFromPEM(ob.Bytes())
 	require.NoError(t, err)
 	assert.Equal(t, "stdin-test", lCrt.Name())
 	assert.True(t, lCrt.CheckSignature(caPub))
 	// two flags reading from stdin should error before any read attempt;
 	// otherwise an interactive shell would hang on io.ReadAll
 	stdinIn := bytes.NewReader(rawCAKey)
 	withStdin(t, stdinIn)
 	ob.Reset()
 	eb.Reset()
 	args = []string{"-version", "1", "-ca-crt", "-", "-ca-key", "-", "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", "nope", "-out-key", "nope", "-duration", "100m"}
 	require.EqualError(t, signCert(args, ob, eb, nopw),
 		`-ca-key and -ca-crt both set to "-", only one input may read from stdin`)
 	assert.Equal(t, len(rawCAKey), stdinIn.Len(), "stdin should be untouched when conflict is caught up front")
 	// two flags writing to stdout should error before any output is written
 	// AND before stdin is consumed
 	stdinR := bytes.NewReader(rawCAKey)
 	withStdin(t, stdinR)
 	ob.Reset()
 	eb.Reset()
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", "-", "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", "-", "-out-key", "-", "-duration", "100m"}
 	require.EqualError(t, signCert(args, ob, eb, nopw),
 		`-out-key and -out-crt both set to "-", only one output may write to stdout`)
 	assert.Empty(t, ob.String())
 	// stdin should be untouched because the conflict was caught up front
 	assert.Equal(t, len(rawCAKey), stdinR.Len())
 	// out-key on stdout, cert on disk
 	keyF2, err := os.CreateTemp("", "sign.key")
 	require.NoError(t, err)
 	os.Remove(keyF2.Name())
 	defer os.Remove(keyF2.Name())
 	crtF, err := os.CreateTemp("", "sign.crt")
 	require.NoError(t, err)
 	os.Remove(crtF.Name())
 	defer os.Remove(crtF.Name())
 	ob.Reset()
 	eb.Reset()
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", "-", "-duration", "100m"}
 	require.NoError(t, signCert(args, ob, eb, nopw))
 	assert.Empty(t, eb.String())
 	_, _, curve, err := cert.UnmarshalPrivateKeyFromPEM(ob.Bytes())
 	require.NoError(t, err)
 	assert.Equal(t, cert.Curve_CURVE25519, curve)
 	// in-pub on stdin (caller already has a keypair, only the cert is generated)
 	inPub, _ := x25519Keypair()
 	rawInPub := cert.MarshalPublicKeyToPEM(cert.Curve_CURVE25519, inPub)
 	withStdin(t, bytes.NewReader(rawInPub))
 	os.Remove(crtF.Name())
 	ob.Reset()
 	eb.Reset()
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "in-pub-test", "-ip", "1.1.1.1/24", "-in-pub", "-", "-out-crt", "-", "-duration", "100m"}
 	require.NoError(t, signCert(args, ob, eb, nopw))
 	assert.Empty(t, eb.String())
 	stdinCrt, _, err := cert.UnmarshalCertificateFromPEM(ob.Bytes())
 	require.NoError(t, err)
 	assert.Equal(t, "in-pub-test", stdinCrt.Name())
 	assert.Equal(t, inPub, stdinCrt.PublicKey())
 }
@@ -1,117 +0,0 @@
 package main
 import (
 	"fmt"
 	"io"
 	"os"
 )
 // stdioPath is the special path value that selects stdin (for inputs) or
 // stdout (for outputs) instead of a file on disk.
 const stdioPath = "-"
 // stdioHelpText is rendered just under the Usage line of each subcommand
 // help so the - convention is documented once instead of on every flag.
 const stdioHelpText = "  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"
 // stdinReader is the source used when an input flag is set to "-".
 // It is a package level var so tests can swap in a deterministic reader.
 // Tests that mutate stdinReader cannot run with t.Parallel().
 var stdinReader io.Reader = os.Stdin
 // ioClaims tracks which flags have claimed stdin and stdout during a single
 // command invocation so we can refuse a second flag asking for the same
 // stream.
 type ioClaims struct {
 	in  string
 	out string
 }
 func (c *ioClaims) claimIn(flagName string) error {
 	if c.in != "" && c.in != flagName {
 		return fmt.Errorf("-%s and -%s both set to %q, only one input may read from stdin", c.in, flagName, stdioPath)
 	}
 	c.in = flagName
 	return nil
 }
 func (c *ioClaims) claimOut(flagName string) error {
 	if c.out != "" && c.out != flagName {
 		return fmt.Errorf("-%s and -%s both set to %q, only one output may write to stdout", c.out, flagName, stdioPath)
 	}
 	c.out = flagName
 	return nil
 }
 // reserveInputs walks alternating (flagName, path) pairs and claims stdin
 // for any path equal to stdioPath. It must be called before any input is
 // read so a conflict can be reported immediately instead of blocking on
 // io.ReadAll while waiting for input that will never arrive.
 func reserveInputs(claims *ioClaims, pairs ...string) error {
 	return reserveStdio(claims, "reserveInputs", (*ioClaims).claimIn, pairs)
 }
 // reserveOutputs walks alternating (flagName, path) pairs and claims stdout
 // for any path equal to stdioPath. It must be called before any output is
 // written so a conflict cannot leave one stream half written before the
 // second flag fails.
 func reserveOutputs(claims *ioClaims, pairs ...string) error {
 	return reserveStdio(claims, "reserveOutputs", (*ioClaims).claimOut, pairs)
 }
 func reserveStdio(claims *ioClaims, who string, claim func(*ioClaims, string) error, pairs []string) error {
 	if len(pairs)%2 != 0 {
 		panic(who + " requires alternating name, path pairs")
 	}
 	for i := 0; i < len(pairs); i += 2 {
 		name, path := pairs[i], pairs[i+1]
 		if path != stdioPath {
 			continue
 		}
 		if err := claim(claims, name); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 // readInput returns the bytes referenced by path, reading from stdin when
 // path is stdioPath.
 func readInput(flagName, path string, claims *ioClaims) ([]byte, error) {
 	if path == stdioPath {
 		if err := claims.claimIn(flagName); err != nil {
 			return nil, err
 		}
 		return io.ReadAll(stdinReader)
 	}
 	return os.ReadFile(path)
 }
 // openInput returns a reader for path. When path is stdioPath the returned
 // reader wraps stdin and Close is a no-op.
 func openInput(flagName, path string, claims *ioClaims) (io.ReadCloser, error) {
 	if path == stdioPath {
 		if err := claims.claimIn(flagName); err != nil {
 			return nil, err
 		}
 		return io.NopCloser(stdinReader), nil
 	}
 	return os.Open(path)
 }
 // writeOutput writes data to path, or to stdout when path is stdioPath. perm
 // is only used for file output. The caller must have already claimed stdout
 // via reserveOutputs before invoking with stdioPath.
 func writeOutput(path string, data []byte, perm os.FileMode, stdout io.Writer) error {
 	if path == stdioPath {
 		_, err := stdout.Write(data)
 		return err
 	}
 	return os.WriteFile(path, data, perm)
 }
 // isStdio reports whether path is the stdio sentinel and so should skip
 // existence checks like "refuse to overwrite".
 func isStdio(path string) bool {
 	return path == stdioPath
 }
@@ -1,167 +0,0 @@
 package main
 import (
 	"bytes"
 	"io"
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // withStdin temporarily replaces stdinReader for the duration of t.
 func withStdin(t *testing.T, r io.Reader) {
 	t.Helper()
 	prev := stdinReader
 	stdinReader = r
 	t.Cleanup(func() { stdinReader = prev })
 }
 func Test_readInput_stdin(t *testing.T) {
 	withStdin(t, bytes.NewBufferString("hello"))
 	var claims ioClaims
 	got, err := readInput("path", "-", &claims)
 	require.NoError(t, err)
 	assert.Equal(t, []byte("hello"), got)
 	assert.Equal(t, "path", claims.in)
 }
 func Test_readInput_file(t *testing.T) {
 	dir := t.TempDir()
 	p := filepath.Join(dir, "f")
 	require.NoError(t, os.WriteFile(p, []byte("file"), 0600))
 	var claims ioClaims
 	got, err := readInput("path", p, &claims)
 	require.NoError(t, err)
 	assert.Equal(t, []byte("file"), got)
 	assert.Empty(t, claims.in)
 }
 func Test_readInput_doubleStdinErrors(t *testing.T) {
 	withStdin(t, bytes.NewBufferString("hello"))
 	var claims ioClaims
 	_, err := readInput("ca-key", "-", &claims)
 	require.NoError(t, err)
 	_, err = readInput("ca-crt", "-", &claims)
 	require.EqualError(t, err, `-ca-key and -ca-crt both set to "-", only one input may read from stdin`)
 }
 func Test_openInput_stdin(t *testing.T) {
 	withStdin(t, bytes.NewBufferString("hi"))
 	var claims ioClaims
 	r, err := openInput("ca", "-", &claims)
 	require.NoError(t, err)
 	defer r.Close()
 	b, err := io.ReadAll(r)
 	require.NoError(t, err)
 	assert.Equal(t, []byte("hi"), b)
 }
 func Test_openInput_doubleStdinErrors(t *testing.T) {
 	withStdin(t, bytes.NewBufferString("hi"))
 	var claims ioClaims
 	r, err := openInput("ca", "-", &claims)
 	require.NoError(t, err)
 	r.Close()
 	_, err = openInput("crt", "-", &claims)
 	require.EqualError(t, err, `-ca and -crt both set to "-", only one input may read from stdin`)
 }
 func Test_writeOutput_stdout(t *testing.T) {
 	out := &bytes.Buffer{}
 	err := writeOutput("-", []byte("payload"), 0600, out)
 	require.NoError(t, err)
 	assert.Equal(t, "payload", out.String())
 }
 func Test_writeOutput_file(t *testing.T) {
 	dir := t.TempDir()
 	p := filepath.Join(dir, "f")
 	out := &bytes.Buffer{}
 	err := writeOutput(p, []byte("payload"), 0600, out)
 	require.NoError(t, err)
 	assert.Empty(t, out.String())
 	got, err := os.ReadFile(p)
 	require.NoError(t, err)
 	assert.Equal(t, []byte("payload"), got)
 }
 func Test_reserveOutputs_noConflict(t *testing.T) {
 	var claims ioClaims
 	require.NoError(t, reserveOutputs(&claims,
 		"out-key", "/tmp/key",
 		"out-crt", "-",
 		"out-qr", "",
 	))
 	assert.Equal(t, "out-crt", claims.out)
 }
 func Test_reserveOutputs_conflict(t *testing.T) {
 	var claims ioClaims
 	err := reserveOutputs(&claims,
 		"out-key", "-",
 		"out-crt", "-",
 	)
 	require.EqualError(t, err, `-out-key and -out-crt both set to "-", only one output may write to stdout`)
 }
 func Test_reserveOutputs_panicsOnOddPairs(t *testing.T) {
 	defer func() {
 		r := recover()
 		require.NotNil(t, r)
 	}()
 	var claims ioClaims
 	_ = reserveOutputs(&claims, "out-key")
 }
 func Test_reserveInputs_noConflict(t *testing.T) {
 	var claims ioClaims
 	require.NoError(t, reserveInputs(&claims,
 		"ca-key", "/tmp/ca.key",
 		"ca-crt", "-",
 		"in-pub", "",
 	))
 	assert.Equal(t, "ca-crt", claims.in)
 }
 func Test_reserveInputs_conflict(t *testing.T) {
 	var claims ioClaims
 	err := reserveInputs(&claims,
 		"ca-key", "-",
 		"ca-crt", "-",
 	)
 	require.EqualError(t, err, `-ca-key and -ca-crt both set to "-", only one input may read from stdin`)
 }
 func Test_claimIn_idempotent(t *testing.T) {
 	// pre-claim then a lazy re-claim of the same flag should be a no-op
 	var claims ioClaims
 	require.NoError(t, claims.claimIn("ca-key"))
 	require.NoError(t, claims.claimIn("ca-key"))
 	assert.Equal(t, "ca-key", claims.in)
 }
 func Test_claimOut_idempotent(t *testing.T) {
 	var claims ioClaims
 	require.NoError(t, claims.claimOut("out-crt"))
 	require.NoError(t, claims.claimOut("out-crt"))
 	assert.Equal(t, "out-crt", claims.out)
 }
 func Test_isStdio(t *testing.T) {
 	assert.True(t, isStdio("-"))
 	assert.False(t, isStdio(""))
 	assert.False(t, isStdio("./-"))
 	assert.False(t, isStdio("foo"))
 }
@@ -39,26 +39,18 @@ func verify(args []string, out io.Writer, errOut io.Writer) error {
 		return err
 	}
-	var claims ioClaims
+	caFile, err := os.Open(*vf.caPath)
 	if err := reserveInputs(&claims,
 		"ca", *vf.caPath,
 		"crt", *vf.certPath,
 	); err != nil {
 		return err
 	}
 	caReader, err := openInput("ca", *vf.caPath, &claims)
 	if err != nil {
 		return fmt.Errorf("error while reading ca: %w", err)
 	}
-	defer caReader.Close()
+	defer caFile.Close()
-	caPool, err := cert.NewCAPoolFromPEMReader(caReader)
+	caPool, err := cert.NewCAPoolFromPEMReader(caFile)
 	if err != nil && !errors.Is(err, cert.ErrExpired) {
 		return fmt.Errorf("error while adding ca cert to pool: %w", err)
 	}
-	rawCert, err := readInput("crt", *vf.certPath, &claims)
+	rawCert, err := os.ReadFile(*vf.certPath)
 	if err != nil {
 		return fmt.Errorf("unable to read crt: %w", err)
 	}
@@ -93,7 +85,6 @@ func verifySummary() string {
 func verifyHelp(out io.Writer) {
 	vf := newVerifyFlags()
 	_, _ = out.Write([]byte("Usage of " + os.Args[0] + " " + verifySummary() + "\n"))
 	_, _ = out.Write([]byte(stdioHelpText))
 	vf.set.SetOutput(out)
 	vf.set.PrintDefaults()
 }
@@ -23,7 +23,6 @@ func Test_verifyHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" verify <flags>: verifies a certificate isn't expired and was signed by a trusted authority.\n"+
 			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -ca string\n"+
 			"    \tRequired: path to a file containing one or more ca certificates\n"+
 			"  -crt string\n"+
@@ -123,46 +122,3 @@ func Test_verify(t *testing.T) {
 	assert.Empty(t, eb.String())
 	require.NoError(t, err)
 }
 func Test_verify_stdio(t *testing.T) {
 	ob := &bytes.Buffer{}
 	eb := &bytes.Buffer{}
 	caPub, caPriv, _ := ed25519.GenerateKey(rand.Reader)
 	ca, _ := NewTestCaCert("test-ca", caPub, caPriv, time.Now().Add(time.Hour*-1), time.Now().Add(time.Hour*2), nil, nil, nil)
 	caPEM, _ := ca.MarshalPEM()
 	crt, _ := NewTestCert(ca, caPriv, "test-cert", time.Now().Add(time.Hour*-1), time.Now().Add(time.Hour), nil, nil, nil)
 	crtPEM, _ := crt.MarshalPEM()
 	caFile, err := os.CreateTemp("", "verify-ca")
 	require.NoError(t, err)
 	defer os.Remove(caFile.Name())
 	caFile.Write(caPEM)
 	// crt on stdin, ca on disk
 	withStdin(t, bytes.NewReader(crtPEM))
 	require.NoError(t, verify([]string{"-ca", caFile.Name(), "-crt", "-"}, ob, eb))
 	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
 	// ca on stdin, crt on disk
 	certFile, err := os.CreateTemp("", "verify-cert")
 	require.NoError(t, err)
 	defer os.Remove(certFile.Name())
 	certFile.Write(crtPEM)
 	withStdin(t, bytes.NewReader(caPEM))
 	ob.Reset()
 	eb.Reset()
 	require.NoError(t, verify([]string{"-ca", "-", "-crt", certFile.Name()}, ob, eb))
 	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
 	// both flags on stdin should error
 	withStdin(t, bytes.NewReader(caPEM))
 	ob.Reset()
 	eb.Reset()
 	require.EqualError(t, verify([]string{"-ca", "-", "-crt", "-"}, ob, eb),
 		`-ca and -crt both set to "-", only one input may read from stdin`)
 }
@@ -1,5 +0,0 @@
 //go:build fips140enforce
 //go:debug fips140=only
 package main
@@ -3,15 +3,8 @@
 package main
-import (
+import "github.com/sirupsen/logrus"
 	"log/slog"
 	"os"
-	"github.com/slackhq/nebula/logging"
+func HookLogger(l *logrus.Logger) {
-)
+	// Do nothing, let the logs flow to stdout/stderr
 // newPlatformLogger returns a *slog.Logger that writes to stdout. Non-Windows
 // platforms have no special sink to integrate with.
 func newPlatformLogger() *slog.Logger {
 	return logging.NewLogger(os.Stdout)
 }
@@ -1,86 +1,54 @@
 package main
 import (
-	"context"
+	"fmt"
-	"log/slog"
+	"io/ioutil"
-	"strings"
+	"os"
 	"sync"
-	"github.com/slackhq/nebula/logging"
+	"github.com/kardianos/service"
 	"github.com/sirupsen/logrus"
 )
-// newPlatformLogger returns a *slog.Logger that routes every log record
+// HookLogger routes the logrus logs through the service logger so that they end up in the Windows Event Viewer
-// through the Windows service logger so records end up in the Windows
+// logrus output will be discarded
-// Event Log. All the heavy lifting (level management, format swap,
+func HookLogger(l *logrus.Logger) {
-// timestamp toggle, WithAttrs/WithGroup) comes from logging.NewHandler;
+	l.AddHook(newLogHook(logger))
-// this file only contributes:
+	l.SetOutput(ioutil.Discard)
 //
 //   - an io.Writer that forwards each formatted line to the service
 //     logger at the current record's Event Log severity, and
 //   - a thin severityTag that embeds *logging.Handler and overrides
 //     only Handle / WithAttrs / WithGroup, so Event Viewer's severity
 //     column and severity-based filters keep working the way they did
 //     before the slog migration.
 //
 // Format (text vs json) is carried by the embedded *logging.Handler, so
 // logging.format: json in config still produces JSON lines in Event
 // Viewer, same as the pre-slog logrus setup.
 func newPlatformLogger() *slog.Logger {
 	w := &eventLogWriter{}
 	return slog.New(&severityTag{Handler: logging.NewHandler(w), w: w})
 }
-// eventLogWriter forwards slog-formatted lines to the Windows service
+type logHook struct {
-// logger at the severity most recently stashed by severityTag.Handle.
+	sl service.Logger
 // The mutex serializes the stash + inner.Handle + Write cycle per record
 // across all concurrent goroutines; slog's builtin text/json handlers
 // each hold their own mutex around Write, but that only protects the
 // Write call itself, not our stash-then-handle sequence.
 type eventLogWriter struct {
 	mu    sync.Mutex
 	level slog.Level
 }
-func (w *eventLogWriter) Write(p []byte) (int, error) {
+func newLogHook(sl service.Logger) *logHook {
-	line := strings.TrimRight(string(p), "\n")
+	return &logHook{sl: sl}
-	switch {
+}
-	case w.level >= slog.LevelError:
+
-		return len(p), logger.Error(line)
+func (h *logHook) Fire(entry *logrus.Entry) error {
-	case w.level >= slog.LevelWarn:
+	line, err := entry.String()
-		return len(p), logger.Warning(line)
+	if err != nil {
 		fmt.Fprintf(os.Stderr, "Unable to read entry, %v", err)
 		return err
 	}
 	switch entry.Level {
 	case logrus.PanicLevel:
 		return h.sl.Error(line)
 	case logrus.FatalLevel:
 		return h.sl.Error(line)
 	case logrus.ErrorLevel:
 		return h.sl.Error(line)
 	case logrus.WarnLevel:
 		return h.sl.Warning(line)
 	case logrus.InfoLevel:
 		return h.sl.Info(line)
 	case logrus.DebugLevel:
 		return h.sl.Info(line)
 	default:
-		return len(p), logger.Info(line)
+		return nil
 	}
 }
-// severityTag embeds *logging.Handler to pick up everything it does for
+func (h *logHook) Levels() []logrus.Level {
-// free (Enabled, SetLevel, GetLevel, SetFormat, GetFormat,
+	return logrus.AllLevels
 // SetDisableTimestamp) and overrides only Handle / WithAttrs / WithGroup
 // so each record's slog.Level is stashed on the writer before formatting
 // and so derived handlers stay wrapped as severityTag rather than
 // downgrading to bare *logging.Handler.
 type severityTag struct {
 	*logging.Handler
 	w *eventLogWriter
 }
 func (s *severityTag) Handle(ctx context.Context, r slog.Record) error {
 	s.w.mu.Lock()
 	defer s.w.mu.Unlock()
 	s.w.level = r.Level
 	return s.Handler.Handle(ctx, r)
 }
 func (s *severityTag) WithAttrs(attrs []slog.Attr) slog.Handler {
 	if len(attrs) == 0 {
 		return s
 	}
 	return &severityTag{Handler: s.Handler.WithAttrs(attrs).(*logging.Handler), w: s.w}
 }
 func (s *severityTag) WithGroup(name string) slog.Handler {
 	if name == "" {
 		return s
 	}
 	return &severityTag{Handler: s.Handler.WithGroup(name).(*logging.Handler), w: s.w}
 }
@@ -7,9 +7,9 @@ import (
 	"runtime/debug"
 	"strings"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/logging"
 	"github.com/slackhq/nebula/util"
 )
@@ -50,30 +50,20 @@ func main() {
 		os.Exit(0)
 	}
 	l := logging.NewLogger(os.Stdout)
 	if *serviceFlag != "" {
-		if *configTest {
+		doService(configPath, configTest, Build, serviceFlag)
-			fmt.Println("-test is not supported with -service, run the config test without -service")
+		os.Exit(1)
 			os.Exit(1)
 		}
 		if err := doService(configPath, Build, serviceFlag); err != nil {
 			l.Error("Service command failed", "error", err)
 			os.Exit(1)
 		}
 		return
 	}
 	if *configPath == "" {
-		p, err := config.DefaultPath()
+		fmt.Println("-config flag must be set")
-		if err != nil {
+		flag.Usage()
-			fmt.Println(err)
+		os.Exit(1)
 			os.Exit(1)
 		}
 		*configPath = p
 	}
 	l := logrus.New()
 	l.Out = os.Stdout
 	c := config.NewC(l)
 	err := c.Load(*configPath)
 	if err != nil {
@@ -81,16 +71,6 @@ func main() {
 		os.Exit(1)
 	}
 	if err := logging.ApplyConfig(l, c); err != nil {
 		fmt.Printf("failed to apply logging config: %s", err)
 		os.Exit(1)
 	}
 	c.RegisterReloadCallback(func(c *config.C) {
 		if err := logging.ApplyConfig(l, c); err != nil {
 			l.Error("Failed to reconfigure logger on reload", "error", err)
 		}
 	})
 	ctrl, err := nebula.Main(c, *configTest, Build, l, nil)
 	if err != nil {
 		util.LogWithContextIfNeeded("Failed to start", err, l)
@@ -98,15 +78,16 @@ func main() {
 	}
 	if !*configTest {
-		if err := ctrl.Start(); err != nil {
+		wait, err := ctrl.Start()
 		if err != nil {
 			util.LogWithContextIfNeeded("Error while running", err, l)
 			os.Exit(1)
 		}
 		go ctrl.ShutdownBlock()
-		if err := ctrl.Wait(); err != nil {
+		if err := wait(); err != nil {
-			l.Error("Nebula stopped due to fatal error", "error", err)
+			l.WithError(err).Error("Nebula stopped due to fatal error")
 			os.Exit(2)
 		}
@@ -4,17 +4,19 @@ import (
 	"fmt"
 	"log"
 	"os"
 	"path/filepath"
 	"github.com/kardianos/service"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/logging"
 )
 var logger service.Logger
 type program struct {
 	configPath *string
 	configTest *bool
 	build      string
 	control    *nebula.Control
 }
@@ -23,7 +25,8 @@ func (p *program) Start(s service.Service) error {
 	// Start should not block.
 	logger.Info("Nebula service starting.")
-	l := newPlatformLogger()
+	l := logrus.New()
 	HookLogger(l)
 	c := config.NewC(l)
 	err := c.Load(*p.configPath)
@@ -31,56 +34,39 @@ func (p *program) Start(s service.Service) error {
 		return fmt.Errorf("failed to load config: %s", err)
 	}
-	if err := logging.ApplyConfig(l, c); err != nil {
+	p.control, err = nebula.Main(c, *p.configTest, Build, l, nil)
 		return fmt.Errorf("failed to apply logging config: %s", err)
 	}
 	c.RegisterReloadCallback(func(c *config.C) {
 		if err := logging.ApplyConfig(l, c); err != nil {
 			l.Error("Failed to reconfigure logger on reload", "error", err)
 		}
 	})
 	p.control, err = nebula.Main(c, false, Build, l, nil)
 	if err != nil {
 		return err
 	}
-	if err := p.control.Start(); err != nil {
+	p.control.Start()
 		return err
 	}
 	// Nebula can stop itself on a fatal packet reader error, make sure to log it if it happens.
 	go func() {
 		if err := p.control.Wait(); err != nil {
 			logger.Error(fmt.Sprintf("Nebula stopped due to fatal error: %v", err))
 			os.Exit(2)
 		}
 	}()
 	return nil
 }
 func (p *program) Stop(s service.Service) error {
 	logger.Info("Nebula service stopping.")
 	if p.control == nil {
 		return nil
 	}
 	p.control.Stop()
 	// block until nebula has fully drained before reporting stopped.
 	// error logging is handled by Start.
 	_ = p.control.Wait()
 	return nil
 }
-func doService(configPath *string, build string, serviceFlag *string) error {
+func fileExists(filename string) bool {
 	_, err := os.Stat(filename)
 	if os.IsNotExist(err) {
 		return false
 	}
 	return true
 }
 func doService(configPath *string, configTest *bool, build string, serviceFlag *string) {
 	if *configPath == "" {
-		p, err := config.DefaultPath()
+		ex, err := os.Executable()
 		if err != nil {
-			return err
+			panic(err)
 		}
 		*configPath = filepath.Dir(ex) + "/config.yaml"
 		if !fileExists(*configPath) {
 			*configPath = filepath.Dir(ex) + "/config.yml"
 		}
 		*configPath = p
 	}
 	svcConfig := &service.Config{
@@ -92,22 +78,23 @@ func doService(configPath *string, build string, serviceFlag *string) error {
 	prg := &program{
 		configPath: configPath,
 		configTest: configTest,
 		build:      build,
 	}
 	// Here are what the different loggers are doing:
 	// - `log` is the standard go log utility, meant to be used while the process is still attached to stdout/stderr
 	// - `logger` is the service log utility that may be attached to a special place depending on OS (Windows will have it attached to the event log)
-	// - in program.Start we build a *slog.Logger via newPlatformLogger; on non-Windows that is a stdout-backed slog logger, on Windows it routes records through the service logger
+	// - above, in `Run` we create a `logrus.Logger` which is what nebula expects to use
 	s, err := service.New(prg, svcConfig)
 	if err != nil {
-		return err
+		log.Fatal(err)
 	}
 	errs := make(chan error, 5)
 	logger, err = s.Logger(errs)
 	if err != nil {
-		return err
+		log.Fatal(err)
 	}
 	go func() {
@@ -122,17 +109,18 @@ func doService(configPath *string, build string, serviceFlag *string) error {
 	switch *serviceFlag {
 	case "run":
-		if err := s.Run(); err != nil {
+		err = s.Run()
-			// Route any errors to the system logger and report the failure
+		if err != nil {
 			// Route any errors to the system logger
 			logger.Error(err)
 			return err
 		}
 	default:
-		if err := service.Control(s, *serviceFlag); err != nil {
+		err := service.Control(s, *serviceFlag)
 		if err != nil {
 			log.Printf("Valid actions: %q\n", service.ControlAction)
-			return err
+			log.Fatal(err)
 		}
 		return
 	}
 	return nil
 }
@@ -1,96 +0,0 @@
 //go:build linux && !android && !e2e_testing
 package main
 import (
 	"fmt"
 	"net/netip"
 	"os"
 	"path/filepath"
 	"runtime"
 	"testing"
 	"time"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	cert_test "github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/require"
 )
 // TestControlStopClosesOnTimer reproduces the dnclient lifecycle: nebula runs as
 // a library, and on a config update dnclient calls Stop() in-process to tear the
 // old instance down before starting a new one. This boots a real nebula (real
 // blocking UDP sockets, tun disabled), lets it run, then Stop()s it on a timer
 // and asserts it actually closes. If the reader goroutines parked in recvmmsg
 // don't wake on Close(), Wait() blocks forever and this fails with a goroutine
 // dump instead of relying on a process signal to unstick them.
 func TestControlStopClosesOnTimer(t *testing.T) {
 	l := test.NewLogger()
 	dir := t.TempDir()
 	before := time.Now().Add(-time.Hour)
 	after := time.Now().Add(time.Hour)
 	ca, _, caKey, caPEM := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, before, after, nil, nil, nil)
 	networks := []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")}
 	_, _, keyPEM, certPEM := cert_test.NewTestCert(cert.Version2, cert.Curve_CURVE25519, ca, caKey, "close-on-timer", before, after, networks, nil, nil)
 	caPath := filepath.Join(dir, "ca.pem")
 	certPath := filepath.Join(dir, "cert.pem")
 	keyPath := filepath.Join(dir, "key.pem")
 	require.NoError(t, os.WriteFile(caPath, caPEM, 0o600))
 	require.NoError(t, os.WriteFile(certPath, certPEM, 0o600))
 	require.NoError(t, os.WriteFile(keyPath, keyPEM, 0o600))
 	// tun disabled so no device/root is needed; routines: 2 so we exercise the
 	// multi-socket (SO_REUSEPORT) teardown, which is where dnclient runs.
 	configBody := fmt.Sprintf(`
 pki:
  ca: %s
  cert: %s
  key: %s
 listen:
  host: 127.0.0.1
  port: 0
 tun:
  disabled: true
 firewall:
  outbound:
    - port: any
      proto: any
      host: any
  inbound:
    - port: any
      proto: any
      host: any
 routines: 2
 `, caPath, certPath, keyPath)
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yml"), []byte(configBody), 0o600))
 	c := config.NewC(l)
 	require.NoError(t, c.Load(dir))
 	ctrl, err := nebula.Main(c, false, "close-on-timer", l, nil)
 	require.NoError(t, err)
 	require.NoError(t, ctrl.Start())
 	// Run like a live nebula, then close on a timer, exactly as dnclient does.
 	<-time.NewTimer(5 * time.Second).C
 	stopped := make(chan struct{})
 	go func() {
 		ctrl.Stop() // closes the udp sockets (shutdown(2)) and the tun
 		ctrl.Wait() // blocks until every reader goroutine has returned
 		close(stopped)
 	}()
 	select {
 	case <-stopped:
 		t.Log("nebula closed cleanly on timer")
 	case <-time.After(10 * time.Second):
 		buf := make([]byte, 1<<20)
 		n := runtime.Stack(buf, true)
 		t.Fatalf("nebula did NOT close within 10s of Stop(): a blocking reader never woke\n%s", buf[:n])
 	}
 }
@@ -1,131 +0,0 @@
 package main
 import (
 	"errors"
 	"flag"
 	"fmt"
 	"io/fs"
 	"log/slog"
 	"os"
 	"syscall"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/diag"
 )
 // ctlMain implements `nebula ctl <command> [args...]`, which runs a debug command against the
 // nebula already running on this host. Everything after the command name is forwarded to that
 // nebula verbatim and parsed there by the same flag sets the ssh console uses, so this side
 // deliberately understands as little as possible about it.
 //
 // Returns the process exit status.
 func ctlMain(argv []string) int {
 	fl := flag.NewFlagSet("nebula ctl", flag.ContinueOnError)
 	fl.Usage = func() {
 		out := fl.Output()
 		fmt.Fprintf(out, "Usage: nebula ctl [-config path] [-socket path] <command> [arguments]\n\n")
 		fmt.Fprintf(out, "Runs a debug command against the running nebula on this host, over its local\n")
 		fmt.Fprintf(out, "control socket. Run `nebula ctl` with no command for the list of commands.\n\n")
 		fl.PrintDefaults()
 	}
 	socket := fl.String("socket", "", "Path to the control socket. Overrides ctl.socket from the config")
 	configPath := fl.String("config", "", "Path to the nebula config, read only to find ctl.socket")
 	// The flag package stops at the first non-flag argument, which is exactly the behaviour
 	// wanted here: `nebula ctl -socket /x list-hostmap -json` consumes -socket, stops at
 	// list-hostmap, and leaves the rest untouched for the daemon to parse.
 	if err := fl.Parse(argv); err != nil {
 		// -h is a request, not a failure.
 		if errors.Is(err, flag.ErrHelp) {
 			return diag.StatusOK
 		}
 		return diag.StatusUsage
 	}
 	path := *socket
 	if path == "" {
 		path = ctlSocketPath(*configPath)
 	}
 	if path == "" {
 		fmt.Fprintln(os.Stderr, "nebula ctl: no control socket path is known for this platform, set ctl.socket in the config")
 		return diag.StatusError
 	}
 	client, err := diag.Dial(path)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, ctlDialError(path, err))
 		return diag.StatusError
 	}
 	defer client.Close()
 	args := fl.Args()
 	status, err := client.Run(args, os.Stdout)
 	if err != nil {
 		if errors.Is(err, diag.ErrTruncated) {
 			fmt.Fprintf(os.Stderr, "nebula ctl: nebula closed the connection before %s finished\n", ctlCommandName(args))
 			return diag.StatusError
 		}
 		fmt.Fprintf(os.Stderr, "nebula ctl: %s\n", err)
 		if status == diag.StatusOK {
 			return diag.StatusError
 		}
 	}
 	return status
 }
 // ctlSocketPath finds the socket to talk to. The platform default is the primary mechanism;
 // reading the config is the refinement for someone who moved the socket. It is best effort by
 // design, because config.DefaultPath resolves next to the nebula binary and a packaged install
 // keeps its config somewhere else entirely, so a config we cannot find is the normal case
 // rather than a failure.
 func ctlSocketPath(configPath string) string {
 	if configPath == "" {
 		p, err := config.DefaultPath()
 		if err != nil {
 			return diag.DefaultSocketPath()
 		}
 		configPath = p
 	}
 	c := config.NewC(slog.New(slog.DiscardHandler))
 	if err := c.Load(configPath); err != nil {
 		return diag.DefaultSocketPath()
 	}
 	return c.GetString("ctl.socket", diag.DefaultSocketPath())
 }
 // ctlDialError turns a connect failure into something an operator can act on. These messages
 // are the entire user experience when things are not working, so they name the path and say
 // what to check.
 func ctlDialError(path string, err error) string {
 	switch {
 	case errors.Is(err, diag.ErrNotSupported):
 		return "nebula ctl is not supported on this platform yet"
 	case errors.Is(err, fs.ErrNotExist):
 		return fmt.Sprintf("nebula ctl: no control socket at %s. Is nebula running? Is ctl.enabled set to false, or ctl.socket set to another path?", path)
 	case errors.Is(err, syscall.ECONNREFUSED):
 		return fmt.Sprintf("nebula ctl: found a stale socket at %s, nebula is not listening on it", path)
 	case errors.Is(err, fs.ErrPermission):
 		return fmt.Sprintf("nebula ctl: permission denied opening %s. nebula ctl must run as the user nebula runs as, usually root", path)
 	default:
 		return fmt.Sprintf("nebula ctl: %s", err)
 	}
 }
 // ctlCommandName names the command for an error message, for the case where there isn't one.
 func ctlCommandName(args []string) string {
 	if len(args) == 0 {
 		return "the command"
 	}
 	return args[0]
 }
@@ -1,70 +0,0 @@
 package main
 import (
 	"errors"
 	"io/fs"
 	"os"
 	"path/filepath"
 	"syscall"
 	"testing"
 	"github.com/slackhq/nebula/diag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // The daemon parses the command's own flags, so this side must consume its own and forward
 // everything from the command name onwards untouched.
 func TestCtlSocketPath(t *testing.T) {
 	t.Run("a config naming a socket is used", func(t *testing.T) {
 		dir := t.TempDir()
 		path := filepath.Join(dir, "config.yml")
 		require.NoError(t, os.WriteFile(path, []byte("ctl:\n  socket: /run/somewhere/ctl.sock\n"), 0600))
 		assert.Equal(t, "/run/somewhere/ctl.sock", ctlSocketPath(path))
 	})
 	t.Run("a config without a ctl block falls back to the platform default", func(t *testing.T) {
 		dir := t.TempDir()
 		path := filepath.Join(dir, "config.yml")
 		require.NoError(t, os.WriteFile(path, []byte("pki:\n  ca: /dev/null\n"), 0600))
 		assert.Equal(t, diag.DefaultSocketPath(), ctlSocketPath(path))
 	})
 	// A packaged install keeps its config somewhere config.DefaultPath will never look, so a
 	// config we cannot read is the ordinary case and must not be fatal.
 	t.Run("an unreadable config falls back to the platform default", func(t *testing.T) {
 		assert.Equal(t, diag.DefaultSocketPath(), ctlSocketPath(filepath.Join(t.TempDir(), "nope.yml")))
 	})
 }
 func TestCtlDialError(t *testing.T) {
 	tests := []struct {
 		name  string
 		err   error
 		wants string
 	}{
 		{"missing socket names the path and what to check", fs.ErrNotExist, "no control socket at /x/ctl.sock. Is nebula running?"},
 		{"a stale socket is called stale", syscall.ECONNREFUSED, "found a stale socket at /x/ctl.sock"},
 		{"permission denied suggests the right user", fs.ErrPermission, "must run as the user nebula runs as"},
 		{"an unsupported platform says so", diag.ErrNotSupported, "not supported on this platform"},
 		{"anything else is reported verbatim", errors.New("something else"), "something else"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert.Contains(t, ctlDialError("/x/ctl.sock", tt.err), tt.wants)
 		})
 	}
 	t.Run("a wrapped syscall error is still recognised", func(t *testing.T) {
 		err := &os.SyscallError{Syscall: "connect", Err: syscall.ECONNREFUSED}
 		assert.Contains(t, ctlDialError("/x/ctl.sock", err), "stale socket")
 	})
 }
 func TestCtlCommandName(t *testing.T) {
 	assert.Equal(t, "print-cert", ctlCommandName([]string{"print-cert", "-json"}))
 	assert.Equal(t, "the command", ctlCommandName(nil))
 }
@@ -1,5 +0,0 @@
 //go:build fips140enforce
 //go:debug fips140=only
 package main
@@ -7,9 +7,9 @@ import (
 	"runtime/debug"
 	"strings"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/logging"
 	"github.com/slackhq/nebula/util"
 )
@@ -32,26 +32,11 @@ func init() {
 }
 func main() {
 	// Subcommands are dispatched before flag.Parse, because flag.Parse stops at the first
 	// non-flag argument and everything after `ctl` has to reach the running nebula's own flag
 	// parser untouched. Nothing here looks at -json or a vpn address.
 	if len(os.Args) > 1 && os.Args[1] == "ctl" {
 		os.Exit(ctlMain(os.Args[2:]))
 	}
 	configPath := flag.String("config", "", "Path to either a file or directory to load configuration from")
 	configTest := flag.Bool("test", false, "Test the config and print the end result. Non zero exit indicates a faulty config")
 	printVersion := flag.Bool("version", false, "Print version")
 	printUsage := flag.Bool("help", false, "Print command line usage")
 	flag.Usage = func() {
 		out := flag.CommandLine.Output()
 		fmt.Fprintf(out, "Usage of %s:\n", os.Args[0])
 		flag.PrintDefaults()
 		fmt.Fprintf(out, "\nCommands:\n")
 		fmt.Fprintf(out, "  ctl [command]\n\tRun a debug command against the running nebula on this host.\n\tRun `nebula ctl` on its own for the list of commands.\n")
 	}
 	flag.Parse()
 	if *printVersion {
@@ -65,15 +50,13 @@ func main() {
 	}
 	if *configPath == "" {
-		p, err := config.DefaultPath()
+		fmt.Println("-config flag must be set")
-		if err != nil {
+		flag.Usage()
-			fmt.Println(err)
+		os.Exit(1)
 			os.Exit(1)
 		}
 		*configPath = p
 	}
-	l := logging.NewLogger(os.Stdout)
+	l := logrus.New()
 	l.Out = os.Stdout
 	c := config.NewC(l)
 	err := c.Load(*configPath)
@@ -82,16 +65,6 @@ func main() {
 		os.Exit(1)
 	}
 	if err := logging.ApplyConfig(l, c); err != nil {
 		fmt.Printf("failed to apply logging config: %s", err)
 		os.Exit(1)
 	}
 	c.RegisterReloadCallback(func(c *config.C) {
 		if err := logging.ApplyConfig(l, c); err != nil {
 			l.Error("Failed to reconfigure logger on reload", "error", err)
 		}
 	})
 	ctrl, err := nebula.Main(c, *configTest, Build, l, nil)
 	if err != nil {
 		util.LogWithContextIfNeeded("Failed to start", err, l)
@@ -99,7 +72,8 @@ func main() {
 	}
 	if !*configTest {
-		if err := ctrl.Start(); err != nil {
+		wait, err := ctrl.Start()
 		if err != nil {
 			util.LogWithContextIfNeeded("Error while running", err, l)
 			os.Exit(1)
 		}
@@ -107,8 +81,8 @@ func main() {
 		go ctrl.ShutdownBlock()
 		notifyReady(l)
-		if err := ctrl.Wait(); err != nil {
+		if err := wait(); err != nil {
-			l.Error("Nebula stopped due to fatal error", "error", err)
+			l.WithError(err).Error("Nebula stopped due to fatal error")
 			os.Exit(2)
 		}
@@ -1,10 +1,11 @@
 package main
 import (
 	"log/slog"
 	"net"
 	"os"
 	"time"
 	"github.com/sirupsen/logrus"
 )
 // SdNotifyReady tells systemd the service is ready and dependent services can now be started
@@ -12,30 +13,30 @@ import (
 // https://www.freedesktop.org/software/systemd/man/systemd.service.html
 const SdNotifyReady = "READY=1"
-func notifyReady(l *slog.Logger) {
+func notifyReady(l *logrus.Logger) {
 	sockName := os.Getenv("NOTIFY_SOCKET")
 	if sockName == "" {
-		l.Debug("NOTIFY_SOCKET systemd env var not set, not sending ready signal")
+		l.Debugln("NOTIFY_SOCKET systemd env var not set, not sending ready signal")
 		return
 	}
 	conn, err := net.DialTimeout("unixgram", sockName, time.Second)
 	if err != nil {
-		l.Error("failed to connect to systemd notification socket", "error", err)
+		l.WithError(err).Error("failed to connect to systemd notification socket")
 		return
 	}
 	defer conn.Close()
 	err = conn.SetWriteDeadline(time.Now().Add(time.Second))
 	if err != nil {
-		l.Error("failed to set the write deadline for the systemd notification socket", "error", err)
+		l.WithError(err).Error("failed to set the write deadline for the systemd notification socket")
 		return
 	}
 	if _, err = conn.Write([]byte(SdNotifyReady)); err != nil {
-		l.Error("failed to signal the systemd notification socket", "error", err)
+		l.WithError(err).Error("failed to signal the systemd notification socket")
 		return
 	}
-	l.Debug("notified systemd the service is ready")
+	l.Debugln("notified systemd the service is ready")
 }
@@ -3,8 +3,8 @@
 package main
-import "log/slog"
+import "github.com/sirupsen/logrus"
-func notifyReady(_ *slog.Logger) {
+func notifyReady(_ *logrus.Logger) {
 	// No init service to notify
 }
@@ -1,922 +0,0 @@
 package nebula
 // The commands nebula exposes for debugging and administration. They are transport neutral:
 // the ssh console in ssh.go and the `nebula ctl` socket in ctl.go both dispatch against the
 // registry attachCommands fills in, and a command cannot tell which one invoked it. Adding a
 // command here makes it available over both.
 import (
 	"bytes"
 	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
 	"log/slog"
 	"maps"
 	"net/netip"
 	"os"
 	"path/filepath"
 	"runtime"
 	"runtime/pprof"
 	"sort"
 	"strconv"
 	"strings"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/diag"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/logging"
 )
 type listHostMapFlags struct {
 	Json    bool
 	Pretty  bool
 	ByIndex bool
 }
 type printCertFlags struct {
 	Json   bool
 	Pretty bool
 	Raw    bool
 }
 type printTunnelFlags struct {
 	Pretty bool
 }
 type changeRemoteFlags struct {
 	Address string
 }
 type closeTunnelFlags struct {
 	LocalOnly bool
 }
 type createTunnelFlags struct {
 	Address string
 }
 type deviceInfoFlags struct {
 	Json   bool
 	Pretty bool
 }
 func attachCommands(l *slog.Logger, c *config.C, reg *diag.Registry, f *Interface) {
 	// sandboxDir defaults to a dir in temp. The intention is that end user will
 	// create this dir as needed. Overriding this config value to "" allows
 	// writing to anywhere in the system.
 	defaultDir := filepath.Join(os.TempDir(), "nebula-debug")
 	// The key is spelled for both transports now: the profile writers are reachable over
 	// `nebula ctl` as well, but sshd.sandbox_dir keeps working for anyone already setting it.
 	sandboxDir := c.GetString("ctl.sandbox_dir", c.GetString("sshd.sandbox_dir", defaultDir))
 	reg.RegisterCommand(&diag.Command{
 		Name:             "list-hostmap",
 		ShortDescription: "List all known previously connected hosts",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := listHostMapFlags{}
 			fl.BoolVar(&s.Json, "json", false, "outputs as json with more information")
 			fl.BoolVar(&s.Pretty, "pretty", false, "pretty prints json, assumes -json")
 			fl.BoolVar(&s.ByIndex, "by-index", false, "gets all hosts in the hostmap from the index table")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdListHostMap(f.hostMap, fs, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "list-pending-hostmap",
 		ShortDescription: "List all handshaking hosts",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := listHostMapFlags{}
 			fl.BoolVar(&s.Json, "json", false, "outputs as json with more information")
 			fl.BoolVar(&s.Pretty, "pretty", false, "pretty prints json, assumes -json")
 			fl.BoolVar(&s.ByIndex, "by-index", false, "gets all hosts in the hostmap from the index table")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdListHostMap(f.handshakeManager, fs, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "list-lighthouse-addrmap",
 		ShortDescription: "List all lighthouse map entries",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := listHostMapFlags{}
 			fl.BoolVar(&s.Json, "json", false, "outputs as json with more information")
 			fl.BoolVar(&s.Pretty, "pretty", false, "pretty prints json, assumes -json")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdListLighthouseMap(f.lightHouse, fs, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "reload",
 		ShortDescription: "Reloads configuration from disk, same as sending HUP to the process",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdReload(c, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "start-cpu-profile",
 		ShortDescription: "Starts a cpu profile and write output to the provided file, ex: `cpu-profile.pb.gz`",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdStartCpuProfile(sandboxDir, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "stop-cpu-profile",
 		ShortDescription: "Stops a cpu profile and writes output to the previously provided file",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			pprof.StopCPUProfile()
 			return w.WriteLine("If a CPU profile was running it is now stopped")
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "save-heap-profile",
 		ShortDescription: "Saves a heap profile to the provided path, ex: `heap-profile.pb.gz`",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdGetHeapProfile(sandboxDir, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "mutex-profile-fraction",
 		ShortDescription: "Gets or sets runtime.SetMutexProfileFraction",
 		Callback:         cmdMutexProfileFraction,
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "save-mutex-profile",
 		ShortDescription: "Saves a mutex profile to the provided path, ex: `mutex-profile.pb.gz`",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdGetMutexProfile(sandboxDir, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "log-level",
 		ShortDescription: "Gets or sets the current log level",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdLogLevel(l, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "log-format",
 		ShortDescription: "Gets or sets the current log format",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdLogFormat(l, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "version",
 		ShortDescription: "Prints the currently running version of nebula",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdVersion(f, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "device-info",
 		ShortDescription: "Prints information about the network device.",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := deviceInfoFlags{}
 			fl.BoolVar(&s.Json, "json", false, "outputs as json with more information")
 			fl.BoolVar(&s.Pretty, "pretty", false, "pretty prints json, assumes -json")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdDeviceInfo(f, fs, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "print-cert",
 		ShortDescription: "Prints the current certificate being used or the certificate for the provided vpn addr",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := printCertFlags{}
 			fl.BoolVar(&s.Json, "json", false, "outputs as json")
 			fl.BoolVar(&s.Pretty, "pretty", false, "pretty prints json, assumes -json")
 			fl.BoolVar(&s.Raw, "raw", false, "raw prints the PEM encoded certificate, not compatible with -json or -pretty")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdPrintCert(f, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "print-tunnel",
 		ShortDescription: "Prints json details about a tunnel for the provided vpn addr",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := printTunnelFlags{}
 			fl.BoolVar(&s.Pretty, "pretty", false, "pretty prints json")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdPrintTunnel(f, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "print-relays",
 		ShortDescription: "Prints json details about all relay info",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := printTunnelFlags{}
 			fl.BoolVar(&s.Pretty, "pretty", false, "pretty prints json")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdPrintRelays(f, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "change-remote",
 		ShortDescription: "Changes the remote address used in the tunnel for the provided vpn addr",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := changeRemoteFlags{}
 			fl.StringVar(&s.Address, "address", "", "The new remote address, ip:port")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdChangeRemote(f, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "close-tunnel",
 		ShortDescription: "Closes a tunnel for the provided vpn addr",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := closeTunnelFlags{}
 			fl.BoolVar(&s.LocalOnly, "local-only", false, "Disables notifying the remote that the tunnel is shutting down")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdCloseTunnel(f, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "create-tunnel",
 		ShortDescription: "Creates a tunnel for the provided vpn address",
 		Help:             "The lighthouses will be queried for real addresses but you can provide one as well.",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			s := createTunnelFlags{}
 			fl.StringVar(&s.Address, "address", "", "Optionally provide a real remote address, ip:port ")
 			return fl, &s
 		},
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdCreateTunnel(f, fs, a, w)
 		},
 	})
 	reg.RegisterCommand(&diag.Command{
 		Name:             "query-lighthouse",
 		ShortDescription: "Query the lighthouses for the provided vpn address",
 		Help:             "This command is asynchronous. Only currently known udp addresses will be printed.",
 		Callback: func(fs any, a []string, w diag.StringWriter) error {
 			return cmdQueryLighthouse(f, fs, a, w)
 		},
 	})
 }
 func cmdListHostMap(hl controlHostLister, a any, w diag.StringWriter) error {
 	fs, ok := a.(*listHostMapFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be listHostMapFlags but was %+v", a)
 	}
 	var hm []ControlHostInfo
 	if fs.ByIndex {
 		hm = listHostMapIndexes(hl)
 	} else {
 		hm = listHostMapHosts(hl)
 	}
 	sort.Slice(hm, func(i, j int) bool {
 		return hm[i].VpnAddrs[0].Compare(hm[j].VpnAddrs[0]) < 0
 	})
 	if fs.Json || fs.Pretty {
 		js := json.NewEncoder(w.GetWriter())
 		if fs.Pretty {
 			js.SetIndent("", "    ")
 		}
 		err := js.Encode(hm)
 		if err != nil {
 			return nil
 		}
 	} else {
 		for _, v := range hm {
 			err := w.WriteLine(fmt.Sprintf("%s: %s", v.VpnAddrs, v.RemoteAddrs))
 			if err != nil {
 				return err
 			}
 		}
 	}
 	return nil
 }
 func cmdListLighthouseMap(lightHouse *LightHouse, a any, w diag.StringWriter) error {
 	fs, ok := a.(*listHostMapFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be listHostMapFlags but was %+v", a)
 	}
 	type lighthouseInfo struct {
 		VpnAddr string    `json:"vpnAddr"`
 		Addrs   *CacheMap `json:"addrs"`
 	}
 	lightHouse.RLock()
 	addrMap := make([]lighthouseInfo, len(lightHouse.addrMap))
 	x := 0
 	for k, v := range lightHouse.addrMap {
 		addrMap[x] = lighthouseInfo{
 			VpnAddr: k.String(),
 			Addrs:   v.CopyCache(),
 		}
 		x++
 	}
 	lightHouse.RUnlock()
 	sort.Slice(addrMap, func(i, j int) bool {
 		return strings.Compare(addrMap[i].VpnAddr, addrMap[j].VpnAddr) < 0
 	})
 	if fs.Json || fs.Pretty {
 		js := json.NewEncoder(w.GetWriter())
 		if fs.Pretty {
 			js.SetIndent("", "    ")
 		}
 		err := js.Encode(addrMap)
 		if err != nil {
 			return nil
 		}
 	} else {
 		for _, v := range addrMap {
 			b, err := json.Marshal(v.Addrs)
 			if err != nil {
 				return err
 			}
 			err = w.WriteLine(fmt.Sprintf("%s: %s", v.VpnAddr, string(b)))
 			if err != nil {
 				return err
 			}
 		}
 	}
 	return nil
 }
 // sanitizeFilePath validates that the given file path is within the sandbox directory.
