it works

gottem
no
2026-09-30 12:56:39 +02:00 · 2026-05-22 08:52:37 -05:00 · 2026-05-14 16:06:00 -05:00 · 2026-05-14 15:56:39 -05:00 · 2026-05-14 15:56:34 -05:00 · 2026-05-14 14:43:57 -05:00
212 changed files with 5631 additions and 20716 deletions
@@ -25,9 +25,9 @@ inputs:
    required: false
    default: "code-signer"
  key-prefix:
-    description: "S3 key prefix to write under; defaults to code-signing/<owner>/<repo> of the calling repo"
+    description: "S3 key prefix the caller is authorized to write under"
    required: false
-    default: ""
+    default: "code-signing/slackhq/nebula"

 runs:
  using: composite
@@ -43,15 +43,8 @@ runs:
      with:
        role-to-assume: ${{ inputs.role }}
        aws-region: ${{ inputs.region }}
-        # An STS secret key with special characters does not survive the
-        # pwsh -> make -> MSYS sh -> aws.exe chain, and SigV4 then signs with a
-        # key that no longer matches, so the first S3 upload fails with
-        # SignatureDoesNotMatch. Retries the assume until it comes back clean.
-        # Same fix as DefinedNet/dnclient#867.
-        special-characters-workaround: true
-        # Overridden by the workaround above and kept for whenever that goes:
-        # the default 12 rides out IAM trust-policy propagation, and once the
-        # role is stable a real misconfiguration should fail fast.
+        # Default is 12 retries to ride out IAM trust-policy propagation; once
+        # the role is stable we want a real misconfiguration to fail fast.
        retry-max-attempts: 5

    - name: Sign .exe files
@@ -64,9 +57,6 @@ runs:
        KEY_PREFIX: ${{ inputs.key-prefix }}
      run: |
        set -eu
-        # Default the prefix to this repo so the S3 key attributes the sign correctly.
-        # nebula-nightly runs this same action but writes under its own repo's prefix.
-        KEY_PREFIX="${KEY_PREFIX:-code-signing/$GITHUB_REPOSITORY}"
        RUN="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"

        find "$SIGN_PATH" -name '*.exe' -print | while read -r path
@@ -0,0 +1,34 @@
+name: gofmt
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    paths:
+      - '.github/workflows/gofmt.yml'
+      - '**.go'
+jobs:
+
+  gofmt:
+    name: Run gofmt
+    runs-on: ubuntu-latest
+    steps:
+
+    - uses: actions/checkout@v6
+
+    - uses: actions/setup-go@v6
+      with:
+        go-version: '1.25'
+        check-latest: true
+
+    - name: Install goimports
+      run: |
+        go install golang.org/x/tools/cmd/goimports@latest
+
+    - name: gofmt
+      run: |
+        if [ "$(find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -l)" ]
+        then
+          find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -d
+          exit 1
+        fi
@@ -10,11 +10,11 @@ jobs:
    name: Build Linux/BSD All
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6

-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
-          go-version: '1.26'
+          go-version: '1.25'
          check-latest: true

      - name: Build
@@ -36,11 +36,11 @@ jobs:
      id-token: write
      contents: read
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6

-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
-          go-version: '1.26'
+          go-version: '1.25'
          check-latest: true

      - name: Build
@@ -73,81 +73,27 @@ jobs:
  build-darwin:
    name: Build Universal Darwin
    env:
-      HAS_SIGNING_CREDS: ${{ secrets.APPLE_SIGNING_ROLE_ARN != '' }}
+      HAS_SIGNING_CREDS: ${{ secrets.AC_USERNAME != '' }}
    runs-on: macos-latest
-    permissions:
-      id-token: write
-      contents: read
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6

-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@v6
        with:
-          go-version: '1.26'
+          go-version: '1.25'
          check-latest: true

-      # GitHub holds ARNs, not credentials, and ARNs outlive a rotation
-      - name: Configure AWS credentials
-        if: env.HAS_SIGNING_CREDS == 'true'
-        uses: aws-actions/configure-aws-credentials@v6
-        with:
-          role-to-assume: ${{ secrets.APPLE_SIGNING_ROLE_ARN }}
-          aws-region: us-east-2
-
-      # parse-json-secrets unpacks into SIGNING_* and ASC_*, masked on the way in
-      - name: Fetch signing credentials
-        if: env.HAS_SIGNING_CREDS == 'true'
-        uses: aws-actions/aws-secretsmanager-get-secrets@v3
-        with:
-          parse-json-secrets: true
-          secret-ids: |
-            SIGNING,${{ secrets.APPLE_SIGNING_DEVELOPER_ID_ARN }}
-            ASC,${{ secrets.APPLE_NOTARY_KEY_ARN }}
-
      - name: Import certificates
        if: env.HAS_SIGNING_CREDS == 'true'
        uses: Apple-Actions/import-codesign-certs@v7
        with:
-          p12-file-base64: ${{ env.SIGNING_P12_BASE64 }}
-          p12-password: ${{ env.SIGNING_PASSWORD }}
-
-      # The action imports but does not check the chain validates, which is how a p12
-      # missing its intermediate reaches a failing codesign
-      - name: Check the identity is usable
-        if: env.HAS_SIGNING_CREDS == 'true'
-        run: |
-          : "${SIGNING_IDENTITY_SHA1:?empty, so the secret has no identity_sha1}"
-          identities=$(security find-identity -v -p codesigning signing_temp.keychain)
-          case "$identities" in
-          *"$SIGNING_IDENTITY_SHA1"*) ;;
-          *) printf '%s\n' "$identities" >&2; exit 1 ;;
-          esac
-
-      # notarytool wants the key as a file
-      - name: Write the App Store Connect key
-        if: env.HAS_SIGNING_CREDS == 'true'
-        run: |
-          mkdir -p ~/private_keys
-          chmod 700 ~/private_keys
-          key_path="$HOME/private_keys/AuthKey_${ASC_KEY_ID}.p8"
-          (umask 077; printf '%s\n' "$ASC_PRIVATE_KEY" > "$key_path")
-          echo "ASC_P8=$key_path" >> "$GITHUB_ENV"
-
-      - name: Drop the credentials from the environment
-        if: env.HAS_SIGNING_CREDS == 'true'
-        run: |
-          # The action's own inventory, so a new field in a secret is covered
-          python3 -c '
-          import json, os
-          raw = os.environ.get("SECRETS_LIST_CLEAN_UP")
-          if raw is None and os.environ.get("SIGNING_P12_BASE64"):
-              raise SystemExit("SECRETS_LIST_CLEAN_UP is gone, fetched secrets are not being scrubbed")
-          keep = {"SIGNING_IDENTITY_SHA1", "ASC_KEY_ID", "ASC_ISSUER_ID"}
-          names = [n for n in json.loads(raw or "[]") if n not in keep]
-          print("\n".join(f"{n}=" for n in dict.fromkeys(names)))
-          ' >> "$GITHUB_ENV"
+          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
+          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}

      - name: Build, sign, and notarize
+        env:
+          AC_USERNAME: ${{ secrets.AC_USERNAME }}
+          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
        run: |
          rm -rf release
          mkdir release
@@ -156,34 +102,17 @@ jobs:
          lipo -create -output ./release/nebula ./build/darwin-amd64/nebula ./build/darwin-arm64/nebula
          lipo -create -output ./release/nebula-cert ./build/darwin-amd64/nebula-cert ./build/darwin-arm64/nebula-cert

-          # Unset in a fork, which has no credentials to sign with
-          if [ -n "$SIGNING_IDENTITY_SHA1" ]; then
-            codesign -s "$SIGNING_IDENTITY_SHA1" -f -v --timestamp --options=runtime -i "net.defined.nebula" ./release/nebula
-            codesign -s "$SIGNING_IDENTITY_SHA1" -f -v --timestamp --options=runtime -i "net.defined.nebula-cert" ./release/nebula-cert
+          if [ -n "$AC_USERNAME" ]; then
+            codesign -s "10BC1FDDEB6CE753550156C0669109FAC49E4D1E" -f -v --timestamp --options=runtime -i "net.defined.nebula" ./release/nebula
+            codesign -s "10BC1FDDEB6CE753550156C0669109FAC49E4D1E" -f -v --timestamp --options=runtime -i "net.defined.nebula-cert" ./release/nebula-cert
          fi

          zip -j release/nebula-darwin.zip release/nebula-cert release/nebula

-          if [ -n "$ASC_P8" ]; then
-            xcrun notarytool submit ./release/nebula-darwin.zip --key "$ASC_P8" --key-id "$ASC_KEY_ID" --issuer "$ASC_ISSUER_ID" --wait
+          if [ -n "$AC_USERNAME" ]; then
+            xcrun notarytool submit ./release/nebula-darwin.zip --team-id "576H3XS7FP" --apple-id "$AC_USERNAME" --password "$AC_PASSWORD" --wait
          fi