 // If sandboxDir is empty, the path is returned as-is for backwards compatibility.
 func sanitizeFilePath(sandboxDir, filePath string) (string, error) {
 	if sandboxDir == "" {
 		return filePath, nil
 	}
 	// Clean and resolve the path relative to the sandbox directory
 	if !filepath.IsAbs(filePath) {
 		filePath = filepath.Join(sandboxDir, filePath)
 	}
 	cleaned := filepath.Clean(filePath)
 	// Ensure the resolved path is within the sandbox directory
 	cleanedSandbox := filepath.Clean(sandboxDir)
 	if cleaned == cleanedSandbox {
 		return "", fmt.Errorf("path %q resolves to the sandbox directory itself %q", filePath, sandboxDir)
 	}
 	if !strings.HasPrefix(cleaned, cleanedSandbox+string(filepath.Separator)) {
 		return "", fmt.Errorf("path %q is outside the sandbox directory %q", filePath, sandboxDir)
 	}
 	return cleaned, nil
 }
 func cmdStartCpuProfile(sandboxDir string, fs any, a []string, w diag.StringWriter) error {
 	if len(a) == 0 {
 		err := w.WriteLine("No path to write profile provided")
 		return err
 	}
 	filePath, err := sanitizeFilePath(sandboxDir, a[0])
 	if err != nil {
 		return w.WriteLine(err.Error())
 	}
 	file, err := os.Create(filePath)
 	if err != nil {
 		err = w.WriteLine(fmt.Sprintf("Unable to create profile file: %s", err))
 		return err
 	}
 	err = pprof.StartCPUProfile(file)
 	if err != nil {
 		err = w.WriteLine(fmt.Sprintf("Unable to start cpu profile: %s", err))
 		return err
 	}
 	err = w.WriteLine(fmt.Sprintf("Started cpu profile, issue stop-cpu-profile to write the output to %s", a))
 	return err
 }
 func cmdVersion(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	return w.WriteLine(fmt.Sprintf("%s", ifce.version))
 }
 func cmdQueryLighthouse(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	if len(a) == 0 {
 		return w.WriteLine("No vpn address was provided")
 	}
 	vpnAddr, err := netip.ParseAddr(a[0])
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	if !vpnAddr.IsValid() {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	var cm *CacheMap
 	rl := ifce.lightHouse.Query(vpnAddr)
 	if rl != nil {
 		cm = rl.CopyCache()
 	}
 	return json.NewEncoder(w.GetWriter()).Encode(cm)
 }
 func cmdCloseTunnel(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	flags, ok := fs.(*closeTunnelFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be closeTunnelFlags but was %+v", fs)
 	}
 	if len(a) == 0 {
 		return w.WriteLine("No vpn address was provided")
 	}
 	vpnAddr, err := netip.ParseAddr(a[0])
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	if !vpnAddr.IsValid() {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	hostInfo := ifce.hostMap.QueryVpnAddr(vpnAddr)
 	if hostInfo == nil {
 		return w.WriteLine(fmt.Sprintf("Could not find tunnel for vpn address: %v", a[0]))
 	}
 	if !flags.LocalOnly {
 		ifce.send(
 			header.CloseTunnel,
 			0,
 			hostInfo.ConnectionState,
 			hostInfo,
 			[]byte{},
 			make([]byte, 12, 12),
 			make([]byte, mtu),
 		)
 	}
 	ifce.closeTunnel(hostInfo)
 	return w.WriteLine("Closed")
 }
 func cmdCreateTunnel(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	flags, ok := fs.(*createTunnelFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be createTunnelFlags but was %+v", fs)
 	}
 	if len(a) == 0 {
 		return w.WriteLine("No vpn address was provided")
 	}
 	vpnAddr, err := netip.ParseAddr(a[0])
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	if !vpnAddr.IsValid() {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	hostInfo := ifce.hostMap.QueryVpnAddr(vpnAddr)
 	if hostInfo != nil {
 		return w.WriteLine(fmt.Sprintf("Tunnel already exists"))
 	}
 	hostInfo = ifce.handshakeManager.QueryVpnAddr(vpnAddr)
 	if hostInfo != nil {
 		return w.WriteLine(fmt.Sprintf("Tunnel already handshaking"))
 	}
 	var addr netip.AddrPort
 	if flags.Address != "" {
 		addr, err = netip.ParseAddrPort(flags.Address)
 		if err != nil {
 			return w.WriteLine("Address could not be parsed")
 		}
 	}
 	hostInfo = ifce.handshakeManager.StartHandshake(vpnAddr, nil)
 	if addr.IsValid() {
 		hostInfo.SetRemote(addr)
 	}
 	return w.WriteLine("Created")
 }
 func cmdChangeRemote(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	flags, ok := fs.(*changeRemoteFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be changeRemoteFlags but was %+v", fs)
 	}
 	if len(a) == 0 {
 		return w.WriteLine("No vpn address was provided")
 	}
 	if flags.Address == "" {
 		return w.WriteLine("No address was provided")
 	}
 	addr, err := netip.ParseAddrPort(flags.Address)
 	if err != nil {
 		return w.WriteLine("Address could not be parsed")
 	}
 	vpnAddr, err := netip.ParseAddr(a[0])
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	if !vpnAddr.IsValid() {
 		return w.WriteLine(fmt.Sprintf("The provided vpn address could not be parsed: %s", a[0]))
 	}
 	hostInfo := ifce.hostMap.QueryVpnAddr(vpnAddr)
 	if hostInfo == nil {
 		return w.WriteLine(fmt.Sprintf("Could not find tunnel for vpn address: %v", a[0]))
 	}
 	hostInfo.SetRemote(addr)
 	return w.WriteLine("Changed")
 }
 func cmdGetHeapProfile(sandboxDir string, fs any, a []string, w diag.StringWriter) error {
 	if len(a) == 0 {
 		return w.WriteLine("No path to write profile provided")
 	}
 	filePath, err := sanitizeFilePath(sandboxDir, a[0])
 	if err != nil {
 		return w.WriteLine(err.Error())
 	}
 	file, err := os.Create(filePath)
 	if err != nil {
 		err = w.WriteLine(fmt.Sprintf("Unable to create profile file: %s", err))
 		return err
 	}
 	err = pprof.WriteHeapProfile(file)
 	if err != nil {
 		err = w.WriteLine(fmt.Sprintf("Unable to write profile: %s", err))
 		return err
 	}
 	err = w.WriteLine(fmt.Sprintf("Mem profile created at %s", a))
 	return err
 }
 func cmdMutexProfileFraction(fs any, a []string, w diag.StringWriter) error {
 	if len(a) == 0 {
 		rate := runtime.SetMutexProfileFraction(-1)
 		return w.WriteLine(fmt.Sprintf("Current value: %d", rate))
 	}
 	newRate, err := strconv.Atoi(a[0])
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("Invalid argument: %s", a[0]))
 	}
 	oldRate := runtime.SetMutexProfileFraction(newRate)
 	return w.WriteLine(fmt.Sprintf("New value: %d. Old value: %d", newRate, oldRate))
 }
 func cmdGetMutexProfile(sandboxDir string, fs any, a []string, w diag.StringWriter) error {
 	if len(a) == 0 {
 		return w.WriteLine("No path to write profile provided")
 	}
 	filePath, err := sanitizeFilePath(sandboxDir, a[0])
 	if err != nil {
 		return w.WriteLine(err.Error())
 	}
 	file, err := os.Create(filePath)
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("Unable to create profile file: %s", err))
 	}
 	defer file.Close()
 	mutexProfile := pprof.Lookup("mutex")
 	if mutexProfile == nil {
 		return w.WriteLine("Unable to get pprof.Lookup(\"mutex\")")
 	}
 	err = mutexProfile.WriteTo(file, 0)
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("Unable to write profile: %s", err))
 	}
 	return w.WriteLine(fmt.Sprintf("Mutex profile created at %s", a))
 }
 func cmdLogLevel(l *slog.Logger, fs any, a []string, w diag.StringWriter) error {
 	ctrl, ok := l.Handler().(interface {
 		GetLevel() slog.Level
 		SetLevel(slog.Level)
 	})
 	if !ok {
 		return w.WriteLine("Log level is not reconfigurable on this logger")
 	}
 	if len(a) == 0 {
 		return w.WriteLine(fmt.Sprintf("Log level is: %s", logging.LevelName(ctrl.GetLevel())))
 	}
 	level, err := logging.ParseLevel(strings.ToLower(a[0]))
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("Unknown log level %s. Possible log levels: trace, debug, info, warn, error", a))
 	}
 	ctrl.SetLevel(level)
 	return w.WriteLine(fmt.Sprintf("Log level is: %s", logging.LevelName(ctrl.GetLevel())))
 }
 func cmdLogFormat(l *slog.Logger, fs any, a []string, w diag.StringWriter) error {
 	ctrl, ok := l.Handler().(interface {
 		GetFormat() string
 		SetFormat(string) error
 	})
 	if !ok {
 		return w.WriteLine("Log format is not reconfigurable on this logger")
 	}
 	if len(a) == 0 {
 		return w.WriteLine(fmt.Sprintf("Log format is: %s", ctrl.GetFormat()))
 	}
 	if err := ctrl.SetFormat(strings.ToLower(a[0])); err != nil {
 		return err
 	}
 	return w.WriteLine(fmt.Sprintf("Log format is: %s", ctrl.GetFormat()))
 }
 func cmdPrintCert(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	args, ok := fs.(*printCertFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be printCertFlags but was %+v", fs)
 	}
 	cert := ifce.pki.getCertState().GetDefaultCertificate()
 	if len(a) > 0 {
 		vpnAddr, err := netip.ParseAddr(a[0])
 		if err != nil {
 			return w.WriteLine(fmt.Sprintf("The provided vpn addr could not be parsed: %s", a[0]))
 		}
 		if !vpnAddr.IsValid() {
 			return w.WriteLine(fmt.Sprintf("The provided vpn addr could not be parsed: %s", a[0]))
 		}
 		hostInfo := ifce.hostMap.QueryVpnAddr(vpnAddr)
 		if hostInfo == nil {
 			return w.WriteLine(fmt.Sprintf("Could not find tunnel for vpn addr: %v", a[0]))
 		}
 		cert = hostInfo.GetCert().Certificate
 	}
 	if args.Json || args.Pretty {
 		b, err := cert.MarshalJSON()
 		if err != nil {
 			return nil
 		}
 		if args.Pretty {
 			buf := new(bytes.Buffer)
 			err := json.Indent(buf, b, "", "    ")
 			b = buf.Bytes()
 			if err != nil {
 				return nil
 			}
 		}
 		return w.WriteBytes(b)
 	}
 	if args.Raw {
 		b, err := cert.MarshalPEM()
 		if err != nil {
 			return nil
 		}
 		return w.WriteBytes(b)
 	}
 	return w.WriteLine(cert.String())
 }
 func cmdPrintRelays(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	args, ok := fs.(*printTunnelFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be printTunnelFlags but was %+v", fs)
 	}
 	relays := map[uint32]*HostInfo{}
 	ifce.hostMap.Lock()
 	maps.Copy(relays, ifce.hostMap.Relays)
 	ifce.hostMap.Unlock()
 	type RelayFor struct {
 		Error          error
 		Type           string
 		State          string
 		PeerAddr       netip.Addr
 		LocalIndex     uint32
 		RemoteIndex    uint32
 		RelayedThrough []netip.Addr
 	}
 	type RelayOutput struct {
 		NebulaAddr    netip.Addr
 		RelayForAddrs []RelayFor
 	}
 	type CmdOutput struct {
 		Relays []*RelayOutput
 	}
 	co := CmdOutput{}
 	enc := json.NewEncoder(w.GetWriter())
 	if args.Pretty {
 		enc.SetIndent("", "    ")
 	}
 	for k, v := range relays {
 		ro := RelayOutput{NebulaAddr: v.vpnAddrs[0]}
 		co.Relays = append(co.Relays, &ro)
 		relayHI := ifce.hostMap.QueryVpnAddr(v.vpnAddrs[0])
 		if relayHI == nil {
 			ro.RelayForAddrs = append(ro.RelayForAddrs, RelayFor{Error: errors.New("could not find hostinfo")})
 			continue
 		}
 		for _, vpnAddr := range relayHI.relayState.CopyRelayForIps() {
 			rf := RelayFor{Error: nil}
 			r, ok := relayHI.relayState.GetRelayForByAddr(vpnAddr)
 			if ok {
 				t := ""
 				switch r.Type {
 				case ForwardingType:
 					t = "forwarding"
 				case TerminalType:
 					t = "terminal"
 				default:
 					t = "unknown"
 				}
 				s := ""
 				switch r.State {
 				case Requested:
 					s = "requested"
 				case Established:
 					s = "established"
 				default:
 					s = "unknown"
 				}
 				rf.LocalIndex = r.LocalIndex
 				rf.RemoteIndex = r.RemoteIndex
 				rf.PeerAddr = r.PeerAddr
 				rf.Type = t
 				rf.State = s
 				if rf.LocalIndex != k {
 					rf.Error = fmt.Errorf("hostmap LocalIndex '%v' does not match RelayState LocalIndex", k)
 				}
 			}
 			relayedHI := ifce.hostMap.QueryVpnAddr(vpnAddr)
 			if relayedHI != nil {
 				rf.RelayedThrough = append(rf.RelayedThrough, relayedHI.relayState.CopyRelayIps()...)
 			}
 			ro.RelayForAddrs = append(ro.RelayForAddrs, rf)
 		}
 	}
 	err := enc.Encode(co)
 	if err != nil {
 		return err
 	}
 	return nil
 }
 func cmdPrintTunnel(ifce *Interface, fs any, a []string, w diag.StringWriter) error {
 	args, ok := fs.(*printTunnelFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be printTunnelFlags but was %+v", fs)
 	}
 	if len(a) == 0 {
 		return w.WriteLine("No vpn address was provided")
 	}
 	vpnAddr, err := netip.ParseAddr(a[0])
 	if err != nil {
 		return w.WriteLine(fmt.Sprintf("The provided vpn addr could not be parsed: %s", a[0]))
 	}
 	if !vpnAddr.IsValid() {
 		return w.WriteLine(fmt.Sprintf("The provided vpn addr could not be parsed: %s", a[0]))
 	}
 	hostInfo := ifce.hostMap.QueryVpnAddr(vpnAddr)
 	if hostInfo == nil {
 		return w.WriteLine(fmt.Sprintf("Could not find tunnel for vpn addr: %v", a[0]))
 	}
 	enc := json.NewEncoder(w.GetWriter())
 	if args.Pretty {
 		enc.SetIndent("", "    ")
 	}
 	return enc.Encode(copyHostInfo(hostInfo, ifce.hostMap.GetPreferredRanges()))
 }
 func cmdDeviceInfo(ifce *Interface, fs any, w diag.StringWriter) error {
 	data := struct {
 		Name string         `json:"name"`
 		Cidr []netip.Prefix `json:"cidr"`
 	}{
 		Name: ifce.inside.Name(),
 		Cidr: make([]netip.Prefix, len(ifce.inside.Networks())),
 	}
 	copy(data.Cidr, ifce.inside.Networks())
 	flags, ok := fs.(*deviceInfoFlags)
 	if !ok {
 		return fmt.Errorf("internal error: expected flags to be deviceInfoFlags but was %+v", fs)
 	}
 	if flags.Json || flags.Pretty {
 		js := json.NewEncoder(w.GetWriter())
 		if flags.Pretty {
 			js.SetIndent("", "    ")
 		}
 		return js.Encode(data)
 	} else {
 		return w.WriteLine(fmt.Sprintf("name=%v cidr=%v", data.Name, data.Cidr))
 	}
 }
 func cmdReload(c *config.C, w diag.StringWriter) error {
 	err := w.WriteLine("Reloading config")
 	c.ReloadConfig()
 	return err
 }
@@ -1,69 +0,0 @@
 package nebula
 import (
 	"bytes"
 	"log/slog"
 	"testing"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/diag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // attachedCommands is every command nebula exposes. The ssh console and `nebula ctl` dispatch
 // against this one set, so this list is the contract for both transports.
 var attachedCommands = []string{
 	"change-remote",
 	"close-tunnel",
 	"create-tunnel",
 	"device-info",
 	"list-hostmap",
 	"list-lighthouse-addrmap",
 	"list-pending-hostmap",
 	"log-format",
 	"log-level",
 	"mutex-profile-fraction",
 	"print-cert",
 	"print-relays",
 	"print-tunnel",
 	"query-lighthouse",
 	"reload",
 	"save-heap-profile",
 	"save-mutex-profile",
 	"start-cpu-profile",
 	"stop-cpu-profile",
 	"version",
 }
 func TestAttachCommands(t *testing.T) {
 	l := slog.New(slog.DiscardHandler)
 	reg := diag.NewRegistry()
 	// The callbacks capture these but do not touch them until a command runs, and this test
 	// only registers and asks for help.
 	attachCommands(l, config.NewC(l), reg, &Interface{})
 	t.Run("every command is registered", func(t *testing.T) {
 		for _, name := range attachedCommands {
 			assert.Equal(t, []string{name}, reg.Match(name), "%s is not registered", name)
 		}
 	})
 	t.Run("help is available for every command", func(t *testing.T) {
 		for _, name := range attachedCommands {
 			buf := &bytes.Buffer{}
 			require.NoError(t, reg.DispatchArgs([]string{"help", name}, diag.NewWriter(buf)), name)
 			assert.Contains(t, buf.String(), name+" - ", name)
 		}
 	})
 	t.Run("the command list names them all", func(t *testing.T) {
 		buf := &bytes.Buffer{}
 		require.NoError(t, reg.DispatchArgs(nil, diag.NewWriter(buf)))
 		for _, name := range attachedCommands {
 			assert.Contains(t, buf.String(), name+" - ", name)
 		}
 	})
 }
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
 	"log/slog"
 	"math"
 	"os"
 	"os/signal"
@@ -17,6 +16,7 @@ import (
 	"time"
 	"dario.cat/mergo"
 	"github.com/sirupsen/logrus"
 	"go.yaml.in/yaml/v3"
 )
@@ -26,11 +26,11 @@ type C struct {
 	Settings    map[string]any
 	oldSettings map[string]any
 	callbacks   []func(*C)
-	l           *slog.Logger
+	l           *logrus.Logger
 	reloadLock  sync.Mutex
 }
-func NewC(l *slog.Logger) *C {
+func NewC(l *logrus.Logger) *C {
 	return &C{
 		Settings: make(map[string]any),
 		l:        l,
@@ -107,18 +107,12 @@ func (c *C) HasChanged(k string) bool {
 	newVals, err := yaml.Marshal(nv)
 	if err != nil {
-		c.l.Error("Error while marshaling new config",
+		c.l.WithField("config_path", k).WithError(err).Error("Error while marshaling new config")
 			"config_path", k,
 			"error", err,
 		)
 	}
 	oldVals, err := yaml.Marshal(ov)
 	if err != nil {
-		c.l.Error("Error while marshaling old config",
+		c.l.WithField("config_path", k).WithError(err).Error("Error while marshaling old config")
 			"config_path", k,
 			"error", err,
 		)
 	}
 	return string(newVals) != string(oldVals)
@@ -160,10 +154,7 @@ func (c *C) ReloadConfig() {
 	err := c.Load(c.path)
 	if err != nil {
-		c.l.Error("Error occurred while reloading config",
+		c.l.WithField("config_path", c.path).WithError(err).Error("Error occurred while reloading config")
 			"config_path", c.path,
 			"error", err,
 		)
 		return
 	}
@@ -1,29 +0,0 @@
 package config
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 )
 // DefaultPath returns a path to a config file alongside the running executable, preferring config.yaml over config.yml.
 // If neither file exists an error is returned that names both paths checked.
 func DefaultPath() (string, error) {
 	ex, err := os.Executable()
 	if err != nil {
 		return "", err
 	}
 	return defaultPathInDir(filepath.Dir(ex))
 }
 func defaultPathInDir(dir string) (string, error) {
 	yamlPath := filepath.Join(dir, "config.yaml")
 	if _, err := os.Stat(yamlPath); err == nil {
 		return yamlPath, nil
 	}
 	ymlPath := filepath.Join(dir, "config.yml")
 	if _, err := os.Stat(ymlPath); err == nil {
 		return ymlPath, nil
 	}
 	return "", fmt.Errorf("no default config found at %s or %s", yamlPath, ymlPath)
 }
@@ -1,67 +0,0 @@
 package config
 import (
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func TestDefaultPathInDir(t *testing.T) {
 	t.Run("prefers config.yaml when both exist", func(t *testing.T) {
 		dir := t.TempDir()
 		want := filepath.Join(dir, "config.yaml")
 		other := filepath.Join(dir, "config.yml")
 		require.NoError(t, os.WriteFile(want, []byte("a: 1"), 0644))
 		require.NoError(t, os.WriteFile(other, []byte("a: 2"), 0644))
 		got, err := defaultPathInDir(dir)
 		require.NoError(t, err)
 		assert.Equal(t, want, got)
 	})
 	t.Run("returns config.yaml when only it exists", func(t *testing.T) {
 		dir := t.TempDir()
 		want := filepath.Join(dir, "config.yaml")
 		require.NoError(t, os.WriteFile(want, []byte("a: 1"), 0644))
 		got, err := defaultPathInDir(dir)
 		require.NoError(t, err)
 		assert.Equal(t, want, got)
 	})
 	t.Run("falls back to config.yml when only it exists", func(t *testing.T) {
 		dir := t.TempDir()
 		want := filepath.Join(dir, "config.yml")
 		require.NoError(t, os.WriteFile(want, []byte("a: 1"), 0644))
 		got, err := defaultPathInDir(dir)
 		require.NoError(t, err)
 		assert.Equal(t, want, got)
 	})
 	t.Run("errors when neither exists and names both paths", func(t *testing.T) {
 		dir := t.TempDir()
 		got, err := defaultPathInDir(dir)
 		assert.Empty(t, got)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), filepath.Join(dir, "config.yaml"))
 		assert.Contains(t, err.Error(), filepath.Join(dir, "config.yml"))
 	})
 }
 func TestDefaultPath(t *testing.T) {
 	got, err := DefaultPath()
 	if err != nil {
 		ex, exErr := os.Executable()
 		require.NoError(t, exErr)
 		assert.Contains(t, err.Error(), filepath.Dir(ex))
 		return
 	}
 	ex, err := os.Executable()
 	require.NoError(t, err)
 	assert.Equal(t, filepath.Dir(ex), filepath.Dir(got))
 	assert.Contains(t, []string{"config.yaml", "config.yml"}, filepath.Base(got))
 }
@@ -5,12 +5,13 @@ import (
 	"context"
 	"encoding/binary"
 	"fmt"
 	"log/slog"
 	"net/netip"
 	"sync"
 	"sync/atomic"
 	"time"
 	"github.com/rcrowley/go-metrics"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/header"
@@ -44,16 +45,19 @@ type connectionManager struct {
 	inactivityTimeout       atomic.Int64
 	dropInactive            atomic.Bool
-	l *slog.Logger
+	metricsTxPunchy metrics.Counter
 	l *logrus.Logger
 }
-func newConnectionManagerFromConfig(l *slog.Logger, c *config.C, hm *HostMap, p *Punchy) *connectionManager {
+func newConnectionManagerFromConfig(l *logrus.Logger, c *config.C, hm *HostMap, p *Punchy) *connectionManager {
 	cm := &connectionManager{
-		hostMap:       hm,
+		hostMap:         hm,
-		l:             l,
+		l:               l,
-		punchy:        p,
+		punchy:          p,
-		relayUsed:     make(map[uint32]struct{}),
+		relayUsed:       make(map[uint32]struct{}),
-		relayUsedLock: &sync.RWMutex{},
+		relayUsedLock:   &sync.RWMutex{},
 		metricsTxPunchy: metrics.GetOrRegisterCounter("messages.tx.punchy", nil),
 	}
 	cm.reload(c, true)
@@ -81,10 +85,9 @@ func (cm *connectionManager) reload(c *config.C, initial bool) {
 		old := cm.getInactivityTimeout()
 		cm.inactivityTimeout.Store((int64)(c.GetDuration("tunnels.inactivity_timeout", 10*time.Minute)))
 		if !initial {
-			cm.l.Info("Inactivity timeout has changed",
+			cm.l.WithField("oldDuration", old).
-				"oldDuration", old,
+				WithField("newDuration", cm.getInactivityTimeout()).
-				"newDuration", cm.getInactivityTimeout(),
+				Info("Inactivity timeout has changed")
 			)
 		}
 	}
@@ -92,10 +95,9 @@ func (cm *connectionManager) reload(c *config.C, initial bool) {
 		old := cm.dropInactive.Load()
 		cm.dropInactive.Store(c.GetBool("tunnels.drop_inactive", false))
 		if !initial {
-			cm.l.Info("Drop inactive setting has changed",
+			cm.l.WithField("oldBool", old).
-				"oldBool", old,
+				WithField("newBool", cm.dropInactive.Load()).
-				"newBool", cm.dropInactive.Load(),
+				Info("Drop inactive setting has changed")
 			)
 		}
 	}
 }
@@ -105,18 +107,11 @@ func (cm *connectionManager) getInactivityTimeout() time.Duration {
 }
 func (cm *connectionManager) In(h *HostInfo) {
-	h.markIn()
+	h.in.Store(true)
 }
-// OutNoRebind records outbound traffic without consuming the rebind epoch, for relayed sends: the direct path
+func (cm *connectionManager) Out(h *HostInfo) {
-// to the relay consumes the edge, the via send must not.
+	h.out.Store(true)
 func (cm *connectionManager) OutNoRebind(h *HostInfo) {
 	h.markOutOnly()
 }
 // Out records outbound traffic and reports whether we rebound since this tunnel last sent
 func (cm *connectionManager) Out(h *HostInfo) bool {
 	return h.markOut(cm.intf.rebindEpoch.Load())
 }
 func (cm *connectionManager) RelayUsed(localIndex uint32) {
@@ -135,13 +130,22 @@ func (cm *connectionManager) RelayUsed(localIndex uint32) {
 // getAndResetTrafficCheck returns if there was any inbound or outbound traffic within the last tick and
 // resets the state for this local index
 func (cm *connectionManager) getAndResetTrafficCheck(h *HostInfo, now time.Time) (bool, bool) {
-	in, out := h.takeTraffic()
+	in := h.in.Swap(false)
 	out := h.out.Swap(false)
 	if in || out {
 		h.lastUsed = now
 	}
 	return in, out
 }
 // AddTrafficWatch must be called for every new HostInfo.
 // We will continue to monitor the HostInfo until the tunnel is dropped.
 func (cm *connectionManager) AddTrafficWatch(h *HostInfo) {
 	if h.out.Swap(true) == false {
 		cm.trafficTimer.Add(h.localIndexId, cm.checkInterval)
 	}
 }
 func (cm *connectionManager) Start(ctx context.Context) {
 	clockSource := time.NewTicker(cm.trafficTimer.t.tickDuration)
 	defer clockSource.Stop()
@@ -252,7 +256,7 @@ func (cm *connectionManager) migrateRelayUsed(oldhostinfo, newhostinfo *HostInfo
 			var err error
 			index, err = AddRelay(cm.l, newhostinfo, cm.hostMap, r.PeerAddr, nil, r.Type, Requested)
 			if err != nil {
-				cm.l.Error("failed to migrate relay to new hostinfo", "error", err)
+				cm.l.WithError(err).Error("failed to migrate relay to new hostinfo")
 				continue
 			}
 			switch r.Type {
@@ -300,16 +304,16 @@ func (cm *connectionManager) migrateRelayUsed(oldhostinfo, newhostinfo *HostInfo
 		msg, err := req.Marshal()
 		if err != nil {
-			cm.l.Error("failed to marshal Control message to migrate relay", "error", err)
+			cm.l.WithError(err).Error("failed to marshal Control message to migrate relay")
 		} else {
 			cm.intf.SendMessageToHostInfo(header.Control, 0, newhostinfo, msg, make([]byte, 12), make([]byte, mtu))
-			cm.l.Info("send CreateRelayRequest",
+			cm.l.WithFields(logrus.Fields{
-				"relayFrom", relayFrom,
+				"relayFrom":           req.RelayFromAddr,
-				"relayTo", relayTo,
+				"relayTo":             req.RelayToAddr,
-				"initiatorRelayIndex", req.InitiatorRelayIndex,
+				"initiatorRelayIndex": req.InitiatorRelayIndex,
-				"responderRelayIndex", req.ResponderRelayIndex,
+				"responderRelayIndex": req.ResponderRelayIndex,
-				"vpnAddrs", newhostinfo.vpnAddrs,
+				"vpnAddrs":            newhostinfo.vpnAddrs}).
-			)
+				Info("send CreateRelayRequest")
 		}
 	}
 }
@@ -321,7 +325,7 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 	hostinfo := cm.hostMap.Indexes[localIndex]
 	if hostinfo == nil {
-		cm.l.Debug("Not found in hostmap", "localIndex", localIndex)
+		cm.l.WithField("localIndex", localIndex).Debugln("Not found in hostmap")
 		return doNothing, nil, nil
 	}
@@ -329,12 +333,6 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 		return closeTunnel, hostinfo, nil
 	}
 	if hostinfo.ConnectionState != nil && hostinfo.ConnectionState.messageCounter.Load() >= RejectAfterMessages {
 		// Send path can't encrypt a CloseTunnel notify, so just delete locally; the peer recovers via recv_error.
 		hostinfo.logger(cm.l).Error("Dropping tunnel, message counter is exhausted")
 		return deleteTunnel, hostinfo, nil
 	}
 	primary := cm.hostMap.Hosts[hostinfo.vpnAddrs[0]]
 	mainHostInfo := true
 	if primary != nil && primary != hostinfo {
@@ -347,12 +345,12 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 	// A hostinfo is determined alive if there is incoming traffic
 	if inTraffic {
 		decision := doNothing
-		if cm.l.Enabled(context.Background(), slog.LevelDebug) {
+		if cm.l.Level >= logrus.DebugLevel {
-			hostinfo.logger(cm.l).Debug("Tunnel status",
+			hostinfo.logger(cm.l).
-				"tunnelCheck", m{"state": "alive", "method": "passive"},
+				WithField("tunnelCheck", m{"state": "alive", "method": "passive"}).
-			)
+				Debug("Tunnel status")
 		}
-		hostinfo.setPendingDeletion(false)
+		hostinfo.pendingDeletion.Store(false)
 		if mainHostInfo {
 			decision = tryRehandshake
@@ -369,17 +367,17 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 		if !outTraffic {
 			// Send a punch packet to keep the NAT state alive
-			cm.punchy.SendPunch(hostinfo)
+			cm.sendPunch(hostinfo)
 		}
 		return decision, hostinfo, primary
 	}
-	if hostinfo.isPendingDeletion() {
+	if hostinfo.pendingDeletion.Load() {
 		// We have already sent a test packet and nothing was returned, this hostinfo is dead
-		hostinfo.logger(cm.l).Info("Tunnel status",
+		hostinfo.logger(cm.l).
-			"tunnelCheck", m{"state": "dead", "method": "active"},
+			WithField("tunnelCheck", m{"state": "dead", "method": "active"}).
-		)
+			Info("Tunnel status")
 		return deleteTunnel, hostinfo, nil
 	}
@@ -390,43 +388,44 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 			inactiveFor, isInactive := cm.isInactive(hostinfo, now)
 			if isInactive {
 				// Tunnel is inactive, tear it down
-				hostinfo.logger(cm.l).Info("Dropping tunnel due to inactivity",
+				hostinfo.logger(cm.l).
-					"inactiveDuration", inactiveFor,
+					WithField("inactiveDuration", inactiveFor).
-					"primary", mainHostInfo,
+					WithField("primary", mainHostInfo).
-				)
+					Info("Dropping tunnel due to inactivity")
 				return closeTunnel, hostinfo, primary
 			}
 			// If we aren't sending or receiving traffic then its an unused tunnel and we don't to test the tunnel.
 			// Just maintain NAT state if configured to do so.
-			cm.punchy.SendPunch(hostinfo)
+			cm.sendPunch(hostinfo)
 			cm.trafficTimer.Add(hostinfo.localIndexId, cm.checkInterval)
 			return doNothing, nil, nil
 		}
-		// We aren't receiving traffic but we are sending it. The outbound
+		if cm.punchy.GetTargetEverything() {
-		// traffic itself refreshes the primary remote's NAT state; this
+			// This is similar to the old punchy behavior with a slight optimization.
-		// fans out to non-primary remotes, but only if target_all_remotes
+			// We aren't receiving traffic but we are sending it, punch on all known
-		// is configured.
+			// ips in case we need to re-prime NAT state
-		cm.punchy.SendPunchToAll(hostinfo)
+			cm.sendPunch(hostinfo)
 		}
-		if cm.l.Enabled(context.Background(), slog.LevelDebug) {
+		if cm.l.Level >= logrus.DebugLevel {
-			hostinfo.logger(cm.l).Debug("Tunnel status",
+			hostinfo.logger(cm.l).
-				"tunnelCheck", m{"state": "testing", "method": "active"},
+				WithField("tunnelCheck", m{"state": "testing", "method": "active"}).
-			)
+				Debug("Tunnel status")
 		}
 		// Send a test packet to trigger an authenticated tunnel test, this should suss out any lingering tunnel issues
 		decision = sendTestPacket
 	} else {
-		if cm.l.Enabled(context.Background(), slog.LevelDebug) {
+		if cm.l.Level >= logrus.DebugLevel {
-			hostinfo.logger(cm.l).Debug("Hostinfo sadness")
+			hostinfo.logger(cm.l).Debugf("Hostinfo sadness")
 		}
 	}
-	hostinfo.setPendingDeletion(true)
+	hostinfo.pendingDeletion.Store(true)
 	cm.trafficTimer.Add(hostinfo.localIndexId, cm.pendingDeletionInterval)
 	return decision, hostinfo, nil
 }
@@ -460,11 +459,6 @@ func (cm *connectionManager) shouldSwapPrimary(current *HostInfo) bool {
 		return false
 	}
 	if current.ConnectionState.messageCounter.Load() >= RehandshakeAfterMessages {
 		// This tunnel is being rolled for counter exhaustion, never swap back onto its spent key.
 		return false
 	}
 	crt := cm.intf.pki.getCertState().getCertificate(current.ConnectionState.myCert.Version())
 	if crt == nil {
 		//my cert was reloaded away. We should definitely swap from this tunnel
@@ -499,16 +493,14 @@ func (cm *connectionManager) isInvalidCertificate(now time.Time, hostinfo *HostI
 		return false //cert is still valid! yay!
 	} else if err == cert.ErrBlockListed { //avoiding errors.Is for speed
 		// Block listed certificates should always be disconnected
-		hostinfo.logger(cm.l).Info("Remote certificate is blocked, tearing down the tunnel",
+		hostinfo.logger(cm.l).WithError(err).
-			"error", err,
+			WithField("fingerprint", remoteCert.Fingerprint).
-			"fingerprint", remoteCert.Fingerprint,
+			Info("Remote certificate is blocked, tearing down the tunnel")
 		)
 		return true
 	} else if cm.intf.disconnectInvalid.Load() {
-		hostinfo.logger(cm.l).Info("Remote certificate is no longer valid, tearing down the tunnel",
+		hostinfo.logger(cm.l).WithError(err).
-			"error", err,
+			WithField("fingerprint", remoteCert.Fingerprint).
-			"fingerprint", remoteCert.Fingerprint,
+			Info("Remote certificate is no longer valid, tearing down the tunnel")
 		)
 		return true
 	} else {
 		//if we reach here, the cert is no longer valid, but we're configured to keep tunnels from now-invalid certs open
@@ -516,17 +508,41 @@ func (cm *connectionManager) isInvalidCertificate(now time.Time, hostinfo *HostI
 	}
 }
 func (cm *connectionManager) sendPunch(hostinfo *HostInfo) {
 	if !cm.punchy.GetPunch() {
 		// Punching is disabled
 		return
 	}
 	if cm.intf.lightHouse.IsAnyLighthouseAddr(hostinfo.vpnAddrs) {
 		// Do not punch to lighthouses, we assume our lighthouse update interval is good enough.
 		// In the event the update interval is not sufficient to maintain NAT state then a publicly available lighthouse
 		// would lose the ability to notify us and punchy.respond would become unreliable.
 		return
 	}
 	if cm.punchy.GetTargetEverything() {
 		hostinfo.remotes.ForEach(cm.hostMap.GetPreferredRanges(), func(addr netip.AddrPort, preferred bool) {
 			cm.metricsTxPunchy.Inc(1)
 			cm.intf.outside.WriteTo([]byte{1}, addr)
 		})
 	} else if hostinfo.remote.IsValid() {
 		cm.metricsTxPunchy.Inc(1)
 		cm.intf.outside.WriteTo([]byte{1}, hostinfo.remote)
 	}
 }
 func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 	cs := cm.intf.pki.getCertState()
 	curCrt := hostinfo.ConnectionState.myCert
 	curCrtVersion := curCrt.Version()
 	myCrt := cs.getCertificate(curCrtVersion)
 	if myCrt == nil {
-		cm.l.Info("Re-handshaking with remote",
+		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-			"vpnAddrs", hostinfo.vpnAddrs,
+			WithField("version", curCrtVersion).
-			"version", curCrtVersion,
+			WithField("reason", "local certificate removed").
-			"reason", "local certificate removed",
+			Info("Re-handshaking with remote")
 		)
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}
@@ -534,12 +550,11 @@ func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 	if peerCrt != nil && curCrtVersion < peerCrt.Certificate.Version() {
 		// if our certificate version is less than theirs, and we have a matching version available, rehandshake?
 		if cs.getCertificate(peerCrt.Certificate.Version()) != nil {
-			cm.l.Info("Re-handshaking with remote",
+			cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-				"vpnAddrs", hostinfo.vpnAddrs,
+				WithField("version", curCrtVersion).
-				"version", curCrtVersion,
+				WithField("peerVersion", peerCrt.Certificate.Version()).
-				"peerVersion", peerCrt.Certificate.Version(),
+				WithField("reason", "local certificate version lower than peer, attempting to correct").
-				"reason", "local certificate version lower than peer, attempting to correct",
+				Info("Re-handshaking with remote")
 			)
 			cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], func(hh *HandshakeHostInfo) {
 				hh.initiatingVersionOverride = peerCrt.Certificate.Version()
 			})
@@ -547,28 +562,17 @@ func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 		}
 	}
 	if !bytes.Equal(curCrt.Signature(), myCrt.Signature()) {
-		cm.l.Info("Re-handshaking with remote",
+		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-			"vpnAddrs", hostinfo.vpnAddrs,
+			WithField("reason", "local certificate is not current").
-			"reason", "local certificate is not current",
+			Info("Re-handshaking with remote")
 		)
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}
 	if curCrtVersion < cs.initiatingVersion {
-		cm.l.Info("Re-handshaking with remote",
+		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-			"vpnAddrs", hostinfo.vpnAddrs,
+			WithField("reason", "current cert version < pki.initiatingVersion").
-			"reason", "current cert version < pki.initiatingVersion",
+			Info("Re-handshaking with remote")
 		)
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}
 	if hostinfo.ConnectionState.messageCounter.Load() >= RehandshakeAfterMessages {
 		cm.l.Info("Re-handshaking with remote",
 			"vpnAddrs", hostinfo.vpnAddrs,
 			"reason", "message counter rehandshake threshold reached",
 		)
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
@@ -7,9 +7,10 @@ import (
 	"testing"
 	"time"
 	"github.com/flynn/noise"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/overlaytest"
+	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/test"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
@@ -25,7 +26,6 @@ func newTestLighthouse() *LightHouse {
 	lighthouses := []netip.Addr{}
 	staticList := map[netip.Addr]struct{}{}
 	lh.localAddrsFn = func(*LocalAllowList) []netip.Addr { return nil }
 	lh.lighthouses.Store(&lighthouses)
 	lh.staticList.Store(&staticList)
@@ -47,13 +47,13 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
+		v1HandshakeBytes:  []byte{},
 	}
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &overlay.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -64,9 +64,9 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 	ifce.pki.cs.Store(cs)
 	// Create manager
-	conf := config.NewC(test.NewLogger())
+	conf := config.NewC(l)
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf, nil)
+	punchy := NewPunchyFromConfig(l, conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	nc.intf = ifce
 	p := []byte("")
 	nb := make([]byte, 12, 12)
@@ -80,31 +80,32 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 	}
 	hostinfo.ConnectionState = &ConnectionState{
 		myCert: &dummyCert{version: cert.Version1},
 		H:      &noise.HandshakeState{},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
 	// We saw traffic out to vpnIp
 	nc.Out(hostinfo)
 	nc.In(hostinfo)
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
-	assert.True(t, hostinfo.sentSinceCheck())
+	assert.True(t, hostinfo.out.Load())
-	assert.True(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.True(t, hostinfo.in.Load())
 	// Do a traffic check tick, should not be pending deletion but should not have any in/out packets recorded
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	// Do another traffic check tick, this host should be pending deletion now
 	nc.Out(hostinfo)
-	assert.True(t, hostinfo.sentSinceCheck())
+	assert.True(t, hostinfo.out.Load())
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.True(t, hostinfo.isPendingDeletion())
+	assert.True(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
@@ -129,13 +130,13 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
+		v1HandshakeBytes:  []byte{},
 	}
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &overlay.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -146,9 +147,9 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 	ifce.pki.cs.Store(cs)
 	// Create manager
-	conf := config.NewC(test.NewLogger())
+	conf := config.NewC(l)
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf, nil)
+	punchy := NewPunchyFromConfig(l, conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	nc.intf = ifce
 	p := []byte("")
 	nb := make([]byte, 12, 12)
@@ -162,116 +163,44 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 	}
 	hostinfo.ConnectionState = &ConnectionState{
 		myCert: &dummyCert{version: cert.Version1},
 		H:      &noise.HandshakeState{},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
 	// We saw traffic out to vpnIp
 	nc.Out(hostinfo)
 	nc.In(hostinfo)
-	assert.True(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.True(t, hostinfo.in.Load())
-	assert.True(t, hostinfo.sentSinceCheck())
+	assert.True(t, hostinfo.out.Load())
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	// Do a traffic check tick, should not be pending deletion but should not have any in/out packets recorded
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	// Do another traffic check tick, this host should be pending deletion now
 	nc.Out(hostinfo)
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.True(t, hostinfo.isPendingDeletion())
+	assert.True(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 	// We saw traffic, should no longer be pending deletion
 	nc.In(hostinfo)
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 }
 func Test_NewConnectionManager_CounterLimits(t *testing.T) {
 	l := test.NewLogger()
 	localrange := netip.MustParsePrefix("10.1.1.1/24")
 	vpnIp := netip.MustParseAddr("172.1.1.2")
 	preferredRanges := []netip.Prefix{localrange}
 	// Very incomplete mock objects
 	hostMap := newHostMap(l)
 	hostMap.preferredRanges.Store(&preferredRanges)
 	cs := &CertState{
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
 		v1Credential:      nil,
 	}
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
 		inside:           &overlaytest.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
 		pki:              &PKI{},
 		myVpnAddrs:       []netip.Addr{netip.MustParseAddr("172.1.1.1")}, // sorts below vpnIp so shouldSwapPrimary can proceed
 		handshakeManager: NewHandshakeManager(l, hostMap, lh, &udp.NoopConn{}, defaultHandshakeConfig),
 		l:                l,
 	}
 	ifce.pki.cs.Store(cs)
 	conf := config.NewC(test.NewLogger())
 	punchy := NewPunchyFromConfig(test.NewLogger(), conf, nil)
 	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
 	nc.intf = ifce
 	hostinfo := &HostInfo{
 		vpnAddrs:      []netip.Addr{vpnIp},
 		localIndexId:  1099,
 		remoteIndexId: 9901,
 	}
 	hostinfo.ConnectionState = &ConnectionState{
 		myCert: &dummyCert{version: cert.Version1},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
 	// Below the rehandshake threshold, no handshake is started
 	hostinfo.ConnectionState.messageCounter.Store(RehandshakeAfterMessages - 1)
 	nc.tryRehandshake(hostinfo)
 	assert.Nil(t, ifce.handshakeManager.QueryVpnAddr(vpnIp))
 	// A tunnel on its current cert would normally swap to primary
 	assert.True(t, nc.shouldSwapPrimary(hostinfo))
 	// At the rehandshake threshold, a new handshake is started
 	hostinfo.ConnectionState.messageCounter.Store(RehandshakeAfterMessages)
 	nc.tryRehandshake(hostinfo)
 	assert.NotNil(t, ifce.handshakeManager.QueryVpnAddr(vpnIp))
 	// An exhausted tunnel being rolled must never swap back to primary onto its spent key
 	assert.False(t, nc.shouldSwapPrimary(hostinfo))
 	// Still below the reject limit, the tunnel stays up
 	nc.In(hostinfo)
 	decision, _, _ := nc.makeTrafficDecision(hostinfo.localIndexId, time.Now())
 	assert.Equal(t, tryRehandshake, decision)
 	// At the reject limit, the tunnel is deleted locally without a doomed CloseTunnel notify
 	hostinfo.ConnectionState.messageCounter.Store(RejectAfterMessages)
 	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, time.Now())
 	assert.Equal(t, deleteTunnel, decision)
 }
 func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	l := test.NewLogger()
 	localrange := netip.MustParsePrefix("10.1.1.1/24")
@@ -286,13 +215,13 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
+		v1HandshakeBytes:  []byte{},
 	}
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &overlay.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -303,12 +232,12 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	ifce.pki.cs.Store(cs)
 	// Create manager
-	conf := config.NewC(test.NewLogger())
+	conf := config.NewC(l)
 	conf.Settings["tunnels"] = map[string]any{
 		"drop_inactive": true,
 	}
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf, nil)
+	punchy := NewPunchyFromConfig(l, conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	assert.True(t, nc.dropInactive.Load())
 	nc.intf = ifce
@@ -320,37 +249,38 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	}
 	hostinfo.ConnectionState = &ConnectionState{
 		myCert: &dummyCert{version: cert.Version1},
 		H:      &noise.HandshakeState{},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
 	// Do a traffic check tick, in and out should be cleared but should not be pending deletion
 	nc.Out(hostinfo)
 	nc.In(hostinfo)
-	assert.True(t, hostinfo.sentSinceCheck())
+	assert.True(t, hostinfo.out.Load())
-	assert.True(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.True(t, hostinfo.in.Load())
 	now := time.Now()
 	decision, _, _ := nc.makeTrafficDecision(hostinfo.localIndexId, now)
 	assert.Equal(t, tryRehandshake, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, now.Add(time.Second*5))
 	assert.Equal(t, doNothing, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	// Do another traffic check tick, should still not be pending deletion
 	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, now.Add(time.Second*10))
 	assert.Equal(t, doNothing, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
@@ -358,9 +288,9 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, now.Add(time.Minute*10))
 	assert.Equal(t, closeTunnel, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
-	assert.False(t, hostinfo.sentSinceCheck())
+	assert.False(t, hostinfo.out.Load())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 }
@@ -410,15 +340,15 @@ func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
 	cachedPeerCert, err := ncp.VerifyCertificate(now.Add(time.Second), peerCert)
 	cs := &CertState{
-		privateKey:   []byte{},
+		privateKey:       []byte{},
-		v1Cert:       &dummyCert{},
+		v1Cert:           &dummyCert{},
-		v1Credential: nil,
+		v1HandshakeBytes: []byte{},
 	}
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &overlay.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -431,9 +361,9 @@ func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
 	ifce.disconnectInvalid.Store(true)
 	// Create manager
-	conf := config.NewC(test.NewLogger())
+	conf := config.NewC(l)
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf, nil)
+	punchy := NewPunchyFromConfig(l, conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	nc.intf = ifce
 	ifce.connectionManager = nc
@@ -442,6 +372,7 @@ func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
 		ConnectionState: &ConnectionState{
 			myCert:   &dummyCert{},
 			peerCert: cachedPeerCert,
 			H:        &noise.HandshakeState{},
 		},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
@@ -1,76 +1,80 @@
 package nebula
 import (
 	"crypto/rand"
 	"encoding/json"
 	"fmt"
 	"log/slog"
 	"sync"
 	"sync/atomic"
 	"github.com/flynn/noise"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/handshake"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/noiseutil"
 )
-const (
+const ReplayWindow = 1024
 	ReplayWindow = 8192
 	// RehandshakeAfterMessages rolls keys inside the AES-GCM data-volume margin (~2^-36 advantage at 64KB frames).
 	RehandshakeAfterMessages = uint64(1) << 34
 	// RejectAfterMessages is the nonce ceiling enforced by noiseutil; a tunnel here is deleted locally, not notified.
 	RejectAfterMessages = noiseutil.RejectAfterMessages
 )
 // RehandshakeAfterMessages must stay below RejectAfterMessages so tunnels roll before the hard send stop.
 const _ = RejectAfterMessages - RehandshakeAfterMessages
 // sessionEpoch hands out a receiver-local ordinal to every ConnectionState at creation. The RX
 // staging sort (overlay/batch) orders packets by (epoch, message counter). A re-handshake never
 // rekeys an existing tunnel; it brings up a new hostinfo and ConnectionState with a counter space
 // starting near zero, while the old tunnel keeps decrypting until torn down. During that cutover
 // one flush batch can hold packets from both tunnels, and the epoch keeps the old tunnel's
 // packets sorted first.
 var sessionEpoch atomic.Uint64
 type ConnectionState struct {
-	eKey           noiseutil.CipherState
+	eKey           *NebulaCipherState
-	dKey           noiseutil.CipherState
+	dKey           *NebulaCipherState
 	H              *noise.HandshakeState
 	myCert         cert.Certificate
 	peerCert       *cert.CachedCertificate
 	initiator      bool
 	messageCounter atomic.Uint64
 	window         *Bits
 	decryptLock    sync.Mutex
 	writeLock      sync.Mutex
 	// epoch is this session's sessionEpoch ordinal. Immutable after creation.
 	epoch uint64
 }
-// newConnectionStateFromResult builds a fully-populated ConnectionState from a
+func NewConnectionState(l *logrus.Logger, cs *CertState, crt cert.Certificate, initiator bool, pattern noise.HandshakePattern) (*ConnectionState, error) {
-// completed handshake.Result. It seeds messageCounter and the replay window so
+	var dhFunc noise.DHFunc
-// that the post-handshake message indices already used on the wire don't count
+	switch crt.Curve() {
-// as missed traffic in the data plane.
+	case cert.Curve_CURVE25519:
-func newConnectionStateFromResult(r *handshake.Result) (*ConnectionState, error) {
+		dhFunc = noise.DH25519
-	// Refuse a MessageIndex too big for the replay window: it can only be a bug, and would spin the seed loop below.
+	case cert.Curve_P256:
-	if r.MessageIndex >= ReplayWindow {
+		if cs.pkcs11Backed {
-		return nil, fmt.Errorf("handshake message index %d exceeds replay window", r.MessageIndex)
+			dhFunc = noiseutil.DHP256PKCS11
 		} else {
 			dhFunc = noiseutil.DHP256
 		}
 	default:
 		return nil, fmt.Errorf("invalid curve: %s", crt.Curve())
 	}
 	var ncs noise.CipherSuite
 	if cs.cipher == "chachapoly" {
 		ncs = noise.NewCipherSuite(dhFunc, noise.CipherChaChaPoly, noise.HashSHA256)
 	} else {
 		ncs = noise.NewCipherSuite(dhFunc, noiseutil.CipherAESGCM, noise.HashSHA256)
 	}
 	static := noise.DHKey{Private: cs.privateKey, Public: crt.PublicKey()}
 	hs, err := noise.NewHandshakeState(noise.Config{
 		CipherSuite:   ncs,
 		Random:        rand.Reader,
 		Pattern:       pattern,
 		Initiator:     initiator,
 		StaticKeypair: static,
 		//NOTE: These should come from CertState (pki.go) when we finally implement it
 		PresharedKey:          []byte{},
 		PresharedKeyPlacement: 0,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("NewConnectionState: %s", err)
 	}
 	// The queue and ready params prevent a counter race that would happen when
 	// sending stored packets and simultaneously accepting new traffic.
 	ci := &ConnectionState{
-		myCert:    r.MyCert,
+		H:         hs,
-		initiator: r.Initiator,
+		initiator: initiator,
 		peerCert:  r.RemoteCert,
 		eKey:      noiseutil.NewCipherState(r.EKey, r.Cipher),
 		dKey:      noiseutil.NewCipherState(r.DKey, r.Cipher),
 		window:    NewBits(ReplayWindow),
-		epoch:     sessionEpoch.Add(1),
+		myCert:    crt,
 	}
 	ci.messageCounter.Add(r.MessageIndex)
 	for i := uint64(1); i <= r.MessageIndex; i++ {
 		ci.window.Update(nil, i)
 	}
 	// always start the counter from 2, as packet 1 and packet 2 are handshake packets.
 	ci.messageCounter.Add(2)
 	return ci, nil
 }
@@ -82,67 +86,6 @@ func (cs *ConnectionState) MarshalJSON() ([]byte, error) {
 	})
 }
 // NextMessageCounter reserves the next 1-based counter; RejectAfterMessages is the first we refuse, pinned to not wrap.
 func (cs *ConnectionState) NextMessageCounter() (uint64, bool) {
 	c := cs.messageCounter.Add(1)
 	if c >= RejectAfterMessages {
 		cs.messageCounter.Store(RejectAfterMessages)
 		return c, false
 	}
 	return c, true
 }
 func (cs *ConnectionState) Curve() cert.Curve {
 	return cs.myCert.Curve()
 }
 func (cs *ConnectionState) Decrypt(l *slog.Logger, messageCounter uint64, packet []byte, nb []byte) ([]byte, error) {
 	cs.decryptLock.Lock()
 	result := cs.window.Check(l, messageCounter)
 	cs.decryptLock.Unlock()
 	if !result {
 		return nil, ErrAlreadySeen
 	}
 	out, err := cs.dKey.DecryptDanger(packet[header.Len:header.Len], packet[:header.Len], packet[header.Len:], messageCounter, nb)
 	if err != nil {
 		return nil, err
 	}
 	cs.decryptLock.Lock()
 	result = cs.window.Update(l, messageCounter)
 	cs.decryptLock.Unlock()
 	if !result {
 		return nil, ErrAlreadySeen
 	}
 	return out, nil
 }
 func (cs *ConnectionState) VerifyRelay(l *slog.Logger, messageCounter uint64, packet []byte, nb []byte) error {
 	cs.decryptLock.Lock()
 	result := cs.window.Check(l, messageCounter)
 	cs.decryptLock.Unlock()
 	if !result {
 		return ErrAlreadySeen
 	}
 	// The entire body is sent as AD, not encrypted.
 	// The packet consists of a 16-byte parsed Nebula header, Associated Data-protected payload, and a trailing 16-byte AEAD signature value.
 	// The packet is guaranteed to be at least 16 bytes at this point, b/c it got past the h.Parse() call above. If it's
 	// otherwise malformed (meaning, there is no trailing 16 byte AEAD value), then this will result in at worst a 0-length slice
 	// which will gracefully fail in the DecryptDanger call.
 	signedPayload := packet[:len(packet)-cs.dKey.Overhead()]
 	signatureValue := packet[len(packet)-cs.dKey.Overhead():]
 	_, err := cs.dKey.DecryptDanger(nil, signedPayload, signatureValue, messageCounter, nb)
 	if err != nil {
 		return err
 	}
 	cs.decryptLock.Lock()
 	result = cs.window.Update(l, messageCounter)
 	cs.decryptLock.Unlock()
 	if !result {
 		return ErrAlreadySeen
 	}
 	return nil
 }
@@ -1,192 +0,0 @@
 package nebula
 import (
 	"net/netip"
 	"testing"
 	"time"
 	"github.com/flynn/noise"
 	"github.com/rcrowley/go-metrics"
 	"github.com/slackhq/nebula/cert"
 	ct "github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/handshake"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/test"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // runTestHandshake runs a complete IX handshake between two freshly-built
 // peers and returns the initiator and responder Results. Used to produce
 // real cipher states for tests that need to exercise post-handshake glue.
 func runTestHandshake(t *testing.T) (initR, respR *handshake.Result) {
 	t.Helper()
 	ca, _, caKey, _ := ct.NewTestCaCert(
 		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
 	)
 	caPool := ct.NewTestCAPool(ca)
 	makeCreds := func(name string, networks []netip.Prefix) handshake.GetCredentialFunc {
 		c, _, rawKey, _ := ct.NewTestCert(
 			cert.Version2, cert.Curve_CURVE25519, ca, caKey,
 			name, ca.NotBefore(), ca.NotAfter(), networks, nil, nil,
 		)
 		priv, _, _, err := cert.UnmarshalPrivateKeyFromPEM(rawKey)
 		require.NoError(t, err)
 		hsBytes, err := c.MarshalForHandshakes()
 		require.NoError(t, err)
 		ncs := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
 		cred := handshake.NewCredential(c, hsBytes, priv, ncs)
 		return func(v cert.Version) *handshake.Credential {
 			if v == cert.Version2 {
 				return cred
 			}
 			return nil
 		}
 	}
 	verifier := func(c cert.Certificate) (*cert.CachedCertificate, error) {
 		return caPool.VerifyCertificate(time.Now(), c)
 	}
 	initCreds := makeCreds("initiator", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
 	respCreds := makeCreds("responder", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
 	initM, err := handshake.NewMachine(
 		cert.Version2, initCreds, verifier,
 		func() (uint32, error) { return 1000, nil },
 		true, header.HandshakeIXPSK0,
 	)
 	require.NoError(t, err)
 	respM, err := handshake.NewMachine(
 		cert.Version2, respCreds, verifier,
 		func() (uint32, error) { return 2000, nil },
 		false, header.HandshakeIXPSK0,
 	)
 	require.NoError(t, err)
 	msg1, err := initM.Initiate(nil)
 	require.NoError(t, err)
 	resp, respR, err := respM.ProcessPacket(nil, msg1)
 	require.NoError(t, err)
 	require.NotNil(t, respR)
 	_, initR, err = initM.ProcessPacket(nil, resp)
 	require.NoError(t, err)
 	require.NotNil(t, initR)
 	return initR, respR
 }
 func TestConnectionState_NextMessageCounter(t *testing.T) {
 	cs := &ConnectionState{}
 	cs.messageCounter.Store(RejectAfterMessages - 2)
 	c, ok := cs.NextMessageCounter()
 	assert.True(t, ok)
 	assert.Equal(t, RejectAfterMessages-1, c)
 	// Hitting the limit refuses and pins the counter there
 	c, ok = cs.NextMessageCounter()
 	assert.False(t, ok)
 	assert.Equal(t, RejectAfterMessages, c)
 	assert.Equal(t, RejectAfterMessages, cs.messageCounter.Load())
 	// Continued send attempts stay refused and the counter never wraps
 	for i := 0; i < 10; i++ {
 		_, ok = cs.NextMessageCounter()
 		assert.False(t, ok)
 	}
 	assert.Equal(t, RejectAfterMessages, cs.messageCounter.Load())
 }
 // TestSendNoMetricsDropsExhausted drives the send path to the exhausted drop; metric and out flag prove it.
 func TestSendNoMetricsDropsExhausted(t *testing.T) {
 	initR, _ := runTestHandshake(t)
 	ci, err := newConnectionStateFromResult(initR)
 	require.NoError(t, err)
 	ci.messageCounter.Store(RejectAfterMessages - 1)
 	f := &Interface{l: test.NewLogger(), messageMetrics: &MessageMetrics{txExhausted: metrics.NewCounter()}}
 	hostinfo := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.1")}, ConnectionState: ci}
 	f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, []byte{}, make([]byte, 12), make([]byte, mtu), 0)
 	// The crossing send is refused: it records an exhaustion drop and never reaches connectionManager.Out.
 	assert.Equal(t, int64(1), f.messageMetrics.txExhausted.Count())
 	assert.False(t, hostinfo.sentSinceCheck())
 }
 // TestSendNoMetricsCloseTunnelKeepsRebindEpoch pins that a closing tunnel does not consume a rebind, a later
 // packet on a re-established tunnel still needs that edge to trigger the far-side punch.
 func TestSendNoMetricsCloseTunnelKeepsRebindEpoch(t *testing.T) {
 	initR, _ := runTestHandshake(t)
 	ci, err := newConnectionStateFromResult(initR)
 	require.NoError(t, err)
 	f := &Interface{
 		l:                 test.NewLogger(),
 		messageMetrics:    &MessageMetrics{txExhausted: metrics.NewCounter()},
 		writers:           []udp.Conn{udp.NoopConn{}},
 		connectionManager: &connectionManager{},
 	}
 	hostinfo := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.1")}, ConnectionState: ci}
 	// Tunnel is on epoch 0, then we rebind.
 	hostinfo.markOut(0)
 	f.rebindEpoch.Add(1)
 	remote := netip.MustParseAddrPort("10.0.0.2:4242")
 	f.sendNoMetrics(header.CloseTunnel, 0, ci, hostinfo, remote, []byte{}, make([]byte, 12), make([]byte, mtu), 0)
 	// markOut at the new epoch still reports the move, so the edge was preserved.
 	assert.True(t, hostinfo.markOut(1), "a CloseTunnel send must not consume the rebind epoch")
 }
 func TestNewConnectionStateFromResult(t *testing.T) {
 	initR, respR := runTestHandshake(t)
 	t.Run("initiator", func(t *testing.T) {
 		ci, err := newConnectionStateFromResult(initR)
 		require.NoError(t, err)
 		assert.True(t, ci.initiator)
 		assert.Equal(t, initR.MyCert, ci.myCert)
 		assert.Equal(t, initR.RemoteCert, ci.peerCert)
 		assert.NotNil(t, ci.eKey)
 		assert.NotNil(t, ci.dKey)
 		// IX has 2 handshake messages; the next data-plane send is counter=3.
 		assert.Equal(t, uint64(2), ci.messageCounter.Load(),
 			"messageCounter must equal Result.MessageIndex so the next send is N+1")
 		// Both handshake counters must be marked seen so they don't appear lost.
 		// Check returns false if an index has already been recorded.
 		assert.False(t, ci.window.Check(nil, 1), "counter 1 must already be seen")
 		assert.False(t, ci.window.Check(nil, 2), "counter 2 must already be seen")
 		// Counter 3 is the next data-plane message and must NOT be pre-marked.
 		assert.True(t, ci.window.Check(nil, 3), "counter 3 must not be pre-seeded")
 	})
 	t.Run("message index too large is refused", func(t *testing.T) {
 		bad := *initR
 		bad.MessageIndex = ReplayWindow
 		ci, err := newConnectionStateFromResult(&bad)
 		require.Error(t, err)
 		assert.Nil(t, ci)
 	})
 	t.Run("responder", func(t *testing.T) {
 		ci, err := newConnectionStateFromResult(respR)
 		require.NoError(t, err)
 		assert.False(t, ci.initiator)
 		assert.Equal(t, respR.MyCert, ci.myCert)
 		assert.Equal(t, respR.RemoteCert, ci.peerCert)
 		assert.NotNil(t, ci.eKey)
 		assert.NotNil(t, ci.dKey)
 		assert.Equal(t, uint64(2), ci.messageCounter.Load())
 	})
 }
@@ -3,13 +3,13 @@ package nebula
 import (
 	"context"
 	"errors"
 	"log/slog"
 	"net/netip"
 	"os"
 	"os/signal"
 	"sync"
 	"syscall"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/overlay"
@@ -46,15 +46,13 @@ type Control struct {
 	state     RunState
 	f                      *Interface
-	l                      *slog.Logger
+	l                      *logrus.Logger
 	ctx                    context.Context
 	cancel                 context.CancelFunc
 	sshStart               func()
 	ctlStart               func()
 	statsStart             func()
 	dnsStart               func()
 	lighthouseStart        func()
 	networkChangeStart     func(rebind func())
 	connectionManagerStart func(context.Context)
 }
@@ -71,47 +69,41 @@ type ControlHostInfo struct {
 }
 // Start actually runs nebula, this is a nonblocking call.
-// Use Wait to block until nebula has fully stopped and to learn whether a fatal reader error caused the shutdown.
+// The returned function blocks until nebula has fully stopped and returns the
-func (c *Control) Start() error {
+// first fatal reader error (if any). A nil error means nebula shut down
 // gracefully; a non-nil error means a reader hit an unexpected failure that
 // triggered the shutdown.
 func (c *Control) Start() (func() error, error) {
 	c.stateLock.Lock()
 	defer c.stateLock.Unlock()
 	switch c.state {
 	case StateReady:
 		//yay!
 	case StateStopped, StateStopping:
-		return ErrAlreadyStopped
+		return nil, ErrAlreadyStopped
 	case StateStarted:
-		return ErrAlreadyStarted
+		return nil, ErrAlreadyStarted
 	default:
-		return ErrUnknownState
+		return nil, ErrUnknownState
 	}
 	// Activate the interface
 	err := c.f.activate()
 	if err != nil {
 		// Cancel before Close so a caller returning from Wait always observes a dead Context
 		c.cancel()
 		_ = c.f.Close()
 		c.state = StateStopped
-		return err
+		return nil, err
 	}
 	// Call all the delayed funcs that waited patiently for the interface to be created.
 	if c.sshStart != nil {
 		go c.sshStart()
 	}
 	if c.ctlStart != nil {
 		go c.ctlStart()
 	}
 	if c.statsStart != nil {
 		go c.statsStart()
 	}
 	if c.dnsStart != nil {
 		go c.dnsStart()
 	}
 	if c.networkChangeStart != nil {
 		go c.networkChangeStart(c.RebindUDPServer)
 	}
 	if c.connectionManagerStart != nil {
 		go c.connectionManagerStart(c.ctx)
 	}
@@ -119,12 +111,16 @@ func (c *Control) Start() error {
 		c.lighthouseStart()
 	}
-	c.f.triggerShutdown = func() { go c.Stop() }
+	c.f.triggerShutdown = c.Stop
 	// Start reading packets.
-	c.f.run()
+	out, err := c.f.run()
 	if err != nil {
 		c.state = StateStopped
 		return nil, err
 	}
 	c.state = StateStarted
-	return nil
+	return out, nil
 }
 func (c *Control) State() RunState {
@@ -137,26 +133,10 @@ func (c *Control) Context() context.Context {
 	return c.ctx
 }
-// Stop tears nebula down, closing all tunnels and releasing everything it holds.
+// Stop is a non-blocking call that signals nebula to close all tunnels and shut down
 // Use Wait to block until the shutdown has completed.
 // A Control that has been stopped cannot be started again, Start will return ErrAlreadyStopped.
 func (c *Control) Stop() {
 	c.stateLock.Lock()
-	switch c.state {
+	if c.state != StateStarted {
 	case StateStarted:
 		// Fall through to the full teardown below
 	case StateReady:
 		// Never started
 		c.cancel()
 		c.state = StateStopped
 		if err := c.f.Close(); err != nil {
 			c.l.Error("Close interface failed", "error", err)
 		}
 		c.stateLock.Unlock()
 		return
 	default:
 		c.stateLock.Unlock()
 		// We are stopping or stopped already
 		return
@@ -165,26 +145,19 @@ func (c *Control) Stop() {
 	c.state = StateStopping
 	c.stateLock.Unlock()
-	// Closing tunnels can be slow with a large hostmap, don't hold the lock for it
+	// Stop the handshakeManager (and other services), to prevent new tunnels from
 	// being created while we're shutting them all down.
 	c.cancel()
 	c.CloseAllTunnels(false)
 	c.CloseAllTunnels(false)
 	if err := c.f.Close(); err != nil {
 		c.l.WithError(err).Error("Close interface failed")
 	}
 	c.stateLock.Lock()
 	c.state = StateStopped
 	if err := c.f.Close(); err != nil {
 		c.l.Error("Close interface failed", "error", err)
 	}
 	c.stateLock.Unlock()
 }
 // Wait blocks until nebula has fully stopped, either via Stop or an internal fatal error,
 // and returns the first fatal packet reader error if there was one.
 // It is safe to call from multiple goroutines and at any point in the lifecycle,
 // but a Wait on a Control that is never started and never stopped will block forever.
 func (c *Control) Wait() error {
 	return c.f.wait()
 }
 // ShutdownBlock will listen for and block on term and interrupt signals, calling Control.Stop() once signalled
 func (c *Control) ShutdownBlock() {
 	sigChan := make(chan os.Signal, 1)
@@ -193,30 +166,19 @@ func (c *Control) ShutdownBlock() {
 	rawSig := <-sigChan
 	sig := rawSig.String()
-	c.l.Info("Caught signal, shutting down", "signal", sig)
+	c.l.WithField("signal", sig).Info("Caught signal, shutting down")
 	c.Stop()
 }
-// RebindUDPServer asks the UDP listener to rebind it's listener. Mainly used on mobile clients when interfaces change.
+// RebindUDPServer asks the UDP listener to rebind it's listener. Mainly used on mobile clients when interfaces change
 func (c *Control) RebindUDPServer() {
-	c.stateLock.Lock()
+	_ = c.f.outside.Rebind()
 	defer c.stateLock.Unlock()
 	if c.state != StateStarted {
 		return
 	}
 	// A failure here means we are likely still pinned to the interface we came up on, so the rest of this is
 	// unlikely to help. Say so instead of silently carrying on as if we rebound.
 	if err := c.f.outside.Rebind(); err != nil {
 		c.l.Error("Failed to rebind udp socket", "error", err)
 	}
 	// Trigger a lighthouse update, useful for mobile clients that should have an update interval of 0
 	c.f.lightHouse.SendUpdate()
 	// Let the main interface know that we rebound so that underlying tunnels know to trigger punches from their remotes
-	c.f.rebindEpoch.Add(1)
+	c.f.rebindCount++
 }
 // ListHostmapHosts returns details about the actual or pending (handshaking) hostmap by vpn ip
@@ -341,10 +303,8 @@ func (c *Control) CloseAllTunnels(excludeLighthouses bool) (closed int) {
 		c.f.send(header.CloseTunnel, 0, h.ConnectionState, h, []byte{}, make([]byte, 12, 12), make([]byte, mtu))
 		c.f.closeTunnel(h)
-		c.l.Debug("Sending close tunnel message",
+		c.l.WithField("vpnAddrs", h.vpnAddrs).WithField("udpAddr", h.remote).
-			"vpnAddrs", h.vpnAddrs,
+			Debug("Sending close tunnel message")
 			"udpAddr", h.GetRemote(),
 		)
 		closed++
 	}
@@ -388,7 +348,7 @@ func copyHostInfo(h *HostInfo, preferredRanges []netip.Prefix) ControlHostInfo {
 		RemoteAddrs:            h.remotes.CopyAddrs(preferredRanges),
 		CurrentRelaysToMe:      h.relayState.CopyRelayIps(),
 		CurrentRelaysThroughMe: h.relayState.CopyRelayForIps(),
-		CurrentRemote:          h.GetRemote(),
+		CurrentRemote:          h.remote,
 	}
 	for i, a := range h.vpnAddrs {
@@ -1,309 +0,0 @@
 package nebula
 import (
 	"context"
 	"errors"
 	"io"
 	"net/netip"
 	"sync"
 	"testing"
 	"time"
 	"github.com/gaissmai/bart"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/overlay/batch"
 	"github.com/slackhq/nebula/overlay/tio"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/test"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 type fakeDevice struct {
 	closeOnce sync.Once
 	closedCh  chan struct{}
 	closed    bool
 }
 func newFakeDevice() *fakeDevice {
 	return &fakeDevice{closedCh: make(chan struct{})}
 }
 // Read blocks until Close like a real tun with no traffic, then reports EOF
 // the same way a closed device does
 func (d *fakeDevice) Read() ([]tio.Packet, error) {
 	<-d.closedCh
 	return nil, io.EOF
 }
 func (d *fakeDevice) Write(p []byte) (int, error) { return len(p), nil }
 func (d *fakeDevice) Close() error {
 	d.closeOnce.Do(func() {
 		d.closed = true
 		close(d.closedCh)
 	})
 	return nil
 }
 func (d *fakeDevice) Activate() error                       { return nil }
 func (d *fakeDevice) Networks() []netip.Prefix              { return nil }
 func (d *fakeDevice) Name() string                          { return "fake" }
 func (d *fakeDevice) RoutesFor(netip.Addr) routing.Gateways { return nil }
 func (d *fakeDevice) Queues(int) ([]tio.Queue, error) { return []tio.Queue{d}, nil }
 // newReadyControl hand-builds the minimum Control that Main would have
 // produced right before Start, including the construction token NewInterface
 // takes so waiters block until Close releases the resources
 func newReadyControl(t *testing.T) (*Control, *fakeDevice, *fakeConn) {
 	l := test.NewLogger()
 	dev := newFakeDevice()
 	conn := &fakeConn{}
 	ctx, cancel := context.WithCancel(context.Background())
 	myVpnNet := netip.MustParsePrefix("10.128.0.1/16")
 	nt := new(bart.Lite)
 	nt.Insert(myVpnNet)
 	cs := &CertState{
 		myVpnNetworks:      []netip.Prefix{myVpnNet},
 		myVpnNetworksTable: nt,
 	}
 	lh, err := NewLightHouseFromConfig(ctx, l, config.NewC(l), cs, nil, nil)
 	require.NoError(t, err)
 	f := &Interface{
 		ctx:        ctx,
 		inside:     dev,
 		outside:    conn,
 		writers:    []udp.Conn{conn},
 		batchers:   make([]*batch.MultiCoalescer, 1),
 		routines:   1,
 		hostMap:    newHostMap(l),
 		lightHouse: lh,
 		l:          l,
 	}
 	f.wg.Add(1)
 	return &Control{
 		state:  StateReady,
 		f:      f,
 		l:      l,
 		ctx:    ctx,
 		cancel: cancel,
 	}, dev, conn
 }
 func TestControl_StopBeforeStart(t *testing.T) {
 	c, dev, conn := newReadyControl(t)
 	// A Stop on a never started control must release everything Main acquired
 	c.Stop()
 	assert.Equal(t, StateStopped, c.State())
 	assert.True(t, dev.closed, "the tun device should have been closed")
 	assert.True(t, conn.closed, "the udp socket should have been closed")
 	require.ErrorIs(t, c.ctx.Err(), context.Canceled, "the service context should have been cancelled")
 	// Wait must return promptly now that the resources are released
 	require.NoError(t, c.Wait())
 	// A stopped control can never be started
 	err := c.Start()
 	require.ErrorIs(t, err, ErrAlreadyStopped)
 	// A second Stop is a harmless no-op
 	c.Stop()
 	assert.Equal(t, StateStopped, c.State())
 	require.NoError(t, c.Wait())
 }
 func TestControl_WaitBlocksUntilStop(t *testing.T) {
 	c, _, _ := newReadyControl(t)
 	done := make(chan error, 1)
 	go func() { done <- c.Wait() }()
 	select {
 	case <-done:
 		t.Fatal("Wait returned before Stop")
 	case <-time.After(50 * time.Millisecond):
 	}
 	c.Stop()
 	select {
 	case err := <-done:
 		require.NoError(t, err)
 	case <-time.After(time.Second):
 		t.Fatal("Wait did not return after Stop")
 	}
 }
 type fakeConn struct {
 	closed  bool
 	rebinds int
 }
 func (c *fakeConn) Rebind() error                             { c.rebinds++; return nil }
 func (c *fakeConn) LocalAddr() (netip.AddrPort, error)        { return netip.AddrPort{}, nil }
 func (c *fakeConn) ListenOut(_ udp.EncReader, _ func()) error { return nil }
 func (c *fakeConn) WriteTo(_ []byte, _ netip.AddrPort) error  { return nil }
 func (c *fakeConn) WriteBatch(bufs [][]byte, _ []netip.AddrPort) (int, error) {
 	return len(bufs), nil
 }
 func (c *fakeConn) ReloadConfig(_ *config.C)      {}
 func (c *fakeConn) SupportsMultipleReaders() bool { return true }
 func (c *fakeConn) Close() error                  { c.closed = true; return nil }
 type multiqueueDevice struct {
 	*fakeDevice
 }
 // Queues claims multiqueue support but fails to open the second queue,
 // exercising the activation error path.
 func (d *multiqueueDevice) Queues(n int) ([]tio.Queue, error) {
 	if n > 1 {
 		return nil, errors.New("second queue failed to open")
 	}
 	return d.fakeDevice.Queues(n)
 }
 func TestControl_StartMultiqueueFailureReleases(t *testing.T) {
 	dev := &multiqueueDevice{fakeDevice: newFakeDevice()}
 	conn := &fakeConn{}
 	ctx, cancel := context.WithCancel(context.Background())
 	f := &Interface{
 		ctx:      ctx,
 		inside:   dev,
 		outside:  conn,
 		writers:  []udp.Conn{conn},
 		batchers: make([]*batch.MultiCoalescer, 2),
 		routines: 2,
 		l:        test.NewLogger(),
 	}
 	f.wg.Add(1)
 	c := &Control{
 		state:  StateReady,
 		f:      f,
 		l:      test.NewLogger(),
 		ctx:    ctx,
 		cancel: cancel,
 	}
 	// The second reader fails to open, everything must be released
 	err := c.Start()
 	require.Error(t, err)
 	assert.Equal(t, StateStopped, c.State())
 	assert.True(t, dev.closed, "the tun device should have been closed")
 	assert.True(t, conn.closed, "the udp socket should have been closed")
 	require.ErrorIs(t, c.ctx.Err(), context.Canceled)
 	// And Wait must not hang on the construction token
 	require.NoError(t, c.Wait())
 }
 func TestInterface_CloseIsIdempotent(t *testing.T) {
 	dev := newFakeDevice()
 	f := &Interface{
 		inside: dev,
 		l:      test.NewLogger(),
 	}
 	f.wg.Add(1)
 	require.NoError(t, f.Close())
 	assert.True(t, dev.closed)
 	// A second Close must not double release the wg token or the device
 	require.NoError(t, f.Close())
 	require.NoError(t, f.wait())
 }
 func TestControl_FatalErrorReportsThroughWait(t *testing.T) {
 	c, dev, conn := newReadyControl(t)
 	// Mirror what Start wires up, without needing real packet readers
 	c.f.triggerShutdown = c.Stop
 	c.state = StateStarted
 	boom := errors.New("boom")
 	c.f.onFatal(boom)
 	require.ErrorIs(t, c.Wait(), boom)
 	assert.Equal(t, StateStopped, c.State())
 	assert.True(t, dev.closed)
 	assert.True(t, conn.closed)
 	// A second fatal error must not fire the shutdown again or replace the first
 	c.f.onFatal(errors.New("later"))
 	require.ErrorIs(t, c.Wait(), boom)
 	// Wait stays factual, a Stop after the death does not mask the error
 	c.Stop()
 	require.ErrorIs(t, c.Wait(), boom)
 }
 func TestControl_ConcurrentStopAndStart(t *testing.T) {
 	c, _, _ := newReadyControl(t)
 	var wg sync.WaitGroup
 	for i := 0; i < 2; i++ {
 		wg.Go(func() { c.Stop() })
 	}
 	wg.Go(func() { _ = c.Start() })
 	wg.Go(func() {
 		_ = c.Wait()
 		// A returned Wait must always observe the final state, no matter how
 		// the race resolved
 		assert.Equal(t, StateStopped, c.State())
 	})
 	wg.Wait()
 	// However the race resolves, the control must end fully stopped with no
 	// panic and Wait must observe the final state
 	require.NoError(t, c.Wait())
 	assert.Equal(t, StateStopped, c.State())
 	err := c.Start()
 	require.ErrorIs(t, err, ErrAlreadyStopped)
 }
 func TestControl_StartStopLifecycle(t *testing.T) {
 	c, dev, conn := newReadyControl(t)
 	err := c.Start()
 	require.NoError(t, err)
 	assert.Equal(t, StateStarted, c.State())
 	err = c.Start()
 	require.ErrorIs(t, err, ErrAlreadyStarted)
 	// Stop must unpark the reader blocked in the device and release everything
 	c.Stop()
 	assert.Equal(t, StateStopped, c.State())
 	assert.True(t, dev.closed, "the tun device should have been closed")
 	assert.True(t, conn.closed, "the udp socket should have been closed")
 	require.ErrorIs(t, c.ctx.Err(), context.Canceled)
 	// The reader drained off a closed device, that is not a fatal error
 	require.NoError(t, c.Wait())
 	err = c.Start()
 	require.ErrorIs(t, err, ErrAlreadyStopped)
 }
 func TestControl_RebindIsGatedByState(t *testing.T) {
 	c, _, conn := newReadyControl(t)
 	// A rebind before Start reaches nothing, the interface is not up
 	c.RebindUDPServer()
 	assert.Equal(t, 0, conn.rebinds, "rebind before start must be a no-op")
 	err := c.Start()
 	require.NoError(t, err)
 	c.RebindUDPServer()
 	assert.Equal(t, 1, conn.rebinds, "rebind while started must reach the conn")
 	// A rebind racing a completed stop must not touch the closed conn
 	c.Stop()
 	require.NoError(t, c.Wait())
 	c.RebindUDPServer()
 	assert.Equal(t, 1, conn.rebinds, "rebind after stop must be a no-op")
 }
@@ -1,17 +1,15 @@
 package nebula
 import (
 	"bytes"
 	"log/slog"
 	"net"
 	"net/netip"
 	"reflect"
 	"testing"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func TestControl_GetHostInfoByVpnIp(t *testing.T) {
@@ -45,7 +43,8 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 	assert.True(t, ok)
 	crt := &dummyCert{}
-	hi := &HostInfo{
+	hm.unlockedAddHostInfo(&HostInfo{
 		remote:  remote1,
 		remotes: remotes,
 		ConnectionState: &ConnectionState{
 			peerCert: &cert.CachedCertificate{Certificate: crt},
@@ -58,14 +57,13 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 			relayForByAddr: map[netip.Addr]*Relay{},
 			relayForByIdx:  map[uint32]*Relay{},
 		},
-	}
+	}, &Interface{})
 	hi.remote.Store(&remote1)
 	hm.unlockedAddHostInfo(hi, &Interface{})
 	vpnIp2, ok := netip.AddrFromSlice(ipNet2.IP)
 	assert.True(t, ok)
-	hi2 := &HostInfo{
+	hm.unlockedAddHostInfo(&HostInfo{
 		remote:  remote1,
 		remotes: remotes,
 		ConnectionState: &ConnectionState{
 			peerCert: nil,
@@ -78,16 +76,14 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 			relayForByAddr: map[netip.Addr]*Relay{},
 			relayForByIdx:  map[uint32]*Relay{},
 		},
-	}
+	}, &Interface{})
 	hi2.remote.Store(&remote1)
 	hm.unlockedAddHostInfo(hi2, &Interface{})
 	c := Control{
 		state: StateReady,
 		f: &Interface{
 			hostMap: hm,
 		},
-		l: test.NewLogger(),
+		l: logrus.New(),
 	}
 	thi := c.GetHostInfoByVpnAddr(vpnIp, false)
@@ -124,153 +120,3 @@ func assertFields(t *testing.T, expected []string, actualStruct any) {
 	assert.Equal(t, expected, fields)
 }
 // alwaysAllowV4/V6 are check funcs that accept every entry (including nil pointers),
 // letting us inject a nil *V4AddrPort/*V6AddrPort into a RemoteList's reported cache
 // the same way a malformed proto message off the wire could.
 func alwaysAllowV4(netip.Addr, *V4AddrPort) bool { return true }
 func alwaysAllowV6(netip.Addr, *V6AddrPort) bool { return true }
 // TestGetRelays_SkipsNilRelayAddrs proves GetRelays tolerates nil entries in the
 // RelayVpnAddrs proto slice (which protoAddrToNetAddr would nil-deref on) and still
 // returns the valid relays, including the legacy OldRelayVpnAddrs.
 func TestGetRelays_SkipsNilRelayAddrs(t *testing.T) {
 	good := netip.MustParseAddr("10.0.0.9")
 	d := &NebulaMetaDetails{
 		OldRelayVpnAddrs: []uint32{0x0a000001}, // 10.0.0.1
 		RelayVpnAddrs: []*Addr{
 			nil,
 			netAddrToProtoAddr(good),
 			nil,
 		},
 	}
 	var relays []netip.Addr
 	require.NotPanics(t, func() { relays = d.GetRelays() })
 	assert.Equal(t, []netip.Addr{
 		netip.MustParseAddr("10.0.0.1"),
 		good,
 	}, relays)
 }
 // TestGetRelays_AllNil ensures an all-nil RelayVpnAddrs slice yields no relays and no panic.
 func TestGetRelays_AllNil(t *testing.T) {
 	d := &NebulaMetaDetails{RelayVpnAddrs: []*Addr{nil, nil}}
 	var relays []netip.Addr
 	require.NotPanics(t, func() { relays = d.GetRelays() })
 	assert.Empty(t, relays)
 }
 // TestRemoteList_CopyCache_SkipsNilReported proves CopyCache skips nil reported
 // pointers (v4 and v6) instead of nil-dereferencing them in protoV*AddrPortToNetAddrPort.
 func TestRemoteList_CopyCache_SkipsNilReported(t *testing.T) {
 	owner := netip.MustParseAddr("10.0.0.1")
 	rl := NewRemoteList([]netip.Addr{owner}, nil)
 	rl.unlockedSetV4(owner, owner, []*V4AddrPort{
 		nil,
 		newIp4AndPortFromString("1.2.3.4:5"),
 		nil,
 	}, alwaysAllowV4)
 	rl.unlockedSetV6(owner, owner, []*V6AddrPort{
 		nil,
 		newIp6AndPortFromString("[1::1]:6"),
 		nil,
 	}, alwaysAllowV6)
 	var cm *CacheMap
 	require.NotPanics(t, func() { cm = rl.CopyCache() })
 	c := (*cm)[owner.String()]
 	require.NotNil(t, c)
 	assert.ElementsMatch(t, []netip.AddrPort{
 		netip.MustParseAddrPort("1.2.3.4:5"),
 		netip.MustParseAddrPort("[1::1]:6"),
 	}, c.Reported)
 }
 // TestRemoteList_Rebuild_SkipsNilReported drives unlockedCollect (via Rebuild) with
 // nil reported entries and confirms only the valid addresses survive, with no panic.
 func TestRemoteList_Rebuild_SkipsNilReported(t *testing.T) {
 	owner := netip.MustParseAddr("10.0.0.1")
 	rl := NewRemoteList([]netip.Addr{owner}, nil)
 	rl.unlockedSetV4(owner, owner, []*V4AddrPort{
 		nil,
 		newIp4AndPortFromString("1.2.3.4:5"),
 	}, alwaysAllowV4)
 	rl.unlockedSetV6(owner, owner, []*V6AddrPort{
 		newIp6AndPortFromString("[1::1]:6"),
 		nil,
 	}, alwaysAllowV6)
 	require.NotPanics(t, func() { rl.Rebuild([]netip.Prefix{}) })
 	assert.ElementsMatch(t, []netip.AddrPort{
 		netip.MustParseAddrPort("1.2.3.4:5"),
 		netip.MustParseAddrPort("[1::1]:6"),
 	}, rl.addrs)
 }
 // newRelayControl marshals a NebulaControl the way it arrives on the wire so we can feed
 // it through HandleControlMsg's unmarshal + validate path.
 func newRelayControl(t *testing.T, typ NebulaControl_MessageType, from, to *Addr) []byte {
 	t.Helper()
 	msg := &NebulaControl{
 		Type:          typ,
 		RelayFromAddr: from,
 		RelayToAddr:   to,
 	}
 	b, err := msg.Marshal()
 	require.NoError(t, err)
 	return b
 }
 // TestRelayManager_HandleControlMsg_NilRelayAddrs verifies the validation block added to
 // HandleControlMsg: CreateRelay{Request,Response} carrying a nil RelayFromAddr or
 // RelayToAddr are dropped with a debug log rather than nil-dereferencing downstream.
 func TestRelayManager_HandleControlMsg_NilRelayAddrs(t *testing.T) {
 	good := netAddrToProtoAddr(netip.MustParseAddr("10.0.0.9"))
 	cases := []struct {
 		name    string
 		typ     NebulaControl_MessageType
 		from    *Addr
 		to      *Addr
 		wantLog string // debug substring expected, "" == expect no drop log
 	}{
 		{"request nil from", NebulaControl_CreateRelayRequest, nil, good, "nil RelayFromAddr"},
 		{"request nil to", NebulaControl_CreateRelayRequest, good, nil, "nil RelayToAddr"},
 		{"request both nil", NebulaControl_CreateRelayRequest, nil, nil, "nil RelayFromAddr"},
 		{"response nil from", NebulaControl_CreateRelayResponse, nil, good, "nil RelayFromAddr"},
 		{"response nil to", NebulaControl_CreateRelayResponse, good, nil, "nil RelayToAddr"},
 		// A non-relay control type is not subject to the relay-addr validation and must
 		// pass through it untouched (the final switch simply no-ops on it).