-      - name: Drop the signing key
-        if: always() && env.HAS_SIGNING_CREDS == 'true'
-        run: |
-          # Locked, not deleted: import-codesign-certs deletes it in its own post
-          # step and fails the job if it is already gone. Locked is unusable.
-          security lock-keychain signing_temp.keychain || true
-          rm -f "$ASC_P8"
-          # Nothing later in this job needs AWS
-          python3 -c '
-          import json, os
-          names = json.loads(os.environ.get("SECRETS_LIST_CLEAN_UP") or "[]")
-          names += ["ASC_P8", "SIGNING_IDENTITY_SHA1", "ASC_KEY_ID", "ASC_ISSUER_ID",
-                    "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
-          print("\n".join(f"{n}=" for n in dict.fromkeys(names)))
-          ' >> "$GITHUB_ENV"
-
      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
@@ -205,7 +134,7 @@ jobs:
      # be overwritten
      - name: Checkout code
        if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6

      - name: Download artifacts
        if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
@@ -234,17 +163,14 @@ jobs:
          mkdir -p build/linux-{amd64,arm64}
          tar -zxvf artifacts/nebula-linux-amd64.tar.gz -C build/linux-amd64/
          tar -zxvf artifacts/nebula-linux-arm64.tar.gz -C build/linux-arm64/
-          docker buildx build . --push -f docker/Dockerfile --platform linux/amd64,linux/arm64 \
-            --build-arg VERSION="${GITHUB_REF#refs/tags/v}" \
-            --build-arg REVISION="${GITHUB_SHA}" \
-            --tag "${DOCKER_IMAGE_REPO}:${DOCKER_IMAGE_TAG}" --tag "${DOCKER_IMAGE_REPO}:${GITHUB_REF#refs/tags/v}"
+          docker buildx build . --push -f docker/Dockerfile --platform linux/amd64,linux/arm64 --tag "${DOCKER_IMAGE_REPO}:${DOCKER_IMAGE_TAG}" --tag "${DOCKER_IMAGE_REPO}:${GITHUB_REF#refs/tags/v}"

  release:
    name: Create and Upload Release
    needs: [build-linux, build-darwin, build-windows]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6

      - name: Download artifacts
        uses: actions/download-artifact@v8
@@ -30,11 +30,11 @@ jobs:
      VAGRANT_DEFAULT_PROVIDER: libvirt
    steps:

-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6

-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true

    - name: add hashicorp source
@@ -62,11 +62,11 @@ jobs:
      VAGRANT_DEFAULT_PROVIDER: virtualbox
    steps:

-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6

-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true

    - name: add hashicorp source
@@ -88,11 +88,11 @@ jobs:
    runs-on: windows-latest
    steps:

-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6

-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true

    # WSL2 + Ubuntu so the smoke can run a real linux peer with its own
@@ -18,47 +18,38 @@ jobs:
    runs-on: ubuntu-latest
    steps:

-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6

-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
-        check-latest: true
-
-    - name: Smoke Docker
-      run: make smoke-docker
-
-    - name: Smoke Docker IPv6 overlay
-      run: make smoke-docker-ipv6
-
-    - name: Smoke Relay Docker
-      run: make smoke-relay-docker
-
-    - name: Smoke Docker boringcrypto
-      run: make boringcrypto smoke-docker
-
-    - name: Smoke Docker fips140
-      run: make fips140-all GOALS=smoke-docker
-
-    timeout-minutes: 10
-
-  smoke-self:
-    name: Run self traffic smoke test on macOS
-    runs-on: macos-latest
-    steps:
-
-    - uses: actions/checkout@v7
-
-    - uses: actions/setup-go@v7
-      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true

    - name: build
-      run: make bin
+      run: make bin-docker CGO_ENABLED=1 BUILD_ARGS=-race

-    - name: run smoke-self
+    - name: setup docker image
      working-directory: ./.github/workflows/smoke
-      run: ./smoke-self.sh
+      run: ./build.sh
+
+    - name: run smoke
+      working-directory: ./.github/workflows/smoke
+      run: ./smoke.sh
+
+    - name: setup relay docker image
+      working-directory: ./.github/workflows/smoke
+      run: ./build-relay.sh
+
+    - name: run smoke relay
+      working-directory: ./.github/workflows/smoke
+      run: ./smoke-relay.sh
+
+    - name: setup docker image for P256
+      working-directory: ./.github/workflows/smoke
+      run: NAME="smoke-p256" CURVE=P256 ./build.sh
+
+    - name: run smoke-p256
+      working-directory: ./.github/workflows/smoke
+      run: NAME="smoke-p256" ./smoke.sh

    timeout-minutes: 10
@@ -5,19 +5,6 @@ set -e -x
 rm -rf ./build
 mkdir ./build

-if [ "$SMOKE_OVERLAY_IPV6" ]
-then
-    LIGHTHOUSE_NIP="fd00:4242:0:0:0:ffff:c0a8:6401"
-    HOST2_NIP="fd00:4242:0:0:0:ffff:c0a8:6402"
-    HOST3_NIP="fd00:4242:0:0:0:ffff:c0a8:6403"
-    HOST4_NIP="fd00:4242:0:0:0:ffff:c0a8:6404"
-else
-    LIGHTHOUSE_NIP="192.168.100.1"
-    HOST2_NIP="192.168.100.2"
-    HOST3_NIP="192.168.100.3"
-    HOST4_NIP="192.168.100.4"
-fi
-
 # Smoke containers run on a dedicated docker network whose subnet is allocated
 # at smoke time, not known at build time. Configs are written with TEST-NET-3
 # placeholder IPs (RFC 5737) and smoke.sh / smoke-vagrant.sh / smoke-relay.sh
@@ -44,24 +31,24 @@ LIGHTHOUSE_IP="203.0.113.2"
        ../genconfig.sh >lighthouse1.yml

    HOST="host2" \
-        LIGHTHOUSES="$LIGHTHOUSE_NIP $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
        ../genconfig.sh >host2.yml

    HOST="host3" \
-        LIGHTHOUSES="$LIGHTHOUSE_NIP $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
        INBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
        ../genconfig.sh >host3.yml

    HOST="host4" \
-        LIGHTHOUSES="$LIGHTHOUSE_NIP $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
        OUTBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
        ../genconfig.sh >host4.yml

    ../../../../nebula-cert ca -curve "${CURVE:-25519}" -name "Smoke Test"
-    ../../../../nebula-cert sign -name "lighthouse1" -groups "lighthouse,lighthouse1" -ip "$LIGHTHOUSE_NIP/24"
-    ../../../../nebula-cert sign -name "host2" -groups "host,host2" -ip "$HOST2_NIP/24"
-    ../../../../nebula-cert sign -name "host3" -groups "host,host3" -ip "$HOST3_NIP/24"
-    ../../../../nebula-cert sign -name "host4" -groups "host,host4" -ip "$HOST4_NIP/24"
+    ../../../../nebula-cert sign -name "lighthouse1" -groups "lighthouse,lighthouse1" -ip "192.168.100.1/24"
+    ../../../../nebula-cert sign -name "host2" -groups "host,host2" -ip "192.168.100.2/24"
+    ../../../../nebula-cert sign -name "host3" -groups "host,host3" -ip "192.168.100.3/24"
+    ../../../../nebula-cert sign -name "host4" -groups "host,host4" -ip "192.168.100.4/24"
 )

 docker build -t "nebula:${NAME:-smoke}" .
@@ -1,130 +0,0 @@
-#!/bin/bash
-
-# A host must be able to reach its own overlay address. Where the kernel sends
-# that traffic through the tun rather than over loopback, nebula sees it and
-# hands it straight back (immediatelyForwardToSelf), and whether the kernel
-# accepts what comes back is only answerable against a real kernel. Runs one
-# nebula on this machine as root and aims every probe at its own address.
-
-set -e -x
-
-set -o pipefail
-
-V4=192.0.2.1
-V6=2001:db8::1
-
-case "$(uname -s)" in
-    Darwin) TUN_DEV=utun ;;
-    *) TUN_DEV=tun0 ;;
-esac
-
-ROOT="$(cd ../../.. && pwd)"
-
-rm -rf build/self
-mkdir -p build/self
-cd build/self
-
-cleanup() {
-    echo
-    echo " *** cleanup"
-    echo
-
-    set +e
-    if [ -n "$NEBULA_PID" ]
-    then
-        sudo kill "$NEBULA_PID"
-    fi
-    { kill $(jobs -p); wait; } 2>/dev/null
-    sed 's/^/  [self]  /' nebula.log
-}
-
-trap cleanup EXIT
-
-# perl is on every platform this runs on; timeout(1) is not.
-alarm() {
-    perl -e 'alarm shift; exec @ARGV' "$@"
-}
-
-RESULTS=""
-FAILED=""
-probe() {
-    local name="$1"
-    shift
-    if "$@"
-    then
-        RESULTS="$RESULTS $name=ok"
-    else
-        RESULTS="$RESULTS $name=FAIL"
-        FAILED="$FAILED $name"
-    fi
-}
-
-# Send one datagram, then wait for the listener to have written it out.
-udp_probe() {
-    echo self | alarm 5 nc -u -w1 "$1" 3000 || true
-    set +x
-    for _ in $(seq 1 20)
-    do
-        if grep -q self "$2"
-        then
-            set -x
-            return 0
-        fi
-        sleep 0.25
-    done
-    set -x
-    return 1
-}
-
-"$ROOT/nebula-cert" ca -name "Smoke Test"
-"$ROOT/nebula-cert" sign -name self -networks "$V4/24,$V6/64"
-
-HOST=self AM_LIGHTHOUSE=true TUN_DEV="$TUN_DEV" ../../genconfig.sh >self.yml
-
-"$ROOT/nebula" -config self.yml -test
-
-sudo -v
-sudo "$ROOT/nebula" -config self.yml >nebula.log 2>&1 &
-NEBULA_PID=$!
-
-for _ in $(seq 1 40)
-do
-    ifconfig | grep "inet6 $V6 " >/dev/null && break
-    sleep 0.25
-done
-ifconfig | grep "inet $V4 "
-ifconfig | grep "inet6 $V6 "
-
-nc -l "$V4" 2000 >/dev/null &
-nc -l "$V6" 2000 >/dev/null &
-nc -u -l "$V4" 3000 >udp4.txt &
-nc -u -l "$V6" 3000 >udp6.txt &
-sleep 1
-
-set +x
-echo
-echo " *** Testing self traffic from $V4"
-echo
-set -x
-probe icmp4 alarm 5 ping -c1 "$V4"
-probe tcp4 alarm 5 nc -z "$V4" 2000
-probe udp4 udp_probe "$V4" udp4.txt
-
-set +x
-echo
-echo " *** Testing self traffic from $V6"
-echo
-set -x
-probe icmp6 alarm 5 ping6 -c1 "$V6"
-probe tcp6 alarm 5 nc -z "$V6" 2000
-probe udp6 udp_probe "$V6" udp6.txt
-
-set +x
-echo
-echo " *** self traffic:$RESULTS"
-echo
-if [ -n "$FAILED" ]
-then
-    echo "self traffic failed:$FAILED" >&2
-    exit 1
-fi
@@ -47,19 +47,6 @@ HOST2_IP="$PREFIX.3"
 HOST3_IP="$PREFIX.4"
 HOST4_IP="$PREFIX.5"