 		{"unrelated type nil addrs", NebulaControl_None, nil, nil, ""},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			var buf bytes.Buffer
 			l := test.NewLoggerWithOutputAndLevel(&buf, slog.LevelDebug)
 			rm := &relayManager{l: l, hostmap: newHostMap(l)}
 			rm.useRelays.Store(true)
 			f := &Interface{l: l}
 			h := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.2")}, localIndexId: 1}
 			d := newRelayControl(t, tc.typ, tc.from, tc.to)
 			require.NotPanics(t, func() { rm.HandleControlMsg(h, d, f) })
 			if tc.wantLog == "" {
 				assert.NotContains(t, buf.String(), "nil Relay")
 			} else {
 				assert.Contains(t, buf.String(), tc.wantLog)
 			}
 		})
 	}
 }
@@ -5,6 +5,8 @@ package nebula
 import (
 	"net/netip"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/udp"
@@ -20,9 +22,7 @@ func (c *Control) WaitForType(msgType header.MessageType, subType header.Message
 			panic(err)
 		}
 		pipeTo.InjectUDPPacket(p)
-		match := h.Type == msgType && h.Subtype == subType
+		if h.Type == msgType && h.Subtype == subType {
 		p.Release()
 		if match {
 			return
 		}
 	}
@@ -38,9 +38,7 @@ func (c *Control) WaitForTypeByIndex(toIndex uint32, msgType header.MessageType,
 			panic(err)
 		}
 		pipeTo.InjectUDPPacket(p)
-		match := h.RemoteIndex == toIndex && h.Type == msgType && h.Subtype == subType
+		if h.RemoteIndex == toIndex && h.Type == msgType && h.Subtype == subType {
 		p.Release()
 		if match {
 			return
 		}
 	}
@@ -92,15 +90,65 @@ func (c *Control) GetTunTxChan() <-chan []byte {
 	return c.f.inside.(*overlay.TestTun).TxPackets
 }
-// InjectUDPPacket injects a packet into the udp side. We copy internally so the caller keeps ownership of p.
+// InjectUDPPacket will inject a packet into the udp side of nebula
 // The copy comes from the freelist so steady-state alloc is zero.
 func (c *Control) InjectUDPPacket(p *udp.Packet) {
-	c.f.outside.(*udp.TesterConn).Send(p.Copy())
+	c.f.outside.(*udp.TesterConn).Send(p)
 }
-// InjectTunPacket pushes an IP packet onto the tun interface.
+// InjectTunUDPPacket puts a udp packet on the tun interface. Using UDP here because it's a simpler protocol
-func (c *Control) InjectTunPacket(packet []byte) {
+func (c *Control) InjectTunUDPPacket(toAddr netip.Addr, toPort uint16, fromAddr netip.Addr, fromPort uint16, data []byte) {
-	c.f.inside.(*overlay.TestTun).Send(packet)
+	serialize := make([]gopacket.SerializableLayer, 0)
 	var netLayer gopacket.NetworkLayer
 	if toAddr.Is6() {
 		if !fromAddr.Is6() {
 			panic("Cant send ipv6 to ipv4")
 		}
 		ip := &layers.IPv6{
 			Version:    6,
 			NextHeader: layers.IPProtocolUDP,
 			SrcIP:      fromAddr.Unmap().AsSlice(),
 			DstIP:      toAddr.Unmap().AsSlice(),
 		}
 		serialize = append(serialize, ip)
 		netLayer = ip
 	} else {
 		if !fromAddr.Is4() {
 			panic("Cant send ipv4 to ipv6")
 		}
 		ip := &layers.IPv4{
 			Version:  4,
 			TTL:      64,
 			Protocol: layers.IPProtocolUDP,
 			SrcIP:    fromAddr.Unmap().AsSlice(),
 			DstIP:    toAddr.Unmap().AsSlice(),
 		}
 		serialize = append(serialize, ip)
 		netLayer = ip
 	}
 	udp := layers.UDP{
 		SrcPort: layers.UDPPort(fromPort),
 		DstPort: layers.UDPPort(toPort),
 	}
 	err := udp.SetNetworkLayerForChecksum(netLayer)
 	if err != nil {
 		panic(err)
 	}
 	buffer := gopacket.NewSerializeBuffer()
 	opt := gopacket.SerializeOptions{
 		ComputeChecksums: true,
 		FixLengths:       true,
 	}
 	serialize = append(serialize, &udp, gopacket.Payload(data))
 	err = gopacket.SerializeLayers(buffer, opt, serialize...)
 	if err != nil {
 		panic(err)
 	}
 	c.f.inside.(*overlay.TestTun).Send(buffer.Bytes())
 }
 func (c *Control) GetVpnAddrs() []netip.Addr {
@@ -108,29 +156,7 @@ func (c *Control) GetVpnAddrs() []netip.Addr {
 }
 func (c *Control) GetUDPAddr() netip.AddrPort {
-	return c.f.outside.(*udp.TesterConn).GetAddr()
+	return c.f.outside.(*udp.TesterConn).Addr
 }
 // SetUDPAddr moves this node to a new underlay address, standing in for a laptop waking up on a different
 // network. Register the new address with the router as well or nothing will route back.
 func (c *Control) SetUDPAddr(addr netip.AddrPort) {
 	c.f.outside.(*udp.TesterConn).SetAddr(addr)
 }
 // SetLocalAddrsFn replaces underlay address discovery so a test can advertise its simulated address instead of
 // whatever this machine's NICs happen to be. Call it before Start, SendUpdate reads it from the update worker.
 func (c *Control) SetLocalAddrsFn(fn func(*LocalAllowList) []netip.Addr) {
 	c.f.lightHouse.localAddrsFn = fn
 }
 // GetRebindEpochFor returns the rebind epoch a tunnel last sent under, so a test can tell whether a send
 // consumed the epoch edge without having to infer it from lighthouse traffic.
 func (c *Control) GetRebindEpochFor(vpnAddr netip.Addr) (uint32, bool) {
 	h := c.f.hostMap.QueryVpnAddr(vpnAddr)
 	if h == nil {
 		return 0, false
 	}
 	return h.state.Load() >> stateEpochShift, true
 }
 func (c *Control) KillPendingTunnel(vpnIp netip.Addr) bool {
@@ -147,14 +173,6 @@ func (c *Control) GetHostmap() *HostMap {
 	return c.f.hostMap
 }
 // GetHostmapIndexCount returns the number of entries in the main hostmap Indexes table, holding
 // the hostmap read lock so tests can poll it while connection manager churns tunnels.
 func (c *Control) GetHostmapIndexCount() int {
 	c.f.hostMap.RLock()
 	defer c.f.hostMap.RUnlock()
 	return len(c.f.hostMap.Indexes)
 }
 func (c *Control) GetF() *Interface {
 	return c.f
 }
@@ -1,187 +0,0 @@
 // Package cpupick chooses which CPUs the tun reader threads pin to when the
 // operator has not chosen for us (tun.cpu_affinity). The stock spread —
 // allowed[i] for routine i — has two failure modes this package exists to fix:
 //
 //   - every co-located nebula starts its spread at allowed[0], so N instances
 //     on one box stack their readers onto the same cores, and allowed[0] is
 //     usually CPU 0, the core housekeeping and default IRQ affinity already
 //     favor;
 //   - on heterogeneous CPUs (ARM big.LITTLE, Intel P/E hybrids, AMD compact
 //     cores) low IDs are not necessarily fast cores, and pinning an encrypt
 //     thread to an efficiency core caps that queue's throughput.
 //
 // Default instead returns a preference-ordered pin list: the allowed set
 // filtered to performance cores (when the platform distinguishes them and
 // enough remain for every routine), confined to a single NUMA node and spread
 // across distinct physical cores when the topology permits, CPU 0's physical
 // core demoted to last resort, and the order rotated by a stable per-instance
 // key so co-located instances spread instead of stacking.
 package cpupick
 import (
 	"log/slog"
 	"github.com/slackhq/nebula/util"
 )
 // topology is the slice of machine layout arrange consults: the NUMA node
 // and the physical core behind each candidate CPU, plus which core CPU 0
 // lives on (zeroCore, -1 when unknown — tracked separately because CPU 0's
 // SMT sibling deserves demotion even when CPU 0 itself isn't a candidate).
 // Probed from sysfs on Linux; flatTopology stands in when the platform can't
 // say, which turns every topology rule into a no-op rather than a wrong
 // answer.
 type topology struct {
 	nodeOf   map[int]int
 	coreOf   map[int]int
 	zeroCore int
 }
 // flatTopology places every CPU on node 0 and on a physical core of its own.
 func flatTopology(cpus []int) topology {
 	t := topology{
 		nodeOf:   make(map[int]int, len(cpus)),
 		coreOf:   make(map[int]int, len(cpus)),
 		zeroCore: -1,
 	}
 	for i, c := range cpus {
 		t.nodeOf[c] = 0
 		t.coreOf[c] = i
 		if c == 0 {
 			t.zeroCore = i
 		}
 	}
 	return t
 }
 // Default computes the pin order for `routines` tun readers. key is any
 // stable per-instance value; the bound UDP port is ideal — distinct across
 // co-located instances, stable across restarts so benchmark runs stay
 // comparable. Returns nil when there is nothing useful to say (no affinity
 // support on this platform, lookup failure); callers keep their existing
 // fallback spread.
 func Default(routines int, key uint64, l *slog.Logger) []int {
 	allowed, err := util.AllowedCPUs()
 	if err != nil || len(allowed) == 0 {
 		return nil
 	}
 	perf, signal := perfCPUs(allowed)
 	cands := pickCandidates(allowed, perf, routines)
 	if len(cands) == 0 {
 		return nil
 	}
 	if len(perf) < routines {
 		signal = ""
 	}
 	cpus := arrange(cands, readTopology(cands), routines, splitmix64(key))
 	if l != nil {
 		l.Info("chose default pin CPUs for tun readers",
 			"cpus", cpus[:min(routines, len(cpus))],
 			"perfSignal", signal)
 	}
 	return cpus
 }
 // pickCandidates applies the enough-for-everyone guard: a perf filter that
 // leaves fewer candidates than routines is discarded — giving every reader
 // its own (possibly slow) core beats stacking two readers on a fast one.
 func pickCandidates(allowed, perf []int, routines int) []int {
 	if len(perf) < routines {
 		return allowed
 	}
 	return perf
 }
 // arrange turns the candidate set into the final pin order:
 //
 //  1. NUMA: when at least one node holds enough candidates for every
 //     routine, confine to one such node, chosen by the instance hash. The
 //     readers share hostmap and cipher state, so splitting one instance
 //     across nodes taxes every packet — and co-located instances that hash
 //     to different nodes stop competing entirely. When no node is big
 //     enough, span nodes rather than stack readers.
 //  2. Rotate the preferred candidates by the hash so instances spread.
 //  3. SMT: emit one thread per physical core before any of their siblings —
 //     two encrypt threads on one core split its execution units. Siblings
 //     still follow for the routines > cores case.
 //  4. CPU 0's whole physical core goes last: housekeeping and default IRQ
 //     noise on CPU 0 bleeds into its SMT sibling too. Within that tail the
 //     sibling precedes CPU 0 itself, which only catches the bleed-through.
 //
 // The rotation happens before the SMT pass so each instance's one-per-core
 // walk also starts at a different core, and CPU 0's core is excluded from
 // the rotation so no hash value can put it back at the front.
 func arrange(cands []int, topo topology, routines int, h uint64) []int {
 	byNode := map[int][]int{}
 	var nodes []int
 	for _, c := range cands {
 		n := topo.nodeOf[c]
 		if _, ok := byNode[n]; !ok {
 			nodes = append(nodes, n)
 		}
 		byNode[n] = append(byNode[n], c)
 	}
 	var eligible []int
 	for _, n := range nodes {
 		if len(byNode[n]) >= routines {
 			eligible = append(eligible, n)
 		}
 	}
 	if len(eligible) > 0 {
 		cands = byNode[eligible[int(h%uint64(len(eligible)))]]
 	}
 	// Split off CPU 0's core: its siblings tail the list, CPU 0 tails them.
 	preferred := make([]int, 0, len(cands))
 	var zeroTail []int
 	hasZero := false
 	for _, c := range cands {
 		switch {
 		case c == 0:
 			hasZero = true
 		case topo.zeroCore >= 0 && topo.coreOf[c] == topo.zeroCore:
 			zeroTail = append(zeroTail, c)
 		default:
 			preferred = append(preferred, c)
 		}
 	}
 	if hasZero {
 		zeroTail = append(zeroTail, 0)
 	}
 	if len(preferred) == 0 {
 		return zeroTail // CPU 0's core is all we have
 	}
 	// The node pick consumed the low hash bits; rotate by the high ones so
 	// the two choices stay independent.
 	off := int((h >> 32) % uint64(len(preferred)))
 	rot := make([]int, 0, len(preferred))
 	rot = append(rot, preferred[off:]...)
 	rot = append(rot, preferred[:off]...)
 	seenCore := make(map[int]bool, len(rot))
 	out := make([]int, 0, len(cands))
 	var siblings []int
 	for _, c := range rot {
 		g := topo.coreOf[c]
 		if seenCore[g] {
 			siblings = append(siblings, c)
 			continue
 		}
 		seenCore[g] = true
 		out = append(out, c)
 	}
 	out = append(out, siblings...)
 	out = append(out, zeroTail...)
 	return out
 }
 // splitmix64 decorrelates instance keys before the selection modulos: ports
 // on one box often share spacing (4242/4243, or round steps like +1000) that
 // raw key%len arithmetic would fold onto the same offset.
 func splitmix64(x uint64) uint64 {
 	x += 0x9e3779b97f4a7c15
 	x = (x ^ (x >> 30)) * 0xbf58476d1ce4e5b9
 	x = (x ^ (x >> 27)) * 0x94d049bb133111eb
 	return x ^ (x >> 31)
 }
@@ -1,171 +0,0 @@
 package cpupick
 import (
 	"slices"
 	"testing"
 )
 // pairTopo builds a topology where consecutive candidate pairs are SMT
 // siblings: (cpus[0],cpus[1]) share a core, (cpus[2],cpus[3]) the next, ...
 // All CPUs land on node 0.
 func pairTopo(cpus []int) topology {
 	t := topology{
 		nodeOf:   make(map[int]int, len(cpus)),
 		coreOf:   make(map[int]int, len(cpus)),
 		zeroCore: -1,
 	}
 	for i, c := range cpus {
 		t.nodeOf[c] = 0
 		t.coreOf[c] = i / 2
 		if c == 0 {
 			t.zeroCore = i / 2
 		}
 	}
 	return t
 }
 func TestArrangeDemotesZeroForEveryKey(t *testing.T) {
 	candidates := []int{0, 1, 2, 3, 4, 5, 6, 7}
 	for key := range uint64(64) {
 		got := arrange(candidates, flatTopology(candidates), 4, splitmix64(key))
 		if len(got) != len(candidates) {
 			t.Fatalf("key %d: len=%d want %d", key, len(got), len(candidates))
 		}
 		if got[0] == 0 {
 			t.Errorf("key %d: CPU 0 at the front: %v", key, got)
 		}
 		if got[len(got)-1] != 0 {
 			t.Errorf("key %d: CPU 0 not demoted to last: %v", key, got)
 		}
 		sorted := slices.Clone(got)
 		slices.Sort(sorted)
 		if !slices.Equal(sorted, candidates) {
 			t.Errorf("key %d: not a permutation: %v", key, got)
 		}
 	}
 }
 func TestArrangeDemotesZeroSiblings(t *testing.T) {
 	// Pairs (0,1),(2,3),(4,5),(6,7): CPU 0's core — 0 and its sibling 1 —
 	// must tail the list, sibling ahead of 0 itself.
 	candidates := []int{0, 1, 2, 3, 4, 5, 6, 7}
 	for key := range uint64(64) {
 		got := arrange(candidates, pairTopo(candidates), 2, splitmix64(key))
 		n := len(got)
 		if got[n-1] != 0 || got[n-2] != 1 {
 			t.Fatalf("key %d: tail = %v, want [... 1 0]", key, got)
 		}
 	}
 }
 func TestArrangeZeroSiblingWithoutZero(t *testing.T) {
 	// CPU 0 excluded (cpuset) but its sibling 1 remains: the sibling still
 	// tails the list when the topology knows which core CPU 0 lives on.
 	candidates := []int{1, 2, 3, 4, 5}
 	topo := pairTopo([]int{0, 1, 2, 3, 4, 5})
 	got := arrange(candidates, topo, 2, splitmix64(7))
 	if got[len(got)-1] != 1 {
 		t.Errorf("CPU 0's sibling not demoted: %v", got)
 	}
 }
 func TestArrangeRotatesByKey(t *testing.T) {
 	candidates := []int{1, 2, 3, 4, 5, 6, 7, 8}
 	seen := map[int]bool{}
 	for key := range uint64(64) {
 		seen[arrange(candidates, flatTopology(candidates), 4, splitmix64(key))[0]] = true
 	}
 	// 64 hashed keys over 8 slots must hit more than one starting CPU, or
 	// co-located instances would all stack again.
 	if len(seen) < 2 {
 		t.Errorf("rotation never varied across keys: %v", seen)
 	}
 }
 func TestArrangeStableForSameKey(t *testing.T) {
 	candidates := []int{0, 2, 4, 6}
 	topo := flatTopology(candidates)
 	a := arrange(candidates, topo, 2, splitmix64(4242))
 	b := arrange(candidates, topo, 2, splitmix64(4242))
 	if !slices.Equal(a, b) {
 		t.Errorf("same key ordered differently: %v vs %v", a, b)
 	}
 }
 func TestArrangeZeroOnly(t *testing.T) {
 	if got := arrange([]int{0}, flatTopology([]int{0}), 1, splitmix64(7)); !slices.Equal(got, []int{0}) {
 		t.Errorf("sole CPU 0 must survive: %v", got)
 	}
 }
 func TestArrangeSMTSiblingsLast(t *testing.T) {
 	// Pairs (1,2),(3,4),(5,6),(7,8): the first four picks must cover four
 	// distinct physical cores before any sibling repeats.
 	candidates := []int{1, 2, 3, 4, 5, 6, 7, 8}
 	topo := pairTopo(candidates)
 	for key := range uint64(16) {
 		got := arrange(candidates, topo, 4, splitmix64(key))
 		seen := map[int]bool{}
 		for _, c := range got[:4] {
 			g := topo.coreOf[c]
 			if seen[g] {
 				t.Fatalf("key %d: sibling before all cores covered: %v", key, got)
 			}
 			seen[g] = true
 		}
 	}
 }
 func TestArrangeNUMAConfinesToOneNode(t *testing.T) {
 	// Two nodes of four; both fit routines=3, so the result must sit
 	// entirely inside one of them, and the hash must pick both across keys.
 	candidates := []int{1, 2, 3, 4, 10, 11, 12, 13}
 	topo := flatTopology(candidates)
 	for _, c := range []int{10, 11, 12, 13} {
 		topo.nodeOf[c] = 1
 	}
 	nodesSeen := map[int]bool{}
 	for key := range uint64(32) {
 		got := arrange(candidates, topo, 3, splitmix64(key))
 		if len(got) != 4 {
 			t.Fatalf("key %d: not confined to one node: %v", key, got)
 		}
 		n := topo.nodeOf[got[0]]
 		for _, c := range got {
 			if topo.nodeOf[c] != n {
 				t.Fatalf("key %d: spans nodes: %v", key, got)
 			}
 		}
 		nodesSeen[n] = true
 	}
 	if len(nodesSeen) != 2 {
 		t.Errorf("hash never spread instances across nodes: %v", nodesSeen)
 	}
 }
 func TestArrangeNUMASpansWhenNoNodeFits(t *testing.T) {
 	candidates := []int{1, 2, 3, 4, 10, 11, 12, 13}
 	topo := flatTopology(candidates)
 	for _, c := range []int{10, 11, 12, 13} {
 		topo.nodeOf[c] = 1
 	}
 	got := arrange(candidates, topo, 6, splitmix64(1))
 	if len(got) != len(candidates) {
 		t.Errorf("undersized nodes must span, got %v", got)
 	}
 }
 func TestPickCandidates(t *testing.T) {
 	allowed := []int{0, 1, 2, 3, 4, 5, 6, 7}
 	perf := []int{4, 5}
 	// Enough perf cores for every routine: only they are used.
 	if got := pickCandidates(allowed, perf, 2); !slices.Equal(got, perf) {
 		t.Errorf("perf filter not applied: %v", got)
 	}
 	// Perf filter too small for the routine count: discarded, everyone
 	// gets their own core from the full allowed set.
 	if got := pickCandidates(allowed, perf, 4); !slices.Equal(got, allowed) {
 		t.Errorf("undersized perf filter not discarded: %v", got)
 	}
 }
@@ -1,154 +0,0 @@
 //go:build linux
 package cpupick
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 )
 // capacityKeepPct is the cpu_capacity admission threshold, relative to the
 // fastest allowed core. LITTLE cores are normalized to ~250-400 of the big
 // core's 1024 while mid cores sit at ~75%+, so half of max separates little
 // from the rest without splitting prime from mid on three-tier parts.
 const capacityKeepPct = 50
 // freqKeepPct is the cpuinfo_max_freq admission threshold. Favored-core
 // turbo skew is 2-4% and ARM mid-vs-prime ~12%, while E-cores, LITTLE
 // cores, and AMD compact cores all sit >= 20% below their siblings' max.
 const freqKeepPct = 85
 // perfCPUs partitions allowed into the subset that are "performance" cores,
 // consulting (in order of authority):
 //
 //  1. cpu_capacity — arch_topology's normalized per-CPU capacity, exposed on
 //     arm/arm64/riscv; the scheduler's own view of big vs LITTLE.
 //  2. /sys/devices/cpu_core/cpus — the Intel hybrid P-core PMU mask, present
 //     only on P/E parts (x86 has no cpu_capacity) and naming P cores outright.
 //  3. cpuinfo_max_freq — the cross-vendor fallback; catches AMD compact
 //     cores, which neither of the above covers.
 //
 // Returns allowed unchanged (signal "") when nothing distinguishes the
 // cores: homogeneous parts, VMs without cpufreq, sysfs unavailable.
 func perfCPUs(allowed []int) ([]int, string) {
 	return perfCPUsFrom("/sys/devices/system/cpu", "/sys/devices/cpu_core/cpus", allowed)
 }
 func perfCPUsFrom(cpuDir, intelCoreMask string, allowed []int) ([]int, string) {
 	if cpus, ok := byPerCPUValue(cpuDir, "cpu_capacity", allowed, capacityKeepPct); ok {
 		return cpus, "cpu_capacity"
 	}
 	if cpus, ok := byIntelCoreMask(intelCoreMask, allowed); ok {
 		return cpus, "intel_core_pmu"
 	}
 	if cpus, ok := byPerCPUValue(cpuDir, "cpufreq/cpuinfo_max_freq", allowed, freqKeepPct); ok {
 		return cpus, "max_freq"
 	}
 	return allowed, ""
 }
 // byPerCPUValue keeps the allowed CPUs whose per-CPU sysfs value is at least
 // keepPct percent of the maximum across allowed. Inconclusive (ok=false)
 // when any CPU is missing the file or when every value is equal.
 func byPerCPUValue(cpuDir, file string, allowed []int, keepPct int) ([]int, bool) {
 	vals := make([]int, len(allowed))
 	minV, maxV := 0, 0
 	for i, cpu := range allowed {
 		v, err := readIntFile(filepath.Join(cpuDir, fmt.Sprintf("cpu%d", cpu), file))
 		if err != nil {
 			return nil, false
 		}
 		vals[i] = v
 		if i == 0 || v < minV {
 			minV = v
 		}
 		if v > maxV {
 			maxV = v
 		}
 	}
 	if minV == maxV {
 		return nil, false // homogeneous by this signal; try the next one
 	}
 	keep := make([]int, 0, len(allowed))
 	for i, cpu := range allowed {
 		if vals[i]*100 >= maxV*keepPct {
 			keep = append(keep, cpu)
 		}
 	}
 	return keep, true
 }
 // byIntelCoreMask keeps the allowed CPUs named by the hybrid P-core PMU
 // mask. Inconclusive when the file is absent (non-hybrid x86, other arches)
 // or no allowed CPU is in the mask (the process was deliberately confined
 // to E-cores; nothing useful to prefer within that).
 func byIntelCoreMask(maskPath string, allowed []int) ([]int, bool) {
 	b, err := os.ReadFile(maskPath)
 	if err != nil {
 		return nil, false
 	}
 	set, err := parseCPUList(strings.TrimSpace(string(b)))
 	if err != nil || len(set) == 0 {
 		return nil, false
 	}
 	pcore := make(map[int]bool, len(set))
 	for _, c := range set {
 		pcore[c] = true
 	}
 	keep := make([]int, 0, len(allowed))
 	for _, cpu := range allowed {
 		if pcore[cpu] {
 			keep = append(keep, cpu)
 		}
 	}
 	if len(keep) == 0 {
 		return nil, false
 	}
 	return keep, true
 }
 // parseCPUList decodes the kernel's cpulist format ("0-7,16-23", "3") into
 // individual CPU IDs. Empty input yields an empty list.
 func parseCPUList(s string) ([]int, error) {
 	if s == "" {
 		return nil, nil
 	}
 	var out []int
 	for part := range strings.SplitSeq(s, ",") {
 		part = strings.TrimSpace(part)
 		if part == "" {
 			continue
 		}
 		lo, hi, isRange := strings.Cut(part, "-")
 		a, err := strconv.Atoi(lo)
 		if err != nil {
 			return nil, fmt.Errorf("bad cpulist entry %q: %w", part, err)
 		}
 		if !isRange {
 			out = append(out, a)
 			continue
 		}
 		b, err := strconv.Atoi(hi)
 		if err != nil {
 			return nil, fmt.Errorf("bad cpulist entry %q: %w", part, err)
 		}
 		if b < a || b-a > 8192 {
 			return nil, fmt.Errorf("bad cpulist range %q", part)
 		}
 		for v := a; v <= b; v++ {
 			out = append(out, v)
 		}
 	}
 	return out, nil
 }
 func readIntFile(path string) (int, error) {
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return 0, err
 	}
 	return strconv.Atoi(strings.TrimSpace(string(b)))
 }
@@ -1,163 +0,0 @@
 //go:build linux
 package cpupick
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"slices"
 	"testing"
 )
 // fakeSysfs builds a cpuDir tree with the given per-CPU file values.
 // A nil map for a file means "file absent on every CPU".
 func fakeSysfs(t *testing.T, capacity, maxFreq map[int]int) string {
 	t.Helper()
 	dir := t.TempDir()
 	write := func(cpu int, rel string, v int) {
 		p := filepath.Join(dir, fmt.Sprintf("cpu%d", cpu), rel)
 		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(p, fmt.Appendf(nil, "%d\n", v), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for cpu, v := range capacity {
 		write(cpu, "cpu_capacity", v)
 	}
 	for cpu, v := range maxFreq {
 		write(cpu, "cpufreq/cpuinfo_max_freq", v)
 	}
 	return dir
 }
 func writeCoreMask(t *testing.T, mask string) string {
 	t.Helper()
 	p := filepath.Join(t.TempDir(), "cpus")
 	if err := os.WriteFile(p, []byte(mask+"\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	return p
 }
 func TestPerfCPUsBigLittleCapacity(t *testing.T) {
 	// 4 big (1024) + 4 LITTLE (~290): capacity is authoritative on ARM.
 	dir := fakeSysfs(t, map[int]int{
 		0: 1024, 1: 1024, 2: 1024, 3: 1024,
 		4: 290, 5: 290, 6: 290, 7: 290,
 	}, nil)
 	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3, 4, 5, 6, 7})
 	if signal != "cpu_capacity" {
 		t.Fatalf("signal = %q", signal)
 	}
 	if !slices.Equal(got, []int{0, 1, 2, 3}) {
 		t.Errorf("got %v", got)
 	}
 }
 func TestPerfCPUsThreeTierKeepsMid(t *testing.T) {
 	// prime (1024) + mid (~780) + little (~280): 50% keeps prime+mid.
 	dir := fakeSysfs(t, map[int]int{
 		0: 280, 1: 280, 2: 280, 3: 280,
 		4: 780, 5: 780, 6: 780,
 		7: 1024,
 	}, nil)
 	got, _ := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3, 4, 5, 6, 7})
 	if !slices.Equal(got, []int{4, 5, 6, 7}) {
 		t.Errorf("got %v", got)
 	}
 }
 func TestPerfCPUsIntelHybridMask(t *testing.T) {
 	// No cpu_capacity on x86; the P-core PMU mask decides.
 	dir := fakeSysfs(t, nil, nil)
 	mask := writeCoreMask(t, "0-7")
 	got, signal := perfCPUsFrom(dir, mask, []int{0, 1, 2, 3, 8, 9, 10, 11})
 	if signal != "intel_core_pmu" {
 		t.Fatalf("signal = %q", signal)
 	}
 	if !slices.Equal(got, []int{0, 1, 2, 3}) {
 		t.Errorf("got %v", got)
 	}
 }
 func TestPerfCPUsIntelMaskDisjointFallsThrough(t *testing.T) {
 	// Confined to E-cores only: the mask can't help, and equal freqs below
 	// mean nothing else distinguishes them either -> allowed unchanged.
 	dir := fakeSysfs(t, nil, map[int]int{8: 4300000, 9: 4300000})
 	mask := writeCoreMask(t, "0-7")
 	got, signal := perfCPUsFrom(dir, mask, []int{8, 9})
 	if signal != "" || !slices.Equal(got, []int{8, 9}) {
 		t.Errorf("got %v signal %q", got, signal)
 	}
 }
 func TestPerfCPUsMaxFreqCompactCores(t *testing.T) {
 	// AMD-style compact cores: no capacity, no Intel mask; 3.3 vs 5.7 GHz.
 	dir := fakeSysfs(t, nil, map[int]int{
 		0: 5700000, 1: 5700000, 2: 3300000, 3: 3300000,
 	})
 	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3})
 	if signal != "max_freq" {
 		t.Fatalf("signal = %q", signal)
 	}
 	if !slices.Equal(got, []int{0, 1}) {
 		t.Errorf("got %v", got)
 	}
 }
 func TestPerfCPUsFavoredCoreSkewKept(t *testing.T) {
 	// Turbo Boost Max favored cores run a few percent hot; they must not
 	// shrink the candidate set to one or two cores.
 	dir := fakeSysfs(t, nil, map[int]int{
 		0: 5800000, 1: 5700000, 2: 5700000, 3: 5600000,
 	})
 	got, _ := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3})
 	if !slices.Equal(got, []int{0, 1, 2, 3}) {
 		t.Errorf("favored-core skew filtered CPUs: %v", got)
 	}
 }
 func TestPerfCPUsHomogeneousInconclusive(t *testing.T) {
 	dir := fakeSysfs(t, nil, map[int]int{0: 3000000, 1: 3000000})
 	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1})
 	if signal != "" || !slices.Equal(got, []int{0, 1}) {
 		t.Errorf("got %v signal %q", got, signal)
 	}
 }
 func TestPerfCPUsNoSysfs(t *testing.T) {
 	dir := t.TempDir()
 	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2})
 	if signal != "" || !slices.Equal(got, []int{0, 1, 2}) {
 		t.Errorf("got %v signal %q", got, signal)
 	}
 }
 func TestParseCPUList(t *testing.T) {
 	cases := []struct {
 		in      string
 		want    []int
 		wantErr bool
 	}{
 		{"0-3", []int{0, 1, 2, 3}, false},
 		{"0-1,16-17", []int{0, 1, 16, 17}, false},
 		{"5", []int{5}, false},
 		{"", nil, false},
 		{"3-1", nil, true},
 		{"a-b", nil, true},
 		{"1,x", nil, true},
 	}
 	for _, c := range cases {
 		got, err := parseCPUList(c.in)
 		if (err != nil) != c.wantErr {
 			t.Errorf("%q: err=%v wantErr=%v", c.in, err, c.wantErr)
 			continue
 		}
 		if !c.wantErr && !slices.Equal(got, c.want) {
 			t.Errorf("%q: got %v want %v", c.in, got, c.want)
 		}
 	}
 }
@@ -1,10 +0,0 @@
 //go:build !linux
 package cpupick
 // perfCPUs is Linux-only sysfs walking; elsewhere report "no distinction".
 // Default already returns nil off-Linux (util.AllowedCPUs has no answer
 // there), so this exists to keep the package compiling everywhere.
 func perfCPUs(allowed []int) ([]int, string) {
 	return allowed, ""
 }
@@ -1,118 +0,0 @@
 //go:build linux
 package cpupick
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 )
 // readTopology probes the NUMA node and physical-core layout of cpus from
 // sysfs. Anything sysfs won't say degrades toward flatTopology: an unknown
 // node becomes node 0, an unknown core becomes a core of its own — either
 // way the corresponding arrange rule becomes a no-op instead of a wrong
 // answer.
 func readTopology(cpus []int) topology {
 	return readTopologyFrom("/sys/devices/system/node", "/sys/devices/system/cpu", cpus)
 }
 func readTopologyFrom(nodeDir, cpuDir string, cpus []int) topology {
 	coreOf, zeroCore := coreGroups(cpuDir, cpus)
 	return topology{
 		nodeOf:   numaNodes(nodeDir, cpus),
 		coreOf:   coreOf,
 		zeroCore: zeroCore,
 	}
 }
 // numaNodes maps each cpu to its NUMA node via
 // /sys/devices/system/node/nodeN/cpulist. CPUs no node claims (or no node
 // dirs at all: VMs, non-NUMA kernels) land on node 0.
 func numaNodes(nodeDir string, cpus []int) map[int]int {
 	out := make(map[int]int, len(cpus))
 	for _, c := range cpus {
 		out[c] = 0
 	}
 	entries, err := os.ReadDir(nodeDir)
 	if err != nil {
 		return out
 	}
 	want := make(map[int]bool, len(cpus))
 	for _, c := range cpus {
 		want[c] = true
 	}
 	for _, e := range entries {
 		id, ok := strings.CutPrefix(e.Name(), "node")
 		if !ok {
 			continue
 		}
 		n, err := strconv.Atoi(id)
 		if err != nil {
 			continue // has_cpu, possible, ... share the prefix
 		}
 		b, err := os.ReadFile(filepath.Join(nodeDir, e.Name(), "cpulist"))
 		if err != nil {
 			continue
 		}
 		list, err := parseCPUList(strings.TrimSpace(string(b)))
 		if err != nil {
 			continue
 		}
 		for _, c := range list {
 			if want[c] {
 				out[c] = n
 			}
 		}
 	}
 	return out
 }
 // coreGroups maps each cpu to a dense physical-core id derived from its
 // (physical_package_id, core_id) pair — core_id alone repeats across
 // sockets. CPUs whose topology files are unreadable get a core of their own.
 // The second return is the group id of the core CPU 0 lives on, or -1 when
 // that can't be determined; CPU 0's own files are consulted even when 0 is
 // not a candidate, so its SMT siblings are recognized under cpusets that
 // exclude CPU 0 itself.
 func coreGroups(cpuDir string, cpus []int) (map[int]int, int) {
 	type pkgCore struct{ pkg, core int }
 	pairOf := func(cpu int) (pkgCore, bool) {
 		topoDir := filepath.Join(cpuDir, fmt.Sprintf("cpu%d", cpu), "topology")
 		pkg, err1 := readIntFile(filepath.Join(topoDir, "physical_package_id"))
 		core, err2 := readIntFile(filepath.Join(topoDir, "core_id"))
 		if err1 != nil || err2 != nil {
 			return pkgCore{}, false
 		}
 		return pkgCore{pkg, core}, true
 	}
 	ids := map[pkgCore]int{}
 	out := make(map[int]int, len(cpus))
 	next := 0
 	for _, cpu := range cpus {
 		k, ok := pairOf(cpu)
 		if !ok {
 			out[cpu] = next
 			next++
 			continue
 		}
 		id, ok := ids[k]
 		if !ok {
 			id = next
 			next++
 			ids[k] = id
 		}
 		out[cpu] = id
 	}
 	zeroCore := -1
 	if k, ok := pairOf(0); ok {
 		if id, ok := ids[k]; ok {
 			zeroCore = id
 		}
 	}
 	return out, zeroCore
 }
@@ -1,111 +0,0 @@
 //go:build linux
 package cpupick
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
 )
 // fakeTopoSysfs builds nodeDir/cpuDir trees. nodes maps node id -> cpulist
 // string; cores maps cpu -> (package, core) pair.
 func fakeTopoSysfs(t *testing.T, nodes map[int]string, cores map[int][2]int) (string, string) {
 	t.Helper()
 	base := t.TempDir()
 	nodeDir := filepath.Join(base, "node")
 	cpuDir := filepath.Join(base, "cpu")
 	for n, list := range nodes {
 		d := filepath.Join(nodeDir, fmt.Sprintf("node%d", n))
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(filepath.Join(d, "cpulist"), []byte(list+"\n"), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	for cpu, pc := range cores {
 		d := filepath.Join(cpuDir, fmt.Sprintf("cpu%d", cpu), "topology")
 		if err := os.MkdirAll(d, 0o755); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(filepath.Join(d, "physical_package_id"), fmt.Appendf(nil, "%d\n", pc[0]), 0o644); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(filepath.Join(d, "core_id"), fmt.Appendf(nil, "%d\n", pc[1]), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	return nodeDir, cpuDir
 }
 func TestReadTopology(t *testing.T) {
 	// Two nodes; SMT pairs (0,4),(1,5) on node 0 and (2,6),(3,7) on node 1.
 	// core_id repeats across packages on purpose: the pair must disambiguate.
 	nodeDir, cpuDir := fakeTopoSysfs(t,
 		map[int]string{0: "0-1,4-5", 1: "2-3,6-7"},
 		map[int][2]int{
 			0: {0, 0}, 4: {0, 0}, 1: {0, 1}, 5: {0, 1},
 			2: {1, 0}, 6: {1, 0}, 3: {1, 1}, 7: {1, 1},
 		})
 	cpus := []int{0, 1, 2, 3, 4, 5, 6, 7}
 	topo := readTopologyFrom(nodeDir, cpuDir, cpus)
 	for _, c := range []int{0, 1, 4, 5} {
 		if topo.nodeOf[c] != 0 {
 			t.Errorf("cpu %d on node %d, want 0", c, topo.nodeOf[c])
 		}
 	}
 	for _, c := range []int{2, 3, 6, 7} {
 		if topo.nodeOf[c] != 1 {
 			t.Errorf("cpu %d on node %d, want 1", c, topo.nodeOf[c])
 		}
 	}
 	pairs := [][2]int{{0, 4}, {1, 5}, {2, 6}, {3, 7}}
 	for _, p := range pairs {
 		if topo.coreOf[p[0]] != topo.coreOf[p[1]] {
 			t.Errorf("siblings %v not grouped: %d vs %d", p, topo.coreOf[p[0]], topo.coreOf[p[1]])
 		}
 	}
 	if topo.coreOf[0] == topo.coreOf[2] {
 		t.Error("cross-package cores with equal core_id must not merge")
 	}
 	if topo.zeroCore != topo.coreOf[0] {
 		t.Errorf("zeroCore = %d, want %d", topo.zeroCore, topo.coreOf[0])
 	}
 }
 func TestReadTopologyZeroCoreWithoutZeroCandidate(t *testing.T) {
 	// CPU 0 is not a candidate (cpuset excludes it) but its sibling 4 is:
 	// zeroCore must still identify their shared core.
 	nodeDir, cpuDir := fakeTopoSysfs(t,
 		map[int]string{0: "0-7"},
 		map[int][2]int{0: {0, 0}, 4: {0, 0}, 1: {0, 1}, 5: {0, 1}})
 	topo := readTopologyFrom(nodeDir, cpuDir, []int{1, 4, 5})
 	if topo.zeroCore < 0 || topo.coreOf[4] != topo.zeroCore {
 		t.Errorf("zeroCore = %d, coreOf[4] = %d; sibling of CPU 0 not identified", topo.zeroCore, topo.coreOf[4])
 	}
 	if topo.coreOf[1] == topo.zeroCore {
 		t.Error("cpu 1 wrongly grouped with CPU 0's core")
 	}
 }
 func TestReadTopologyMissingSysfs(t *testing.T) {
 	base := t.TempDir()
 	cpus := []int{0, 1, 2}
 	topo := readTopologyFrom(filepath.Join(base, "nope"), filepath.Join(base, "also-nope"), cpus)
 	seen := map[int]bool{}
 	for _, c := range cpus {
 		if topo.nodeOf[c] != 0 {
 			t.Errorf("cpu %d node = %d, want 0", c, topo.nodeOf[c])
 		}
 		if seen[topo.coreOf[c]] {
 			t.Errorf("cpu %d shares a fallback core group", c)
 		}
 		seen[topo.coreOf[c]] = true
 	}
 	if topo.zeroCore != -1 {
 		t.Errorf("zeroCore = %d, want -1 when unknown", topo.zeroCore)
 	}
 }
@@ -1,10 +0,0 @@
 //go:build !linux
 package cpupick
 // readTopology has no sysfs to consult off Linux; the flat stand-in makes
 // arrange's NUMA and SMT rules no-ops. Default is already nil off Linux
 // (util.AllowedCPUs has no answer there) — this keeps the package compiling.
 func readTopology(cpus []int) topology {
 	return flatTopology(cpus)
 }
@@ -1,234 +0,0 @@
 package nebula
 import (
 	"context"
 	"errors"
 	"log/slog"
 	"net"
 	"path/filepath"
 	"sync"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/diag"
 	"github.com/slackhq/nebula/util"
 )
 // ctlConfig is the parsed form of the `ctl` config block. It is comparable so that a reload
 // can tell "nothing changed" from "the socket moved" with ==.
 type ctlConfig struct {
 	enabled bool
 	socket  string
 	// explicit records that the operator named a socket path rather than taking the platform
 	// default. It only affects how loudly a failure to listen is reported: an unprivileged
 	// nebula that cannot create /run/nebula is a normal deployment, not a problem to shout
 	// about on every upgrade, but a path someone chose deliberately failing to bind is.
 	explicit bool
 }
 // ctlServer owns the unix socket `nebula ctl` connects to. It exposes the same command
 // registry the ssh console does, minus the ceremony of running an ssh server: the socket is
 // local only and guarded by filesystem permissions, so it needs no keys.
 //
 // The lifecycle mirrors statsServer: the constructor wires the reload callback, reload
 // records config and reconciles a running listener, Start builds and serves the runtime, and
 // Stop tears it down.
 type ctlServer struct {
 	l   *slog.Logger
 	ctx context.Context
 	srv *diag.Server
 	runMu  sync.Mutex
 	runCfg *ctlConfig
 	run    *ctlRuntime
 }
 // ctlRuntime is the live state owned by a single Start invocation.
 type ctlRuntime struct {
 	cancel   context.CancelFunc
 	listener net.Listener
 }
 // newCtlServerFromConfig builds a ctlServer, parses the config, and registers a reload
 // callback. It deliberately does not start listening: there is no interface yet, and
 // Control.Start is what launches the first runtime. The callback is registered before the
 // config is parsed so a SIGHUP can fix a bad block even if the first parse failed.
 //
 // reg is only held, never read, until Start runs. That is what lets this be constructed
 // before attachCommands has populated the registry.
 func newCtlServerFromConfig(ctx context.Context, l *slog.Logger, c *config.C, reg *diag.Registry) (*ctlServer, error) {
 	s := &ctlServer{
 		l:   l,
 		ctx: ctx,
 		srv: diag.NewServer(l, reg),
 	}
 	c.RegisterReloadCallback(func(c *config.C) {
 		if err := s.reload(c, false); err != nil {
 			s.l.Error("Failed to reload ctl from config", "error", err)
 		}
 	})
 	if err := s.reload(c, true); err != nil {
 		return s, err
 	}
 	return s, nil
 }
 // loadCtlConfig parses and validates the `ctl` block. An empty socket path while enabled is
 // not an error: it means the platform has no default and the operator did not name one, so
 // there is simply nothing to listen on.
 func loadCtlConfig(c *config.C) (ctlConfig, error) {
 	cfg := ctlConfig{
 		enabled:  c.GetBool("ctl.enabled", true),
 		socket:   c.GetString("ctl.socket", diag.DefaultSocketPath()),
 		explicit: c.IsSet("ctl.socket"),
 	}
 	if cfg.enabled && cfg.socket != "" && !filepath.IsAbs(cfg.socket) {
 		return cfg, util.NewContextualError("ctl.socket must be an absolute path", m{"path": cfg.socket}, nil)
 	}
 	return cfg, nil
 }
 // reload parses the config and records it, then reconciles the running listener against it:
 //
 //   - newly enabled -> spawn Start
 //   - newly disabled -> Stop the runtime
 //   - socket moved (still enabled) -> Stop the old, Start the new
 //   - no change -> no-op
 //
 // On the initial call it only records configuration; Control.Start is what launches the first
 // runtime via ctlStart. There is no interface to serve yet at that point.
 func (s *ctlServer) reload(c *config.C, initial bool) error {
 	newCfg, err := loadCtlConfig(c)
 	if err != nil {
 		return err
 	}
 	s.runMu.Lock()
 	sameCfg := s.runCfg != nil && *s.runCfg == newCfg
 	s.runCfg = &newCfg
 	running := s.run != nil
 	s.runMu.Unlock()
 	if initial || sameCfg {
 		return nil
 	}
 	if running {
 		s.Stop()
 	}
 	if newCfg.enabled && newCfg.socket != "" {
 		go s.Start()
 	}
 	return nil
 }
 // Start binds the socket and serves until Stop is called or ctx fires. Safe to call when ctl
 // is disabled or already running: both no-op.
 func (s *ctlServer) Start() {
 	s.runMu.Lock()
 	if s.ctx.Err() != nil || s.run != nil || s.runCfg == nil {
 		s.runMu.Unlock()
 		return
 	}
 	cfg := *s.runCfg
 	s.runMu.Unlock()
 	if !cfg.enabled || cfg.socket == "" {
 		if cfg.enabled {
 			s.l.Info("ctl has no socket path on this platform, `nebula ctl` will not be available",
 				"hint", "set ctl.socket to enable it",
 			)
 		}
 		return
 	}
 	listener, err := diag.Listen(cfg.socket)
 	if err != nil {
 		// A default path nebula cannot create is an ordinary state for an unprivileged
 		// install; a path the operator chose failing to bind is something they want to know
 		// about. Either way ctl is optional and nebula carries on without it.
 		if cfg.explicit {
 			s.l.Error("Failed to listen on the ctl socket", "ctlSocket", cfg.socket, "error", err)
 		} else {
 			s.l.Info("Not serving the ctl socket, `nebula ctl` will not be available",
 				"ctlSocket", cfg.socket,
 				"error", err,
 				"hint", "set ctl.socket to a path nebula can write, or ctl.enabled to false",
 			)
 		}
 		// Drop the cached config so a SIGHUP retries once the underlying problem is fixed,
 		// even when the config itself is unchanged.
 		s.runMu.Lock()
 		if s.runCfg != nil && *s.runCfg == cfg {
 			s.runCfg = nil
 		}
 		s.runMu.Unlock()
 		return
 	}
 	runCtx, cancel := context.WithCancel(s.ctx)
 	rt := &ctlRuntime{cancel: cancel, listener: listener}
 	s.runMu.Lock()
 	// Losing the race against a Stop or a competing Start means this listener is already
 	// obsolete. Close it rather than serving a socket nobody will tear down.
 	if s.ctx.Err() != nil || s.run != nil {
 		s.runMu.Unlock()
 		cancel()
 		_ = listener.Close()
 		return
 	}
 	s.run = rt
 	s.runMu.Unlock()
 	s.l.Info("ctl socket is listening", "ctlSocket", cfg.socket)
 	err = s.srv.Serve(runCtx, listener)
 	if err != nil {
 		s.l.Error("The ctl listener stopped", "ctlSocket", cfg.socket, "error", err)
 	}
 	// Clear our runtime only if nothing has replaced it.
 	s.runMu.Lock()
 	if s.run == rt {
 		rt.cancel()
 		s.run = nil
 		if err != nil {
 			// An unclean exit leaves runCfg cached as if it were applied, so drop it and let a
 			// SIGHUP retry.
 			s.runCfg = nil
 		}
 	}
 	s.runMu.Unlock()
 }
 // Stop closes the listener and unlinks the socket. It deliberately does not touch connections
 // that are already being served: `nebula ctl reload` runs every reload callback inline on its
 // own connection, including this one, and hanging up on it would truncate the response to a
 // reload that actually succeeded.
 //
 // The socket file is removed by net.UnixListener's unlink-on-close, so there is no os.Remove
 // here; doing it by hand would delete a successor's socket after a fast reload.
 func (s *ctlServer) Stop() {
 	s.runMu.Lock()
 	rt := s.run
 	s.run = nil
 	s.runMu.Unlock()
 	if rt == nil {
 		return
 	}
 	rt.cancel()
 	if err := rt.listener.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
 		s.l.Warn("Failed to close the ctl listener", "error", err)
 	}
 }
@@ -1,305 +0,0 @@
 //go:build !windows
 package nebula
 import (
 	"context"
 	"log/slog"
 	"os"
 	"path/filepath"
 	"testing"
 	"time"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/diag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func newTestCtlServer(t *testing.T) (*ctlServer, *config.C) {
 	t.Helper()
 	l := slog.New(slog.DiscardHandler)
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 	return &ctlServer{
 		l:   l,
 		ctx: ctx,
 		srv: diag.NewServer(l, diag.NewRegistry()),
 	}, config.NewC(l)
 }
 func setCtlConfig(c *config.C, m map[string]any) {
 	c.Settings["ctl"] = m
 }
 func currentCtlRuntime(s *ctlServer) *ctlRuntime {
 	s.runMu.Lock()
 	defer s.runMu.Unlock()
 	return s.run
 }
 // testCtlSocket returns a short socket path, see the note in diag/server_test.go about
 // sun_path on darwin.
 func testCtlSocket(t *testing.T) string {
 	t.Helper()
 	dir, err := os.MkdirTemp("/tmp", "nebctl")
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(dir) })
 	return filepath.Join(dir, "ctl.sock")
 }
 func startCtl(t *testing.T, s *ctlServer) chan struct{} {
 	t.Helper()
 	done := make(chan struct{})
 	go func() {
 		s.Start()
 		close(done)
 	}()
 	return done
 }
 func requireCtlStopped(t *testing.T, done chan struct{}) {
 	t.Helper()
 	select {
 	case <-done:
 	case <-time.After(5 * time.Second):
 		t.Fatal("ctl Start did not return after Stop")
 	}
 }
 func TestCtlServer_loadConfig(t *testing.T) {
 	t.Run("defaults to enabled at the platform path", func(t *testing.T) {
 		_, c := newTestCtlServer(t)
 		cfg, err := loadCtlConfig(c)
 		require.NoError(t, err)
 		assert.True(t, cfg.enabled)
 		assert.Equal(t, diag.DefaultSocketPath(), cfg.socket)
 		assert.False(t, cfg.explicit)
 	})
 	t.Run("an operator chosen path is recorded as explicit", func(t *testing.T) {
 		_, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"socket": "/run/somewhere/ctl.sock"})
 		cfg, err := loadCtlConfig(c)
 		require.NoError(t, err)
 		assert.Equal(t, "/run/somewhere/ctl.sock", cfg.socket)
 		assert.True(t, cfg.explicit)
 	})
 	t.Run("a relative path is rejected", func(t *testing.T) {
 		_, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"socket": "ctl.sock"})
 		_, err := loadCtlConfig(c)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "must be an absolute path")
 	})
 	t.Run("a relative path is not rejected when ctl is off", func(t *testing.T) {
 		_, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"enabled": false, "socket": "ctl.sock"})
 		_, err := loadCtlConfig(c)
 		assert.NoError(t, err)
 	})
 }
 func TestCtlServer_reload(t *testing.T) {
 	t.Run("the initial reload records config without listening", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"socket": testCtlSocket(t)})
 		require.NoError(t, s.reload(c, true))
 		assert.Nil(t, currentCtlRuntime(s), "Control.Start is what starts listening")
 	})
 	t.Run("enabling on reload starts listening", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		path := testCtlSocket(t)
 		setCtlConfig(c, map[string]any{"enabled": false, "socket": path})
 		require.NoError(t, s.reload(c, true))
 		setCtlConfig(c, map[string]any{"enabled": true, "socket": path})
 		require.NoError(t, s.reload(c, false))
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		assert.FileExists(t, path)
 		s.Stop()
 	})
 	t.Run("disabling on reload stops listening and unlinks", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		path := testCtlSocket(t)
 		setCtlConfig(c, map[string]any{"enabled": true, "socket": path})
 		require.NoError(t, s.reload(c, true))
 		done := startCtl(t, s)
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		setCtlConfig(c, map[string]any{"enabled": false, "socket": path})
 		require.NoError(t, s.reload(c, false))
 		requireCtlStopped(t, done)
 		assert.Nil(t, currentCtlRuntime(s))
 		assert.NoFileExists(t, path)
 	})
 	t.Run("moving the socket restarts at the new path", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		oldPath := testCtlSocket(t)
 		newPath := testCtlSocket(t)
 		setCtlConfig(c, map[string]any{"socket": oldPath})
 		require.NoError(t, s.reload(c, true))
 		done := startCtl(t, s)
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		require.FileExists(t, oldPath)
 		setCtlConfig(c, map[string]any{"socket": newPath})
 		require.NoError(t, s.reload(c, false))
 		requireCtlStopped(t, done)
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		assert.FileExists(t, newPath)
 		assert.NoFileExists(t, oldPath, "the old socket should have been unlinked")
 		s.Stop()
 	})
 	t.Run("an unchanged config leaves the listener alone", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"socket": testCtlSocket(t)})
 		require.NoError(t, s.reload(c, true))
 		startCtl(t, s)
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		before := currentCtlRuntime(s)
 		require.NoError(t, s.reload(c, false))
 		assert.Same(t, before, currentCtlRuntime(s), "the runtime should not have been replaced")
 		s.Stop()
 	})
 }
 func TestCtlServer_Start(t *testing.T) {
 	t.Run("a command can be run over the socket", func(t *testing.T) {
 		l := slog.New(slog.DiscardHandler)
 		ctx, cancel := context.WithCancel(context.Background())
 		t.Cleanup(cancel)
 		reg := diag.NewRegistry()
 		s := &ctlServer{l: l, ctx: ctx, srv: diag.NewServer(l, reg)}
 		c := config.NewC(l)
 		path := testCtlSocket(t)
 		setCtlConfig(c, map[string]any{"socket": path})
 		require.NoError(t, s.reload(c, true))
 		startCtl(t, s)
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		client, err := diag.Dial(path)
 		require.NoError(t, err)
 		defer client.Close()
 		out := &testWriter{}
 		status, err := client.Run([]string{"help"}, out)
 		require.NoError(t, err)
 		assert.Equal(t, diag.StatusOK, status)
 		assert.Contains(t, out.String(), "Available commands:")
 		s.Stop()
 	})
 	t.Run("Start is a no-op when ctl is disabled", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"enabled": false, "socket": testCtlSocket(t)})
 		require.NoError(t, s.reload(c, true))
 		s.Start()
 		assert.Nil(t, currentCtlRuntime(s))
 	})
 	t.Run("Start is a no-op with no socket path for this platform", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"enabled": true, "socket": ""})
 		require.NoError(t, s.reload(c, true))
 		s.Start()
 		assert.Nil(t, currentCtlRuntime(s))
 	})
 	t.Run("Start is a no-op after the context is cancelled", func(t *testing.T) {
 		l := slog.New(slog.DiscardHandler)
 		ctx, cancel := context.WithCancel(context.Background())
 		s := &ctlServer{l: l, ctx: ctx, srv: diag.NewServer(l, diag.NewRegistry())}
 		c := config.NewC(l)
 		path := testCtlSocket(t)
 		setCtlConfig(c, map[string]any{"socket": path})
 		require.NoError(t, s.reload(c, true))
 		cancel()
 		s.Start()
 		assert.Nil(t, currentCtlRuntime(s))
 		assert.NoFileExists(t, path)
 	})
 	// A path nebula cannot bind must not stop it from running, and a SIGHUP with the same
 	// config has to be able to retry once the problem is fixed.
 	t.Run("a listen failure is survivable and retried on the next reload", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		path := testCtlSocket(t)
 		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0700))
 		require.NoError(t, os.WriteFile(path, []byte("in the way"), 0600))
 		setCtlConfig(c, map[string]any{"socket": path})
 		require.NoError(t, s.reload(c, true))
 		s.Start()
 		assert.Nil(t, currentCtlRuntime(s))
 		s.runMu.Lock()
 		cachedCfg := s.runCfg
 		s.runMu.Unlock()
 		assert.Nil(t, cachedCfg, "the cached config should be dropped so a reload retries")
 		require.NoError(t, os.Remove(path))
 		require.NoError(t, s.reload(c, false))
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		s.Stop()
 	})
 	t.Run("Stop is idempotent", func(t *testing.T) {
 		s, c := newTestCtlServer(t)
 		setCtlConfig(c, map[string]any{"socket": testCtlSocket(t)})
 		require.NoError(t, s.reload(c, true))
 		done := startCtl(t, s)
 		waitFor(t, func() bool { return currentCtlRuntime(s) != nil })
 		s.Stop()
 		requireCtlStopped(t, done)
 		assert.NotPanics(t, s.Stop)
 	})
 }
 // testWriter collects command output.
 type testWriter struct{ b []byte }
 func (w *testWriter) Write(p []byte) (int, error) {
 	w.b = append(w.b, p...)
 	return len(p), nil
 }
 func (w *testWriter) String() string { return string(w.b) }
@@ -1,41 +0,0 @@
 package diag
 import (
 	"bufio"
 	"io"
 	"net"
 	"time"
 )
 // dialTimeout bounds the connect only. A command may take as long as it likes to answer.
 const dialTimeout = 2 * time.Second
 // Client is a connection to a nebula serving the ctl socket. It carries exactly one command.
 type Client struct {
 	conn net.Conn
 }
 // Dial connects to the nebula serving at path. On a platform without socket support the
 // returned error wraps ErrNotSupported.
 func Dial(path string) (*Client, error) {
 	conn, err := dialSocket(path, dialTimeout)
 	if err != nil {
 		return nil, err
 	}
 	return &Client{conn: conn}, nil
 }
 // Run sends args and streams the command's output to out, returning the command's exit
 // status. A non-nil error means the exchange itself failed and the status means nothing.
 func (c *Client) Run(args []string, out io.Writer) (int, error) {
 	if err := writeRequest(c.conn, args); err != nil {
 		return 0, err
 	}
 	return readResponse(bufio.NewReader(c.conn), out)
 }
 func (c *Client) Close() error {
 	return c.conn.Close()
 }
@@ -1,226 +0,0 @@
 package diag
 import (
 	"bufio"
 	"encoding/binary"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 )
 // The ctl protocol is one request, one response, one connection.
 //
 // The request is a single JSON line. argv travels as a list rather than a joined string so
 // that a path with a space in it survives the trip; the client already has a real argv from
 // the operating system and re-splitting it would only ever lose information.
 //
 // The response is a stream of frames rather than raw bytes followed by a status line,
 // because there is no sentinel that is safe to look for: `print-cert -raw` emits arbitrary
 // PEM and `list-hostmap -json` emits arbitrary JSON, either of which could contain whatever
 // terminator we picked.
 const (
 	// ProtoVersion is the only request version this build understands. An unknown version
 	// gets a legible error rather than a hang, which is the whole point of sending it.
 	ProtoVersion = 1
 	// frameOutput carries raw command output, destined for the client's stdout.
 	frameOutput = 0x01
 	// frameEnd carries a JSON endPayload and is the last frame on a connection.
 	frameEnd = 0x02
 	// frameStderr is reserved. Commands write to a single writer today, so there is nothing
 	// to put in it, but holding the number means adding one later needs no version bump.
 	frameStderr = 0x03
 	// maxFrame bounds a single frame's payload. Larger writes are split across frames.
 	maxFrame = 64 * 1024
 	// maxRequest bounds the request line, so a client that never sends a newline cannot make
 	// nebula buffer without limit.
 	maxRequest = 64 * 1024
 	// outputBuffer is what keeps json.NewEncoder(w.GetWriter()) from emitting a frame per
 	// token; output accumulates here and flushes in useful sized chunks.
 	outputBuffer = 32 * 1024
 )
 // ErrTruncated means the connection ended before the end frame arrived, which is how a
 // client notices that nebula died or was torn down partway through a command.
 var ErrTruncated = errors.New("connection closed before the command finished")
 // request is the JSON line a client sends.
 type request struct {
 	Version int      `json:"version"`
 	Args    []string `json:"args"`
 }
 // endPayload is the JSON body of the end frame. Error is set only when Status is non-zero
 // and describes a failure to run the command, not a failure the command itself reported.
 type endPayload struct {
 	Status int    `json:"status"`
 	Error  string `json:"error,omitempty"`
 }
 // writeRequest sends the request line.
 func writeRequest(w io.Writer, args []string) error {
 	b, err := json.Marshal(request{Version: ProtoVersion, Args: args})
 	if err != nil {
 		return err
 	}
 	if len(b)+1 > maxRequest {
 		return fmt.Errorf("command line is too long: %d bytes", len(b))
 	}
 	_, err = w.Write(append(b, '\n'))
 	return err
 }
 // readRequest reads and validates one request line.
 func readRequest(r *bufio.Reader) (request, error) {
 	var req request
 	line, err := readLimitedLine(r, maxRequest)
 	if err != nil {
 		return req, err
 	}
 	if err := json.Unmarshal(line, &req); err != nil {
 		return req, fmt.Errorf("malformed request: %w", err)
 	}
 	if req.Version != ProtoVersion {
 		return req, fmt.Errorf("unsupported protocol version %d, this nebula speaks version %d", req.Version, ProtoVersion)
 	}
 	return req, nil
 }
 // readLimitedLine reads through the next newline, refusing a line longer than limit rather
 // than buffering whatever an unfriendly client decides to send.
 func readLimitedLine(r *bufio.Reader, limit int) ([]byte, error) {
 	line := make([]byte, 0, 256)
 	for {
 		b, err := r.ReadByte()
 		if err != nil {
 			return nil, err
 		}
 		if b == '\n' {
 			return line, nil
 		}
 		if len(line) >= limit {
 			return nil, fmt.Errorf("request exceeded %d bytes without a newline", limit)
 		}
 		line = append(line, b)
 	}
 }
 // frameWriter turns writes into output frames. It is handed to commands wrapped in a
 // bufio.Writer, so a command that makes many small writes does not make many small frames.
 type frameWriter struct {
 	w io.Writer
 }
 func (f *frameWriter) Write(b []byte) (int, error) {
 	written := 0
 	for {
 		chunk := b[written:]
 		if len(chunk) > maxFrame {
 			chunk = chunk[:maxFrame]
 		}
 		if err := writeFrame(f.w, frameOutput, chunk); err != nil {
 			return written, err
 		}
 		written += len(chunk)
 		if written == len(b) {
 			return written, nil
 		}
 	}
 }
 // writeFrame emits one frame: a type byte, a big endian length, then the payload.
 func writeFrame(w io.Writer, kind byte, payload []byte) error {
 	var hdr [5]byte
 	hdr[0] = kind
 	binary.BigEndian.PutUint32(hdr[1:], uint32(len(payload)))
 	if _, err := w.Write(hdr[:]); err != nil {
 		return err
 	}
 	if len(payload) == 0 {
 		return nil
 	}
 	_, err := w.Write(payload)
 	return err
 }
 // writeEnd emits the final frame. A transport error here is unreportable by definition, the
 // connection is the only channel we have.
 func writeEnd(w io.Writer, status int, msg string) error {
 	b, err := json.Marshal(endPayload{Status: status, Error: msg})
 	if err != nil {
 		return err
 	}
 	return writeFrame(w, frameEnd, b)
 }
 // readResponse consumes frames until the end frame, copying output to out. It returns the
 // command's exit status. A non-nil error means the exchange failed and the status is
 // meaningless.
 func readResponse(r io.Reader, out io.Writer) (int, error) {
 	var hdr [5]byte
 	for {
 		if _, err := io.ReadFull(r, hdr[:]); err != nil {
 			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
 				return 0, ErrTruncated
 			}
 			return 0, err
 		}
 		length := binary.BigEndian.Uint32(hdr[1:])
 		if length > maxFrame {
 			return 0, fmt.Errorf("frame of %d bytes exceeds the %d byte maximum", length, maxFrame)
 		}
 		payload := make([]byte, length)
 		if _, err := io.ReadFull(r, payload); err != nil {
 			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
 				return 0, ErrTruncated
 			}
 			return 0, err
 		}
 		switch hdr[0] {
 		case frameOutput:
 			if _, err := out.Write(payload); err != nil {
 				return 0, err
 			}
 		case frameEnd:
 			var end endPayload
 			if err := json.Unmarshal(payload, &end); err != nil {
 				return 0, fmt.Errorf("malformed end frame: %w", err)
 			}
 			if end.Error != "" {
 				return end.Status, errors.New(end.Error)
 			}
 			return end.Status, nil
 		case frameStderr:
 			// Reserved and unused by this build. Skipping rather than failing means an older
 			// client stays usable against a newer nebula that starts sending them.
 		default:
 			return 0, fmt.Errorf("unknown frame type 0x%02x", hdr[0])
 		}
 	}
 }
@@ -1,144 +0,0 @@
 package diag
 import (
 	"bufio"
 	"bytes"
 	"encoding/binary"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func TestRequestRoundTrip(t *testing.T) {
 	t.Run("argv survives a round trip, spaces and all", func(t *testing.T) {
 		buf := &bytes.Buffer{}
 		args := []string{"start-cpu-profile", "/tmp/a path.pb.gz", "-json"}
 		require.NoError(t, writeRequest(buf, args))
 		req, err := readRequest(bufio.NewReader(buf))
 		require.NoError(t, err)
 		assert.Equal(t, ProtoVersion, req.Version)
 		assert.Equal(t, args, req.Args)
 	})
 	t.Run("an unknown version is refused by name", func(t *testing.T) {
 		r := bufio.NewReader(strings.NewReader(`{"version":99,"args":["version"]}` + "\n"))
 		_, err := readRequest(r)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "unsupported protocol version 99")
 	})
 	t.Run("malformed json is refused", func(t *testing.T) {
 		r := bufio.NewReader(strings.NewReader("not json\n"))
 		_, err := readRequest(r)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "malformed request")
 	})
 	t.Run("a line without a newline is bounded rather than buffered forever", func(t *testing.T) {
 		r := bufio.NewReader(strings.NewReader(strings.Repeat("a", maxRequest+10)))
 		_, err := readRequest(r)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "without a newline")
 	})
 }
 func TestResponseRoundTrip(t *testing.T) {
 	t.Run("output and status survive a round trip", func(t *testing.T) {
 		wire := &bytes.Buffer{}
 		w := bufio.NewWriterSize(&frameWriter{w: wire}, outputBuffer)
 		require.NoError(t, NewWriter(w).WriteLine("hello"))
 		require.NoError(t, w.Flush())
 		require.NoError(t, writeEnd(wire, StatusOK, ""))
 		out := &bytes.Buffer{}
 		status, err := readResponse(wire, out)
 		require.NoError(t, err)
 		assert.Equal(t, StatusOK, status)
 		assert.Equal(t, "hello\n", out.String())
 	})
 	// print-cert -raw and list-hostmap -json both emit arbitrary bytes, so a payload larger
 	// than one frame has to reassemble exactly.
 	t.Run("a payload larger than one frame reassembles byte for byte", func(t *testing.T) {
 		big := bytes.Repeat([]byte("nebula"), maxFrame)
 		wire := &bytes.Buffer{}
 		fw := &frameWriter{w: wire}
 		n, err := fw.Write(big)
 		require.NoError(t, err)
 		require.Equal(t, len(big), n)
 		require.NoError(t, writeEnd(wire, StatusOK, ""))
 		out := &bytes.Buffer{}
 		status, err := readResponse(wire, out)
 		require.NoError(t, err)
 		assert.Equal(t, StatusOK, status)
 		assert.Equal(t, big, out.Bytes())
 	})
 	t.Run("a non-zero status carries its message", func(t *testing.T) {
 		wire := &bytes.Buffer{}
 		require.NoError(t, writeEnd(wire, StatusError, "it went wrong"))
 		status, err := readResponse(wire, &bytes.Buffer{})
 		require.Error(t, err)
 		assert.Equal(t, StatusError, status)
 		assert.Contains(t, err.Error(), "it went wrong")
 	})
 	// This is how the CLI notices a nebula that died mid-command rather than silently
 	// reporting whatever partial output it managed to read.
 	t.Run("a stream ending without an end frame is truncated, not successful", func(t *testing.T) {
 		wire := &bytes.Buffer{}
 		_, err := (&frameWriter{w: wire}).Write([]byte("partial"))
 		require.NoError(t, err)
 		out := &bytes.Buffer{}
 		_, err = readResponse(wire, out)
 		assert.ErrorIs(t, err, ErrTruncated)
 	})
 	t.Run("a truncated frame header is truncated, not successful", func(t *testing.T) {
 		_, err := readResponse(bytes.NewReader([]byte{frameOutput, 0x00}), &bytes.Buffer{})
 		assert.ErrorIs(t, err, ErrTruncated)
 	})
 	t.Run("an oversized frame is refused rather than allocated", func(t *testing.T) {
 		var hdr [5]byte
 		hdr[0] = frameOutput
 		binary.BigEndian.PutUint32(hdr[1:], maxFrame+1)
 		_, err := readResponse(bytes.NewReader(hdr[:]), &bytes.Buffer{})
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "exceeds")
 	})
 	// A reserved frame an older client does not understand must not break it.
 	t.Run("a reserved frame type is skipped", func(t *testing.T) {
 		wire := &bytes.Buffer{}
 		require.NoError(t, writeFrame(wire, frameStderr, []byte("future")))
 		require.NoError(t, writeFrame(wire, frameOutput, []byte("now")))
 		require.NoError(t, writeEnd(wire, StatusOK, ""))
 		out := &bytes.Buffer{}
 		status, err := readResponse(wire, out)
 		require.NoError(t, err)
 		assert.Equal(t, StatusOK, status)
 		assert.Equal(t, "now", out.String())
 	})
 	t.Run("an unknown frame type is an error", func(t *testing.T) {
 		wire := &bytes.Buffer{}
 		require.NoError(t, writeFrame(wire, 0x7f, nil))
 		_, err := readResponse(wire, &bytes.Buffer{})
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "unknown frame type")
 	})
 }
@@ -1,125 +0,0 @@
 package diag
 import (
 	"fmt"
 	"sync"
 	"github.com/anmitsu/go-shlex"
 	"github.com/armon/go-radix"
 )
 // Registry is the set of commands nebula exposes for debugging and administration. It is
 // transport neutral: the ssh console and the `nebula ctl` unix socket dispatch against the
 // same registry, and neither knows the other exists.
 //
 // Registration is expected to happen once during startup, before any transport is serving,
 // but the lock makes a late RegisterCommand safe rather than a data race waiting to happen.
 type Registry struct {
 	mu       sync.RWMutex
 	commands *radix.Tree
 }
 // NewRegistry returns a registry containing only `help`. Everything else is attached by
 // the caller, see attachCommands in the nebula package.
 func NewRegistry() *Registry {
 	r := &Registry{commands: radix.New()}
 	r.RegisterCommand(&Command{
 		Name:             "help",
 		ShortDescription: "prints available commands or help <command> for specific usage info",
 		Callback: func(a any, args []string, w StringWriter) error {
 			return r.help(args, w)
 		},
 	})
 	return r
 }
 // RegisterCommand adds a command that a user can run.
 func (r *Registry) RegisterCommand(c *Command) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	r.commands.Insert(c.Name, c)
 }
 // Clone returns an independent copy sharing no tree with the original. The ssh session uses
 // this so the `logout` command it adds for itself is invisible to every other session, and
 // to `nebula ctl`.
 func (r *Registry) Clone() *Registry {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	return &Registry{commands: radix.NewFromMap(r.commands.ToMap())}
 }
 // Match returns every registered command name carrying the given prefix, for tab completion.
 func (r *Registry) Match(prefix string) []string {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	return matchCommand(r.commands, prefix)
 }
 // Dispatch splits line the way a shell would and runs the result. The ssh console uses this
 // because a terminal only ever hands it a line; a transport that already has a real argv
 // should call DispatchArgs instead rather than round tripping through a quoting parser.
 func (r *Registry) Dispatch(line string, w StringWriter) error {
 	args, err := shlex.Split(line, true)
 	if err != nil {
 		if wErr := w.WriteLine(fmt.Sprintf("Unable to parse command: %s", err)); wErr != nil {
 			return wErr
 		}
 		return err
 	}
 	return r.DispatchArgs(args, w)
 }
 // DispatchArgs runs args[0] with args[1:] as its arguments, writing everything the command
 // produces to w. An empty args dumps the command list, matching what an empty line does on
 // the ssh console.
 //
 // Callbacks report user facing problems as prose on w and return nil by convention, so a
 // non-nil error here means the command could not be run at all: ErrUnknownCommand, an
 // ErrUsage wrapped flag failure, or an internal failure a callback chose to surface.
 func (r *Registry) DispatchArgs(args []string, w StringWriter) error {
 	if len(args) == 0 {
 		r.mu.RLock()
 		defer r.mu.RUnlock()
 		dumpCommands(r.commands, w)
 		return nil
 	}
 	r.mu.RLock()
 	cmd, err := lookupCommand(r.commands, args[0])
 	r.mu.RUnlock()
 	if err != nil {
 		if wErr := w.WriteLine(fmt.Sprintf("Command lookup failed: %s", err)); wErr != nil {
 			return wErr
 		}
 		return err
 	}
 	if cmd == nil {
 		if wErr := w.WriteLine(fmt.Sprintf("Did not understand: %s", args[0])); wErr != nil {
 			return wErr
 		}
 		r.mu.RLock()
 		defer r.mu.RUnlock()
 		dumpCommands(r.commands, w)
 		return fmt.Errorf("%w: %s", ErrUnknownCommand, args[0])
 	}
 	// -h and -help anywhere in the arguments mean the user wants to know how the command
 	// works, not to run it.
 	if checkHelpArgs(args) {
 		return r.help([]string{cmd.Name}, w)
 	}
 	return execCommand(cmd, args[1:], w)
 }
 // help renders the command list, or one command's usage, onto w.
 func (r *Registry) help(args []string, w StringWriter) error {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
 	return helpCallback(r.commands, args, w)
 }
@@ -1,167 +0,0 @@
 package diag
 import (
 	"bytes"
 	"flag"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 type testFlags struct {
 	Json bool
 }
 // testCommand builds a command carrying a flag set, recording what the callback was actually
 // handed so a test can assert on it.
 func testCommand(name string, seen *any, args *[]string) *Command {
 	return &Command{
 		Name:             name,
 		ShortDescription: name + " short description",
 		Flags: func() (*flag.FlagSet, any) {
 			fl := flag.NewFlagSet("", flag.ContinueOnError)
 			f := &testFlags{}
 			fl.BoolVar(&f.Json, "json", false, "outputs json")
 			return fl, f
 		},
 		Callback: func(fs any, a []string, w StringWriter) error {
 			if seen != nil {
 				*seen = fs
 			}
 			if args != nil {
 				*args = a
 			}
 			return w.WriteLine("ran " + name)
 		},
 	}
 }
 func newTestRegistry(t *testing.T) (*Registry, *bytes.Buffer, StringWriter) {
 	t.Helper()
 	buf := &bytes.Buffer{}
 	return NewRegistry(), buf, NewWriter(buf)
 }
 func TestRegistryDispatch(t *testing.T) {
 	t.Run("a new registry knows help and nothing else", func(t *testing.T) {
 		r, buf, w := newTestRegistry(t)
 		require.NoError(t, r.DispatchArgs([]string{"help"}, w))
 		assert.Contains(t, buf.String(), "help -")
 	})
 	t.Run("empty args dump the command list, matching an empty line on the console", func(t *testing.T) {
 		r, buf, w := newTestRegistry(t)
 		r.RegisterCommand(testCommand("do-thing", nil, nil))
 		require.NoError(t, r.DispatchArgs(nil, w))
 		assert.Contains(t, buf.String(), "Available commands:")
 		assert.Contains(t, buf.String(), "do-thing - do-thing short description")
 	})
 	t.Run("an unknown command reports ErrUnknownCommand and still tells the user", func(t *testing.T) {
 		r, buf, w := newTestRegistry(t)
 		err := r.DispatchArgs([]string{"nope"}, w)
 		require.ErrorIs(t, err, ErrUnknownCommand)
 		assert.Contains(t, buf.String(), "Did not understand: nope")
 		assert.Contains(t, buf.String(), "Available commands:")
 	})
 	// This is the hazard the ctl transport has to preserve: every callback in ssh.go begins by
 	// type asserting fs to its own concrete flags struct. Reach a callback without going
 	// through Command.Flags and every one of them fails.
 	t.Run("a callback is handed the concrete struct its Flags callback returned", func(t *testing.T) {
 		var seen any
 		r, _, w := newTestRegistry(t)
 		r.RegisterCommand(testCommand("do-thing", &seen, nil))
 		require.NoError(t, r.DispatchArgs([]string{"do-thing", "-json"}, w))
 		flags, ok := seen.(*testFlags)
 		require.True(t, ok, "callback was handed %T, not *testFlags", seen)
 		assert.True(t, flags.Json)
 	})
 	t.Run("positional arguments survive flag parsing", func(t *testing.T) {
 		var args []string
 		r, _, w := newTestRegistry(t)
 		r.RegisterCommand(testCommand("do-thing", nil, &args))
 		require.NoError(t, r.DispatchArgs([]string{"do-thing", "-json", "10.0.0.1"}, w))
 		assert.Equal(t, []string{"10.0.0.1"}, args)
 	})
 	// Documents stdlib flag behaviour rather than endorsing it: parsing stops at the first
 	// positional, so a flag written after one is silently a positional too.
 	t.Run("a flag after a positional is not parsed as a flag", func(t *testing.T) {
 		var seen any
 		var args []string
 		r, _, w := newTestRegistry(t)
 		r.RegisterCommand(testCommand("do-thing", &seen, &args))
 		require.NoError(t, r.DispatchArgs([]string{"do-thing", "10.0.0.1", "-json"}, w))
 		assert.False(t, seen.(*testFlags).Json)
 		assert.Equal(t, []string{"10.0.0.1", "-json"}, args)
 	})
 	t.Run("a bad flag reports ErrUsage and writes the usage text", func(t *testing.T) {
 		r, buf, w := newTestRegistry(t)
 		r.RegisterCommand(testCommand("do-thing", nil, nil))
 		err := r.DispatchArgs([]string{"do-thing", "-nope"}, w)
 		require.ErrorIs(t, err, ErrUsage)
 		assert.Contains(t, buf.String(), "flag provided but not defined")
 	})
 	t.Run("-h anywhere routes to help instead of running the command", func(t *testing.T) {
 		var seen any
 		r, buf, w := newTestRegistry(t)
 		r.RegisterCommand(testCommand("do-thing", &seen, nil))
 		require.NoError(t, r.DispatchArgs([]string{"do-thing", "-h"}, w))
 		assert.Nil(t, seen, "the callback should not have run")
 		assert.Contains(t, buf.String(), "do-thing - do-thing short description")
 		assert.Contains(t, buf.String(), "-json")
 	})
 	t.Run("Dispatch splits a line the way a shell would", func(t *testing.T) {
 		var args []string
 		r, _, w := newTestRegistry(t)
 		r.RegisterCommand(testCommand("do-thing", nil, &args))
 		require.NoError(t, r.Dispatch(`do-thing "/tmp/a path.pb.gz"`, w))
 		assert.Equal(t, []string{"/tmp/a path.pb.gz"}, args)
 	})
 	t.Run("Match returns names by prefix for tab completion", func(t *testing.T) {
 		r, _, _ := newTestRegistry(t)
 		r.RegisterCommand(testCommand("print-cert", nil, nil))
 		r.RegisterCommand(testCommand("print-tunnel", nil, nil))
 		r.RegisterCommand(testCommand("version", nil, nil))
 		assert.Equal(t, []string{"print-cert", "print-tunnel"}, r.Match("print-"))
 	})
 }
 // A clone is what keeps the ssh session's `logout` command from being visible to every other
 // session, and to nebula ctl.
 func TestRegistryCloneIsolation(t *testing.T) {
 	parent, _, w := newTestRegistry(t)
 	parent.RegisterCommand(testCommand("shared", nil, nil))
 	child := parent.Clone()
 	child.RegisterCommand(testCommand("logout", nil, nil))
 	require.NoError(t, child.DispatchArgs([]string{"logout"}, w))
 	buf := &bytes.Buffer{}
 	err := parent.DispatchArgs([]string{"logout"}, NewWriter(buf))
 	assert.ErrorIs(t, err, ErrUnknownCommand)
 	buf.Reset()
 	require.NoError(t, child.DispatchArgs([]string{"shared"}, NewWriter(buf)))
 	assert.True(t, strings.HasPrefix(buf.String(), "ran shared"))
 }
@@ -1,137 +0,0 @@
 package diag
 import (
 	"bufio"
 	"context"
 	"errors"
 	"fmt"
 	"log/slog"
 	"net"
 	"time"
 )
 // Exit statuses the client reports. They follow shell convention closely enough that a
 // script can tell "you asked for something that does not exist" from "it ran and failed".
 const (
 	// StatusOK means the command ran. Note that commands report their own user facing
 	// problems as prose and still exit 0, matching the ssh console.
 	StatusOK = 0
 	// StatusError means the command could not be completed.
 	StatusError = 1
 	// StatusUsage means the arguments were not valid for that command.
 	StatusUsage = 2
 	// StatusUnknownCommand means there is no such command.
 	StatusUnknownCommand = 127
 )
 // requestTimeout bounds how long a connected client may take to send its request line. There
 // is deliberately no timeout on the response: `reload` runs every reload callback inline
 // before it returns, and a slow one is not a reason to hang up on the operator.
 const requestTimeout = 5 * time.Second
 // Server serves a Registry over a stream listener. It knows nothing about unix sockets, so
 // tests can drive it over a net.Pipe.
 type Server struct {
 	l   *slog.Logger
 	reg *Registry
 }
 func NewServer(l *slog.Logger, reg *Registry) *Server {
 	return &Server{l: l, reg: reg}
 }
 // Serve accepts connections until ln is closed. Cancelling ctx closes ln, which is what ends
 // the accept loop; a listener closed underneath us is a normal shutdown, not an error.
 func (s *Server) Serve(ctx context.Context, ln net.Listener) error {
 	go func() {
 		<-ctx.Done()
 		if err := ln.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
 			s.l.Warn("Failed to close the ctl listener", "error", err)
 		}
 	}()
 	for {
 		conn, err := ln.Accept()
 		if err != nil {
 			if errors.Is(err, net.ErrClosed) || ctx.Err() != nil {
 				return nil
 			}
 			return err
 		}
 		go s.ServeConn(ctx, conn)
 	}
 }
 // ServeConn handles one request and closes c.
 func (s *Server) ServeConn(ctx context.Context, c net.Conn) {
 	defer func() {
 		if err := c.Close(); err != nil && !errors.Is(err, net.ErrClosed) {
 			s.l.Debug("Failed to close a ctl connection", "error", err)
 		}
 	}()
 	if err := c.SetReadDeadline(time.Now().Add(requestTimeout)); err != nil {
 		s.l.Debug("Failed to set a ctl read deadline", "error", err)
 	}
 	req, err := readRequest(bufio.NewReaderSize(c, maxRequest))
 	if err != nil {
 		s.l.Debug("Rejected a ctl request", "error", err)
 		// Best effort: the client may already be gone, and there is nowhere else to report it.
 		_ = writeEnd(c, StatusError, err.Error())
 		return
 	}
 	// The request is in hand, so the command owns the rest of the connection's lifetime.
 	if err := c.SetReadDeadline(time.Time{}); err != nil {
 		s.l.Debug("Failed to clear the ctl read deadline", "error", err)
 	}
 	s.l.Debug("Running a ctl command", "args", req.Args)
 	buf := bufio.NewWriterSize(&frameWriter{w: c}, outputBuffer)
 	dispatchErr := s.reg.DispatchArgs(req.Args, NewWriter(buf))
 	if err := buf.Flush(); err != nil {
 		s.l.Debug("Failed to flush ctl output", "error", err)
 		return
 	}
 	status, msg := statusFor(dispatchErr)
 	if err := writeEnd(c, status, msg); err != nil {
 		s.l.Debug("Failed to write the ctl end frame", "error", err)
 	}
 }
 // StatusFor maps a dispatch error onto an exit status, for a transport that has somewhere to
 // put one.
 func StatusFor(err error) int {
 	status, _ := statusFor(err)
 	return status
 }
 // statusFor maps a dispatch error onto an exit status and, when the failure is ours to
 // explain rather than one the command already wrote as prose, a message to go with it.
 func statusFor(err error) (int, string) {
 	switch {
 	case err == nil:
 		return StatusOK, ""
 	case errors.Is(err, ErrUnknownCommand):
 		return StatusUnknownCommand, ""
 	case errors.Is(err, ErrUsage):
 		return StatusUsage, ""
 	default:
 		return StatusError, fmt.Sprintf("%s", err)
 	}
 }
 // ErrNotSupported means this platform has no ctl transport. Windows is waiting on a named
 // pipe implementation; mobile has no daemon for a CLI to attach to in the first place.
 var ErrNotSupported = errors.New("nebula ctl is not supported on this platform")
 // Listen creates the ctl listener at path. It is the platform boundary: everything above it
 // in this package is portable.
 func Listen(path string) (net.Listener, error) {
 	return listenSocket(path)
 }
@@ -1,273 +0,0 @@
 //go:build !windows
 package diag
 import (
 	"bytes"
 	"context"
 	"errors"
 	"fmt"
 	"io/fs"
 	"log/slog"
 	"net"
 	"os"
 	"path/filepath"
 	"sync"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // testSocketPath returns a short socket path. t.TempDir on darwin lives under
 // /var/folders/... and readily exceeds the 104 byte sun_path limit, which fails as a bare
 // "invalid argument" a long way from the cause.
 func testSocketPath(t *testing.T) string {
 	t.Helper()
 	dir, err := os.MkdirTemp("/tmp", "nebctl")
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = os.RemoveAll(dir) })
 	path := filepath.Join(dir, "sub", "ctl.sock")
 	require.LessOrEqual(t, len(path), maxSocketPath, "test socket path is too long for sun_path")
 	return path
 }
 func newTestServer(t *testing.T) (*Registry, string) {
 	t.Helper()
 	reg := NewRegistry()
 	path := testSocketPath(t)
 	ln, err := Listen(path)
 	require.NoError(t, err)
 	ctx, cancel := context.WithCancel(context.Background())
 	srv := NewServer(slog.New(slog.DiscardHandler), reg)
 	var wg sync.WaitGroup
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
 		assert.NoError(t, srv.Serve(ctx, ln))
 	}()
 	t.Cleanup(func() {
 		cancel()
 		wg.Wait()
 	})
 	return reg, path
 }
 func run(t *testing.T, path string, args ...string) (string, int, error) {
 	t.Helper()
 	c, err := Dial(path)
 	require.NoError(t, err)
 	defer c.Close()
 	out := &bytes.Buffer{}
 	status, err := c.Run(args, out)
 	return out.String(), status, err
 }
 func TestServeConn(t *testing.T) {
 	t.Run("a command runs and its output comes back", func(t *testing.T) {
 		reg, path := newTestServer(t)
 		reg.RegisterCommand(&Command{
 			Name:             "version",
 			ShortDescription: "prints a version",
 			Callback: func(fs any, a []string, w StringWriter) error {
 				return w.WriteLine("1.2.3")
 			},
 		})
 		out, status, err := run(t, path, "version")
 		require.NoError(t, err)
 		assert.Equal(t, StatusOK, status)
 		assert.Equal(t, "1.2.3\n", out)
 	})
 	t.Run("no args gets the command list", func(t *testing.T) {
 		_, path := newTestServer(t)
 		out, status, err := run(t, path)
 		require.NoError(t, err)
 		assert.Equal(t, StatusOK, status)
 		assert.Contains(t, out, "Available commands:")
 	})
 	t.Run("an unknown command exits 127", func(t *testing.T) {
 		_, path := newTestServer(t)
 		out, status, err := run(t, path, "nope")
 		require.NoError(t, err)
 		assert.Equal(t, StatusUnknownCommand, status)
 		assert.Contains(t, out, "Did not understand: nope")
 	})
 	t.Run("a bad flag exits 2", func(t *testing.T) {
 		reg, path := newTestServer(t)
 		var seen any
 		reg.RegisterCommand(testCommand("do-thing", &seen, nil))
 		out, status, err := run(t, path, "do-thing", "-nope")
 		require.NoError(t, err)
 		assert.Equal(t, StatusUsage, status)
 		assert.Contains(t, out, "flag provided but not defined")
 	})
 	t.Run("a callback error exits 1 and reports why", func(t *testing.T) {
 		reg, path := newTestServer(t)
 		reg.RegisterCommand(&Command{
 			Name:             "explode",
 			ShortDescription: "fails",
 			Callback: func(fs any, a []string, w StringWriter) error {
 				return errors.New("boom")
 			},
 		})
 		_, status, err := run(t, path, "explode")
 		require.Error(t, err)
 		assert.Equal(t, StatusError, status)
 		assert.Contains(t, err.Error(), "boom")
 	})
 	t.Run("output larger than the buffer arrives intact", func(t *testing.T) {
 		reg, path := newTestServer(t)
 		want := bytes.Repeat([]byte("x"), outputBuffer*3+7)
 		reg.RegisterCommand(&Command{
 			Name:             "big",
 			ShortDescription: "writes a lot",
 			Callback: func(fs any, a []string, w StringWriter) error {
 				return w.WriteBytes(want)
 			},
 		})
 		out, status, err := run(t, path, "big")
 		require.NoError(t, err)
 		assert.Equal(t, StatusOK, status)
 		assert.Equal(t, string(want), out)
 	})
 	t.Run("concurrent clients are all served", func(t *testing.T) {
 		reg, path := newTestServer(t)
 		reg.RegisterCommand(&Command{
 			Name:             "slow",
 			ShortDescription: "takes a moment",
 			Callback: func(fs any, a []string, w StringWriter) error {
 				time.Sleep(10 * time.Millisecond)
 				return w.WriteLine("done")
 			},
 		})
 		var wg sync.WaitGroup
 		for i := 0; i < 8; i++ {
 			wg.Add(1)
 			go func() {
 				defer wg.Done()
 				out, status, err := run(t, path, "slow")
 				assert.NoError(t, err)
 				assert.Equal(t, StatusOK, status)
 				assert.Equal(t, "done\n", out)
 			}()
 		}
 		wg.Wait()
 	})
 	t.Run("a client that hangs up mid command does not take the server down", func(t *testing.T) {
 		reg, path := newTestServer(t)
 		reg.RegisterCommand(&Command{
 			Name:             "version",
 			ShortDescription: "prints a version",
 			Callback: func(fs any, a []string, w StringWriter) error {
 				return w.WriteLine("1.2.3")
 			},
 		})
 		c, err := Dial(path)
 		require.NoError(t, err)
 		require.NoError(t, writeRequest(c.conn, []string{"version"}))
 		require.NoError(t, c.Close())
 		// The next client still gets served.
 		out, status, err := run(t, path, "version")
 		require.NoError(t, err)
 		assert.Equal(t, StatusOK, status)
 		assert.Equal(t, "1.2.3\n", out)
 	})
 }
 func TestListenSocket(t *testing.T) {
 	t.Run("the socket is 0600 inside a 0700 directory", func(t *testing.T) {
 		path := testSocketPath(t)
 		ln, err := Listen(path)
 		require.NoError(t, err)
 		defer ln.Close()
 		fi, err := os.Stat(path)
 		require.NoError(t, err)
 		assert.Equal(t, os.FileMode(0600), fi.Mode().Perm(), "socket mode")
 		di, err := os.Stat(filepath.Dir(path))
 		require.NoError(t, err)
 		assert.Equal(t, os.FileMode(0700), di.Mode().Perm(), "socket directory mode")
 	})
 	t.Run("the socket is unlinked when the listener closes", func(t *testing.T) {
 		path := testSocketPath(t)
 		ln, err := Listen(path)
 		require.NoError(t, err)
 		require.NoError(t, ln.Close())
 		_, err = os.Stat(path)
 		assert.ErrorIs(t, err, fs.ErrNotExist)
 	})
 	// A crashed nebula leaves its socket behind, and the next one has to be able to start.
 	t.Run("a socket left behind by a dead nebula is replaced", func(t *testing.T) {
 		path := testSocketPath(t)
 		ln, err := Listen(path)
 		require.NoError(t, err)
 		// Close the listener without unlinking, the way a killed process leaves things.
 		unix, ok := ln.(*net.UnixListener)
 		require.True(t, ok)
 		unix.SetUnlinkOnClose(false)
 		require.NoError(t, ln.Close())
 		require.FileExists(t, path)
 		ln2, err := Listen(path)
 		require.NoError(t, err)
 		assert.NoError(t, ln2.Close())
 	})
 	// Silently stealing it would break the nebula that got there first.
 	t.Run("a socket another nebula is serving is refused", func(t *testing.T) {
 		_, path := newTestServer(t)
 		_, err := Listen(path)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "already being served")
 	})
 	t.Run("a path that is not a socket is refused rather than removed", func(t *testing.T) {
 		path := testSocketPath(t)
 		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0700))
 		require.NoError(t, os.WriteFile(path, []byte("precious"), 0600))
 		_, err := Listen(path)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "is not a socket")
 		assert.FileExists(t, path, "the file must not have been removed")
 	})
 	t.Run("a path too long for sun_path says so", func(t *testing.T) {
 		_, err := Listen("/tmp/" + fmt.Sprintf("%0*d", maxSocketPath, 0) + "/ctl.sock")
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "the maximum is")
 	})
 }
@@ -1,107 +0,0 @@
 //go:build !windows
 package diag
 import (
 	"errors"
 	"fmt"
 	"io/fs"
 	"net"
 	"os"
 	"path/filepath"
 	"runtime"
 	"time"
 )
 // maxSocketPath is the smallest sun_path across the platforms nebula ships on: 104 bytes on
 // darwin and the BSDs, 108 on Linux. Checking it ourselves turns a bare "invalid argument"
 // into something an operator can act on.
 const maxSocketPath = 103
 // DefaultSocketPath is where nebula listens when ctl.socket is unset. An empty string means
 // the platform has no sensible default and ctl stays off unless an operator names a path.
 func DefaultSocketPath() string {
 	switch runtime.GOOS {
 	case "ios", "android":
 		// No daemon to attach to and no shell to attach from, and nowhere writable that
 		// would survive being guessed. Mobile embedders drive nebula through Control.
 		return ""
 	case "linux":
 		return "/run/nebula/ctl.sock"
 	default:
 		// /run does not exist on darwin, and /var/run is the portable spelling everywhere
 		// else nebula builds.
 		return "/var/run/nebula/ctl.sock"
 	}
 }
 // listenSocket creates the listening socket at path, taking over one a previous nebula left
 // behind but refusing one that is still being served.
 func listenSocket(path string) (net.Listener, error) {
 	if len(path) > maxSocketPath {
 		return nil, fmt.Errorf("socket path is %d bytes, the maximum is %d", len(path), maxSocketPath)
 	}
 	// The directory, not the socket, is what enforces access control. net.Listen creates the
 	// socket with 0777&^umask, so with a typical 0022 umask it is world connectable for the
 	// window between bind and chmod. Nobody can traverse into a 0700 directory to reach it in
 	// that window, and unlike the socket's own mode, directory traversal is enforced
 	// consistently across every platform this file builds for.
 	dir := filepath.Dir(path)
 	if err := os.MkdirAll(dir, 0700); err != nil {
 		return nil, fmt.Errorf("failed to create %s: %w", dir, err)
 	}
 	if err := os.Chmod(dir, 0700); err != nil {
 		return nil, fmt.Errorf("failed to set permissions on %s: %w", dir, err)
 	}
 	if err := clearStaleSocket(path); err != nil {
 		return nil, err
 	}
 	ln, err := net.Listen("unix", path)
 	if err != nil {
 		return nil, err
 	}
 	// Defence in depth behind the directory, for anyone who relocates the socket somewhere
 	// more permissive.
 	if err := os.Chmod(path, 0600); err != nil {
 		_ = ln.Close()
 		return nil, fmt.Errorf("failed to set permissions on %s: %w", path, err)
 	}
 	return ln, nil
 }
 // dialSocket connects to a nebula serving at path.
 func dialSocket(path string, timeout time.Duration) (net.Conn, error) {
 	return net.DialTimeout("unix", path, timeout)
 }
 // clearStaleSocket removes a socket a crashed nebula left behind, but refuses to steal one
 // another nebula is still serving. Two instances on one host need two paths; they cannot
 // share one, and silently taking the socket would break the instance that got there first.
 func clearStaleSocket(path string) error {
 	fi, err := os.Lstat(path)
 	if errors.Is(err, fs.ErrNotExist) {
 		return nil
 	}
 	if err != nil {
 		return err
 	}
 	if fi.Mode()&fs.ModeSocket == 0 {
 		return fmt.Errorf("%s exists and is not a socket, refusing to remove it", path)
 	}
 	// A successful dial is the only reliable way to tell a live socket from an abandoned
 	// one; the inode looks identical either way.
 	c, err := net.DialTimeout("unix", path, 100*time.Millisecond)
 	if err == nil {
 		_ = c.Close()
 		return fmt.Errorf("%s is already being served, is another nebula running?", path)
 	}
 	return os.Remove(path)
 }
@@ -1,27 +0,0 @@
 //go:build windows
 package diag
 import (
 	"net"
 	"time"
 )
 // Windows has AF_UNIX since Windows 10 1803, but no way to secure the socket that resembles
 // what the unix build does: os.Chmod cannot express an ACL, and a socket's reachability comes
 // down to whatever its directory inherited. Doing this properly means a named pipe with an
 // explicit security descriptor, which is a dependency and a design this change does not carry.