-if [ "$SMOKE_OVERLAY_IPV6" ]
-then
-    LIGHTHOUSE_NIP="fd00:4242:0:0:0:ffff:c0a8:6401"
-    HOST2_NIP="fd00:4242:0:0:0:ffff:c0a8:6402"
-    HOST3_NIP="fd00:4242:0:0:0:ffff:c0a8:6403"
-    HOST4_NIP="fd00:4242:0:0:0:ffff:c0a8:6404"
-else
-    LIGHTHOUSE_NIP="192.168.100.1"
-    HOST2_NIP="192.168.100.2"
-    HOST3_NIP="192.168.100.3"
-    HOST4_NIP="192.168.100.4"
-fi
-
 # Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
 # build/lighthouse1.yml has no IPs to rewrite so it's skipped.
 for f in build/host2.yml build/host3.yml build/host4.yml; do
@@ -93,28 +80,28 @@ docker exec host3 tcpdump -i eth0 -q -w - -U 2>logs/host3.outside.log >logs/host
 docker exec host4 tcpdump -i tun0 -q -w - -U 2>logs/host4.inside.log >logs/host4.inside.pcap &
 docker exec host4 tcpdump -i eth0 -q -w - -U 2>logs/host4.outside.log >logs/host4.outside.pcap &

-docker exec host2 ncat -nklv 2000 &
-docker exec host3 ncat -nklv 2000 &
-docker exec host4 ncat -e '/usr/bin/echo helloagainfromhost4' -nkluv 4000 &
-docker exec host2 ncat -e '/usr/bin/echo host2' -nkluv 3000 &
-docker exec host3 ncat -e '/usr/bin/echo host3' -nkluv 3000 &
+docker exec host2 ncat -nklv 0.0.0.0 2000 &
+docker exec host3 ncat -nklv 0.0.0.0 2000 &
+docker exec host4 ncat -e '/usr/bin/echo helloagainfromhost4' -nkluv 0.0.0.0 4000 &
+docker exec host2 ncat -e '/usr/bin/echo host2' -nkluv 0.0.0.0 3000 &
+docker exec host3 ncat -e '/usr/bin/echo host3' -nkluv 0.0.0.0 3000 &

 set +x
 echo
 echo " *** Testing ping from lighthouse1"
 echo
 set -x
-docker exec lighthouse1 ping -c1 $HOST2_NIP
-docker exec lighthouse1 ping -c1 $HOST3_NIP
+docker exec lighthouse1 ping -c1 192.168.100.2
+docker exec lighthouse1 ping -c1 192.168.100.3

 set +x
 echo
 echo " *** Testing ping from host2"
 echo
 set -x
-docker exec host2 ping -c1 $LIGHTHOUSE_NIP
+docker exec host2 ping -c1 192.168.100.1
 # Should fail because not allowed by host3 inbound firewall
-! docker exec host2 ping -c1 $HOST3_NIP -w5 || exit 1
+! docker exec host2 ping -c1 192.168.100.3 -w5 || exit 1

 set +x
 echo
@@ -122,34 +109,34 @@ echo " *** Testing ncat from host2"
 echo
 set -x
 # Should fail because not allowed by host3 inbound firewall
-! docker exec host2 ncat -nzv -w5 $HOST3_NIP 2000 || exit 1
-! docker exec host2 ncat -nzuv -w5 $HOST3_NIP 3000 | grep -q host3 || exit 1
+! docker exec host2 ncat -nzv -w5 192.168.100.3 2000 || exit 1
+! docker exec host2 ncat -nzuv -w5 192.168.100.3 3000 | grep -q host3 || exit 1

 set +x
 echo
 echo " *** Testing ping from host3"
 echo
 set -x
-docker exec host3 ping -c1 $LIGHTHOUSE_NIP
-docker exec host3 ping -c1 $HOST2_NIP
+docker exec host3 ping -c1 192.168.100.1
+docker exec host3 ping -c1 192.168.100.2

 set +x
 echo
 echo " *** Testing ncat from host3"
 echo
 set -x
-docker exec host3 ncat -nzv -w5 $HOST2_NIP 2000
-docker exec host3 ncat -nzuv -w5 $HOST2_NIP 3000 | grep -q host2
+docker exec host3 ncat -nzv -w5 192.168.100.2 2000
+docker exec host3 ncat -nzuv -w5 192.168.100.2 3000 | grep -q host2

 set +x
 echo
 echo " *** Testing ping from host4"
 echo
 set -x
-docker exec host4 ping -c1 $LIGHTHOUSE_NIP
+docker exec host4 ping -c1 192.168.100.1
 # Should fail because not allowed by host4 outbound firewall
-! docker exec host4 ping -c1 $HOST2_NIP -w5 || exit 1
-! docker exec host4 ping -c1 $HOST3_NIP -w5 || exit 1
+! docker exec host4 ping -c1 192.168.100.2 -w5 || exit 1
+! docker exec host4 ping -c1 192.168.100.3 -w5 || exit 1

 set +x
 echo
@@ -157,10 +144,10 @@ echo " *** Testing ncat from host4"
 echo
 set -x
 # Should fail because not allowed by host4 outbound firewall
-! docker exec host4 ncat -nzv -w5 $HOST2_NIP 2000 || exit 1
-! docker exec host4 ncat -nzv -w5 $HOST3_NIP 2000 || exit 1
-! docker exec host4 ncat -nzuv -w5 $HOST2_NIP 3000 | grep -q host2 || exit 1
-! docker exec host4 ncat -nzuv -w5 $HOST3_NIP 3000 | grep -q host3 || exit 1
+! docker exec host4 ncat -nzv -w5 192.168.100.2 2000 || exit 1
+! docker exec host4 ncat -nzv -w5 192.168.100.3 2000 || exit 1
+! docker exec host4 ncat -nzuv -w5 192.168.100.2 3000 | grep -q host2 || exit 1
+! docker exec host4 ncat -nzuv -w5 192.168.100.3 3000 | grep -q host3 || exit 1

 set +x
 echo
@@ -172,7 +159,7 @@ set -x
 # cannot initiate UDP to host2. Once host2 initiates a flow to host4:4000,
 # conntrack must let host4's listener reply on that flow. If it doesn't,
 # the echo back from host4 never reaches host2.
-docker exec host2 sh -c "(/usr/bin/echo host2; sleep 2) | ncat -nuv $HOST4_NIP 4000" | grep -q helloagainfromhost4
+docker exec host2 sh -c "(/usr/bin/echo host2; sleep 2) | ncat -nuv 192.168.100.4 4000" | grep -q helloagainfromhost4

 docker exec host4 sh -c 'kill 1'
 docker exec host3 sh -c 'kill 1'
@@ -13,28 +13,20 @@ on:
      - 'go.sum'
 jobs:

-  static:
-    name: Static checks
+  test-linux:
+    name: Build all and test on ubuntu-linux
    runs-on: ubuntu-latest
    steps:

-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6

-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true

-    - name: Install goimports
-      run: go install golang.org/x/tools/cmd/goimports@latest
-
-    - name: gofmt
-      run: |
-        if [ "$(find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -l)" ]
-        then
-          find . -iname '*.go' | grep -v '\.pb\.go$' | xargs goimports -d
-          exit 1
-        fi
+    - name: Build
+      run: make all

    - name: Vet
      run: make vet
@@ -42,114 +34,99 @@ jobs:
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v9
      with:
-        version: v2.12
+        version: v2.5