 // Until then the stub keeps the package building and gives operators a real answer.
 // DefaultSocketPath returns an empty string: there is no path worth defaulting to here.
 func DefaultSocketPath() string {
 	return ""
 }
 func listenSocket(path string) (net.Listener, error) {
 	return nil, ErrNotSupported
 }
 func dialSocket(path string, timeout time.Duration) (net.Conn, error) {
 	return nil, ErrNotSupported
 }
@@ -62,7 +62,7 @@ function nebula.dissector(tvbuf, pktinfo, root)
    tree:add(pf_version, tvbuf:range(0,1))
    local type = tree:add(pf_type,    tvbuf:range(0,1))
-    local nebula_type = bit.band(tvbuf:range(0,1):uint(), 0x0F)
+    local nebula_type = bit32.band(tvbuf:range(0,1):uint(), 0x0F)
    if nebula_type == 0 then
        local stage = tvbuf(8,8):uint64()
        tree:add(pf_subtype_handshake, tvbuf:range(1,1))
@@ -1,277 +1,68 @@
 package nebula
 import (
 	"context"
 	"fmt"
 	"log/slog"
 	"net"
 	"net/netip"
 	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"github.com/gaissmai/bart"
 	"github.com/miekg/dns"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 )
-type dnsServer struct {
+// This whole thing should be rewritten to use context
 var dnsR *dnsRecords
 var dnsServer *dns.Server
 var dnsAddr string
 type dnsRecords struct {
 	sync.RWMutex
-	l       *slog.Logger
+	l               *logrus.Logger
-	ctx     context.Context
+	dnsMap4         map[string]netip.Addr
-	dnsMap4 map[string]netip.Addr
+	dnsMap6         map[string]netip.Addr
-	dnsMap6 map[string]netip.Addr
+	hostMap         *HostMap
-	hostMap *HostMap
+	myVpnAddrsTable *bart.Lite
 	pki     *PKI
 	// selfHost is the cached FQDN we last seeded for ourselves
 	selfHost string
 	mux *dns.ServeMux
 	// enabled mirrors `lighthouse.serve_dns && lighthouse.am_lighthouse`.
 	// Start, Add, and reload consult it so callers don't need to know the
 	// gating rules. When it toggles off via reload, accumulated records are
 	// cleared so a later re-enable starts with a fresh map populated from
 	// new handshakes.
 	enabled atomic.Bool
 	serverMu sync.Mutex
 	server   *dns.Server
 	// started is closed once `server` has finished binding (or after
 	// ListenAndServe returns on a bind failure). Stop waits on it before
 	// calling Shutdown to avoid the miekg/dns "server not started" race
 	// where a Shutdown that arrives before bind completes is silently
 	// ignored, leaving the listener running forever.
 	started chan struct{}
 	addr    string
 }
-// newDnsServerFromConfig builds a dnsServer, applies the initial config, and
+func newDnsRecords(l *logrus.Logger, cs *CertState, hostMap *HostMap) *dnsRecords {
-// registers a reload callback. The reload callback is registered before the
+	return &dnsRecords{
-// initial config is applied, so a SIGHUP can later enable, fix, or disable
+		l:               l,
-// DNS even if the initial application failed.
+		dnsMap4:         make(map[string]netip.Addr),
-//
+		dnsMap6:         make(map[string]netip.Addr),
-// The dnsServer internally gates on `lighthouse.serve_dns &&
+		hostMap:         hostMap,
-// lighthouse.am_lighthouse`. Start and Add are safe to call unconditionally,
+		myVpnAddrsTable: cs.myVpnAddrsTable,
 // they no-op when DNS isn't enabled. Each Start invocation owns a ctx-cancel
 // watcher that tears the listener down on nebula shutdown. The returned
 // pointer is always non-nil, even on error.
 func newDnsServerFromConfig(ctx context.Context, l *slog.Logger, pki *PKI, hostMap *HostMap, c *config.C) (*dnsServer, error) {
 	ds := &dnsServer{
 		l:       l,
 		ctx:     ctx,
 		dnsMap4: make(map[string]netip.Addr),
 		dnsMap6: make(map[string]netip.Addr),
 		hostMap: hostMap,
 		pki:     pki,
 	}
 	ds.mux = dns.NewServeMux()
 	ds.mux.HandleFunc(".", ds.handleDnsRequest)
 	c.RegisterReloadCallback(func(c *config.C) {
 		if err := ds.reload(c, false); err != nil {
 			ds.l.Error("Failed to reload DNS responder from config", "error", err)
 		}
 	})
 	if err := ds.reload(c, true); err != nil {
 		return ds, err
 	}
 	ds.seedSelf()
 	return ds, nil
 }
 // reload applies the latest config and reconciles the running state with it:
 //   - enabled toggled on  -> spawn a runner
 //   - enabled toggled off -> stop the runner
 //   - listen address changed (while running) -> restart on the new address
 //   - everything else     -> no-op
 //
 // On the initial call it only records configuration; Control.Start is what
 // launches the first runner via dnsStart.
 func (d *dnsServer) reload(c *config.C, initial bool) error {
 	wantsDns := c.GetBool("lighthouse.serve_dns", false)
 	amLighthouse := c.GetBool("lighthouse.am_lighthouse", false)
 	enabled := wantsDns && amLighthouse
 	newAddr := getDnsServerAddr(c)
 	d.serverMu.Lock()
 	running := d.server != nil
 	sameAddr := d.addr == newAddr
 	d.addr = newAddr
 	d.enabled.Store(enabled)
 	d.serverMu.Unlock()
 	if initial {
 		if wantsDns && !amLighthouse {
 			d.l.Warn("DNS server refusing to run because this host is not a lighthouse.")
 		}
 		return nil
 	}
 	if !enabled {
 		if running {
 			d.Stop()
 		}
 		// Drop any records that accumulated while enabled; a later re-enable
 		// will repopulate from fresh handshakes and a fresh seedSelf.
 		d.clearRecords()
 		return nil
 	}
 	if !running {
 		// Was disabled (or never started); bring it up now.
 		go d.Start()
 	} else if !sameAddr {
 		// Stop clears the slot before shutting down, otherwise the Start below can find the dying server and refuse
 		d.Stop()
 		go d.Start()
 	}
 	// Refresh the self entry every enabled reload so cert renewals that change our name or VPN addresses are picked up.
 	d.seedSelf()
 	return nil
 }
 // shutdownServer waits for the server to finish binding (so Shutdown actually
 // stops it rather than no-oping) and then shuts it down.
 func (d *dnsServer) shutdownServer(srv *dns.Server, started chan struct{}, reason string) {
 	if srv == nil {
 		return
 	}
 	if started != nil {
 		<-started
 	}
 	if err := srv.Shutdown(); err != nil {
 		d.l.Warn("Failed to shut down the DNS responder", "reason", reason, "error", err)
 	}
 }
-// Start binds and serves the DNS responder. Blocks until Stop is called or
+func (d *dnsRecords) Query(q uint16, data string) netip.Addr {
 // the listener errors. Safe to call when DNS is disabled (returns
 // immediately). This is what Control.dnsStart points at.
 //
 // Must be invoked after the tun device is active so that lighthouse.dns.host
 // may bind to a nebula IP.
 func (d *dnsServer) Start() {
 	if !d.enabled.Load() {
 		return
 	}
 	started := make(chan struct{})
 	d.serverMu.Lock()
 	// Re-check enabled under the lock, a disable that raced our check above snapshots the slot under it too.
 	// Two reloads in quick succession can both spawn a Start, the loser would orphan the live listener past Stop
 	if d.ctx.Err() != nil || d.server != nil || !d.enabled.Load() {
 		d.serverMu.Unlock()
 		return
 	}
 	addr := d.addr
 	server := &dns.Server{
 		Addr:              addr,
 		Net:               "udp",
 		Handler:           d.mux,
 		NotifyStartedFunc: func() { close(started) },
 	}
 	d.server = server
 	d.started = started
 	d.serverMu.Unlock()
 	// Per-invocation ctx watcher. Exits when Start does, so we don't leak a
 	// watcher per reload-driven restart.
 	done := make(chan struct{})
 	go func() {
 		select {
 		case <-d.ctx.Done():
 			d.shutdownServer(server, started, "shutdown")
 		case <-done:
 		}
 	}()
 	d.l.Info("Starting DNS responder", "dnsListener", addr)
 	err := server.ListenAndServe()
 	close(done)
 	// If the listener never bound (bind error) NotifyStartedFunc never fires,
 	// so close started here to release any Stop caller waiting on it.
 	select {
 	case <-started:
 	default:
 		close(started)
 	}
 	// Release our slot, unless a reload already replaced us, so a dead listener can't block a future Start
 	d.serverMu.Lock()
 	if d.server == server {
 		d.server = nil
 		d.started = nil
 	}
 	d.serverMu.Unlock()
 	if err != nil {
 		d.l.Warn("Failed to run the DNS responder", "error", err)
 	}
 }
 // Stop shuts down the active server, if any. Idempotent.
 func (d *dnsServer) Stop() {
 	d.serverMu.Lock()
 	srv := d.server
 	started := d.started
 	d.server = nil
 	d.started = nil
 	d.serverMu.Unlock()
 	d.shutdownServer(srv, started, "stop")
 }
 // Query returns the address for the given name and query type. The second
 // return value reports whether the name is known at all (in either A or AAAA),
 // which lets callers distinguish NODATA from NXDOMAIN.
 func (d *dnsServer) Query(q uint16, data string) (netip.Addr, bool) {
 	data = strings.ToLower(data)
 	d.RLock()
 	defer d.RUnlock()
 	addr4, haveV4 := d.dnsMap4[data]
 	addr6, haveV6 := d.dnsMap6[data]
 	nameExists := haveV4 || haveV6
 	switch q {
 	case dns.TypeA:
-		if haveV4 {
+		if r, ok := d.dnsMap4[data]; ok {
-			return addr4, nameExists
+			return r
 		}
 	case dns.TypeAAAA:
-		if haveV6 {
+		if r, ok := d.dnsMap6[data]; ok {
-			return addr6, nameExists
+			return r
 		}
 	}
-	return netip.Addr{}, nameExists
+	return netip.Addr{}
 }
-func (d *dnsServer) QueryCert(data string) string {
+func (d *dnsRecords) QueryCert(data string) string {
 	if len(data) < 2 {
 		return ""
 	}
 	ip, err := netip.ParseAddr(data[:len(data)-1])
 	if err != nil {
 		return ""
 	}
 	// The hostmap only ever contains peers we have handshaked with, so it never carries an entry for ourselves.
 	// Answer self lookups straight from the local cert state.
 	if cs := d.certState(); cs != nil && cs.myVpnAddrsTable != nil && cs.myVpnAddrsTable.Contains(ip) {
 		c := cs.GetDefaultCertificate()
 		if c == nil {
 			return ""
 		}
 		b, err := c.MarshalJSON()
 		if err != nil {
 			return ""
 		}
 		return string(b)
 	}
 	hostinfo := d.hostMap.QueryVpnAddr(ip)
 	if hostinfo == nil {
 		return ""
@@ -289,67 +80,8 @@ func (d *dnsServer) QueryCert(data string) string {
 	return string(b)
 }
 // clearRecords drops all DNS records, including the self entry.
 func (d *dnsServer) clearRecords() {
 	d.Lock()
 	defer d.Unlock()
 	clear(d.dnsMap4)
 	clear(d.dnsMap6)
 	d.selfHost = ""
 }
 // seedSelf inserts (or refreshes) a record for our own cert name pointing at our VPN addresses,
 // so a single-lighthouse network can resolve the lighthouse's own hostname without the two-process workaround.
 func (d *dnsServer) seedSelf() {
 	if !d.enabled.Load() {
 		return
 	}
 	cs := d.certState()
 	if cs == nil {
 		return
 	}
 	c := cs.GetDefaultCertificate()
 	if c == nil {
 		return
 	}
 	newHost := strings.ToLower(c.Name()) + "."
 	d.Lock()
 	defer d.Unlock()
 	if d.selfHost != "" && d.selfHost != newHost {
 		delete(d.dnsMap4, d.selfHost)
 		delete(d.dnsMap6, d.selfHost)
 	}
 	d.selfHost = newHost
 	delete(d.dnsMap4, newHost)
 	delete(d.dnsMap6, newHost)
 	haveV4, haveV6 := false, false
 	for _, addr := range cs.myVpnAddrs {
 		if addr.Is4() && !haveV4 {
 			d.dnsMap4[newHost] = addr
 			haveV4 = true
 		} else if addr.Is6() && !haveV6 {
 			d.dnsMap6[newHost] = addr
 			haveV6 = true
 		}
 		if haveV4 && haveV6 {
 			break
 		}
 	}
 }
 func (d *dnsServer) certState() *CertState {
 	if d.pki == nil {
 		return nil
 	}
 	return d.pki.getCertState()
 }
 // Add adds the first IPv4 and IPv6 address that appears in `addresses` as the record for `host`
-func (d *dnsServer) Add(host string, addresses []netip.Addr) {
+func (d *dnsRecords) Add(host string, addresses []netip.Addr) {
 	if !d.enabled.Load() {
 		return
 	}
 	host = strings.ToLower(host)
 	d.Lock()
 	defer d.Unlock()
@@ -369,7 +101,7 @@ func (d *dnsServer) Add(host string, addresses []netip.Addr) {
 	}
 }
-func (d *dnsServer) isSelfNebulaOrLocalhost(addr string) bool {
+func (d *dnsRecords) isSelfNebulaOrLocalhost(addr string) bool {
 	a, _, _ := net.SplitHostPort(addr)
 	b, err := netip.ParseAddr(a)
 	if err != nil {
@@ -380,32 +112,17 @@ func (d *dnsServer) isSelfNebulaOrLocalhost(addr string) bool {
 		return true
 	}
 	cs := d.certState()
 	if cs == nil || cs.myVpnAddrsTable == nil {
 		return false
 	}
 	//if we found it in this table, it's good
-	return cs.myVpnAddrsTable.Contains(b)
+	return d.myVpnAddrsTable.Contains(b)
 }
-func (d *dnsServer) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
+func (d *dnsRecords) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 	debugEnabled := d.l.Enabled(context.Background(), slog.LevelDebug)
 	// Per RFC 2308 §2.2, a name that exists but has no record of the requested
 	// type must be answered with NOERROR and an empty answer section (NODATA),
 	// not NXDOMAIN (RFC 2308 §2.1), which is reserved for names that do not
 	// exist at all.
 	anyNameExists := false
 	for _, q := range m.Question {
 		switch q.Qtype {
 		case dns.TypeA, dns.TypeAAAA:
 			qType := dns.TypeToString[q.Qtype]
-			if debugEnabled {
+			d.l.Debugf("Query for %s %s", qType, q.Name)
-				d.l.Debug("DNS query", "type", qType, "name", q.Name)
+			ip := d.Query(q.Qtype, q.Name)
 			}
 			ip, nameExists := d.Query(q.Qtype, q.Name)
 			if nameExists {
 				anyNameExists = true
 			}
 			if ip.IsValid() {
 				rr, err := dns.NewRR(fmt.Sprintf("%s %s %s", q.Name, qType, ip))
 				if err == nil {
@@ -417,9 +134,7 @@ func (d *dnsServer) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 			if !d.isSelfNebulaOrLocalhost(w.RemoteAddr().String()) {
 				return
 			}
-			if debugEnabled {
+			d.l.Debugf("Query for TXT %s", q.Name)
 				d.l.Debug("DNS query", "type", "TXT", "name", q.Name)
 			}
 			ip := d.QueryCert(q.Name)
 			if ip != "" {
 				rr, err := dns.NewRR(fmt.Sprintf("%s TXT %s", q.Name, ip))
@@ -430,12 +145,12 @@ func (d *dnsServer) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 		}
 	}
-	if len(m.Answer) == 0 && !anyNameExists {
+	if len(m.Answer) == 0 {
 		m.Rcode = dns.RcodeNameError
 	}
 }
-func (d *dnsServer) handleDnsRequest(w dns.ResponseWriter, r *dns.Msg) {
+func (d *dnsRecords) handleDnsRequest(w dns.ResponseWriter, r *dns.Msg) {
 	m := new(dns.Msg)
 	m.SetReply(r)
 	m.Compress = false
@@ -448,6 +163,21 @@ func (d *dnsServer) handleDnsRequest(w dns.ResponseWriter, r *dns.Msg) {
 	w.WriteMsg(m)
 }
 func dnsMain(l *logrus.Logger, cs *CertState, hostMap *HostMap, c *config.C) func() {
 	dnsR = newDnsRecords(l, cs, hostMap)
 	// attach request handler func
 	dns.HandleFunc(".", dnsR.handleDnsRequest)
 	c.RegisterReloadCallback(func(c *config.C) {
 		reloadDns(l, c)
 	})
 	return func() {
 		startDns(l, c)
 	}
 }
 func getDnsServerAddr(c *config.C) string {
 	dnsHost := strings.TrimSpace(c.GetString("lighthouse.dns.host", ""))
 	// Old guidance was to provide the literal `[::]` in `lighthouse.dns.host` but that won't resolve.
@@ -456,3 +186,25 @@ func getDnsServerAddr(c *config.C) string {
 	}
 	return net.JoinHostPort(dnsHost, strconv.Itoa(c.GetInt("lighthouse.dns.port", 53)))
 }
 func startDns(l *logrus.Logger, c *config.C) {
 	dnsAddr = getDnsServerAddr(c)
 	dnsServer = &dns.Server{Addr: dnsAddr, Net: "udp"}
 	l.WithField("dnsListener", dnsAddr).Info("Starting DNS responder")
 	err := dnsServer.ListenAndServe()
 	defer dnsServer.Shutdown()
 	if err != nil {
 		l.Errorf("Failed to start server: %s\n ", err.Error())
 	}
 }
 func reloadDns(l *logrus.Logger, c *config.C) {
 	if dnsAddr == getDnsServerAddr(c) {
 		l.Debug("No DNS server config change detected")
 		return
 	}
 	l.Debug("Restarting DNS server")
 	dnsServer.Shutdown()
 	go startDns(l, c)
 }
@@ -1,46 +1,19 @@
 package nebula
 import (
 	"context"
 	"log/slog"
 	"net"
 	"net/netip"
 	"strconv"
 	"testing"
 	"time"
 	"github.com/gaissmai/bart"
 	"github.com/miekg/dns"
-	"github.com/slackhq/nebula/cert"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/config"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 type stubDNSWriter struct{}
 func (stubDNSWriter) LocalAddr() net.Addr { return &net.UDPAddr{} }
 func (stubDNSWriter) RemoteAddr() net.Addr {
 	return &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 5353}
 }
 func (stubDNSWriter) Write([]byte) (int, error) { return 0, nil }
 func (stubDNSWriter) WriteMsg(*dns.Msg) error   { return nil }
 func (stubDNSWriter) Close() error              { return nil }
 func (stubDNSWriter) TsigStatus() error         { return nil }
 func (stubDNSWriter) TsigTimersOnly(bool)       {}
 func (stubDNSWriter) Hijack()                   {}
 func TestParsequery(t *testing.T) {
-	l := slog.New(slog.DiscardHandler)
+	l := logrus.New()
 	hostMap := &HostMap{}
-	ds := &dnsServer{
+	ds := newDnsRecords(l, &CertState{}, hostMap)
 		l:       l,
 		dnsMap4: make(map[string]netip.Addr),
 		dnsMap6: make(map[string]netip.Addr),
 		hostMap: hostMap,
 	}
 	ds.enabled.Store(true)
 	addrs := []netip.Addr{
 		netip.MustParseAddr("1.2.3.4"),
 		netip.MustParseAddr("1.2.3.5"),
@@ -48,56 +21,18 @@ func TestParsequery(t *testing.T) {
 		netip.MustParseAddr("fd01::25"),
 	}
 	ds.Add("test.com.com", addrs)
 	ds.Add("v4only.com.com", []netip.Addr{netip.MustParseAddr("1.2.3.6")})
 	ds.Add("v6only.com.com", []netip.Addr{netip.MustParseAddr("fd01::26")})
 	m := &dns.Msg{}
 	m.SetQuestion("test.com.com", dns.TypeA)
 	ds.parseQuery(m, nil)
 	assert.NotNil(t, m.Answer)
 	assert.Equal(t, "1.2.3.4", m.Answer[0].(*dns.A).A.String())
 	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
 	m = &dns.Msg{}
 	m.SetQuestion("test.com.com", dns.TypeAAAA)
 	ds.parseQuery(m, nil)
 	assert.NotNil(t, m.Answer)
 	assert.Equal(t, "fd01::24", m.Answer[0].(*dns.AAAA).AAAA.String())
 	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
 	// A known name with no record of the requested type should return NODATA
 	// (NOERROR with empty answer), not NXDOMAIN.
 	m = &dns.Msg{}
 	m.SetQuestion("v4only.com.com", dns.TypeAAAA)
 	ds.parseQuery(m, nil)
 	assert.Empty(t, m.Answer)
 	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
 	m = &dns.Msg{}
 	m.SetQuestion("v6only.com.com", dns.TypeA)
 	ds.parseQuery(m, nil)
 	assert.Empty(t, m.Answer)
 	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
 	// An unknown name should still return NXDOMAIN.
 	m = &dns.Msg{}
 	m.SetQuestion("unknown.com.com", dns.TypeA)
 	ds.parseQuery(m, nil)
 	assert.Empty(t, m.Answer)
 	assert.Equal(t, dns.RcodeNameError, m.Rcode)
 	// short lookups should not fail
 	m = &dns.Msg{}
 	m.Question = []dns.Question{{Name: "", Qtype: dns.TypeTXT, Qclass: dns.ClassINET}}
 	ds.parseQuery(m, stubDNSWriter{})
 	assert.Empty(t, m.Answer)
 	assert.Equal(t, dns.RcodeNameError, m.Rcode)
 	m = &dns.Msg{}
 	m.Question = []dns.Question{{Name: ".", Qtype: dns.TypeTXT, Qclass: dns.ClassINET}}
 	ds.parseQuery(m, stubDNSWriter{})
 	assert.Empty(t, m.Answer)
 	assert.Equal(t, dns.RcodeNameError, m.Rcode)
 }
 func Test_getDnsServerAddr(t *testing.T) {
@@ -136,496 +71,3 @@ func Test_getDnsServerAddr(t *testing.T) {
 	}
 	assert.Equal(t, "[::]:1", getDnsServerAddr(c))
 }
 func newTestDnsServer(t *testing.T) (*dnsServer, *config.C) {
 	t.Helper()
 	sl := slog.New(slog.DiscardHandler)
 	ds := &dnsServer{
 		l:       sl,
 		ctx:     context.Background(),
 		dnsMap4: make(map[string]netip.Addr),
 		dnsMap6: make(map[string]netip.Addr),
 		hostMap: &HostMap{},
 	}
 	ds.mux = dns.NewServeMux()
 	ds.mux.HandleFunc(".", ds.handleDnsRequest)
 	return ds, config.NewC(nil)
 }
 func setDnsConfig(c *config.C, host string, port string, amLighthouse, serveDns bool) {
 	c.Settings["lighthouse"] = map[string]any{
 		"am_lighthouse": amLighthouse,
 		"serve_dns":     serveDns,
 		"dns": map[string]any{
 			"host": host,
 			"port": port,
 		},
 	}
 }
 func TestDnsServer_reload_initial_disabled(t *testing.T) {
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", "0", true, false)
 	require.NoError(t, ds.reload(c, true))
 	assert.False(t, ds.enabled.Load())
 	assert.Equal(t, "127.0.0.1:0", ds.addr)
 	assert.Nil(t, ds.server)
 }
 func TestDnsServer_reload_initial_enabled(t *testing.T) {
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", "0", true, true)
 	require.NoError(t, ds.reload(c, true))
 	assert.True(t, ds.enabled.Load())
 	assert.Equal(t, "127.0.0.1:0", ds.addr)
 	// initial never starts a runner; that's Control.Start's job
 	assert.Nil(t, ds.server)
 }
 func TestDnsServer_reload_initial_serveDnsWithoutLighthouse(t *testing.T) {
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", "0", false, true)
 	require.NoError(t, ds.reload(c, true))
 	// Wants DNS but isn't a lighthouse: gated off, no runner.
 	assert.False(t, ds.enabled.Load())
 }
 func TestDnsServer_reload_sameAddr_noOp(t *testing.T) {
 	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", port, true, true)
 	require.NoError(t, ds.reload(c, true))
 	go ds.Start()
 	waitForBind(t, ds)
 	ds.serverMu.Lock()
 	before := ds.server
 	ds.serverMu.Unlock()
 	require.NotNil(t, before)
 	// Same address, so the running listener must be left alone rather than rebuilt under live queries
 	require.NoError(t, ds.reload(c, false))
 	assert.True(t, ds.enabled.Load())
 	ds.serverMu.Lock()
 	after := ds.server
 	ds.serverMu.Unlock()
 	assert.Same(t, before, after, "a same-address reload must not restart the listener")
 	ds.Stop()
 }
 // The branch the old sameAddr test was accidentally hitting: enabled with nothing running means reload starts it.
 func TestDnsServer_reload_whenNotRunning_starts(t *testing.T) {
 	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", port, true, true)
 	// initial only records config, it never starts anything
 	require.NoError(t, ds.reload(c, true))
 	ds.serverMu.Lock()
 	assert.Nil(t, ds.server, "the initial reload must not start a listener")
 	ds.serverMu.Unlock()
 	require.NoError(t, ds.reload(c, false))
 	waitForBind(t, ds)
 	ds.serverMu.Lock()
 	assert.NotNil(t, ds.server, "a reload with nothing running should bring DNS up")
 	ds.serverMu.Unlock()
 	ds.Stop()
 }
 func TestDnsServer_StartStop_lifecycle(t *testing.T) {
 	// Bind to a real (random) UDP port so we exercise the actual
 	// ListenAndServe + Shutdown plumbing including the started-chan race fix.
 	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", port, true, true)
 	require.NoError(t, ds.reload(c, true))
 	done := make(chan struct{})
 	go func() {
 		ds.Start()
 		close(done)
 	}()
 	waitFor(t, func() bool {
 		ds.serverMu.Lock()
 		started := ds.started
 		ds.serverMu.Unlock()
 		if started == nil {
 			return false
 		}
 		select {
 		case <-started:
 			return true
 		default:
 			return false
 		}
 	})
 	ds.Stop()
 	select {
 	case <-done:
 	case <-time.After(5 * time.Second):
 		t.Fatal("Start did not return after Stop")
 	}
 }
 func TestDnsServer_Stop_beforeBind_doesNotHang(t *testing.T) {
 	// Stop called immediately after Start should not deadlock even if bind
 	// hasn't completed yet. This exercises the started-chan close-on-bind-fail
 	// path: by binding to an obviously bad port (privileged) we get a fast
 	// bind error before NotifyStartedFunc fires.
 	ds, c := newTestDnsServer(t)
 	// Use a port that should fail to bind (negative would be invalid, use a
 	// host that won't resolve to ensure listenUDP fails quickly).
 	setDnsConfig(c, "256.256.256.256", "53", true, true)
 	require.NoError(t, ds.reload(c, true))
 	done := make(chan struct{})
 	go func() {
 		ds.Start()
 		close(done)
 	}()
 	// Give Start a moment to attempt the bind and fail.
 	select {
 	case <-done:
 		// Bind failed and Start returned; Stop should be a no-op.
 	case <-time.After(time.Second):
 		t.Fatal("Start did not return after a bad bind")
 	}
 	stopped := make(chan struct{})
 	go func() {
 		ds.Stop()
 		close(stopped)
 	}()
 	select {
 	case <-stopped:
 	case <-time.After(time.Second):
 		t.Fatal("Stop hung after a failed bind")
 	}
 }
 // newTestPKI builds a minimal *PKI with a single v1 cert whose name and
 // VPN addresses are caller-provided, suitable for exercising seedSelf and
 // QueryCert self handling.
 func newTestPKI(t *testing.T, name string, addrs []netip.Addr) *PKI {
 	t.Helper()
 	networks := make([]netip.Prefix, 0, len(addrs))
 	for _, a := range addrs {
 		bits := 32
 		if a.Is6() {
 			bits = 128
 		}
 		networks = append(networks, netip.PrefixFrom(a, bits))
 	}
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil)
 	c, _, _, _ := cert_test.NewTestCert(cert.Version2, cert.Curve_CURVE25519, ca, caKey, name, time.Time{}, time.Time{}, networks, nil, nil)
 	addrsTable := new(bart.Lite)
 	for _, a := range addrs {
 		addrsTable.Insert(netip.PrefixFrom(a, a.BitLen()))
 	}
 	cs := &CertState{
 		v2Cert:            c,
 		initiatingVersion: cert.Version2,
 		myVpnAddrs:        addrs,
 		myVpnAddrsTable:   addrsTable,
 	}
 	pki := &PKI{}
 	pki.cs.Store(cs)
 	return pki
 }
 func TestDnsServer_seedSelf_addsOwnRecord(t *testing.T) {
 	ds, c := newTestDnsServer(t)
 	myV4 := netip.MustParseAddr("10.0.0.1")
 	myV6 := netip.MustParseAddr("fd00::1")
 	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{myV4, myV6})
 	setDnsConfig(c, "127.0.0.1", "0", true, true)
 	require.NoError(t, ds.reload(c, true))
 	ds.seedSelf()
 	got4, exists := ds.Query(dns.TypeA, "lighthouse.")
 	assert.True(t, exists)
 	assert.Equal(t, myV4, got4)
 	got6, exists := ds.Query(dns.TypeAAAA, "lighthouse.")
 	assert.True(t, exists)
 	assert.Equal(t, myV6, got6)
 }
 func TestDnsServer_seedSelf_disabled_noOp(t *testing.T) {
 	ds, c := newTestDnsServer(t)
 	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{netip.MustParseAddr("10.0.0.1")})
 	setDnsConfig(c, "127.0.0.1", "0", true, false)
 	require.NoError(t, ds.reload(c, true))
 	ds.seedSelf()
 	_, exists := ds.Query(dns.TypeA, "lighthouse.")
 	assert.False(t, exists)
 }
 func TestDnsServer_clearRecords_dropsSelfHost(t *testing.T) {
 	ds, c := newTestDnsServer(t)
 	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{netip.MustParseAddr("10.0.0.1")})
 	setDnsConfig(c, "127.0.0.1", "0", true, true)
 	require.NoError(t, ds.reload(c, true))
 	ds.seedSelf()
 	require.NotEmpty(t, ds.selfHost)
 	ds.clearRecords()
 	assert.Empty(t, ds.selfHost)
 	_, exists := ds.Query(dns.TypeA, "lighthouse.")
 	assert.False(t, exists)
 }
 func TestDnsServer_QueryCert_returnsOwnCert(t *testing.T) {
 	ds, _ := newTestDnsServer(t)
 	myV4 := netip.MustParseAddr("10.0.0.1")
 	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{myV4})
 	got := ds.QueryCert(myV4.String() + ".")
 	assert.NotEmpty(t, got, "TXT lookup of our own VPN address should return our cert")
 	other := netip.MustParseAddr("10.0.0.99")
 	assert.Empty(t, ds.QueryCert(other.String()+"."), "unknown peer IP should return nothing")
 }
 func TestDnsServer_reload_disable_stopsRunningServer(t *testing.T) {
 	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", port, true, true)
 	require.NoError(t, ds.reload(c, true))
 	startReturned := make(chan struct{})
 	go func() {
 		ds.Start()
 		close(startReturned)
 	}()
 	waitForBind(t, ds)
 	// Toggle serve_dns off; reload should shut the running server down.
 	setDnsConfig(c, "127.0.0.1", port, true, false)
 	require.NoError(t, ds.reload(c, false))
 	select {
 	case <-startReturned:
 	case <-time.After(5 * time.Second):
 		t.Fatal("Start did not return after reload disabled DNS")
 	}
 	assert.False(t, ds.enabled.Load())
 }
 func freeUDPPort(t *testing.T) string {
 	t.Helper()
 	conn, err := net.ListenPacket("udp", "127.0.0.1:0")
 	require.NoError(t, err)
 	port := conn.LocalAddr().(*net.UDPAddr).Port
 	require.NoError(t, conn.Close())
 	return strconv.Itoa(port)
 }
 func waitForBind(t *testing.T, ds *dnsServer) {
 	t.Helper()
 	waitFor(t, func() bool {
 		ds.serverMu.Lock()
 		started := ds.started
 		ds.serverMu.Unlock()
 		if started == nil {
 			return false
 		}
 		select {
 		case <-started:
 			return true
 		default:
 			return false
 		}
 	})
 }
 func waitFor(t *testing.T, cond func() bool) {
 	t.Helper()
 	deadline := time.Now().Add(5 * time.Second)
 	for time.Now().Before(deadline) {
 		if cond() {
 			return
 		}
 		time.Sleep(5 * time.Millisecond)
 	}
 	t.Fatal("timed out waiting for condition")
 }
 // Two reloads in quick succession, or a HUP before Control.Start, can race two Starts at the same listener.
 func TestDnsServer_Start_isIdempotent(t *testing.T) {
 	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", port, true, true)
 	require.NoError(t, ds.reload(c, true))
 	go ds.Start()
 	waitForBind(t, ds)
 	ds.serverMu.Lock()
 	first := ds.server
 	ds.serverMu.Unlock()
 	require.NotNil(t, first)
 	// If the second Start replaces the tracked server, Stop kills the wrong one and the port leaks
 	done := make(chan struct{})
 	go func() {
 		ds.Start()
 		close(done)
 	}()
 	select {
 	case <-done:
 	case <-time.After(time.Second * 5):
 		t.Fatal("second Start never returned")
 	}
 	ds.serverMu.Lock()
 	second := ds.server
 	ds.serverMu.Unlock()
 	assert.Same(t, first, second, "a second Start must not replace the running server")
 	// The real proof, after Stop the port must actually be free
 	ds.Stop()
 	waitFor(t, func() bool {
 		pc, err := net.ListenPacket("udp", "127.0.0.1:"+port)
 		if err != nil {
 			return false
 		}
 		_ = pc.Close()
 		return true
 	})
 }
 // An address change must actually end up listening on the new port. Start's guard refuses when a server is already
 // installed, so reload has to clear the slot before shutting the old one down.
 func TestDnsServer_reload_addrChange_restarts(t *testing.T) {
 	first := freeUDPPort(t)
 	second := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", first, true, true)
 	require.NoError(t, ds.reload(c, true))
 	go ds.Start()
 	waitForBind(t, ds)
 	// Cycle a few times, the failure this guards against depends on which goroutine wins serverMu
 	for i := range 8 {
 		want := second
 		if i%2 == 1 {
 			want = first
 		}
 		setDnsConfig(c, "127.0.0.1", want, true, true)
 		require.NoError(t, ds.reload(c, false))
 		waitForBind(t, ds)
 		ds.serverMu.Lock()
 		srv := ds.server
 		ds.serverMu.Unlock()
 		require.NotNil(t, srv, "reload left DNS down instead of restarting it")
 		require.Equal(t, "127.0.0.1:"+want, srv.Addr, "reload should be serving the new address")
 	}
 	// Land back on second so the port assertions below are meaningful
 	setDnsConfig(c, "127.0.0.1", second, true, true)
 	require.NoError(t, ds.reload(c, false))
 	waitForBind(t, ds)
 	// The old port must be released and the new one actually held
 	waitFor(t, func() bool {
 		pc, err := net.ListenPacket("udp", "127.0.0.1:"+first)
 		if err != nil {
 			return false
 		}
 		_ = pc.Close()
 		return true
 	})
 	_, err := net.ListenPacket("udp", "127.0.0.1:"+second)
 	require.Error(t, err, "the new address should be bound by the DNS responder")
 	ds.Stop()
 }
 // A listener that dies on its own must release the slot, or a later same-addr reload sees it as running and no-ops.
 func TestDnsServer_Start_bindFailure_releasesSlot(t *testing.T) {
 	port := freeUDPPort(t)
 	blocker, err := net.ListenPacket("udp", "127.0.0.1:"+port)
 	require.NoError(t, err)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", port, true, true)
 	require.NoError(t, ds.reload(c, true))
 	ds.Start() // returns once the bind fails
 	ds.serverMu.Lock()
 	assert.Nil(t, ds.server, "a listener that failed to bind must not stay parked in the slot")
 	ds.serverMu.Unlock()
 	// With the slot released, a reload can retry once the port frees up
 	require.NoError(t, blocker.Close())
 	require.NoError(t, ds.reload(c, false))
 	waitForBind(t, ds)
 	ds.serverMu.Lock()
 	assert.NotNil(t, ds.server, "a same-addr reload should retry after a failed bind")
 	ds.serverMu.Unlock()
 	ds.Stop()
 }
 // A disable that lands while Start is between its unlocked check and the guard must not leave a listener behind.
 func TestDnsServer_Start_refusesWhenDisabledUnderLock(t *testing.T) {
 	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
 	setDnsConfig(c, "127.0.0.1", port, true, true)
 	require.NoError(t, ds.reload(c, true))
 	require.True(t, ds.enabled.Load())
 	// Holding serverMu parks Start on the lock, the only way to land the disable in that window on purpose
 	ds.serverMu.Lock()
 	done := make(chan struct{})
 	go func() {
 		ds.Start()
 		close(done)
 	}()
 	select {
 	case <-done:
 		ds.serverMu.Unlock()
 		t.Fatal("Start returned early, the test never exercised the window")
 	case <-time.After(time.Millisecond * 100):
 	}
 	// The disable reload's critical section. It sees nothing running, so it never calls Stop.
 	ds.enabled.Store(false)
 	ds.serverMu.Unlock()
 	select {
 	case <-done:
 	case <-time.After(time.Second * 5):
 		t.Fatal("Start never returned")
 	}
 	ds.serverMu.Lock()
 	assert.Nil(t, ds.server, "Start must not install a listener a disable already cancelled")
 	ds.serverMu.Unlock()
 	pc, err := net.ListenPacket("udp", "127.0.0.1:"+port)
 	require.NoError(t, err, "an orphaned listener is still holding the port")
 	_ = pc.Close()
 }
@@ -1,16 +1,6 @@
 FROM gcr.io/distroless/static:latest
 ARG TARGETOS TARGETARCH
 ARG VERSION=dev
 ARG REVISION=unknown
 LABEL org.opencontainers.image.title="nebula" \
      org.opencontainers.image.description="A scalable overlay networking tool with a focus on performance, simplicity and security" \
      org.opencontainers.image.vendor="Nebula OSS" \
      org.opencontainers.image.source="https://github.com/slackhq/nebula" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.revision="${REVISION}"
 COPY build/$TARGETOS-$TARGETARCH/nebula /nebula
 COPY build/$TARGETOS-$TARGETARCH/nebula-cert /nebula-cert
@@ -1,85 +0,0 @@
 //go:build e2e_testing
 // +build e2e_testing
 package e2e
 import (
 	"testing"
 	"time"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func assertTestRequestEchoed(t *testing.T, cipher string) {
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	over := m{"cipher": cipher}
 	a, aNet, aUdp, _ := newSimpleServer(cert.Version1, ca, caKey, "a", "10.128.0.1/24", over)
 	b, bNet, bUdp, _ := newSimpleServer(cert.Version1, ca, caKey, "b", "10.128.0.2/24", over)
 	a.InjectLightHouseAddr(bNet[0].Addr(), bUdp)
 	b.InjectLightHouseAddr(aNet[0].Addr(), aUdp)
 	a.Start()
 	b.Start()
 	t.Cleanup(func() { a.Stop(); b.Stop() })
 	r := router.NewR(t, a, b)
 	defer r.RenderFlow()
 	assertTunnel(t, aNet[0].Addr(), bNet[0].Addr(), a, b, r)
 	drainUDPTx(a)
 	drainUDPTx(b)
 	payload := []byte("a test payload well over sixteen bytes long, wow it's so very long long long!")
 	require.Greater(t, len(payload), header.Len)
 	a.GetF().SendMessageToVpnAddr(header.Test, header.TestRequest, bNet[0].Addr(), payload, make([]byte, 12, 12), make([]byte, udp.MTU))
 	// Deliver A's request to B; B must echo a reply back
 	b.InjectUDPPacket(a.GetFromUDP(true))
 	reply := nextUDPTxOfType(t, b, header.Test, header.TestReply, 2*time.Second)
 	assert.Equal(t, aUdp, reply.To, "the reply must go back to the requester")
 	// header + echoed payload + 16-byte AEAD tag: proves the whole payload
 	// round-tripped rather than being dropped or truncated.
 	assert.Equal(t, header.Len+len(payload)+16, len(reply.Data), "the full payload must be echoed back")
 }
 func TestTestRequestEchoesLongPayloadAES(t *testing.T) {
 	assertTestRequestEchoed(t, "aes")
 }
 func TestTestRequestEchoesLongPayloadChaChaPoly(t *testing.T) {
 	assertTestRequestEchoed(t, "chachapoly")
 }
 // drainUDPTx empties a control's UDP tx queue without blocking.
 func drainUDPTx(c *nebula.Control) {
 	for c.GetFromUDP(false) != nil {
 	}
 }
 // nextUDPTxOfType returns the next packet a control transmits whose nebula
 // header matches (wantType, wantSub), skipping unrelated packets.
 // It fails the test if none arrives within the timeout.
 func nextUDPTxOfType(t *testing.T, c *nebula.Control, wantType header.MessageType, wantSub header.MessageSubType, within time.Duration) *udp.Packet {
 	t.Helper()
 	ch := c.GetUDPTxChan()
 	timeout := time.After(within)
 	for {
 		select {
 		case p := <-ch:
 			var h header.H
 			if err := h.Parse(p.Data); err == nil && h.Type == wantType && h.Subtype == wantSub {
 				return p
 			}
 		case <-timeout:
 			t.Fatalf("timed out waiting for a %v/%v packet on the udp tx queue", wantType, wantSub)
 			return nil
 		}
 	}
 }
@@ -28,7 +28,6 @@ func makeHandshakePacket(from, to netip.AddrPort, subtype header.MessageSubType,
 }
 func TestHandshakeRetransmitDuplicate(t *testing.T) {
 	t.Parallel()
 	// Verify the responder correctly handles receiving the same msg1 multiple times
 	// (retransmission). The duplicate goes through CheckAndComplete -> ErrAlreadySeen
 	// and the cached response is resent.
@@ -47,7 +46,7 @@ func TestHandshakeRetransmitDuplicate(t *testing.T) {
 	defer r.RenderFlow()
 	t.Log("Trigger handshake from me to them")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
 	t.Log("Grab my msg1")
 	msg1 := myControl.GetFromUDP(true)
@@ -79,7 +78,6 @@ func TestHandshakeRetransmitDuplicate(t *testing.T) {
 }
 func TestHandshakeTruncatedPacketRecovery(t *testing.T) {
 	t.Parallel()
 	// Verify that a truncated handshake packet is ignored and the real
 	// packet can still complete the handshake.
@@ -97,7 +95,7 @@ func TestHandshakeTruncatedPacketRecovery(t *testing.T) {
 	defer r.RenderFlow()
 	t.Log("Trigger handshake")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
 	t.Log("Get msg1 and deliver to responder")
 	msg1 := myControl.GetFromUDP(true)
@@ -128,7 +126,6 @@ func TestHandshakeTruncatedPacketRecovery(t *testing.T) {
 }
 func TestHandshakeOrphanedMsg2Dropped(t *testing.T) {
 	t.Parallel()
 	// A msg2 arriving with no matching pending index should be silently dropped
 	// with no response sent and no state changes.
@@ -146,7 +143,7 @@ func TestHandshakeOrphanedMsg2Dropped(t *testing.T) {
 	defer r.RenderFlow()
 	t.Log("Complete a normal handshake")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
 	r.RouteForAllUntilTxTun(theirControl)
 	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
@@ -171,7 +168,6 @@ func TestHandshakeOrphanedMsg2Dropped(t *testing.T) {
 }
 func TestHandshakeUnknownMessageCounter(t *testing.T) {
 	t.Parallel()
 	// A handshake packet with an unexpected message counter should be silently
 	// dropped with no side effects and no UDP response.
@@ -203,7 +199,6 @@ func TestHandshakeUnknownMessageCounter(t *testing.T) {
 }
 func TestHandshakeUnknownSubtype(t *testing.T) {
 	t.Parallel()
 	// A handshake packet with an unknown subtype should be silently dropped.
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -229,7 +224,6 @@ func TestHandshakeUnknownSubtype(t *testing.T) {
 }
 func TestHandshakeLateResponse(t *testing.T) {
 	t.Parallel()
 	// After a handshake times out, a late response should be silently ignored
 	// with no new tunnels created.
@@ -248,7 +242,7 @@ func TestHandshakeLateResponse(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger handshake from me")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
 	t.Log("Grab msg1 but don't deliver")
 	msg1 := myControl.GetFromUDP(true)
@@ -279,7 +273,6 @@ func TestHandshakeLateResponse(t *testing.T) {
 }
 func TestHandshakeSelfConnectionRejected(t *testing.T) {
 	t.Parallel()
 	// Verify that a node rejects a handshake containing its own VPN IP in the
 	// peer cert. We do this by sending the initiator's own msg1 back to itself.
@@ -292,7 +285,7 @@ func TestHandshakeSelfConnectionRejected(t *testing.T) {
 	myControl.Start()
 	t.Log("Trigger handshake from me")
-	myControl.InjectTunPacket(BuildTunUDPPacket(netip.MustParseAddr("10.128.0.2"), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi")))
+	myControl.InjectTunUDPPacket(netip.MustParseAddr("10.128.0.2"), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
 	msg1 := myControl.GetFromUDP(true)
 	t.Log("Drain any handshake retransmits before injecting")
@@ -328,7 +321,6 @@ func TestHandshakeSelfConnectionRejected(t *testing.T) {
 }
 func TestHandshakeMessageCounter0Dropped(t *testing.T) {
 	t.Parallel()
 	// MessageCounter=0 is not a valid handshake message and should be dropped.
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -349,7 +341,6 @@ func TestHandshakeMessageCounter0Dropped(t *testing.T) {
 }
 func TestHandshakeRemoteAllowList(t *testing.T) {
 	t.Parallel()
 	// Verify that a handshake from a blocked underlay IP is dropped with no
 	// response and no state changes. Then verify the same packet from an
 	// allowed IP succeeds.
@@ -375,7 +366,7 @@ func TestHandshakeRemoteAllowList(t *testing.T) {
 	defer r.RenderFlow()
 	t.Log("Trigger handshake from them")
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi")))
+	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi"))
 	msg1 := theirControl.GetFromUDP(true)
 	t.Log("Rewrite the source to a blocked IP and inject")
@@ -408,7 +399,6 @@ func TestHandshakeRemoteAllowList(t *testing.T) {
 }
 func TestHandshakeAlreadySeenPreferredRemote(t *testing.T) {
 	t.Parallel()
 	// When a duplicate msg1 arrives via ErrAlreadySeen, verify the tunnel
 	// remains functional and hostmap index count is stable.
@@ -426,7 +416,7 @@ func TestHandshakeAlreadySeenPreferredRemote(t *testing.T) {
 	defer r.RenderFlow()
 	t.Log("Complete a normal handshake via the router")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
 	r.RouteForAllUntilTxTun(theirControl)
 	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
@@ -437,7 +427,7 @@ func TestHandshakeAlreadySeenPreferredRemote(t *testing.T) {
 	originalRemote := hi.CurrentRemote
 	t.Log("Re-trigger traffic to cause a new handshake attempt (ErrAlreadySeen)")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("roam")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("roam"))
 	r.RouteForAllUntilTxTun(theirControl)
 	t.Log("Verify tunnel still works")
@@ -455,7 +445,6 @@ func TestHandshakeAlreadySeenPreferredRemote(t *testing.T) {
 }
 func TestHandshakeWrongResponderPacketStore(t *testing.T) {
 	t.Parallel()
 	// Verify that when the wrong host responds, the cached packets are
 	// transferred to the new handshake, the evil tunnel is closed, evil's
 	// address is blocked, and the correct tunnel is eventually established.
@@ -475,8 +464,8 @@ func TestHandshakeWrongResponderPacketStore(t *testing.T) {
 	evilControl.Start()
 	t.Log("Send multiple packets to them (cached during handshake)")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet1")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet1"))
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet2")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet2"))
 	t.Log("Route until evil tunnel is closed")
 	h := &header.H{}
@@ -519,7 +508,6 @@ func TestHandshakeWrongResponderPacketStore(t *testing.T) {
 }
 func TestHandshakeRelayComplete(t *testing.T) {
 	t.Parallel()
 	// Verify that a relay handshake completes correctly and relay state is
 	// properly maintained on all three nodes.
@@ -540,7 +528,7 @@ func TestHandshakeRelayComplete(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger handshake via relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi via relay")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi via relay"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	assertUdpPacket(t, []byte("Hi via relay"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
@@ -568,7 +556,7 @@ func TestHandshakeRelayComplete(t *testing.T) {
 }
 // NOTE: Relay V1 cert + IPv6 rejection is not tested here because
-// BuildTunUDPPacket from a V4 node to a V6 address panics in the test
+// InjectTunUDPPacket from a V4 node to a V6 address panics in the test
 // framework. The check is in handshake_manager.go handleOutbound relay
 // logic (lines ~304-313): if the relay host has a V1 cert and either
 // address is IPv6, the relay is skipped.
@@ -11,12 +11,12 @@ import (
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -40,22 +40,11 @@ func BenchmarkHotPath(b *testing.B) {
 	r.CancelFlowLogs()
 	assertTunnel(b, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 	// Pre-build the IP packet bytes once so the bench measures the data plane,
 	// not gopacket SerializeLayers overhead.
 	prebuilt := BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	// EnableFanIn switches the router to a 0-alloc routing path. Required
 	// for hot-path benchmarks; would conflict with GetFromUDP-using tests.
 	r.EnableFanIn()
 	b.ResetTimer()
 	for n := 0; n < b.N; n++ {
-		myControl.InjectTunPacket(prebuilt)
+		myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-		// Release the TUN-side bytes back to the harness freelist; the bench
+		_ = r.RouteForAllUntilTxTun(theirControl)
 		// just confirms a packet arrived, the contents aren't inspected.
 		overlay.ReleaseTunBuf(r.RouteForAllUntilTxTun(theirControl))
 	}
 	myControl.Stop()
@@ -83,15 +72,11 @@ func BenchmarkHotPathRelay(b *testing.B) {
 	theirControl.Start()
 	assertTunnel(b, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 	prebuilt := BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	r.EnableFanIn()
 	b.ResetTimer()
 	for n := 0; n < b.N; n++ {
-		myControl.InjectTunPacket(prebuilt)
+		myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-		overlay.ReleaseTunBuf(r.RouteForAllUntilTxTun(theirControl))
+		_ = r.RouteForAllUntilTxTun(theirControl)
 	}
 	myControl.Stop()
@@ -100,7 +85,6 @@ func BenchmarkHotPathRelay(b *testing.B) {
 }
 func TestGoodHandshake(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
@@ -113,7 +97,7 @@ func TestGoodHandshake(t *testing.T) {
 	theirControl.Start()
 	t.Log("Send a udp packet through to begin standing up the tunnel, this should come out the other side")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	t.Log("Have them consume my stage 0 packet. They have a tunnel now")
 	theirControl.InjectUDPPacket(myControl.GetFromUDP(true))
@@ -151,7 +135,6 @@ func TestGoodHandshake(t *testing.T) {
 }
 func TestGoodHandshakeNoOverlap(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "2001::69/24", nil) //look ma, cross-stack!
@@ -187,7 +170,6 @@ func TestGoodHandshakeNoOverlap(t *testing.T) {
 }
 func TestWrongResponderHandshake(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.100/24", nil)
@@ -207,7 +189,7 @@ func TestWrongResponderHandshake(t *testing.T) {
 	evilControl.Start()
 	t.Log("Start the handshake process, we will route until we see the evil tunnel closed")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	h := &header.H{}
 	r.RouteForAllExitFunc(func(p *udp.Packet, c *nebula.Control) router.ExitType {
@@ -264,7 +246,6 @@ func TestWrongResponderHandshake(t *testing.T) {
 }
 func TestWrongResponderHandshakeStaticHostMap(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.99/24", nil)
@@ -289,7 +270,7 @@ func TestWrongResponderHandshakeStaticHostMap(t *testing.T) {
 	evilControl.Start()
 	t.Log("Start the handshake process, we will route until we see the evil tunnel closed")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	h := &header.H{}
 	r.RouteForAllExitFunc(func(p *udp.Packet, c *nebula.Control) router.ExitType {
@@ -347,7 +328,6 @@ func TestWrongResponderHandshakeStaticHostMap(t *testing.T) {
 }
 func TestStage1Race(t *testing.T) {
 	t.Parallel()
 	// This tests ensures that two hosts handshaking with each other at the same time will allow traffic to flow
 	// But will eventually collapse down to a single tunnel
@@ -368,8 +348,8 @@ func TestStage1Race(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger a handshake to start on both me and them")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
+	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them"))
 	t.Log("Get both stage 1 handshake packets")
 	myHsForThem := myControl.GetFromUDP(true)
@@ -405,7 +385,7 @@ func TestStage1Race(t *testing.T) {
 	r.Log("Spin until connection manager tears down a tunnel")
-	for myControl.GetHostmapIndexCount()+theirControl.GetHostmapIndexCount() > 2 {
+	for len(myControl.GetHostmap().Indexes)+len(theirControl.GetHostmap().Indexes) > 2 {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -428,7 +408,6 @@ func TestStage1Race(t *testing.T) {
 }
 func TestUncleanShutdownRaceLoser(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me  ", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
@@ -446,20 +425,18 @@ func TestUncleanShutdownRaceLoser(t *testing.T) {
 	theirControl.Start()
 	r.Log("Trigger a handshake from me to them")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
 	r.Log("Nuke my hostmap")
 	myHostmap := myControl.GetHostmap()
 	myHostmap.Lock()
 	myHostmap.Hosts = map[netip.Addr]*nebula.HostInfo{}
 	myHostmap.Indexes = map[uint32]*nebula.HostInfo{}
 	myHostmap.RemoteIndexes = map[uint32]*nebula.HostInfo{}
 	myHostmap.Unlock()
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me again")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me again"))
 	p = r.RouteForAllUntilTxTun(theirControl)
 	assertUdpPacket(t, []byte("Hi from me again"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
@@ -467,10 +444,10 @@ func TestUncleanShutdownRaceLoser(t *testing.T) {
 	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 	r.Log("Wait for the dead index to go away")
-	start := theirControl.GetHostmapIndexCount()
+	start := len(theirControl.GetHostmap().Indexes)
 	for {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-		if theirControl.GetHostmapIndexCount() < start {
+		if len(theirControl.GetHostmap().Indexes) < start {
 			break
 		}
 		time.Sleep(time.Second)
@@ -480,7 +457,6 @@ func TestUncleanShutdownRaceLoser(t *testing.T) {
 }
 func TestUncleanShutdownRaceWinner(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me  ", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
@@ -498,7 +474,7 @@ func TestUncleanShutdownRaceWinner(t *testing.T) {
 	theirControl.Start()
 	r.Log("Trigger a handshake from me to them")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
@@ -506,13 +482,11 @@ func TestUncleanShutdownRaceWinner(t *testing.T) {
 	r.Log("Nuke my hostmap")
 	theirHostmap := theirControl.GetHostmap()
 	theirHostmap.Lock()
 	theirHostmap.Hosts = map[netip.Addr]*nebula.HostInfo{}
 	theirHostmap.Indexes = map[uint32]*nebula.HostInfo{}
 	theirHostmap.RemoteIndexes = map[uint32]*nebula.HostInfo{}
 	theirHostmap.Unlock()
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them again")))
+	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them again"))
 	p = r.RouteForAllUntilTxTun(myControl)
 	assertUdpPacket(t, []byte("Hi from them again"), p, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), 80, 80)
 	r.RenderHostmaps("Derp hostmaps", myControl, theirControl)
@@ -521,10 +495,10 @@ func TestUncleanShutdownRaceWinner(t *testing.T) {
 	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 	r.Log("Wait for the dead index to go away")
-	start := myControl.GetHostmapIndexCount()
+	start := len(myControl.GetHostmap().Indexes)
 	for {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-		if myControl.GetHostmapIndexCount() < start {
+		if len(myControl.GetHostmap().Indexes) < start {
 			break
 		}
 		time.Sleep(time.Second)
@@ -534,7 +508,6 @@ func TestUncleanShutdownRaceWinner(t *testing.T) {
 }
 func TestRelays(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
@@ -555,7 +528,7 @@ func TestRelays(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	r.Log("Assert the tunnel works")
@@ -564,7 +537,6 @@ func TestRelays(t *testing.T) {
 }
 func TestRelaysDontCareAboutIps(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "2001::9999/24", m{"relay": m{"am_relay": true}})
@@ -585,7 +557,7 @@ func TestRelaysDontCareAboutIps(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	r.Log("Assert the tunnel works")
@@ -594,7 +566,6 @@ func TestRelaysDontCareAboutIps(t *testing.T) {
 }
 func TestReestablishRelays(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
@@ -615,14 +586,14 @@ func TestReestablishRelays(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	r.Log("Assert the tunnel works")
 	assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
 	t.Log("Ensure packet traversal from them to me via the relay")
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
+	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them"))
 	p = r.RouteForAllUntilTxTun(myControl)
 	r.Log("Assert the tunnel works")
@@ -632,12 +603,12 @@ func TestReestablishRelays(t *testing.T) {
 	r.Log("Close the tunnel")
 	relayControl.CloseTunnel(theirVpnIpNet[0].Addr(), true)
-	start := myControl.GetHostmapIndexCount()
+	start := len(myControl.GetHostmap().Indexes)
-	curIndexes := myControl.GetHostmapIndexCount()
+	curIndexes := len(myControl.GetHostmap().Indexes)
 	for curIndexes >= start {
-		curIndexes = myControl.GetHostmapIndexCount()
+		curIndexes = len(myControl.GetHostmap().Indexes)
 		r.Logf("Wait for the dead index to go away:start=%v indexes, current=%v indexes", start, curIndexes)
-		myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me should fail")))
+		myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me should fail"))
 		r.RouteForAllExitFunc(func(p *udp.Packet, c *nebula.Control) router.ExitType {
 			return router.RouteAndExit
@@ -654,7 +625,7 @@ func TestReestablishRelays(t *testing.T) {
 		myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
 		myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
 		relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-		myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+		myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 		p = r.RouteForAllUntilTxTun(theirControl)
 		r.Log("Assert the tunnel works")
@@ -689,7 +660,7 @@ func TestReestablishRelays(t *testing.T) {
 	t.Log("Assert the tunnel works the other way, too")
 	for {
 		t.Log("RouteForAllUntilTxTun")
-		theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
+		theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them"))
 		p = r.RouteForAllUntilTxTun(myControl)
 		r.Log("Assert the tunnel works")
@@ -725,72 +696,7 @@ func TestReestablishRelays(t *testing.T) {
 }
 func TestRelayHandshakeOverDisestablishedEntry(t *testing.T) {
 	t.Parallel()
 	// If them tears down the tunnel while me keeps Established relay state, me's next
 	// handshake flows through the relay with no fresh CreateRelayRequest and lands on
 	// them's Disestablished terminal relay entry. them must re-establish that entry, or
 	// its first transmit deletes its only relay and the tunnel is born transmit-dead:
 	// them can receive but every send is silently dropped.
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them   ", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
 	// Teach my how to get to the relay and that their can be reached via the relay
 	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
 	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
 	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
 	// Build a router so we don't have to reason who gets which packet
 	r := router.NewR(t, myControl, relayControl, theirControl)
 	defer r.RenderFlow()
 	// Start the servers
 	myControl.Start()
 	relayControl.Start()
 	theirControl.Start()
 	t.Log("Trigger a handshake from me to them via the relay")
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
 	oldIdx := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false).LocalIndex
 	t.Log("Close the tunnel on them only, marking their relay entry Disestablished")
 	theirControl.CloseTunnel(myVpnIpNet[0].Addr(), true)
 	t.Log("Re-handshake from me, riding the still-Established relay state")
 	myControl.ReHandshake(theirVpnIpNet[0].Addr())
 	for {
 		h := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
 		if h != nil && h.LocalIndex != oldIdx && h.RemoteIndex != 0 {
 			break
 		}
 		r.RouteForAllExitFunc(func(*udp.Packet, *nebula.Control) router.ExitType {
 			return router.RouteAndExit
 		})
 	}
 	hAtThem := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
 	require.NotNil(t, hAtThem, "them should have completed the relayed handshake")
 	require.Equal(t, []netip.Addr{relayVpnIpNet[0].Addr()}, hAtThem.CurrentRelaysToMe, "them should know a relay for the new tunnel")
 	t.Log("Send from them to me; their only relay entry must survive the transmit")
 	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
 	require.Never(t, func() bool {
 		h := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
 		return h == nil || len(h.CurrentRelaysToMe) == 0
 	}, time.Second, 10*time.Millisecond, "them deleted its only relay entry; the tunnel is permanently transmit-dead")
 	p = r.RouteForAllUntilTxTun(myControl)
 	assertUdpPacket(t, []byte("Hi from them"), p, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), 80, 80)
 	r.RenderHostmaps("Final hostmaps", myControl, relayControl, theirControl)
 }
 func TestStage1RaceRelays(t *testing.T) {
 	t.Parallel()
 	//NOTE: this is a race between me and relay resulting in a full tunnel from me to them via relay
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
@@ -823,8 +729,8 @@ func TestStage1RaceRelays(t *testing.T) {
 	assertTunnel(t, theirVpnIpNet[0].Addr(), relayVpnIpNet[0].Addr(), theirControl, relayControl, r)
 	r.Log("Trigger a handshake from both them and me via relay to them and me")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
+	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them"))
 	r.Log("Wait for a packet from them to me")
 	p := r.RouteForAllUntilTxTun(myControl)
@@ -838,12 +744,12 @@ func TestStage1RaceRelays(t *testing.T) {
 }
 func TestStage1RaceRelays2(t *testing.T) {
 	t.Parallel()
 	//NOTE: this is a race between me and relay resulting in a full tunnel from me to them via relay
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them   ", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
 	l := NewTestLogger()
 	// Teach my how to get to the relay and that their can be reached via the relay
 	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
@@ -865,41 +771,49 @@ func TestStage1RaceRelays2(t *testing.T) {
 	theirControl.Start()
 	r.Log("Get a tunnel between me and relay")
 	l.Info("Get a tunnel between me and relay")
 	assertTunnel(t, myVpnIpNet[0].Addr(), relayVpnIpNet[0].Addr(), myControl, relayControl, r)
 	r.Log("Get a tunnel between them and relay")
 	l.Info("Get a tunnel between them and relay")
 	assertTunnel(t, theirVpnIpNet[0].Addr(), relayVpnIpNet[0].Addr(), theirControl, relayControl, r)
 	r.Log("Trigger a handshake from both them and me via relay to them and me")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	l.Info("Trigger a handshake from both them and me via relay to them and me")
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them"))
 	//r.RouteUntilAfterMsgType(myControl, header.Control, header.MessageNone)
 	//r.RouteUntilAfterMsgType(theirControl, header.Control, header.MessageNone)
-	r.Log("Wait for a packet from them to me; myControl")
+	r.Log("Wait for a packet from them to me")
 	l.Info("Wait for a packet from them to me; myControl")
 	r.RouteForAllUntilTxTun(myControl)
-	r.Log("Wait for a packet from them to me; theirControl")
+	l.Info("Wait for a packet from them to me; theirControl")
 	r.RouteForAllUntilTxTun(theirControl)
 	r.Log("Assert the tunnel works")
 	l.Info("Assert the tunnel works")
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 	t.Log("Wait until we remove extra tunnels")
-	t.Logf("Waiting for hostinfos to be removed... myControl=%d theirControl=%d relayControl=%d",
+	l.Info("Wait until we remove extra tunnels")
-		myControl.GetHostmapIndexCount(),
+	l.WithFields(
-		theirControl.GetHostmapIndexCount(),
+		logrus.Fields{
-		relayControl.GetHostmapIndexCount(),
+			"myControl":    len(myControl.GetHostmap().Indexes),
-	)
+			"theirControl": len(theirControl.GetHostmap().Indexes),
-	hostInfos := myControl.GetHostmapIndexCount() + theirControl.GetHostmapIndexCount() + relayControl.GetHostmapIndexCount()
+			"relayControl": len(relayControl.GetHostmap().Indexes),
 		}).Info("Waiting for hostinfos to be removed...")
 	hostInfos := len(myControl.GetHostmap().Indexes) + len(theirControl.GetHostmap().Indexes) + len(relayControl.GetHostmap().Indexes)
 	retries := 60
 	for hostInfos > 6 && retries > 0 {
-		hostInfos = myControl.GetHostmapIndexCount() + theirControl.GetHostmapIndexCount() + relayControl.GetHostmapIndexCount()
+		hostInfos = len(myControl.GetHostmap().Indexes) + len(theirControl.GetHostmap().Indexes) + len(relayControl.GetHostmap().Indexes)
-		t.Logf("Waiting for hostinfos to be removed... myControl=%d theirControl=%d relayControl=%d",
+		l.WithFields(
-			myControl.GetHostmapIndexCount(),
+			logrus.Fields{
-			theirControl.GetHostmapIndexCount(),
+				"myControl":    len(myControl.GetHostmap().Indexes),
-			relayControl.GetHostmapIndexCount(),
+				"theirControl": len(theirControl.GetHostmap().Indexes),
-		)
+				"relayControl": len(relayControl.GetHostmap().Indexes),
 			}).Info("Waiting for hostinfos to be removed...")
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -907,6 +821,7 @@ func TestStage1RaceRelays2(t *testing.T) {
 	}
 	r.Log("Assert the tunnel works")
 	l.Info("Assert the tunnel works")
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 	myControl.Stop()
@@ -915,7 +830,6 @@ func TestStage1RaceRelays2(t *testing.T) {
 }
 func TestRehandshakingRelays(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, relayConfig := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
@@ -936,7 +850,7 @@ func TestRehandshakingRelays(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	r.Log("Assert the tunnel works")
@@ -992,24 +906,24 @@ func TestRehandshakingRelays(t *testing.T) {
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 	r.RenderHostmaps("working hostmaps", myControl, relayControl, theirControl)
 	// We should have two hostinfos on all sides
-	for myControl.GetHostmapIndexCount() != 2 {
+	for len(myControl.GetHostmap().Indexes) != 2 {
-		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", myControl.GetHostmapIndexCount())
+		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(myControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("myControl hostinfos got cleaned up!")
-	for theirControl.GetHostmapIndexCount() != 2 {
+	for len(theirControl.GetHostmap().Indexes) != 2 {
-		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", theirControl.GetHostmapIndexCount())
+		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(theirControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("theirControl hostinfos got cleaned up!")
-	for relayControl.GetHostmapIndexCount() != 2 {
+	for len(relayControl.GetHostmap().Indexes) != 2 {
-		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", relayControl.GetHostmapIndexCount())
+		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(relayControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
@@ -1019,7 +933,6 @@ func TestRehandshakingRelays(t *testing.T) {
 }
 func TestRehandshakingRelaysPrimary(t *testing.T) {
 	t.Parallel()
 	// This test is the same as TestRehandshakingRelays but one of the terminal types is a primary swap winner
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.128/24", m{"relay": m{"use_relays": true}})
@@ -1041,7 +954,7 @@ func TestRehandshakingRelaysPrimary(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	r.Log("Assert the tunnel works")
@@ -1097,24 +1010,24 @@ func TestRehandshakingRelaysPrimary(t *testing.T) {
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 	r.RenderHostmaps("working hostmaps", myControl, relayControl, theirControl)
 	// We should have two hostinfos on all sides
-	for myControl.GetHostmapIndexCount() != 2 {
+	for len(myControl.GetHostmap().Indexes) != 2 {
-		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", myControl.GetHostmapIndexCount())
+		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(myControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("myControl hostinfos got cleaned up!")
-	for theirControl.GetHostmapIndexCount() != 2 {
+	for len(theirControl.GetHostmap().Indexes) != 2 {
-		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", theirControl.GetHostmapIndexCount())
+		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(theirControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("theirControl hostinfos got cleaned up!")
-	for relayControl.GetHostmapIndexCount() != 2 {
+	for len(relayControl.GetHostmap().Indexes) != 2 {
-		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", relayControl.GetHostmapIndexCount())
+		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(relayControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
@@ -1124,7 +1037,6 @@ func TestRehandshakingRelaysPrimary(t *testing.T) {
 }
 func TestRehandshaking(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, myConfig := newSimpleServer(cert.Version1, ca, caKey, "me  ", "10.128.0.2/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, theirConfig := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.1/24", nil)
@@ -1191,7 +1103,7 @@ func TestRehandshaking(t *testing.T) {
 	theirConfig.ReloadConfigString(string(rc))
 	r.Log("Spin until there is only 1 tunnel")
-	for myControl.GetHostmapIndexCount()+theirControl.GetHostmapIndexCount() > 2 {
+	for len(myControl.GetHostmap().Indexes)+len(theirControl.GetHostmap().Indexes) > 2 {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -1220,7 +1132,6 @@ func TestRehandshaking(t *testing.T) {
 }
 func TestRehandshakingLoser(t *testing.T) {
 	t.Parallel()
 	// The purpose of this test is that the race loser renews their certificate and rehandshakes. The final tunnel
 	// Should be the one with the new certificate
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -1291,7 +1202,7 @@ func TestRehandshakingLoser(t *testing.T) {
 	myConfig.ReloadConfigString(string(rc))
 	r.Log("Spin until there is only 1 tunnel")
-	for myControl.GetHostmapIndexCount()+theirControl.GetHostmapIndexCount() > 2 {
+	for len(myControl.GetHostmap().Indexes)+len(theirControl.GetHostmap().Indexes) > 2 {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -1319,7 +1230,6 @@ func TestRehandshakingLoser(t *testing.T) {
 }
 func TestRaceRegression(t *testing.T) {
 	t.Parallel()
 	// This test forces stage 1, stage 2, stage 1 to be received by me from them
 	// We had a bug where we were not finding the duplicate handshake and responding to the final stage 1 which
 	// caused a cross-linked hostinfo
@@ -1343,8 +1253,8 @@ func TestRaceRegression(t *testing.T) {
 	//them rx stage:2 initiatorIndex=120607833 responderIndex=4209862089
 	t.Log("Start both handshakes")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
+	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them"))
 	t.Log("Get both stage 1")
 	myStage1ForThem := myControl.GetFromUDP(true)
@@ -1380,7 +1290,6 @@ func TestRaceRegression(t *testing.T) {
 }
 func TestV2NonPrimaryWithLighthouse(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh  ", "10.128.0.1/24, ff::1/64", m{"lighthouse": m{"am_lighthouse": true}})
@@ -1421,7 +1330,6 @@ func TestV2NonPrimaryWithLighthouse(t *testing.T) {
 }
 func TestV2NonPrimaryWithOffNetLighthouse(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh  ", "2001::1/64", m{"lighthouse": m{"am_lighthouse": true}})
@@ -1461,84 +1369,7 @@ func TestV2NonPrimaryWithOffNetLighthouse(t *testing.T) {
 	theirControl.Stop()
 }
 func TestLighthouseUpdateOnReload(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	// Create the lighthouse
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{"lighthouse": m{"am_lighthouse": true}})
 	// Create a client with NO lighthouse configured and a long update interval.
 	// The initial SendUpdate at startup will be a no-op since no lighthouses are known.
 	myControl, myVpnIpNet, _, myConfig := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", m{
 		"lighthouse": m{
 			"interval": 600,
 			"local_allow_list": m{
 				"10.0.0.0/24": true,
 				"::/0":        false,
 			},
 		},
 	})
 	r := router.NewR(t, lhControl, myControl)
 	defer r.RenderFlow()
 	lhControl.Start()
 	myControl.Start()
 	// Drain any startup packets (there should be none meaningful)
 	r.FlushAll()
 	// Verify lighthouse has no knowledge of the client
 	assert.Nil(t, lhControl.QueryLighthouse(myVpnIpNet[0].Addr()))
 	// Build a new config that adds the lighthouse
 	newSettings := make(m)
 	for k, v := range myConfig.Settings {
 		newSettings[k] = v
 	}
 	newSettings["static_host_map"] = m{
 		lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
 	}
 	newSettings["lighthouse"] = m{
 		"hosts":    []any{lhVpnIpNet[0].Addr().String()},
 		"interval": 600,
 		"local_allow_list": m{
 			"10.0.0.0/24": true,
 			"::/0":        false,
 		},
 	}
 	newCfg, err := yaml.Marshal(newSettings)
 	require.NoError(t, err)
 	// Reload the config. The lighthouse.hosts change triggers TriggerUpdate,
 	// which wakes the update worker. It calls SendUpdate, initiating a
 	// handshake to the new lighthouse and caching the HostUpdateNotification.
 	require.NoError(t, myConfig.ReloadConfigString(string(newCfg)))
 	// Route until the lighthouse receives the HostUpdateNotification.
 	// This covers: handshake stage 1, stage 2, then the cached update.
 	done := make(chan struct{})
 	go func() {
 		r.RouteForAllUntilAfterMsgTypeTo(lhControl, header.LightHouse, 0)
 		close(done)
 	}()
 	select {
 	case <-done:
 	case <-time.After(5 * time.Second):
 		t.Fatal("timed out waiting for lighthouse update after config reload")
 	}
 	// Verify lighthouse now has the client's addresses
 	assert.NotNil(t, lhControl.QueryLighthouse(myVpnIpNet[0].Addr()))
 	r.RenderHostmaps("Final hostmaps", lhControl, myControl)
 	lhControl.Stop()
 	myControl.Stop()
 }
 func TestGoodHandshakeUnsafeDest(t *testing.T) {
 	t.Parallel()
 	unsafePrefix := "192.168.6.0/24"
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(cert.Version2, ca, caKey, "spooky", "10.128.0.2/24", netip.MustParseAddrPort("10.64.0.2:4242"), unsafePrefix, nil)
@@ -1560,7 +1391,7 @@ func TestGoodHandshakeUnsafeDest(t *testing.T) {
 	theirControl.Start()
 	t.Log("Send a udp packet through to begin standing up the tunnel, this should come out the other side")
-	myControl.InjectTunPacket(BuildTunUDPPacket(spookyDest, 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(spookyDest, 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	t.Log("Have them consume my stage 0 packet. They have a tunnel now")
 	theirControl.InjectUDPPacket(myControl.GetFromUDP(true))
@@ -1588,7 +1419,7 @@ func TestGoodHandshakeUnsafeDest(t *testing.T) {
 	assertUdpPacket(t, []byte("Hi from me"), myCachedPacket, myVpnIpNet[0].Addr(), spookyDest, 80, 80)
 	//reply
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, spookyDest, 80, []byte("Hi from the spookyman")))
+	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, spookyDest, 80, []byte("Hi from the spookyman"))
 	//wait for reply
 	theirControl.WaitForType(1, 0, myControl)
 	theirCachedPacket := myControl.GetFromTun(true)
@@ -1603,78 +1434,3 @@ func TestGoodHandshakeUnsafeDest(t *testing.T) {
 	myControl.Stop()
 	theirControl.Stop()
 }
 func TestMultiVpnAddrDeletePrimaryKeepsSecondAddr(t *testing.T) {
 	t.Parallel()
 	// Regression for the hostmap multi-vpnAddr delete bug. A dual-stack (v4+v6) V2-cert peer that
 	// handshakes twice at once ends up with two hostinfos linked in the shared next/prev chain, with the
 	// primary owning both addresses. Deleting that primary (e.g. connection manager dropping it, a
 	// CloseTunnel, a collision) must promote the surviving sibling for EVERY address. The pre-fix code
 	// unlinked the chain once per address, so it promoted the sibling for the first address and orphaned
 	// the second: the peer stayed reachable at its v4 addr but not its v6 addr despite a live tunnel.
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me  ", "10.128.0.1/24,fd00::1/64", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.2/24,fd00::2/64", nil)
 	// This bug only exists for peers carrying more than one vpn address
 	require.Len(t, theirVpnIpNet, 2)
 	theirV4 := theirVpnIpNet[0].Addr()
 	theirV6 := theirVpnIpNet[1].Addr()
 	// Put their info in our lighthouse and vice versa
 	myControl.InjectLightHouseAddr(theirV4, theirUdpAddr)
 	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
 	// Build a router so we don't have to reason who gets which packet
 	r := router.NewR(t, myControl, theirControl)
 	defer r.RenderFlow()
 	myControl.Start()
 	theirControl.Start()
 	// Race a handshake so both of us build a hostinfo for the other, leaving my hostmap with a single
 	// host (them) backed by two linked hostinfos, just like TestStage1Race.
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirV4, 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
 	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirV4, 80, []byte("Hi from them")))
 	myHsForThem := myControl.GetFromUDP(true)
 	theirHsForMe := theirControl.GetFromUDP(true)
 	r.InjectUDPPacket(theirControl, myControl, theirHsForMe)
 	r.InjectUDPPacket(myControl, theirControl, myHsForThem)
 	r.RouteForAllUntilTxTun(theirControl)
 	r.RouteForAllUntilTxTun(myControl)
 	r.RenderHostmaps("Racing hostmaps", myControl, theirControl)
 	// Two hostinfos for them means the shared next/prev chain has a sibling to promote. The Hosts map has
 	// one entry per vpn address (two, for dual stack), so the index count is what tells us there are two
 	// hostinfos.
 	require.Len(t, myControl.ListHostmapIndexes(false), 2)
 	// The primary owns both of their addresses
 	primaryV4 := myControl.GetHostInfoByVpnAddr(theirV4, false)
 	primaryV6 := myControl.GetHostInfoByVpnAddr(theirV6, false)
 	require.NotNil(t, primaryV4)
 	require.NotNil(t, primaryV6)
 	require.Equal(t, primaryV4.LocalIndex, primaryV6.LocalIndex, "both addrs should point at the same primary")
 	// Delete the primary tunnel. localOnly so we don't perturb their side, we only care about my hostmap.
 	require.True(t, myControl.CloseTunnel(theirV4, true))
 	// The surviving sibling must still serve BOTH addresses.
 	survivorV4 := myControl.GetHostInfoByVpnAddr(theirV4, false)
 	survivorV6 := myControl.GetHostInfoByVpnAddr(theirV6, false)
 	require.NotNil(t, survivorV4, "v4 addr should still resolve to the surviving tunnel")
 	// Pre-fix this is nil: the second address was orphaned when the primary was deleted.
 	require.NotNil(t, survivorV6, "v6 addr was orphaned after deleting the primary (multi-vpnAddr delete bug)")
 	assert.Equal(t, survivorV4.LocalIndex, survivorV6.LocalIndex, "both addrs should promote to the same survivor")
 	assert.NotEqual(t, primaryV4.LocalIndex, survivorV4.LocalIndex, "a different hostinfo should now be primary")
 	r.RenderHostmaps("Final hostmaps", myControl, theirControl)
 	myControl.Stop()
 	theirControl.Stop()
 }
@@ -4,7 +4,8 @@
 package e2e
 import (
-	"log/slog"
+	"fmt"
 	"io"
 	"net/netip"
 	"os"
 	"strings"
@@ -14,13 +15,12 @@ import (
 	"dario.cat/mergo"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
-
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/e2e/router"
 	"github.com/slackhq/nebula/logging"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v3"
@@ -116,9 +116,6 @@ func newSimpleServerWithUdpAndUnsafeNetworks(v cert.Version, caCrt cert.Certific
 			"key":  string(myPrivKey),
 		},
 		//"tun": m{"disabled": true},
 		// Several tests bring up more than one nebula in this process, and they would all
 		// contend for the same default ctl socket path. None of them exercise it.
 		"ctl": m{"enabled": false},
 		"firewall": m{
 			"outbound": []m{{
 				"proto": "any",
@@ -135,7 +132,8 @@ func newSimpleServerWithUdpAndUnsafeNetworks(v cert.Version, caCrt cert.Certific
 			"port": udpAddr.Port(),
 		},
 		"logging": m{
-			"level": testLogLevelName(),
+			"timestamp_format": fmt.Sprintf("%v 15:04:05.000000", name),
 			"level":            l.Level.String(),
 		},
 		"timers": m{
 			"pending_deletion_interval": 2,
@@ -216,9 +214,6 @@ func newServer(caCrt []cert.Certificate, certs []cert.Certificate, key []byte, o
 			"key":  string(key),
 		},
 		//"tun": m{"disabled": true},
 		// Several tests bring up more than one nebula in this process, and they would all
 		// contend for the same default ctl socket path. None of them exercise it.
 		"ctl": m{"enabled": false},
 		"firewall": m{
 			"outbound": []m{{
 				"proto": "any",
@@ -239,7 +234,8 @@ func newServer(caCrt []cert.Certificate, certs []cert.Certificate, key []byte, o
 			"port": udpAddr.Port(),
 		},
 		"logging": m{
-			"level": testLogLevelName(),
+			"timestamp_format": fmt.Sprintf("%v 15:04:05.000000", certs[0].Name()),
 			"level":            l.Level.String(),
 		},
 		"timers": m{
 			"pending_deletion_interval": 2,
@@ -298,12 +294,12 @@ func deadline(t *testing.T, seconds time.Duration) doneCb {
 func assertTunnel(t testing.TB, vpnIpA, vpnIpB netip.Addr, controlA, controlB *nebula.Control, r *router.R) {
 	// Send a packet from them to me
-	controlB.InjectTunPacket(BuildTunUDPPacket(vpnIpA, 80, vpnIpB, 90, []byte("Hi from B")))
+	controlB.InjectTunUDPPacket(vpnIpA, 80, vpnIpB, 90, []byte("Hi from B"))
 	bPacket := r.RouteForAllUntilTxTun(controlA)
 	assertUdpPacket(t, []byte("Hi from B"), bPacket, vpnIpB, vpnIpA, 90, 80)
 	// And once more from me to them
-	controlA.InjectTunPacket(BuildTunUDPPacket(vpnIpB, 80, vpnIpA, 90, []byte("Hello from A")))
+	controlA.InjectTunUDPPacket(vpnIpB, 80, vpnIpA, 90, []byte("Hello from A"))
 	aPacket := r.RouteForAllUntilTxTun(controlB)
 	assertUdpPacket(t, []byte("Hello from A"), aPacket, vpnIpA, vpnIpB, 90, 80)
 }
@@ -383,87 +379,24 @@ func getAddrs(ns []netip.Prefix) []netip.Addr {
 	return a
 }
-func NewTestLogger() *slog.Logger {
+func NewTestLogger() *logrus.Logger {
 	l := logrus.New()
 	v := os.Getenv("TEST_LOGS")
 	if v == "" {
-		return slog.New(slog.DiscardHandler)
+		l.SetOutput(io.Discard)
 		l.SetLevel(logrus.PanicLevel)
 		return l
 	}
 	level := slog.LevelInfo
 	switch v {
 	case "2":
-		level = slog.LevelDebug
+		l.SetLevel(logrus.DebugLevel)
 	case "3":
-		level = logging.LevelTrace
+		l.SetLevel(logrus.TraceLevel)
 	default:
 		l.SetLevel(logrus.InfoLevel)
 	}
 	return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: level}))
 }
-// testLogLevelName returns the level name string accepted by logging.ApplyConfig
+	return l
 // for the current TEST_LOGS setting. Kept in sync with NewTestLogger.
 func testLogLevelName() string {
 	switch os.Getenv("TEST_LOGS") {
 	case "2":
 		return "debug"
 	case "3":
 		return "trace"
 	case "":
 		return "info"
 	}
 	return "info"
 }
 // BuildTunUDPPacket assembles an IP+UDP packet suitable for Control.InjectTunPacket.
 // Using UDP here because it's a simpler protocol.
 func BuildTunUDPPacket(toAddr netip.Addr, toPort uint16, fromAddr netip.Addr, fromPort uint16, data []byte) []byte {
 	serialize := make([]gopacket.SerializableLayer, 0)
 	var netLayer gopacket.NetworkLayer
 	if toAddr.Is6() {
 		if !fromAddr.Is6() {
 			panic("Cant send ipv6 to ipv4")
 		}
 		ip := &layers.IPv6{
 			Version:    6,
 			NextHeader: layers.IPProtocolUDP,
 			SrcIP:      fromAddr.Unmap().AsSlice(),
 			DstIP:      toAddr.Unmap().AsSlice(),
 		}
 		serialize = append(serialize, ip)
 		netLayer = ip
 	} else {
 		if !fromAddr.Is4() {
 			panic("Cant send ipv4 to ipv6")
 		}
 		ip := &layers.IPv4{
 			Version:  4,
 			TTL:      64,
 			Protocol: layers.IPProtocolUDP,
 			SrcIP:    fromAddr.Unmap().AsSlice(),
 			DstIP:    toAddr.Unmap().AsSlice(),
 		}
 		serialize = append(serialize, ip)
 		netLayer = ip
 	}
 	udp := layers.UDP{
 		SrcPort: layers.UDPPort(fromPort),
 		DstPort: layers.UDPPort(toPort),
 	}
 	if err := udp.SetNetworkLayerForChecksum(netLayer); err != nil {
 		panic(err)
 	}
 	buffer := gopacket.NewSerializeBuffer()
 	opt := gopacket.SerializeOptions{
 		ComputeChecksums: true,
 		FixLengths:       true,
 	}
 	serialize = append(serialize, &udp, gopacket.Payload(data))
 	if err := gopacket.SerializeLayers(buffer, opt, serialize...); err != nil {
 		panic(err)
 	}
 	return buffer.Bytes()
 }
@@ -1,47 +0,0 @@
 //go:build e2e_testing
 // +build e2e_testing
 package e2e
 import (
 	"testing"
 	"time"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
 	"go.uber.org/goleak"
 )
 // TestNoGoroutineLeaks brings up two nebula instances, completes a tunnel,
 // stops both, and asserts no goroutines leak past the shutdown. goleak's
 // retry mechanism gives the wg.Wait()-driven goroutines a moment to drain
 // before failing the assertion.
 //
 // Intentionally NOT t.Parallel()'d: concurrent tests would have their own
 // goroutines running and trip the assertion.
 func TestNoGoroutineLeaks(t *testing.T) {
 	defer goleak.VerifyNone(t)
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
 	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
 	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
 	myControl.Start()
 	theirControl.Start()
 	r := router.NewR(t, myControl, theirControl)
 	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 	myControl.Stop()
 	theirControl.Stop()
 	r.RenderFlow()
 	// Settle period: Stop() is non-blocking; the wg-driven goroutines need
 	// a moment to drain. goleak retries internally too, but a short explicit
 	// settle reduces flakes when the suite is busy.
 	time.Sleep(50 * time.Millisecond)
 }
@@ -1,282 +0,0 @@
 //go:build e2e_testing
 // +build e2e_testing
 package e2e
 import (
 	"net/netip"
 	"testing"
 	"time"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // reportedAddrs is what the lighthouse would hand a peer asking where vpnAddr is.
 func reportedAddrs(t *testing.T, lh *nebula.Control, vpnAddr netip.Addr) []netip.AddrPort {
 	t.Helper()
 	cm := lh.QueryLighthouse(vpnAddr)
 	if cm == nil {
 		return nil
 	}
 	var out []netip.AddrPort
 	for _, c := range *cm {
 		out = append(out, c.Reported...)
 		out = append(out, c.Learned...)
 	}
 	return out
 }
 // waitForLighthouseMsg routes until a lighthouse message lands on lh, or gives up. Reports whether one arrived.
 func waitForLighthouseMsg(t *testing.T, r *router.R, lh *nebula.Control, wait time.Duration) bool {
 	t.Helper()
 	h := &header.H{}
 	return r.RouteForAllExitFuncOrTimeout(wait, func(p *udp.Packet, c *nebula.Control) router.ExitType {
 		if c != lh {
 			return router.KeepRouting
 		}
 		// Punches are a single byte and never parse, they are just not what we are after
 		if err := h.Parse(p.Data); err != nil {
 			return router.KeepRouting
 		}
 		if h.Type == header.LightHouse {
 			return router.RouteAndExit
 		}
 		return router.KeepRouting
 	})
 }
 // A laptop that changes networks has to tell the lighthouse promptly, otherwise the lighthouse keeps handing peers
 // the old address and their punches land nowhere. On a long lighthouse interval the only thing that closes that
 // window is the rebind, which on darwin the network change monitor drives. The e2e build compiles the monitor out,
 // so we call RebindUDPServer directly, which is the same thing the monitor does.
 func TestRebindSendsLighthouseUpdate(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
 		"lighthouse": m{"am_lighthouse": true},
 	})
 	// 600s interval, so nothing scheduled can send an update during this test. A rebind is the only thing that can.
 	myControl, _, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", m{
 		"lighthouse": m{
 			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
 			"interval": 600,
 		},
 		"static_host_map": m{
 			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
 		},
 	})
 	r := router.NewR(t, lhControl, myControl)
 	defer r.RenderFlow()
 	lhControl.Start()
 	myControl.Start()
 	// Let the startup registration finish, then clear everything it left behind
 	require.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5), "expected an initial registration")
 	r.RouteFor(time.Millisecond * 400)
 	// Nothing should be talking to the lighthouse on its own now
 	require.False(t, waitForLighthouseMsg(t, r, lhControl, time.Millisecond*200),
 		"nothing should reach the lighthouse before the rebind")
 	myControl.RebindUDPServer()
 	assert.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5),
 		"a rebind should push an update to the lighthouse rather than waiting out the interval")
 	lhControl.Stop()
 	myControl.Stop()
 }
 // The other half of a rebind: every live tunnel requeries the lighthouse on its next send. That query is what makes
 // the lighthouse tell the peer to punch toward our new address, which is the part that actually revives a tunnel
 // whose remote NAT state died while we were on a different network.
 func TestRebindRequeriesPeersOnNextSend(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
 		"lighthouse": m{"am_lighthouse": true},
 	})
 	lhCfg := m{
 		"lighthouse": m{
 			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
 			"interval": 600,
 			// Without this the peers advertise this machine's real addresses and then try to punch at them,
 			// which the router has no route for.
 			"local_allow_list": m{
 				"10.0.0.0/24": true,
 				"::/0":        false,
 			},
 		},
 		"static_host_map": m{
 			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
 		},
 	}
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", lhCfg)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.3/24", lhCfg)
 	r := router.NewR(t, lhControl, myControl, theirControl)
 	defer r.RenderFlow()
 	lhControl.Start()
 	myControl.Start()
 	theirControl.Start()
 	r.RouteFor(time.Millisecond * 500)
 	// Point the peers at each other directly, this test is about the rebind and not about lighthouse discovery
 	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
 	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("initial")))
 	r.RouteFor(time.Second)
 	require.NotNil(t, myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false), "expected a tunnel to them")
 	r.RouteFor(time.Millisecond * 300)
 	// Assert on what the peer sees rather than on lighthouse traffic. A query for them makes the lighthouse send
 	// them a punch notification, which is the whole point. Our own update to the lighthouse sends them nothing,
 	// so this cannot be satisfied by the update the rebind itself pushes.
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("quiet")))
 	require.False(t, waitForLighthouseMsg(t, r, theirControl, time.Millisecond*300),
 		"an ordinary send should not requery the lighthouse")
 	myControl.RebindUDPServer()
 	r.RouteFor(time.Millisecond * 300) // let the update the rebind itself sends pass by
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("after rebind")))
 	assert.True(t, waitForLighthouseMsg(t, r, theirControl, time.Second*5),
 		"the first send after a rebind should requery the lighthouse, which then tells the peer to punch at us")
 	lhControl.Stop()
 	myControl.Stop()
 	theirControl.Stop()
 }
 // The scenario this whole thing exists for: a laptop sleeps at the office and wakes up at home on a new address.