-  test:
-    name: Test ${{ matrix.name }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - name: linux
-          os: ubuntu-latest
-          build-cmd: go build ./cmd/nebula ./cmd/nebula-cert
-          test-cmd: make test
-          e2e-cmd: make e2evv
-        - name: linux-boringcrypto
-          os: ubuntu-latest
-          build-cmd: make boringcrypto
-          test-cmd: make boringcrypto test
-          e2e-cmd: make boringcrypto e2evv
-        - name: linux-fips140
-          os: ubuntu-latest
-          build-cmd: make fips140-all
-          test-cmd: make fips140-all GOALS=test
-          e2e-cmd: make fips140-all GOALS=e2evv
-        - name: linux-pkcs11
-          os: ubuntu-latest
-          build-cmd: make bin-pkcs11
-          test-cmd: make test-pkcs11
-          e2e-cmd: ''
-        - name: macos
-          os: macos-latest
-          build-cmd: go build ./cmd/nebula ./cmd/nebula-cert
-          test-cmd: make test
-          e2e-cmd: make e2evv
-        - name: windows
-          os: windows-latest
-          build-cmd: go build ./cmd/nebula ./cmd/nebula-cert
-          test-cmd: make test
-          e2e-cmd: make e2evv
+    - name: Test
+      run: make test
+
+    - name: End 2 end
+      run: make e2evv
+
+    - name: Build test mobile
+      run: make build-test-mobile
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: e2e packet flow linux-latest
+        path: e2e/mermaid/linux-latest
+        if-no-files-found: warn
+
+  test-linux-boringcrypto:
+    name: Build and test on linux with boringcrypto
+    runs-on: ubuntu-latest
    steps:

-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6

-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true

    - name: Build
-      run: ${{ matrix.build-cmd }}
-
-    - name: Cross-build darwin-amd64
-      if: matrix.name == 'macos'
-      run: GOARCH=amd64 go build -o /tmp/nebula-amd64 ./cmd/nebula && GOARCH=amd64 go build -o /tmp/nebula-cert-amd64 ./cmd/nebula-cert
+      run: make bin-boringcrypto

    - name: Test
-      run: ${{ matrix.test-cmd }}
+      run: make test-boringcrypto

    - name: End 2 end
-      if: matrix.e2e-cmd != ''
-      run: ${{ matrix.e2e-cmd }}
+      run: make e2e GOEXPERIMENT=boringcrypto CGO_ENABLED=1 TEST_ENV="TEST_LOGS=1" TEST_FLAGS="-v -ldflags -checklinkname=0"

-    - uses: actions/upload-artifact@v7
-      if: matrix.e2e-cmd != '' && always()
-      with:
-        name: e2e packet flow ${{ matrix.name }}
-        path: e2e/mermaid/
-        if-no-files-found: warn
-
-  cross-build:
-    name: Cross-build ${{ matrix.name }}
+  test-linux-pkcs11:
+    name: Build and test on linux with pkcs11
    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - {name: linux-arm,   make-target: all-cross-linux-arm}
-        - {name: linux-mips,  make-target: all-cross-linux-mips}
-        - {name: linux-other, make-target: all-cross-linux-other}
-        - {name: freebsd,     make-target: all-freebsd}
-        - {name: openbsd,     make-target: all-openbsd}
-        - {name: netbsd,      make-target: all-netbsd}
-        - {name: windows,     make-target: all-cross-windows}
-        - {name: mobile,      make-target: build-test-mobile}
    steps:

-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v6

-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@v6
      with:
-        go-version: '1.26'
+        go-version: '1.25'
        check-latest: true

-    - name: Build ${{ matrix.name }}
-      run: make -j"$(nproc)" ${{ matrix.make-target }}
+    - name: Build
+      run: make bin-pkcs11

-  finish:
-    name: CI status
-    if: always()
-    needs: [static, test, cross-build]
-    runs-on: ubuntu-latest
+    - name: Test
+      run: make test-pkcs11
+
+  test:
+    name: Build and test on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [windows-latest, macos-latest]
    steps:

-    - name: Fail if any upstream job failed
-      if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
-      run: |
-        echo "upstream results: ${{ toJSON(needs) }}"
-        exit 1
+    - uses: actions/checkout@v6

-    - name: All upstream jobs passed
-      run: echo "ok"
+    - uses: actions/setup-go@v6
+      with:
+        go-version: '1.25'
+        check-latest: true
+
+    - name: Build nebula
+      run: go build ./cmd/nebula
+
+    - name: Build nebula-cert
+      run: go build ./cmd/nebula-cert
+
+    - name: Vet
+      run: make vet
+
+    - name: golangci-lint
+      uses: golangci/golangci-lint-action@v9
+      with:
+        version: v2.5
+
+    - name: Test
+      run: make test
+
+    - name: End 2 end
+      run: make e2evv
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: e2e packet flow ${{ matrix.os }}
+        path: e2e/mermaid/${{ matrix.os }}
+        if-no-files-found: warn
@@ -7,102 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

-### Changed
-
- IPv6 packets whose next header is a protocol Nebula does not parse (SCTP, GRE, IP-in-IP, etc.) are now
-  classified as that protocol with no ports, closing a firewall bypass where a crafted payload could steer
-  the classifier into reading one as TCP/UDP and matching a TCP/UDP rule. These packets are now matched as
-  their true protocol, so only a `proto: any` rule allows them. If you carry one of these protocols over the
-  overlay, confirm a `proto: any` rule covers it before upgrading, it may have been passing only through this
-  bypass. (#1840)
-
-### Fixed
-
- The ICMPv6 type was read from the wrong byte when classifying IPv6 packets, so the echo identifier used
-  for conntrack was never picked up. (#1840)
-
-## [1.11.0] - 2026-07-23
-
-See the [v1.11.0](https://github.com/slackhq/nebula/milestone/25?closed=1) milestone for a complete list of changes.
-
-### Breaking
-
- Logging has switched from logrus to Go's structured `slog`. Log output changes: levels are upper case
-  (`level=INFO`), trace prints as `level=DEBUG-4`, timestamps are always RFC3339Nano and `logging.timestamp_format`
-  is ignored, and some messages were reworded. Review any log parsing before upgrading. This is also an API break
-  for embedders, as constructors now take a `*slog.Logger`. (#1672, #1734, #1621)
- `firewall.inbound_action` and `firewall.outbound_action` (used to set reject vs. drop policy) were each being
-  applied to the opposite direction, that is now corrected. This only affects how blocked packets are answered, not
-  which packets the firewall allows or denies. If you set either of these you are getting the behavior of the other
-  one today and likely want to swap them before upgrading. (#1798)
- On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and the listener port by default. WFP
-  sits below Windows Defender Firewall, so any WDF inbound rules you rely on for either will no longer apply. Set
-  `tun.windows_bypass_wdf` and `listen.windows_bypass_wdf` to false to leave WDF in charge. (#1710)
- On Windows, the nebula device is now set to the `private` network category instead of whatever Windows decided,
-  which is usually `Public`. This makes the host firewall less restrictive on the overlay. Set
-  `tun.network_category` to `unset` to keep the old behavior. (#1710)
- Reject packets for non-TCP now use ICMP code 13, communication administratively prohibited, instead of code 3,
-  port unreachable. Anything keying off the old code needs updating. (#1766, #1768)
- The SSH debug server's profiling commands are now confined to `sshd.sandbox_dir`, which defaults to
-  `$TMP/nebula-debug`. Relative paths resolve inside it and absolute paths outside it are rejected, so anything
-  scripting `start-cpu-profile`, `save-heap-profile`, or `save-mutex-profile` with a path elsewhere needs the
-  directory set. The directory is not created for you. (#1622)
-
-### Added
-
- Sign the Windows release binaries. (#1718)
- Generate IPv6 reject packets, matching the existing IPv4 behavior. (#1766, #1767, #1768)
- Accept `-` in `nebula-cert` to read from stdin or write to stdout. (#1714)
- Search for both `config.yml` and `config.yaml` in service and command line modes. (#1717)
- Add version labels to the Docker/OCI images. (#1772)
- Rebind the listener and re-query lighthouses on macOS when the underlay network changes, so devices moving
-  between wifi and wired or between networks recover without waiting for dead tunnel detection. Controlled by
-  `listen.rebind_on_network_change` (default `true`, not reloadable). (#1816)
-
-### Changed
-
- Reload the firewall when the unsafe networks in the certificate change. (#1719)
- Reconfigure, start, and stop the stats listener on a config reload instead of requiring a restart. (#1670)
- Update a static host's addresses when they change on reload. (#1713)
- Don't require a port on ICMP firewall rules. (#1609)
- Connection track ICMP traffic. (#1602)
- Return `NODATA` instead of `NXDOMAIN` from the DNS server for a name that exists but has no record of the
-  requested type, so clients that query `AAAA` first (busybox/Alpine) fall through to `A`. (#1668)
- Record the local host's details in the DNS server. (#1716)
- Install Windows unsafe routes as link routes. (#1709)
- Reduce relay handshake log spam, and only log a handshake send error at error level when the remote list
-  changes. (#1733, #1765, #1810)
- Start, stop, and reload subsystems (DNS, stats, conntrack, ssh, punchy) cleanly without leaking goroutines. (#1640, #1654, #1661, #1667, #1669, #1708, #1806, #1815)
- `Control` is now safe to stop and wait on from any lifecycle state, and a new `Control.Wait` blocks until nebula
-  has fully stopped and returns the first fatal reader error. Failed starts release the udp sockets and tun fd
-  instead of leaking them. (#1794)
- Trigger an immediate lighthouse update when reconnecting to or adding a lighthouse instead of waiting for the next update tick. (#1645)
- Bring the Darwin and OpenBSD tun implementations in line with the other BSDs. (#1703)
- Update to build against go v1.26. (#1818)
- Various dependency updates. (#1586, #1587, #1604, #1617, #1618, #1627, #1628, #1629, #1652, #1664, #1665, #1697, #1721, #1732, #1742, #1743, #1750, #1763, #1771, #1782, #1800, #1807)
-
-### Fixed
-
- Fix a data race on a host's remote address that could send packets to the wrong address during a roam. (#1773)
- Fix tunnels that could permanently escape connection manager monitoring. (#1752)
- Fix a crash when reloading the SSH server's trusted keys. (#1787)
- Fix hostmap corruption when a host has multiple overlay addresses. Each address now gets its own list instead of
-  a single shared chain, which also fixes two latent bugs on the add and makePrimary paths. (#1788, #1790)
- Apply `remote_allow_list` IPv4 rules to 4-in-6 mapped addresses. (#1786)
- Don't panic in the DNS server on a short or empty query name. (#1635)
- Advance the replay window on relayed packets so a relay drops replayed frames instead of re-forwarding them. (#1751)
- Fix a race in relay state handling. (#1753)
- Lock replay window updates so concurrent readers can't corrupt it. (#1802)
- Reject malformed handshakes more reliably, including invalid ed25519 key lengths. (#1601, #1756)
- Properly handle `closetunnel` packets. (#1638)
- Fix an IPv6 extension-header length overflow that could make the firewall parse the wrong protocol and ports. (#1789)
- Fix relay re-establishment when a handshake arrives over a relay entry that a one-sided teardown left
-  `Disestablished`, which silently dropped every send until dead tunnel detection forced a re-handshake. (#1805)
- Don't build new relay state on a tunnel that was just discarded. (#1796)
- Don't delete the wrong pending hostinfo in the handshake manager. (#1811)
- Don't call the packet reader after a UDP error on Darwin. (#1755)
- Open the FreeBSD tun device non blocking. (#1666)
-
 ## [1.10.3] - 2026-02-06