 // Until it tells the lighthouse, the lighthouse keeps handing peers the office address, so their punches land
 // nowhere and the tunnel stays dead. On a long interval the rebind is the only thing that closes that window.
 func TestRebindAdvertisesNewAddressAfterMove(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
 		"lighthouse": m{"am_lighthouse": true},
 	})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", m{
 		"lighthouse": m{
 			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
 			"interval": 600,
 		},
 		"static_host_map": m{
 			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
 		},
 	})
 	// Advertise wherever we currently are rather than this machine's real NICs, read fresh each time so a move
 	// is picked up.
 	myControl.SetLocalAddrsFn(func(*nebula.LocalAllowList) []netip.Addr {
 		return []netip.Addr{myControl.GetUDPAddr().Addr()}
 	})
 	r := router.NewR(t, lhControl, myControl)
 	defer r.RenderFlow()
 	lhControl.Start()
 	myControl.Start()
 	require.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5), "expected an initial registration")
 	r.RouteFor(time.Millisecond * 400)
 	require.Contains(t, reportedAddrs(t, lhControl, myVpnIpNet[0].Addr()), myUdpAddr,
 		"the lighthouse should know the address we started on")
 	// Wake up somewhere else
 	newAddr := netip.MustParseAddrPort("10.0.0.99:4242")
 	myControl.SetUDPAddr(newAddr)
 	r.AddRoute(newAddr.Addr(), newAddr.Port(), myControl)
 	// Nothing has told the lighthouse, and with interval 600 nothing scheduled will
 	r.RouteFor(time.Millisecond * 400)
 	require.NotContains(t, reportedAddrs(t, lhControl, myVpnIpNet[0].Addr()), newAddr,
 		"the lighthouse should still be handing out the old address before the rebind")
 	myControl.RebindUDPServer()
 	require.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5), "expected an update after the rebind")
 	r.RouteFor(time.Millisecond * 400)
 	assert.Contains(t, reportedAddrs(t, lhControl, myVpnIpNet[0].Addr()), newAddr,
 		"after the rebind the lighthouse should hand peers our new address")
 	lhControl.Stop()
 	myControl.Stop()
 }
 // A relayed send records traffic but must not consume the rebind epoch. If it does, the next direct send to the
 // relay host sees the epoch already current and never requeries, so the far side is never told to punch at our
 // new address. This pins the SendVia call site, which the unit tests cannot reach.
 func TestRebindRequeriesAfterRelayedSend(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	// No lighthouse on purpose: it would hand out a direct address for them and nothing would relay.
 	// Long connection manager timers so it never fires a direct test packet at the relay tunnel and bumps its
 	// epoch mid-test, which is the only other thing that touches that tunnel and would flake the assertion below.
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24",
 		m{"relay": m{"use_relays": true}, "timers": m{"connection_alive_interval": 3600, "pending_deletion_interval": 3600}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
 	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
 	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
 	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
 	r := router.NewR(t, myControl, relayControl, theirControl)
 	defer r.RenderFlow()
 	myControl.Start()
 	relayControl.Start()
 	theirControl.Start()
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("establish")))
 	r.RouteForAllUntilTxTun(theirControl)
 	r.RouteFor(time.Millisecond * 500)
 	hi := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
 	require.NotNil(t, hi, "expected a tunnel to them")
 	require.NotEmpty(t, hi.CurrentRelaysToMe, "them must be reachable only via the relay for this test to mean anything")
 	// sendNoMetrics only reaches SendVia when there is no direct remote, so pin that too. Without this the test
 	// keeps passing while quietly sending direct and never exercising the relay path.
 	require.False(t, hi.CurrentRemote.IsValid(), "them must have no direct remote, otherwise SendVia is never called")
 	before, ok := myControl.GetRebindEpochFor(relayVpnIpNet[0].Addr())
 	require.True(t, ok, "expected a tunnel to the relay")
 	myControl.RebindUDPServer()
 	// Traffic to them goes through SendVia on the relay tunnel. That must record traffic without consuming the
 	// relay tunnel's own epoch edge, which belongs to the direct path.
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("relayed")))
 	r.RouteForAllUntilTxTun(theirControl)
 	after, ok := myControl.GetRebindEpochFor(relayVpnIpNet[0].Addr())
 	require.True(t, ok)
 	assert.Equal(t, before, after,
 		"a relayed send consumed the relay tunnel's rebind epoch, so the next direct send will not requery")
 	myControl.Stop()
 	relayControl.Stop()
 	theirControl.Stop()
 }
@@ -1,136 +0,0 @@
 //go:build e2e_testing
 // +build e2e_testing
 package e2e
 import (
 	"testing"
 	"time"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
 	"github.com/slackhq/nebula/udp"
 )
 // TestRecoveryTiming measures how long a tunnel takes to come back after the peer stops accepting our traffic,
 // which is what a laptop waking on a new network looks like from the peer's side: its NAT has no state for where
 // we are now, so everything we send disappears.
 //
 // It is a measurement, not a pass/fail assertion. Recovery is timed to the moment the peer punches back at us,
 // since that is when its NAT opens and the tunnel is usable again.
 //
 //	go test -tags e2e_testing -v -run TestRecoveryTiming ./e2e/
 func TestRecoveryTiming(t *testing.T) {
 	for _, tc := range []struct {
 		name   string
 		rebind bool
 	}{
 		{"no trigger", false},
 		{"rebind counter", true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			d, lost := measureRecovery(t, tc.rebind)
 			t.Logf("RESULT %-16s recovered in %-9v (%d packets lost)", tc.name, d.Round(time.Millisecond), lost)
 		})
 	}
 }
 // measureRecovery returns how long until the peer punched back, and how many of our packets died meanwhile. When
 // rebind is true we call RebindUDPServer once the tunnel goes dark, which is what the darwin network change
 // monitor does and what iOS has always done. When false, nothing tells nebula anything is wrong.
 func measureRecovery(t *testing.T, rebind bool) (time.Duration, int) {
 	t.Helper()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
 		"lighthouse": m{"am_lighthouse": true},
 	})
 	peerCfg := m{
 		"lighthouse": m{
 			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
 			"interval": 600,
 			"local_allow_list": m{
 				"10.0.0.0/24": true,
 				"::/0":        false,
 			},
 		},
 		"static_host_map": m{
 			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
 		},
 	}
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", peerCfg)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.3/24", peerCfg)
 	r := router.NewR(t, lhControl, myControl, theirControl)
 	defer r.RenderFlow()
 	defer func() {
 		lhControl.Stop()
 		myControl.Stop()
 		theirControl.Stop()
 	}()
 	lhControl.Start()
 	myControl.Start()
 	theirControl.Start()
 	r.RouteFor(time.Millisecond * 500)
 	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
 	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("establish")))
 	r.RouteFor(time.Second)
 	if myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false) == nil {
 		t.Fatal("failed to establish the tunnel we are measuring")
 	}
 	r.RouteFor(time.Millisecond * 500)
 	// From here the peer's NAT has no state for us, everything we send it disappears
 	start := time.Now()
 	blackholed := 0
 	var recovered time.Duration
 	if rebind {
 		myControl.RebindUDPServer()
 	}
 	// Keep the tun busy the way someone retrying a stalled connection would
 	stop := make(chan struct{})
 	defer close(stop)
 	go func() {
 		tick := time.NewTicker(time.Millisecond * 200)
 		defer tick.Stop()
 		for {
 			select {
 			case <-stop:
 				return
 			case <-tick.C:
 				myControl.InjectTunPacket(BuildTunUDPPacket(
 					theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("retry")))
 			}
 		}
 	}()
 	r.RouteForAllExitFuncOrTimeout(time.Second*30, func(p *udp.Packet, c *nebula.Control) router.ExitType {
 		if c == theirControl && p.From == myControl.GetUDPAddr() {
 			blackholed++
 			return router.Drop
 		}
 		// The peer reaching us directly is the moment its NAT opened, whether that is a punch or a handshake
 		if c == myControl && p.From == theirUdpAddr {
 			recovered = time.Since(start)
 			return router.RouteAndExit
 		}
 		return router.KeepRouting
 	})
 	if recovered == 0 {
 		t.Fatalf("no recovery within 30s (%d packets blackholed)", blackholed)
 	}
 	return recovered, blackholed
 }
@@ -6,16 +6,13 @@ package router
 import (
 	"context"
 	"fmt"
 	"maps"
 	"net/netip"
 	"os"
 	"path/filepath"
 	"reflect"
 	"regexp"
 	"slices"
 	"sort"
 	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -24,21 +21,9 @@ import (
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/udp"
 	"golang.org/x/exp/maps"
 )
 // outNatKey is the (from, to) pair used by outNat. Comparable struct, so it works as a map key without the
 // allocation cost of a string-concat key.
 type outNatKey struct {
 	from, to netip.AddrPort
 }
 // fannedPacket pairs a UDP TX packet with its source control so the router can route it after popping from
 // the fan-in channel.
 type fannedPacket struct {
 	from *nebula.Control
 	pkt  *udp.Packet
 }
 type R struct {
 	// Simple map of the ip:port registered on a control to the control
 	// Basically a router, right?
@@ -49,28 +34,12 @@ type R struct {
 	// A last used map, if an inbound packet hit the inNat map then
 	// all return packets should use the same last used inbound address for the outbound sender
-	outNat map[outNatKey]netip.AddrPort
+	// map[from address + ":" + to address] => ip:port to rewrite in the udp packet to receiver
 	outNat map[string]netip.AddrPort
 	// A map of vpn ip to the nebula control it belongs to
 	vpnControls map[netip.Addr]*nebula.Control
 	// Cached select infrastructure for RouteForAllUntilTxTun.
 	// The controls map is immutable after NewR so the cases are good for the test lifetime.
 	// We only rebuild if a different receiver is asked.
 	selRecvCtl *nebula.Control
 	selCases   []reflect.SelectCase
 	selCtls    []*nebula.Control
 	// Optional fan-in mode for hot-path benchmarks: one forwarder goroutine per control drains UDP TX into udpFanIn,
 	// so RouteForAllUntilTxTun can do a fixed 2-way native select instead of paying reflect.Select per call.
 	// Off by default (would otherwise interleave with tests that use GetFromUDP directly on the same control).
 	// Enabled by EnableFanIn.
 	udpFanIn  chan fannedPacket
 	stopFanIn chan struct{}
 	fanInWG   sync.WaitGroup
 	fanInMu   sync.Mutex
 	fanInOn   atomic.Bool
 	ignoreFlows []ignoreFlow
 	flow        []flowEntry
@@ -115,28 +84,6 @@ type packet struct {
 	packet *udp.Packet
 	tun    bool // a packet pulled off a tun device
 	rx     bool // the packet was received by a udp device
 	// h is the nebula header, parsed once when the packet is recorded. parseErr says why there isn't one, which
 	// the flow log reports rather than hiding. Punchy sends a single byte, so an unparseable packet is normal.
 	h        header.H
 	parseErr error
 }
 // fromAddr and toAddr are the addresses this packet actually travelled between. Reading them off the control
 // instead would misreport the whole history once a test moves a node. Tun packets are synthesized without
 // addresses, so they fall back to the control.
 func (p *packet) fromAddr() netip.AddrPort {
 	if p.tun || !p.packet.From.IsValid() {
 		return p.from.GetUDPAddr()
 	}
 	return p.packet.From
 }
 func (p *packet) toAddr() netip.AddrPort {
 	if p.tun || !p.packet.To.IsValid() {
 		return p.to.GetUDPAddr()
 	}
 	return p.packet.To
 }
 func (p *packet) WasReceived() {
@@ -154,9 +101,6 @@ const (
 	ExitNow ExitType = 1
 	// RouteAndExit routes this packet and exits immediately afterwards
 	RouteAndExit ExitType = 2
 	// Drop discards this packet without delivering it and keeps routing. Use it to simulate a blackhole, such as
 	// a restrictive NAT refusing traffic from an address it has not seen.
 	Drop ExitType = 3
 )
 type ExitFunc func(packet *udp.Packet, receiver *nebula.Control) ExitType
@@ -167,9 +111,7 @@ type ExitFunc func(packet *udp.Packet, receiver *nebula.Control) ExitType
 func NewR(t testing.TB, controls ...*nebula.Control) *R {
 	ctx, cancel := context.WithCancel(context.Background())
-	// t.Name() contains a slash for subtests, so the flow log can land in a nested directory
+	if err := os.MkdirAll("mermaid", 0755); err != nil {
 	fn := filepath.Join("mermaid", fmt.Sprintf("%s.md", t.Name()))
 	if err := os.MkdirAll(filepath.Dir(fn), 0755); err != nil {
 		panic(err)
 	}
@@ -177,10 +119,10 @@ func NewR(t testing.TB, controls ...*nebula.Control) *R {
 		controls:     make(map[netip.AddrPort]*nebula.Control),
 		vpnControls:  make(map[netip.Addr]*nebula.Control),
 		inNat:        make(map[netip.AddrPort]*nebula.Control),
-		outNat:       make(map[outNatKey]netip.AddrPort),
+		outNat:       make(map[string]netip.AddrPort),
 		flow:         []flowEntry{},
 		ignoreFlows:  []ignoreFlow{},
-		fn:           fn,
+		fn:           filepath.Join("mermaid", fmt.Sprintf("%s.md", t.Name())),
 		t:            t,
 		cancelRender: cancel,
 	}
@@ -211,10 +153,8 @@ func NewR(t testing.TB, controls ...*nebula.Control) *R {
 			case <-ctx.Done():
 				return
 			case <-clockSource.C:
 				r.Lock()
 				r.renderHostmaps("clock tick")
 				r.renderFlow()
 				r.Unlock()
 			}
 		}
 	}()
@@ -240,21 +180,15 @@ func (r *R) AddRoute(ip netip.Addr, port uint16, c *nebula.Control) {
 // RenderFlow renders the packet flow seen up until now and stops further automatic renders from happening.
 func (r *R) RenderFlow() {
 	r.cancelRender()
 	r.Lock()
 	defer r.Unlock()
 	r.renderFlow()
 }
 // CancelFlowLogs stops flow logs from being tracked and destroys any logs already collected
 func (r *R) CancelFlowLogs() {
 	r.cancelRender()
 	r.Lock()
 	r.flow = nil
 	r.Unlock()
 }
 // renderFlow writes the flow log to disk. Caller must hold r.Lock. renderFlow reads r.flow / r.additionalGraphs and
 // the *packet pointers stashed inside, all of which are mutated under the same lock by routing paths.
 func (r *R) renderFlow() {
 	if r.flow == nil {
 		return
@@ -277,7 +211,7 @@ func (r *R) renderFlow() {
 			continue
 		}
-		addr := e.packet.fromAddr()
+		addr := e.packet.from.GetUDPAddr()
 		if _, ok := participants[addr]; ok {
 			continue
 		}
@@ -296,6 +230,7 @@ func (r *R) renderFlow() {
 	}
 	// Print packets
 	h := &header.H{}
 	for _, e := range r.flow {
 		if e.packet == nil {
 			//fmt.Fprintf(f, "    note over %s: %s\n", strings.Join(participantsVals, ", "), e.note)
@@ -307,22 +242,21 @@ func (r *R) renderFlow() {
 			fmt.Fprintln(f, r.formatUdpPacket(p))
 		} else {
 			if err := h.Parse(p.packet.Data); err != nil {
 				panic(err)
 			}
 			line := "--x"
 			if p.rx {
 				line = "->>"
 			}
-			detail := fmt.Sprintf("%s(%s), index %v, counter: %v",
+			fmt.Fprintf(f,
-				p.h.TypeName(), p.h.SubTypeName(), p.h.RemoteIndex, p.h.MessageCounter)
+				"    %s%s%s: %s(%s), index %v, counter: %v\n",
-			if p.parseErr != nil {
+				normalizeName(p.from.GetUDPAddr().String()),
 				detail = fmt.Sprintf("unparsed, %v (%d bytes)", p.parseErr, len(p.packet.Data))
 			}
 			fmt.Fprintf(f, "    %s%s%s: %s\n",
 				normalizeName(p.fromAddr().String()),
 				line,
-				normalizeName(p.toAddr().String()),
+				normalizeName(p.to.GetUDPAddr().String()),
-				detail,
+				h.TypeName(), h.SubTypeName(), h.RemoteIndex, h.MessageCounter,
 			)
 		}
 	}
@@ -375,7 +309,7 @@ func (r *R) RenderHostmaps(title string, controls ...*nebula.Control) {
 }
 func (r *R) renderHostmaps(title string) {
-	c := slices.AppendSeq(make([]*nebula.Control, 0, len(r.controls)), maps.Values(r.controls))
+	c := maps.Values(r.controls)
 	sort.SliceStable(c, func(i, j int) bool {
 		return c[i].GetVpnAddrs()[0].Compare(c[j].GetVpnAddrs()[0]) > 0
 	})
@@ -436,34 +370,29 @@ func (r *R) unlockedInjectFlow(from, to *nebula.Control, p *udp.Packet, tun bool
 	r.renderHostmaps(fmt.Sprintf("Packet %v", len(r.flow)))
-	var h header.H
+	if len(r.ignoreFlows) > 0 {
-	var parseErr error
+		var h header.H
-	if !tun {
+		err := h.Parse(p.Data)
-		parseErr = h.Parse(p.Data)
+		if err != nil {
-	}
+			panic(err)
 	// Decide before copying, the copy comes from a freelist and an ignored packet would never be released
 	for _, i := range r.ignoreFlows {
 		if tun {
 			if i.tun.HasValue && i.tun.IsTrue {
 				return nil
 			}
 			continue
 		}
-		// A packet we could not parse has no type to match against, so no rule can ignore it
+		for _, i := range r.ignoreFlows {
-		if parseErr == nil && i.messageType == h.Type && i.subType == h.Subtype {
+			if !tun {
-			return nil
+				if i.messageType == h.Type && i.subType == h.Subtype {
 					return nil
 				}
 			} else if i.tun.HasValue && i.tun.IsTrue {
 				return nil
 			}
 		}
 	}
 	fp := &packet{
-		from:     from,
+		from:   from,
-		to:       to,
+		to:     to,
-		packet:   p.Copy(),
+		packet: p.Copy(),
-		tun:      tun,
+		tun:    tun,
 		h:        h,
 		parseErr: parseErr,
 	}
 	r.flow = append(r.flow, flowEntry{packet: fp})
@@ -505,157 +434,68 @@ func (r *R) RouteUntilTxTun(sender *nebula.Control, receiver *nebula.Control) []
 				panic("No control for udp tx " + a.String())
 			}
 			fp := r.unlockedInjectFlow(sender, c, p, false)
-			c.InjectUDPPacket(p) // copies internally; original is ours to release
+			c.InjectUDPPacket(p)
 			fp.WasReceived()
 			r.Unlock()
 			p.Release()
 		}
 	}
 }
-// RouteForAllUntilTxTun will route for everyone and return when a packet is seen on the receiver's tun.
+// RouteForAllUntilTxTun will route for everyone and return when a packet is seen on receivers tun
-// If a control's UDP TX address can't be matched to a registered control, we panic.
+// If the router doesn't have the nebula controller for that address, we panic
 //
 // For allocation-sensitive callers (hot-path benchmarks, in particular relay
 // benches with 3+ controls), call EnableFanIn() first.
 func (r *R) RouteForAllUntilTxTun(receiver *nebula.Control) []byte {
 	if r.fanInOn.Load() {
 		return r.routeFanIn(receiver)
 	}
 	return r.routeReflect(receiver)
 }
 // routeFanIn is the alloc-free path used when EnableFanIn is in effect.
 func (r *R) routeFanIn(receiver *nebula.Control) []byte {
 	tunTx := receiver.GetTunTxChan()
 	for {
 		select {
 		case p := <-tunTx:
 			r.Lock()
 			if r.flow != nil {
 				np := udp.Packet{Data: make([]byte, len(p))}
 				copy(np.Data, p)
 				r.unlockedInjectFlow(receiver, receiver, &np, true)
 			}
 			r.Unlock()
 			return p
 		case fp := <-r.udpFanIn:
 			r.routeUDP(fp.from, fp.pkt)
 		}
 	}
 }
 // routeReflect is the default reflect.Select-based path. Pays the boxing allocation per call but doesn't interfere
 // with tests that pull packets directly from controls' UDP TX channels via GetFromUDP.
 func (r *R) routeReflect(receiver *nebula.Control) []byte {
 	sc, cm := r.selectCasesFor(receiver)
 	for {
 		x, rx, _ := reflect.Select(sc)
 		if x == 0 {
 			p := rx.Interface().([]byte)
 			r.Lock()
 			if r.flow != nil {
 				np := udp.Packet{Data: make([]byte, len(p))}
 				copy(np.Data, p)
 				r.unlockedInjectFlow(cm[x], cm[x], &np, true)
 			}
 			r.Unlock()
 			return p
 		}
 		r.routeUDP(cm[x], rx.Interface().(*udp.Packet))
 	}
 }
 // EnableFanIn switches RouteForAllUntilTxTun to the alloc-free fan-in path.
 // One forwarder goroutine per registered control drains UDP TX into a shared channel that RouteForAllUntilTxTun selects
 // on alongside the receiver's TUN TX channel.
 func (r *R) EnableFanIn() {
 	r.fanInMu.Lock()
 	defer r.fanInMu.Unlock()
 	if r.fanInOn.Load() {
 		return
 	}
 	r.udpFanIn = make(chan fannedPacket, 32)
 	r.stopFanIn = make(chan struct{})
 	for _, c := range r.controls {
 		r.startFanInWorker(c)
 	}
 	r.fanInOn.Store(true)
 	r.t.Cleanup(r.stopFanInWorkers)
 }
 // startFanInWorker spawns a goroutine that drains c's UDP TX into r.udpFanIn.
 func (r *R) startFanInWorker(c *nebula.Control) {
 	r.fanInWG.Add(1)
 	udpTx := c.GetUDPTxChan()
 	go func() {
 		defer r.fanInWG.Done()
 		for {
 			select {
 			case <-r.stopFanIn:
 				return
 			case p := <-udpTx:
 				select {
 				case <-r.stopFanIn:
 					p.Release()
 					return
 				case r.udpFanIn <- fannedPacket{from: c, pkt: p}:
 				}
 			}
 		}
 	}()
 }
 // stopFanInWorkers signals the fan-in goroutines to exit and waits for them.
 func (r *R) stopFanInWorkers() {
 	r.fanInMu.Lock()
 	wasOn := r.fanInOn.Swap(false)
 	r.fanInMu.Unlock()
 	if !wasOn {
 		return
 	}
 	close(r.stopFanIn)
 	r.fanInWG.Wait()
 }
 // routeUDP forwards a UDP TX packet from the named source control to the destination control derived from p.To,
 // releasing the source packet after InjectUDPPacket has copied its bytes into a fresh pool slot.
 func (r *R) routeUDP(from *nebula.Control, p *udp.Packet) {
 	r.Lock()
 	defer r.Unlock()
 	a := from.GetUDPAddr()
 	c := r.getControl(a, p.To, p)
 	if c == nil {
 		panic(fmt.Sprintf("No control for udp tx %s", p.To))
 	}
 	fp := r.unlockedInjectFlow(from, c, p, false)
 	c.InjectUDPPacket(p) // copies internally; original is ours to release
 	fp.WasReceived()
 	p.Release()
 }
 // selectCasesFor returns the SelectCase array used by routeReflect: one slot for the receiver's TUN TX channel followed
 // by one per control's UDP TX channel. Cached for the test lifetime, only rebuilt if the receiver changes.
 func (r *R) selectCasesFor(receiver *nebula.Control) ([]reflect.SelectCase, []*nebula.Control) {
 	r.Lock()
 	defer r.Unlock()
 	if r.selRecvCtl == receiver && r.selCases != nil {
 		return r.selCases, r.selCtls
 	}
 	sc := make([]reflect.SelectCase, len(r.controls)+1)
 	cm := make([]*nebula.Control, len(r.controls)+1)
-	sc[0] = reflect.SelectCase{Dir: reflect.SelectRecv, Chan: reflect.ValueOf(receiver.GetTunTxChan())}
+
-	cm[0] = receiver
+	i := 0
-	i := 1
+	sc[i] = reflect.SelectCase{
 		Dir:  reflect.SelectRecv,
 		Chan: reflect.ValueOf(receiver.GetTunTxChan()),
 		Send: reflect.Value{},
 	}
 	cm[i] = receiver
 	i++
 	for _, c := range r.controls {
-		sc[i] = reflect.SelectCase{Dir: reflect.SelectRecv, Chan: reflect.ValueOf(c.GetUDPTxChan())}
+		sc[i] = reflect.SelectCase{
 			Dir:  reflect.SelectRecv,
 			Chan: reflect.ValueOf(c.GetUDPTxChan()),
 			Send: reflect.Value{},
 		}
 		cm[i] = c
 		i++
 	}
-	r.selRecvCtl = receiver
+
-	r.selCases = sc
+	for {
-	r.selCtls = cm
+		x, rx, _ := reflect.Select(sc)
-	return sc, cm
+		r.Lock()
 		if x == 0 {
 			// we are the tun tx, we can exit
 			p := rx.Interface().([]byte)
 			np := udp.Packet{Data: make([]byte, len(p))}
 			copy(np.Data, p)
 			r.unlockedInjectFlow(cm[x], cm[x], &np, true)
 			r.Unlock()
 			return p
 		} else {
 			// we are a udp tx, route and continue
 			p := rx.Interface().(*udp.Packet)
 			a := cm[x].GetUDPAddr()
 			c := r.getControl(a, p.To, p)
 			if c == nil {
 				r.Unlock()
 				panic(fmt.Sprintf("No control for udp tx %s", p.To))
 			}
 			fp := r.unlockedInjectFlow(cm[x], c, p, false)
 			c.InjectUDPPacket(p)
 			fp.WasReceived()
 		}
 		r.Unlock()
 	}
 }
 // RouteExitFunc will call the whatDo func with each udp packet from sender.
@@ -682,7 +522,6 @@ func (r *R) RouteExitFunc(sender *nebula.Control, whatDo ExitFunc) {
 		switch e {
 		case ExitNow:
 			r.Unlock()
 			p.Release()
 			return
 		case RouteAndExit:
@@ -690,13 +529,8 @@ func (r *R) RouteExitFunc(sender *nebula.Control, whatDo ExitFunc) {
 			receiver.InjectUDPPacket(p)
 			fp.WasReceived()
 			r.Unlock()
 			p.Release()
 			return
 		case Drop:
 			// Record it so the flow log shows the attempt, but never hand it to the receiver
 			r.unlockedInjectFlow(sender, receiver, p, false)
 		case KeepRouting:
 			fp := r.unlockedInjectFlow(sender, receiver, p, false)
 			receiver.InjectUDPPacket(p)
@@ -707,7 +541,6 @@ func (r *R) RouteExitFunc(sender *nebula.Control, whatDo ExitFunc) {
 		}
 		r.Unlock()
 		p.Release()
 	}
 }
@@ -727,85 +560,6 @@ func (r *R) RouteUntilAfterMsgType(sender *nebula.Control, msgType header.Messag
 	})
 }
 // RouteFor routes everything that shows up for the given duration and then returns. Use it to let a test settle
 // deterministically rather than sleeping and hoping: a single FlushAll races a completing handshake, which queues
 // more packets right behind it.
 func (r *R) RouteFor(d time.Duration) {
 	r.RouteForAllExitFuncOrTimeout(d, func(*udp.Packet, *nebula.Control) ExitType {
 		return KeepRouting
 	})
 }
 // RouteForAllExitFuncOrTimeout is RouteForAllExitFunc with a deadline, reporting whether whatDo asked to exit
 // before time ran out. The unbounded version blocks forever on a quiet network, so this is what a test needs to
 // assert that something does NOT happen, or to route for a fixed settling period.
 func (r *R) RouteForAllExitFuncOrTimeout(timeout time.Duration, whatDo ExitFunc) bool {
 	sc := make([]reflect.SelectCase, 0, len(r.controls)+1)
 	cm := make([]*nebula.Control, 0, len(r.controls))
 	for _, c := range r.controls {
 		sc = append(sc, reflect.SelectCase{
 			Dir:  reflect.SelectRecv,
 			Chan: reflect.ValueOf(c.GetUDPTxChan()),
 			Send: reflect.Value{},
 		})
 		cm = append(cm, c)
 	}
 	timer := time.NewTimer(timeout)
 	defer timer.Stop()
 	sc = append(sc, reflect.SelectCase{
 		Dir:  reflect.SelectRecv,
 		Chan: reflect.ValueOf(timer.C),
 		Send: reflect.Value{},
 	})
 	for {
 		x, rx, _ := reflect.Select(sc)
 		if x == len(cm) {
 			return false
 		}
 		r.Lock()
 		p := rx.Interface().(*udp.Packet)
 		receiver := r.getControl(cm[x].GetUDPAddr(), p.To, p)
 		if receiver == nil {
 			r.Unlock()
 			panic("Can't RouteForAllExitFuncOrTimeout for host: " + p.To.String())
 		}
 		e := whatDo(p, receiver)
 		switch e {
 		case ExitNow:
 			r.Unlock()
 			p.Release()
 			return true
 		case RouteAndExit:
 			fp := r.unlockedInjectFlow(cm[x], receiver, p, false)
 			receiver.InjectUDPPacket(p)
 			fp.WasReceived()
 			r.Unlock()
 			p.Release()
 			return true
 		case Drop:
 			// Record it so the flow log shows the attempt, but never hand it to the receiver
 			r.unlockedInjectFlow(cm[x], receiver, p, false)
 		case KeepRouting:
 			fp := r.unlockedInjectFlow(cm[x], receiver, p, false)
 			receiver.InjectUDPPacket(p)
 			fp.WasReceived()
 		default:
 			panic(fmt.Sprintf("Unknown exitFunc return: %v", e))
 		}
 		r.Unlock()
 		p.Release()
 	}
 }
 func (r *R) RouteForAllUntilAfterMsgTypeTo(receiver *nebula.Control, msgType header.MessageType, subType header.MessageSubType) {
 	h := &header.H{}
 	r.RouteForAllExitFunc(func(p *udp.Packet, r *nebula.Control) ExitType {
@@ -887,7 +641,6 @@ func (r *R) RouteForAllExitFunc(whatDo ExitFunc) {
 		switch e {
 		case ExitNow:
 			r.Unlock()
 			p.Release()
 			return
 		case RouteAndExit:
@@ -895,13 +648,8 @@ func (r *R) RouteForAllExitFunc(whatDo ExitFunc) {
 			receiver.InjectUDPPacket(p)
 			fp.WasReceived()
 			r.Unlock()
 			p.Release()
 			return
 		case Drop:
 			// Record it so the flow log shows the attempt, but never hand it to the receiver
 			r.unlockedInjectFlow(cm[x], receiver, p, false)
 		case KeepRouting:
 			fp := r.unlockedInjectFlow(cm[x], receiver, p, false)
 			receiver.InjectUDPPacket(p)
@@ -911,7 +659,6 @@ func (r *R) RouteForAllExitFunc(whatDo ExitFunc) {
 			panic(fmt.Sprintf("Unknown exitFunc return: %v", e))
 		}
 		r.Unlock()
 		p.Release()
 	}
 }
@@ -955,20 +702,19 @@ func (r *R) FlushAll() {
 		}
 		receiver.InjectUDPPacket(p)
 		r.Unlock()
 		p.Release()
 	}
 }
 // getControl performs or seeds NAT translation and returns the control for toAddr, p from fields may change
 // This is an internal router function, the caller must hold the lock
 func (r *R) getControl(fromAddr, toAddr netip.AddrPort, p *udp.Packet) *nebula.Control {
-	if newAddr, ok := r.outNat[outNatKey{from: fromAddr, to: toAddr}]; ok {
+	if newAddr, ok := r.outNat[fromAddr.String()+":"+toAddr.String()]; ok {
 		p.From = newAddr
 	}
 	c, ok := r.inNat[toAddr]
 	if ok {
-		r.outNat[outNatKey{from: c.GetUDPAddr(), to: fromAddr}] = toAddr
+		r.outNat[c.GetUDPAddr().String()+":"+fromAddr.String()] = toAddr
 		return c
 	}
@@ -1,125 +0,0 @@
 //go:build e2e_testing
 // +build e2e_testing
 package e2e
 import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"encoding/pem"
 	"net"
 	"strings"
 	"testing"
 	"time"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 )
 func TestSSHDLifecycle(t *testing.T) {
 	// TestSSHDLifecycle exercises the in-process sshd through several config reloads and a Control.Stop.
 	ca, _, caKey, _ := cert_test.NewTestCaCert(
 		cert.Version1, cert.Curve_CURVE25519,
 		time.Now(), time.Now().Add(10*time.Minute),
 		nil, nil, []string{},
 	)
 	hostKeyPEM := generateSSHHostKey(t)
 	clientSigner, clientAuthKey := generateSSHClientKey(t)
 	sshdAddr := allocLoopbackPort(t)
 	overrides := m{
 		"sshd": m{
 			"enabled":  true,
 			"listen":   sshdAddr,
 			"host_key": hostKeyPEM,
 			"authorized_users": []m{{
 				"user": "tester",
 				"keys": []string{clientAuthKey},
 			}},
 		},
 	}
 	control, _, _, _ := newSimpleServer(cert.Version1, ca, caKey, "sshd-test", "10.222.0.1/24", overrides)
 	control.Start()
 	t.Cleanup(func() { control.Stop() })
 	// sshd binds in a goroutine after Start returns; wait for it.
 	require.Eventually(t, func() bool { return canDial(sshdAddr) }, 2*time.Second, 25*time.Millisecond,
 		"sshd never started listening")
 	for i := 1; i <= 3; i++ {
 		out := sshExecReload(t, sshdAddr, clientSigner)
 		assert.Contains(t, out, "Reloading config", "reload cycle %d", i)
 		require.Eventually(t, func() bool { return canDial(sshdAddr) }, 2*time.Second, 25*time.Millisecond,
 			"sshd not listening after reload cycle %d", i)
 	}
 	control.Stop()
 	require.Eventually(t, func() bool { return !canDial(sshdAddr) }, 2*time.Second, 25*time.Millisecond,
 		"sshd still listening after Control.Stop")
 }
 func canDial(addr string) bool {
 	c, err := net.DialTimeout("tcp", addr, 100*time.Millisecond)
 	if err != nil {
 		return false
 	}
 	_ = c.Close()
 	return true
 }
 // allocLoopbackPort grabs an unused TCP port on 127.0.0.1, closes it, and returns the address. There
 // is a small race between releasing the port and the sshd reclaiming it; in practice the OS keeps the
 // port available long enough for the test to bind it.
 func allocLoopbackPort(t *testing.T) string {
 	t.Helper()
 	l, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 	addr := l.Addr().String()
 	require.NoError(t, l.Close())
 	return addr
 }
 func generateSSHHostKey(t *testing.T) string {
 	t.Helper()
 	_, priv, err := ed25519.GenerateKey(rand.Reader)
 	require.NoError(t, err)
 	block, err := ssh.MarshalPrivateKey(priv, "nebula-e2e-host")
 	require.NoError(t, err)
 	return string(pem.EncodeToMemory(block))
 }
 func generateSSHClientKey(t *testing.T) (ssh.Signer, string) {
 	t.Helper()
 	_, priv, err := ed25519.GenerateKey(rand.Reader)
 	require.NoError(t, err)
 	signer, err := ssh.NewSignerFromKey(priv)
 	require.NoError(t, err)
 	auth := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(signer.PublicKey())))
 	return signer, auth
 }
 func sshExecReload(t *testing.T, addr string, signer ssh.Signer) string {
 	t.Helper()
 	cfg := &ssh.ClientConfig{
 		User:            "tester",
 		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
 		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
 		Timeout:         2 * time.Second,
 	}
 	client, err := ssh.Dial("tcp", addr, cfg)
 	require.NoError(t, err)
 	defer client.Close()
 	sess, err := client.NewSession()
 	require.NoError(t, err)
 	defer sess.Close()
 	// reload tears the channel down before sending exit-status, so Output returns an error on the
 	// channel close. The output buffer still has whatever the reload callback wrote before that.
 	out, _ := sess.Output("reload")
 	return string(out)
 }
@@ -15,12 +15,10 @@ import (
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v3"
 )
 func TestDropInactiveTunnels(t *testing.T) {
 	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -43,8 +41,8 @@ func TestDropInactiveTunnels(t *testing.T) {
 	r.Log("Go inactive and wait for the tunnels to get dropped")
 	waitStart := time.Now()
 	for {
-		myIndexes := myControl.GetHostmapIndexCount()
+		myIndexes := len(myControl.GetHostmap().Indexes)
-		theirIndexes := theirControl.GetHostmapIndexCount()
+		theirIndexes := len(theirControl.GetHostmap().Indexes)
 		if myIndexes == 0 && theirIndexes == 0 {
 			break
 		}
@@ -65,7 +63,6 @@ func TestDropInactiveTunnels(t *testing.T) {
 }
 func TestCertUpgrade(t *testing.T) {
 	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -160,7 +157,6 @@ func TestCertUpgrade(t *testing.T) {
 }
 func TestCertDowngrade(t *testing.T) {
 	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -259,7 +255,6 @@ func TestCertDowngrade(t *testing.T) {
 }
 func TestCertMismatchCorrection(t *testing.T) {
 	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -327,7 +322,6 @@ func TestCertMismatchCorrection(t *testing.T) {
 }
 func TestCrossStackRelaysWork(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24,fc00::1/64", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "10.128.0.128/24,fc00::128/64", m{"relay": m{"am_relay": true}})
@@ -356,14 +350,14 @@ func TestCrossStackRelaysWork(t *testing.T) {
 	theirControl.Start()
 	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnV6.Addr(), 80, myVpnV6.Addr(), 80, []byte("Hi from me")))
+	myControl.InjectTunUDPPacket(theirVpnV6.Addr(), 80, myVpnV6.Addr(), 80, []byte("Hi from me"))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	r.Log("Assert the tunnel works")
 	assertUdpPacket(t, []byte("Hi from me"), p, myVpnV6.Addr(), theirVpnV6.Addr(), 80, 80)
 	t.Log("reply?")
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnV6.Addr(), 80, theirVpnV6.Addr(), 80, []byte("Hi from them")))
+	theirControl.InjectTunUDPPacket(myVpnV6.Addr(), 80, theirVpnV6.Addr(), 80, []byte("Hi from them"))
 	p = r.RouteForAllUntilTxTun(myControl)
 	assertUdpPacket(t, []byte("Hi from them"), p, theirVpnV6.Addr(), myVpnV6.Addr(), 80, 80)
@@ -374,102 +368,7 @@ func TestCrossStackRelaysWork(t *testing.T) {
 	//relayControl.Stop()
 }
 // TestRelayReplayProtection asserts that a relay (forwarding-type) node rejects
 // replayed relay frames. A captured relay frame, re-injected with the same
 // message counter, must be dropped by the replay window rather than re-forwarded
 // to the relay target. Before the fix, handleOutsideRelayPacket authenticated the
 // frame but never advanced the replay window, so every replay was re-forwarded.
 func TestRelayReplayProtection(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24,fc00::1/64", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "10.128.0.128/24,fc00::128/64", m{"relay": m{"am_relay": true}})
 	theirUdp := netip.MustParseAddrPort("10.0.0.2:4242")
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServerWithUdp(cert.Version2, ca, caKey, "them   ", "fc00::2/64", theirUdp, m{"relay": m{"use_relays": true}})
 	myVpnV6 := myVpnIpNet[1]
 	relayVpnV4 := relayVpnIpNet[0]
 	relayVpnV6 := relayVpnIpNet[1]
 	theirVpnV6 := theirVpnIpNet[0]
 	// Teach me how to reach the relay and that them is reachable via the relay
 	myControl.InjectLightHouseAddr(relayVpnV4.Addr(), relayUdpAddr)
 	myControl.InjectLightHouseAddr(relayVpnV6.Addr(), relayUdpAddr)
 	myControl.InjectRelays(theirVpnV6.Addr(), []netip.Addr{relayVpnV6.Addr()})
 	relayControl.InjectLightHouseAddr(theirVpnV6.Addr(), theirUdpAddr)
 	r := router.NewR(t, myControl, relayControl, theirControl)
 	defer r.RenderFlow()
 	myControl.Start()
 	relayControl.Start()
 	theirControl.Start()
 	// Establish the relayed tunnel in both directions so all handshakes complete.
 	t.Log("Establish the relayed tunnel")
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnV6.Addr(), 80, myVpnV6.Addr(), 80, []byte("Hi from me")))
 	p := r.RouteForAllUntilTxTun(theirControl)
 	assertUdpPacket(t, []byte("Hi from me"), p, myVpnV6.Addr(), theirVpnV6.Addr(), 80, 80)
 	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnV6.Addr(), 80, theirVpnV6.Addr(), 80, []byte("Hi from them")))
 	p = r.RouteForAllUntilTxTun(myControl)
 	assertUdpPacket(t, []byte("Hi from them"), p, theirVpnV6.Addr(), myVpnV6.Addr(), 80, 80)
 	// Drain anything still queued on me's UDP tx so the next packet we pull is the
 	// relay frame we are about to generate.
 	for myControl.GetFromUDP(false) != nil {
 	}
 	// Capture a single legitimate relay frame that me transmits toward the relay.
 	t.Log("Capture a relay frame from me -> relay")
 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnV6.Addr(), 80, myVpnV6.Addr(), 80, []byte("replay me")))
 	relayFrame := myControl.GetFromUDP(true)
 	require.Equal(t, relayUdpAddr, relayFrame.To, "captured frame should be addressed to the relay")
 	var fh header.H
 	require.NoError(t, fh.Parse(relayFrame.Data))
 	require.Equal(t, header.Message, fh.Type)
 	require.Equal(t, header.MessageRelay, fh.Subtype)
 	// drainForwards counts relay frames the relay forwards toward them within the
 	// settle window. We match on destination + (Message, MessageRelay) so the
 	// relay's own direct traffic to them can't be miscounted.
 	drainForwards := func(settle time.Duration) int {
 		ch := relayControl.GetUDPTxChan()
 		count := 0
 		for {
 			select {
 			case pkt := <-ch:
 				var ph header.H
 				if pkt.To == theirUdpAddr && ph.Parse(pkt.Data) == nil &&
 					ph.Type == header.Message && ph.Subtype == header.MessageRelay {
 					count++
 				}
 				pkt.Release()
 			case <-time.After(settle):
 				return count
 			}
 		}
 	}
 	// First delivery of the captured frame: the relay should forward it once.
 	t.Log("Deliver the captured frame once; relay forwards it to them")
 	relayControl.InjectUDPPacket(relayFrame)
 	require.Equal(t, 1, drainForwards(200*time.Millisecond), "relay should forward the first, legitimate copy")
 	// Replay the exact same frame several times. A correct replay window rejects
 	// these duplicates so the relay forwards none of them.
 	t.Log("Replay the captured frame; relay must drop the duplicates")
 	const replays = 3
 	for i := 0; i < replays; i++ {
 		relayControl.InjectUDPPacket(relayFrame)
 	}
 	forwarded := drainForwards(200 * time.Millisecond)
 	assert.Equal(t, 0, forwarded, "relay re-forwarded %d/%d replayed relay frames; replay protection is ineffective on relay tunnels", forwarded, replays)
 	r.RenderHostmaps("Final hostmaps", myControl, relayControl, theirControl)
 }
 func TestCloseTunnelAuthenticated(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{"tunnels": m{"drop_inactive": true, "inactivity_timeout": "5s"}})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", m{"tunnels": m{"drop_inactive": true, "inactivity_timeout": "10m"}})
@@ -493,8 +392,8 @@ func TestCloseTunnelAuthenticated(t *testing.T) {
 	waitStart := time.Now()
 	for {
-		myIndexes := myControl.GetHostmapIndexCount()
+		myIndexes := len(myControl.GetHostmap().Indexes)
-		theirIndexes := theirControl.GetHostmapIndexCount()
+		theirIndexes := len(theirControl.GetHostmap().Indexes)
 		if myIndexes == 0 && theirIndexes == 0 {
 			break
 		}
@@ -548,8 +447,8 @@ func TestCloseTunnelAuthenticated(t *testing.T) {
 	r.Log("Injected bogus close tunnel. Let's see!")
 	waitStart = time.Now()
 	for {
-		myIndexes := myControl.GetHostmapIndexCount()
+		myIndexes := len(myControl.GetHostmap().Indexes)
-		theirIndexes := theirControl.GetHostmapIndexCount()
+		theirIndexes := len(theirControl.GetHostmap().Indexes)
 		if myIndexes == 0 {
 			t.Fatal("myIndexes should not be 0")
 		}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
rawdigits	2bc200103f	tun/linux: coalesce WriteGSO into single write() to avoid 4.19 UAF The scatter-gather writev path in WriteGSO triggered a kernel-side use-after-free in tun_chr_write_iter → sock_alloc_send_pskb → skb_set_owner_w on Linux 4.19 TUN when the virtio_net_hdr requested TSO segmentation. The skb write-memory refcount (sk_wmem_alloc) underflowed, producing paired traces of refcount_t: addition on 0 (in the write path) and refcount_t: underflow (in the paired recv socket), reliably rebooting UBIOS UXG-Pro routers under iperf3 -R. Match wireguard-go's design: coalesce the virtio_net_hdr, IP/TCP header, and all payload fragments into a single contiguous per-queue scratch buffer, then emit the superpacket with a single write() syscall. wireguard-go's offload path handles GRO-merged TSO superpackets this way and has no equivalent failure mode (see tun/tun_linux.go Write — it writes bufs[bufsI][offset:] with a single tunFile.Write call after coalesce). Cost: one extra memcpy per superpacket (bounded at ~64KiB by the virtio spec). Unit tests pass (go test ./overlay/tio/...). Field testing on UXG-Pro (4.19) pending.	2026-04-24 22:21:51 +00:00
JackDoan	c9d5a6e35a	be safer	2026-04-24 16:48:52 -05:00
JackDoan	8fd724d762	fix?	2026-04-24 16:27:23 -05:00
JackDoan	6e23fe4d46	GRO	2026-04-23 17:32:49 -05:00
JackDoan	90f2938f9c	cruft	2026-04-23 13:12:24 -05:00
JackDoan	f76ac2e216	fix tests	2026-04-23 11:35:51 -05:00
JackDoan	382b15ac52	haha yep faster	2026-04-21 17:19:32 -05:00
JackDoan	4104a48a86	checksum speed	2026-04-21 17:07:50 -05:00
JackDoan	35212c21b9	haha	2026-04-21 17:07:24 -05:00
JackDoan	370a7f50af	save pennies	2026-04-21 17:07:15 -05:00
JackDoan	50d6632845	fix	2026-04-21 14:52:28 -05:00
JackDoan	78af44068f	typo!	2026-04-21 14:02:15 -05:00
JackDoan	ad6b918e4d	checkpt	2026-04-21 13:31:16 -05:00
JackDoan	bf4e37e99d	merge hell	2026-04-21 11:29:39 -05:00
JackDoan	d0825514a0	GSO again	2026-04-21 11:25:47 -05:00
JackDoan	6ee5e18d84	fancy blocking writes wait for goroutines to finish and for tun to actually be closed remove yellow squiggles nbio for tun bugz Remove more os.Exit calls and give a more reliable wait for stop function checkpt tun_linux.go: stdlib too slow, but can't use blocking IO and clean shutdown	2026-04-21 11:22:55 -05:00