 ### Security
@@ -60,29 +60,6 @@ ALL = $(ALL_LINUX) \
 	windows-amd64 \
 	windows-arm64

-# Cross-build shards used by .github/workflows/test.yml — same as ALL_*
-# but with the arch that has a native CI runner removed, so the cross-build
-# job is not duplicating coverage the native test jobs already give.
-ALL_CROSS_LINUX = $(filter-out linux-amd64,$(ALL_LINUX))
-
-# ALL_CROSS_LINUX further split into family sub-shards so each can run on
-# its own CI runner in parallel. Union of the three must equal
-# ALL_CROSS_LINUX; adding a new linux arch goes into the matching family.
-ALL_CROSS_LINUX_ARM   = linux-arm-5 linux-arm-6 linux-arm-7 linux-arm64
-ALL_CROSS_LINUX_MIPS  = linux-mips linux-mipsle linux-mips64 linux-mips64le linux-mips-softfloat
-ALL_CROSS_LINUX_OTHER = linux-386 linux-ppc64le linux-riscv64 linux-loong64
-
-# Based on section 2.2 of the Go Cryptographic Module CVMP Security Policy #5247
-ALL_FIPS140 = linux-amd64-fips140 \
-	linux-arm64-fips140 \
-	windows-amd64-fips140 \
-	windows-arm64-fips140 \
-	darwin-arm64-fips140 \
-	freebsd-amd64-fips140 \
-	linux-arm-7-fips140 \
-	linux-mips64-fips140 \
-	linux-ppc64le-fips140
-
 e2e:
 	$(TEST_ENV) go test -tags=e2e_testing -count=1 $(TEST_FLAGS) ./e2e

@@ -105,35 +82,6 @@ DOCKER_BIN = build/linux-amd64/nebula build/linux-amd64/nebula-cert

 all: $(ALL:%=build/%/nebula) $(ALL:%=build/%/nebula-cert)

-all-linux: $(ALL_LINUX:%=build/%/nebula) $(ALL_LINUX:%=build/%/nebula-cert)
-
-all-freebsd: $(ALL_FREEBSD:%=build/%/nebula) $(ALL_FREEBSD:%=build/%/nebula-cert)
-
-all-openbsd: $(ALL_OPENBSD:%=build/%/nebula) $(ALL_OPENBSD:%=build/%/nebula-cert)
-
-all-netbsd: $(ALL_NETBSD:%=build/%/nebula) $(ALL_NETBSD:%=build/%/nebula-cert)
-
-all-darwin: build/darwin-amd64/nebula build/darwin-amd64/nebula-cert build/darwin-arm64/nebula build/darwin-arm64/nebula-cert
-
-all-windows: build/windows-amd64/nebula.exe build/windows-amd64/nebula-cert.exe build/windows-arm64/nebula.exe build/windows-arm64/nebula-cert.exe
-
-# CI cross-build shards. darwin-arm64 is covered by the native macos-latest
-# job; windows-amd64 is covered by the native windows-latest job; both are
-# omitted here to avoid building them a second time. darwin-amd64 stays in
-# all-cross-darwin because intel mac is only a labeled/master-time native
-# job, so PRs still need cross-build coverage for it.
-all-cross-linux: $(ALL_CROSS_LINUX:%=build/%/nebula) $(ALL_CROSS_LINUX:%=build/%/nebula-cert)
-
-all-cross-linux-arm:   $(ALL_CROSS_LINUX_ARM:%=build/%/nebula)   $(ALL_CROSS_LINUX_ARM:%=build/%/nebula-cert)
-
-all-cross-linux-mips:  $(ALL_CROSS_LINUX_MIPS:%=build/%/nebula)  $(ALL_CROSS_LINUX_MIPS:%=build/%/nebula-cert)
-
-all-cross-linux-other: $(ALL_CROSS_LINUX_OTHER:%=build/%/nebula) $(ALL_CROSS_LINUX_OTHER:%=build/%/nebula-cert)
-
-all-cross-darwin: build/darwin-amd64/nebula build/darwin-amd64/nebula-cert
-
-all-cross-windows: build/windows-arm64/nebula.exe build/windows-arm64/nebula-cert.exe
-
 docker: docker/linux-$(shell go env GOARCH)

 release: $(ALL:%=build/nebula-%.tar.gz)
@@ -148,8 +96,6 @@ release-netbsd: $(ALL_NETBSD:%=build/nebula-%.tar.gz)

 release-boringcrypto: build/nebula-linux-$(shell go env GOARCH)-boringcrypto.tar.gz

-release-fips140: $(ALL_FIPS140:%=build/nebula-%.tar.gz)
-
 BUILD_ARGS += -trimpath

 bin-windows: build/windows-amd64/nebula.exe build/windows-amd64/nebula-cert.exe
@@ -170,24 +116,17 @@ bin-freebsd-arm64: build/freebsd-arm64/nebula build/freebsd-arm64/nebula-cert
 bin-boringcrypto: build/linux-$(shell go env GOARCH)-boringcrypto/nebula build/linux-$(shell go env GOARCH)-boringcrypto/nebula-cert
 	mv $? .

-bin-fips140: build/linux-$(shell go env GOARCH)-fips140/nebula build/linux-$(shell go env GOARCH)-fips140/nebula-cert
-	mv $? .
-
 bin-pkcs11: BUILD_ARGS += -tags pkcs11
 bin-pkcs11: CGO_ENABLED = 1
 bin-pkcs11: bin

-# Build with the pprof debug server (serves on :6060). See startPprofServer.
-debug: BUILD_ARGS += -tags debug
-debug: bin
-
 bin:
-	$(GOENV) go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula${NEBULA_CMD_SUFFIX} ${NEBULA_CMD_PATH}
-	$(GOENV) go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula-cert${NEBULA_CMD_SUFFIX} ./cmd/nebula-cert
+	go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula${NEBULA_CMD_SUFFIX} ${NEBULA_CMD_PATH}
+	go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula-cert${NEBULA_CMD_SUFFIX} ./cmd/nebula-cert

 install:
-	$(GOENV) go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ${NEBULA_CMD_PATH}
-	$(GOENV) go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ./cmd/nebula-cert
+	go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ${NEBULA_CMD_PATH}
+	go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ./cmd/nebula-cert

 build/linux-arm-%: GOENV += GOARM=$(word 3, $(subst -, ,$*))
 build/linux-mips-%: GOENV += GOMIPS=$(word 3, $(subst -, ,$*))
@@ -198,11 +137,8 @@ build/linux-mips-softfloat/%: LDFLAGS += -s -w
 # boringcrypto
 build/linux-amd64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1
 build/linux-arm64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1
-
-# fips140
-FIPSVERSION = v1.0.0
-$(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): GOENV += GOFIPS140=$(FIPSVERSION)
-$(foreach _rule, $(ALL_FIPS140), build/$(_rule)/%): BUILD_ARGS += -tags fips140enforce
+build/linux-amd64-boringcrypto/%: LDFLAGS += -checklinkname=0
+build/linux-arm64-boringcrypto/%: LDFLAGS += -checklinkname=0

 build/%/nebula: .FORCE
 	GOOS=$(firstword $(subst -, , $*)) \
@@ -233,7 +169,10 @@ vet:
 	go vet $(VET_FLAGS) -v ./...

 test:
-	$(TEST_ENV) go test $(TEST_FLAGS) -v ./...
+	go test -v ./...
+
+test-boringcrypto:
+	GOEXPERIMENT=boringcrypto CGO_ENABLED=1 go test -ldflags "-checklinkname=0" -v ./...

 test-pkcs11:
 	CGO_ENABLED=1 go test -v -tags pkcs11 ./...
@@ -276,75 +215,26 @@ ifeq ($(words $(MAKECMDGOALS)),1)
 	@$(MAKE) service ${.DEFAULT_GOAL} --no-print-directory
 endif

-# Useful to chain together, like:
-# - make fips140 e2evv
-# - make fips140 smoke-docker
-# Use `release-fips140` to build release binaries
-fips140:
-	@echo > $(NULL_FILE)
-ifeq ($(strip $(GOFIPS140)),)
-	$(eval GOFIPS140 = $(FIPSVERSION))
-endif
-	$(eval GOENV += GOFIPS140=$(GOFIPS140))
-	$(eval BUILD_ARGS += -tags fips140enforce)
-	$(eval TEST_ENV += $(GOENV))
-	$(eval CURVE = P256)
-ifeq ($(words $(MAKECMDGOALS)),1)
-	@$(MAKE) fips140 GOFIPS140=$(GOFIPS140) ${.DEFAULT_GOAL} --no-print-directory
-endif
-
-# To test the future pending module, use like `make fips140-latest test`
-ALL_GOFIPS140 = v1.0.0 v1.26.0 latest
-define FIPS140_rule
-fips140-$(1): GOFIPS140 = $(1)
-fips140-$(1): fips140
-endef
-$(foreach _rule, $(ALL_GOFIPS140), $(eval $(call FIPS140_rule,$(_rule))))
-
-# Iterate and run the goals for all fips versions, like `make fips140-all GOALS=test`
-fips140-all:
-	@$(foreach _v,$(ALL_GOFIPS140),$(MAKE) fips140-$(_v) $(GOALS) &&) true
-
-# Useful to chain together, like:
-# - make boringcrypto e2evv
-# - make boringcrypto smoke-docker
-# Use `release-boringcrypto` or `bin-boringcrypto` to build release binaries
-boringcrypto:
-	@echo > $(NULL_FILE)
-	$(eval GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1)
-	$(eval TEST_ENV += $(GOENV))
-	$(eval CURVE = P256)
-ifeq ($(words $(MAKECMDGOALS)),1)
-	@$(MAKE) boringcrypto ${.DEFAULT_GOAL} --no-print-directory
-endif
-
 bin-docker: bin build/linux-amd64/nebula build/linux-amd64/nebula-cert

-smoke-docker: BUILD_ARGS += -race
-smoke-docker: GOENV += CGO_ENABLED=1
 smoke-docker: bin-docker
-	# This is so we can limit `fips140` smoke test to just P256 curve.
-	if [ "$(CURVE)" != "P256" ]; then cd .github/workflows/smoke/ && $(GOENV) ./build.sh; fi
-	if [ "$(CURVE)" != "P256" ]; then cd .github/workflows/smoke/ && $(GOENV) ./smoke.sh; fi
-	cd .github/workflows/smoke/ && $(GOENV) NAME="smoke-p256" CURVE="P256" ./build.sh
-	cd .github/workflows/smoke/ && $(GOENV) NAME="smoke-p256" ./smoke.sh
+	cd .github/workflows/smoke/ && ./build.sh
+	cd .github/workflows/smoke/ && ./smoke.sh
+	cd .github/workflows/smoke/ && NAME="smoke-p256" CURVE="P256" ./build.sh
+	cd .github/workflows/smoke/ && NAME="smoke-p256" ./smoke.sh

-smoke-relay-docker: BUILD_ARGS += -race
-smoke-relay-docker: GOENV += CGO_ENABLED=1
 smoke-relay-docker: bin-docker
-	cd .github/workflows/smoke/ && $(GOENV) ./build-relay.sh
-	cd .github/workflows/smoke/ && $(GOENV) ./smoke-relay.sh
+	cd .github/workflows/smoke/ && ./build-relay.sh
+	cd .github/workflows/smoke/ && ./smoke-relay.sh

-smoke-docker-ipv6: export SMOKE_OVERLAY_IPV6 = 1
-smoke-docker-ipv6: smoke-docker
-
-smoke-self: bin
-	cd .github/workflows/smoke/ && ./smoke-self.sh
+smoke-docker-race: BUILD_ARGS = -race
+smoke-docker-race: CGO_ENABLED = 1
+smoke-docker-race: smoke-docker

 smoke-vagrant/%: bin-docker build/%/nebula
 	cd .github/workflows/smoke/ && ./build.sh $*
 	cd .github/workflows/smoke/ && ./smoke-vagrant.sh $*

 .FORCE:
-.PHONY: all all-linux all-freebsd all-openbsd all-netbsd all-darwin all-windows all-cross-linux all-cross-linux-arm all-cross-linux-mips all-cross-linux-other all-cross-darwin all-cross-windows bench bench-cpu bench-cpu-long bin bin-windows bin-windows-arm64 bin-darwin bin-freebsd bin-freebsd-arm64 bin-boringcrypto bin-fips140 bin-pkcs11 bin-docker boringcrypto build-test-mobile debug docker e2e e2ev e2evv e2evvv e2evvvv e2e-bench fips140 fips140-all $(ALL_GOFIPS140:%=fips140-%) install proto release release-linux release-freebsd release-openbsd release-netbsd release-boringcrypto release-fips140 service smoke-docker smoke-relay-docker smoke-docker-ipv6 smoke-self test test-pkcs11 test-cov-html vet smoke-vagrant/%
+.PHONY: bench bench-cpu bench-cpu-long bin build-test-mobile e2e e2ev e2evv e2evvv e2evvvv proto release service smoke-docker smoke-docker-race test test-cov-html smoke-vagrant/%
 .DEFAULT_GOAL := bin
@@ -145,27 +145,17 @@ To build nebula for a specific platform (ex, Windows):

 See the [Makefile](Makefile) for more details on build targets

-## Curve P256 and FIPS 140-3 mode
+## Curve P256 and BoringCrypto

 The default curve used for cryptographic handshakes and signatures is Curve25519. This is the recommended setting for most users. If your deployment has certain compliance requirements, you have the option of creating your CA using `nebula-cert ca -curve P256` to use NIST Curve P256. The CA will then sign certificates using ECDSA P256, and any hosts using these certificates will use P256 for ECDH handshakes.

-Nebula can be built to support the [FIPS 140-3](https://go.dev/doc/security/fips140) mode of Go by running either of the following make targets. (This sets GOFIPS140=v1.0.0, which must be done at compile time so that the correct AES-GCM can be used for FIPS 140-3 enforcement mode).
-
-```sh
-make fips140
-make fips140 test
-make release-fips140
-```
-
-Nebula can also be built using the [BoringCrypto GOEXPERIMENT](https://github.com/golang/go/blob/go1.20/src/crypto/internal/boring/README.md) by running either of the following make targets.
+In addition, Nebula can be built using the [BoringCrypto GOEXPERIMENT](https://github.com/golang/go/blob/go1.20/src/crypto/internal/boring/README.md) by running either of the following make targets:

 ```sh
 make bin-boringcrypto
 make release-boringcrypto
 ```

-NOTE: boringcrypto support is deprecated and will be removed in the next release. Users should migrate to the native FIPS 140-3 mode described above.
-
 This is not the recommended default deployment, but may be useful based on your compliance requirements.

 ## Credits
@@ -13,12 +13,6 @@ import (
 	"golang.org/x/crypto/ed25519"
 )

-// testCertNow is the reference "now" used to derive default before/after times
-// in NewTestCaCert and NewTestCert. Holding it fixed for the lifetime of the
-// test binary keeps CA and leaf defaults aligned at the same second, so a leaf
-// signed with default times can never expire after its CA on a rounding race.
-var testCertNow = time.Now().Round(time.Second)
-
 // NewTestCaCert will create a new ca certificate
 func NewTestCaCert(version Version, curve Curve, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (Certificate, []byte, []byte, []byte) {
 	var err error
@@ -40,10 +34,10 @@ func NewTestCaCert(version Version, curve Curve, before, after time.Time, networ
 	}

 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}
 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}

 	t := &TBSCertificate{
@@ -76,11 +70,11 @@ func NewTestCaCert(version Version, curve Curve, before, after time.Time, networ
 // Expiry times are defaulted if you do not pass them in
 func NewTestCert(v Version, curve Curve, ca Certificate, key []byte, name string, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (Certificate, []byte, []byte, []byte) {
 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}

 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}

 	if len(networks) == 0 {
@@ -148,9 +148,6 @@ func MarshalSigningPublicKeyToPEM(curve Curve, b []byte) []byte {
 	}
 }

-// UnmarshalPublicKeyFromPEM will try to unmarshal the first pem block in a byte array, returning any non
-// consumed data or an error on failure. Only key-agreement (ECDH) public key banners are accepted.
-// Use UnmarshalSigningPublicKeyFromPEM for Ed25519/ECDSA banners.
 func UnmarshalPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	k, r := pem.Decode(b)
 	if k == nil {
@@ -159,10 +156,10 @@ func UnmarshalPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	var expectedLen int
 	var curve Curve
 	switch k.Type {
-	case X25519PublicKeyBanner:
+	case X25519PublicKeyBanner, Ed25519PublicKeyBanner:
 		expectedLen = 32
 		curve = Curve_CURVE25519
-	case P256PublicKeyBanner:
+	case P256PublicKeyBanner, ECDSAP256PublicKeyBanner:
 		// Uncompressed
 		expectedLen = 65
 		curve = Curve_P256
@@ -175,33 +172,6 @@ func UnmarshalPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
 	return k.Bytes, r, curve, nil
 }

-// UnmarshalSigningPublicKeyFromPEM will try to unmarshal the first pem block in a byte array, returning any non
-// consumed data or an error on failure. Only Ed25519/ECDSA public key banners are accepted.
-// Use UnmarshalPublicKeyFromPEM for X25519/P256 (ECDH) banners.
-func UnmarshalSigningPublicKeyFromPEM(b []byte) ([]byte, []byte, Curve, error) {
-	k, r := pem.Decode(b)
-	if k == nil {
-		return nil, r, 0, fmt.Errorf("input did not contain a valid PEM encoded block")
-	}
-	var expectedLen int
-	var curve Curve
-	switch k.Type {
-	case Ed25519PublicKeyBanner:
-		expectedLen = 32
-		curve = Curve_CURVE25519
-	case ECDSAP256PublicKeyBanner:
-		// Uncompressed
-		expectedLen = 65
-		curve = Curve_P256
-	default:
-		return nil, r, 0, fmt.Errorf("bytes did not contain a proper Ed25519/ECDSA public key banner")
-	}
-	if len(k.Bytes) != expectedLen {
-		return nil, r, 0, fmt.Errorf("key was not %d bytes, is invalid %s public key", expectedLen, curve)
-	}
-	return k.Bytes, r, curve, nil
-}
-
 func MarshalPrivateKeyToPEM(curve Curve, b []byte) []byte {
 	switch curve {
 	case Curve_CURVE25519:
@@ -255,6 +255,60 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 func TestUnmarshalPublicKeyFromPEM(t *testing.T) {
 	t.Parallel()
 	pubKey := []byte(`# A good key
+-----BEGIN NEBULA ED25519 PUBLIC KEY-----
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+-----END NEBULA ED25519 PUBLIC KEY-----
+`)
+	shortKey := []byte(`# A short key
+-----BEGIN NEBULA ED25519 PUBLIC KEY-----
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
+-----END NEBULA ED25519 PUBLIC KEY-----
+`)
+	invalidBanner := []byte(`# Invalid banner
+-----BEGIN NOT A NEBULA PUBLIC KEY-----
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+-----END NOT A NEBULA PUBLIC KEY-----
+`)
+	invalidPem := []byte(`# Not a valid PEM format
+-BEGIN NEBULA ED25519 PUBLIC KEY-----
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+-END NEBULA ED25519 PUBLIC KEY-----`)
+
+	keyBundle := appendByteSlices(pubKey, shortKey, invalidBanner, invalidPem)
+
+	// Success test case
+	k, rest, curve, err := UnmarshalPublicKeyFromPEM(keyBundle)
+	assert.Len(t, k, 32)
+	assert.Equal(t, Curve_CURVE25519, curve)
+	require.NoError(t, err)
+	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
+
+	// Fail due to short key
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
+	assert.Nil(t, k)
+	assert.Equal(t, Curve_CURVE25519, curve)
+	assert.Equal(t, rest, appendByteSlices(invalidBanner, invalidPem))
+	require.EqualError(t, err, "key was not 32 bytes, is invalid CURVE25519 public key")
+
+	// Fail due to invalid banner
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
+	assert.Nil(t, k)
+	assert.Equal(t, Curve_CURVE25519, curve)
+	require.EqualError(t, err, "bytes did not contain a proper public key banner")
+	assert.Equal(t, rest, invalidPem)
+
+	// Fail due to invalid PEM format, because
+	// it's missing the requisite pre-encapsulation boundary.
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
+	assert.Nil(t, k)
+	assert.Equal(t, Curve_CURVE25519, curve)
+	assert.Equal(t, rest, invalidPem)
+	require.EqualError(t, err, "input did not contain a valid PEM encoded block")
+}
+
+func TestUnmarshalX25519PublicKey(t *testing.T) {
+	t.Parallel()
+	pubKey := []byte(`# A good key
 -----BEGIN NEBULA X25519 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA X25519 PUBLIC KEY-----
@@ -265,7 +319,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA P256 PUBLIC KEY-----
 `)
-	signingKey := []byte(`# A signing key has the wrong scope for this function
+	oldPubP256Key := []byte(`# A good key
 -----BEGIN NEBULA ECDSA P256 PUBLIC KEY-----
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAAAAAAAAAAAAAAAAA=
@@ -286,118 +340,44 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 -END NEBULA X25519 PUBLIC KEY-----`)

-	keyBundle := appendByteSlices(pubKey, pubP256Key, signingKey, shortKey, invalidBanner, invalidPem)
+	keyBundle := appendByteSlices(pubKey, pubP256Key, oldPubP256Key, shortKey, invalidBanner, invalidPem)

-	// X25519 key
+	// Success test case
 	k, rest, curve, err := UnmarshalPublicKeyFromPEM(keyBundle)
 	assert.Len(t, k, 32)
 	require.NoError(t, err)
-	assert.Equal(t, rest, appendByteSlices(pubP256Key, signingKey, shortKey, invalidBanner, invalidPem))
+	assert.Equal(t, rest, appendByteSlices(pubP256Key, oldPubP256Key, shortKey, invalidBanner, invalidPem))
 	assert.Equal(t, Curve_CURVE25519, curve)

-	// P256 key
+	// Success test case
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Len(t, k, 65)
 	require.NoError(t, err)
-	assert.Equal(t, rest, appendByteSlices(signingKey, shortKey, invalidBanner, invalidPem))
+	assert.Equal(t, rest, appendByteSlices(oldPubP256Key, shortKey, invalidBanner, invalidPem))
 	assert.Equal(t, Curve_P256, curve)

-	// Reject a signing public key (Ed25519/ECDSA banner)
-	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
-	assert.Nil(t, k)
-	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
-	require.EqualError(t, err, "bytes did not contain a proper public key banner")
-
-	// Fail due to short key
-	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
-	assert.Nil(t, k)
-	assert.Equal(t, rest, appendByteSlices(invalidBanner, invalidPem))
-	require.EqualError(t, err, "key was not 32 bytes, is invalid CURVE25519 public key")
-
-	// Fail due to invalid banner
-	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
-	assert.Nil(t, k)
-	require.EqualError(t, err, "bytes did not contain a proper public key banner")
-	assert.Equal(t, rest, invalidPem)
-
-	// Fail due to invalid PEM format, because
-	// it's missing the requisite pre-encapsulation boundary.
-	k, rest, _, err = UnmarshalPublicKeyFromPEM(rest)
-	assert.Nil(t, k)
-	assert.Equal(t, rest, invalidPem)
-	require.EqualError(t, err, "input did not contain a valid PEM encoded block")
-}
-
-func TestUnmarshalSigningPublicKeyFromPEM(t *testing.T) {
-	t.Parallel()
-	pubKey := []byte(`# A good key
-----BEGIN NEBULA ED25519 PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-----END NEBULA ED25519 PUBLIC KEY-----
-`)
-	pubP256Key := []byte(`# A good key
-----BEGIN NEBULA ECDSA P256 PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAA=
-----END NEBULA ECDSA P256 PUBLIC KEY-----
-`)
-	ecdhKey := []byte(`# A key-agreement key has the wrong scope for this function
-----BEGIN NEBULA X25519 PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-----END NEBULA X25519 PUBLIC KEY-----
-`)
-	shortKey := []byte(`# A short key
-----BEGIN NEBULA ED25519 PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-----END NEBULA ED25519 PUBLIC KEY-----
-`)
-	invalidBanner := []byte(`# Invalid banner
-----BEGIN NOT A NEBULA PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-----END NOT A NEBULA PUBLIC KEY-----
-`)
-	invalidPem := []byte(`# Not a valid PEM format
-BEGIN NEBULA ED25519 PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-END NEBULA ED25519 PUBLIC KEY-----`)
-
-	keyBundle := appendByteSlices(pubKey, pubP256Key, ecdhKey, shortKey, invalidBanner, invalidPem)
-
-	// Ed25519 key
-	k, rest, curve, err := UnmarshalSigningPublicKeyFromPEM(keyBundle)
-	assert.Len(t, k, 32)
-	require.NoError(t, err)
-	assert.Equal(t, rest, appendByteSlices(pubP256Key, ecdhKey, shortKey, invalidBanner, invalidPem))
-	assert.Equal(t, Curve_CURVE25519, curve)
-
-	// ECDSA P256 key
-	k, rest, curve, err = UnmarshalSigningPublicKeyFromPEM(rest)
+	// Success test case
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Len(t, k, 65)
 	require.NoError(t, err)
-	assert.Equal(t, rest, appendByteSlices(ecdhKey, shortKey, invalidBanner, invalidPem))
+	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
 	assert.Equal(t, Curve_P256, curve)

-	// Reject a key-agreement public key (X25519/P256 banner)
-	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
-	assert.Nil(t, k)
-	assert.Equal(t, rest, appendByteSlices(shortKey, invalidBanner, invalidPem))
-	require.EqualError(t, err, "bytes did not contain a proper Ed25519/ECDSA public key banner")
-
 	// Fail due to short key
-	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, appendByteSlices(invalidBanner, invalidPem))
 	require.EqualError(t, err, "key was not 32 bytes, is invalid CURVE25519 public key")

 	// Fail due to invalid banner
-	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
-	require.EqualError(t, err, "bytes did not contain a proper Ed25519/ECDSA public key banner")
+	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)

 	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
-	k, rest, _, err = UnmarshalSigningPublicKeyFromPEM(rest)
+	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "input did not contain a valid PEM encoded block")
@@ -14,12 +14,6 @@ import (
 	"golang.org/x/crypto/ed25519"
 )

-// testCertNow is the reference "now" used to derive default before/after times
-// in NewTestCaCert and NewTestCert. Holding it fixed for the lifetime of the
-// test binary keeps CA and leaf defaults aligned at the same second, so a leaf
-// signed with default times can never expire after its CA on a rounding race.
-var testCertNow = time.Now().Round(time.Second)
-
 // NewTestCaCert will create a new ca certificate
 func NewTestCaCert(version cert.Version, curve cert.Curve, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (cert.Certificate, []byte, []byte, []byte) {
 	var err error
@@ -41,10 +35,10 @@ func NewTestCaCert(version cert.Version, curve cert.Curve, before, after time.Ti
 	}

 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}
 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}

 	t := &cert.TBSCertificate{
@@ -77,11 +71,11 @@ func NewTestCaCert(version cert.Version, curve cert.Curve, before, after time.Ti
 // Expiry times are defaulted if you do not pass them in
 func NewTestCert(v cert.Version, curve cert.Curve, ca cert.Certificate, key []byte, name string, before, after time.Time, networks, unsafeNetworks []netip.Prefix, groups []string) (cert.Certificate, []byte, []byte, []byte) {
 	if before.IsZero() {
-		before = testCertNow.Add(time.Second * -60)
+		before = time.Now().Add(time.Second * -60).Round(time.Second)
 	}

 	if after.IsZero() {
-		after = testCertNow.Add(time.Second * 60)
+		after = time.Now().Add(time.Second * 60).Round(time.Second)
 	}

 	var pub, priv []byte
@@ -3,14 +3,11 @@ package main
 import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
-	"crypto/fips140"
 	"crypto/rand"
-	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"math"
-	"math/bits"
 	"net/netip"
 	"os"
 	"strings"
@@ -46,28 +43,7 @@ type caFlags struct {
 	subnets *string
 }

-func defaultCurve() string {
-	if fips140.Enforced() {
-		return "P256"
-	}
-	return "25519"
-}
-
 func newCaFlags() *caFlags {
-	// prevent running out of memory on 32-bit systems by defaulting to
-	// RFC9106's recommendation for memory-constrained environments
-	var (
-		defaultArgonMemory     uint
-		defaultArgonIterations uint
-	)
-	if bits.UintSize == 32 {
-		defaultArgonMemory = 64 * 1024
-		defaultArgonIterations = 3
-	} else {
-		defaultArgonMemory = 2 * 1024 * 1024
-		defaultArgonIterations = 1
-	}
-
 	cf := caFlags{set: flag.NewFlagSet("ca", flag.ContinueOnError)}
 	cf.set.Usage = func() {}
 	cf.name = cf.set.String("name", "", "Required: name of the certificate authority")
@@ -79,11 +55,11 @@ func newCaFlags() *caFlags {
 	cf.groups = cf.set.String("groups", "", "Optional: comma separated list of groups. This will limit which groups subordinate certs can use")
 	cf.networks = cf.set.String("networks", "", "Optional: comma separated list of ip address and network in CIDR notation. This will limit which ip addresses and networks subordinate certs can use in networks")
 	cf.unsafeNetworks = cf.set.String("unsafe-networks", "", "Optional: comma separated list of ip address and network in CIDR notation. This will limit which ip addresses and networks subordinate certs can use in unsafe networks")
-	cf.argonMemory = cf.set.Uint("argon-memory", defaultArgonMemory, "Optional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase")
+	cf.argonMemory = cf.set.Uint("argon-memory", 2*1024*1024, "Optional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase")
 	cf.argonParallelism = cf.set.Uint("argon-parallelism", 4, "Optional: Argon2 parallelism parameter used for encrypted private key passphrase")
-	cf.argonIterations = cf.set.Uint("argon-iterations", defaultArgonIterations, "Optional: Argon2 iterations parameter used for encrypted private key passphrase")
+	cf.argonIterations = cf.set.Uint("argon-iterations", 1, "Optional: Argon2 iterations parameter used for encrypted private key passphrase")
 	cf.encryption = cf.set.Bool("encrypt", false, "Optional: prompt for passphrase and write out-key in an encrypted format")
-	cf.curve = cf.set.String("curve", defaultCurve(), "EdDSA/ECDSA Curve (25519, P256)")
+	cf.curve = cf.set.String("curve", "25519", "EdDSA/ECDSA Curve (25519, P256)")
 	cf.p11url = p11Flag(cf.set)

 	cf.ips = cf.set.String("ips", "", "Deprecated, see -networks")
@@ -121,19 +97,6 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		if err = mustFlagString("out-key", cf.outKeyPath); err != nil {
 			return err
 		}
-	} else {
-		// out-key is meaningless under PKCS#11 because the private key never
-		// leaves the HSM; reject it so we never silently accept or claim a
-		// stdout slot for it.
-		outKeySet := false
-		cf.set.Visit(func(f *flag.Flag) {
-			if f.Name == "out-key" {
-				outKeySet = true
-			}
-		})
-		if outKeySet {
-			return newHelpErrorf("cannot set -out-key with -pkcs11")
-		}
 	}
 	if err := mustFlagString("out-crt", cf.outCertPath); err != nil {
 		return err
@@ -208,21 +171,12 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		}
 	}

-	var claims ioClaims
-	if err := reserveOutputs(&claims,
-		"out-key", *cf.outKeyPath,
-		"out-crt", *cf.outCertPath,
-		"out-qr", *cf.outQRPath,
-	); err != nil {
-		return err
-	}
-
 	var passphrase []byte
 	if !isP11 && *cf.encryption {
 		passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
 		if len(passphrase) == 0 {
 			for i := 0; i < 5; i++ {
-				errOut.Write([]byte("Enter passphrase: "))
+				out.Write([]byte("Enter passphrase: "))
 				passphrase, err = pr.ReadPassword()

 				if err == ErrNoTerminal {
@@ -268,9 +222,6 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 	} else {
 		switch *cf.curve {
 		case "25519", "X25519", "Curve25519", "CURVE25519":
-			if fips140.Enforced() {
-				return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
-			}
 			curve = cert.Curve_CURVE25519
 			pub, rawPriv, err = ed25519.GenerateKey(rand.Reader)
 			if err != nil {
@@ -310,16 +261,14 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		Curve:          curve,
 	}

-	if !isP11 && !isStdio(*cf.outKeyPath) {
+	if !isP11 {
 		if _, err := os.Stat(*cf.outKeyPath); err == nil {
 			return fmt.Errorf("refusing to overwrite existing CA key: %s", *cf.outKeyPath)
 		}
 	}

-	if !isStdio(*cf.outCertPath) {
-		if _, err := os.Stat(*cf.outCertPath); err == nil {
-			return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
-		}
+	if _, err := os.Stat(*cf.outCertPath); err == nil {
+		return fmt.Errorf("refusing to overwrite existing CA cert: %s", *cf.outCertPath)
 	}

 	var c cert.Certificate
@@ -345,7 +294,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 			b = cert.MarshalSigningPrivateKeyToPEM(curve, rawPriv)
 		}

-		err = writeOutput(*cf.outKeyPath, b, 0600, out)
+		err = os.WriteFile(*cf.outKeyPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-key: %s", err)
 		}
@@ -356,7 +305,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 		return fmt.Errorf("error while marshalling certificate: %s", err)
 	}

-	err = writeOutput(*cf.outCertPath, b, 0600, out)
+	err = os.WriteFile(*cf.outCertPath, b, 0600)
 	if err != nil {
 		return fmt.Errorf("error while writing out-crt: %s", err)
 	}
@@ -367,7 +316,7 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 			return fmt.Errorf("error while generating qr code: %s", err)
 		}

-		err = writeOutput(*cf.outQRPath, b, 0600, out)
+		err = os.WriteFile(*cf.outQRPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-qr: %s", err)
 		}
@@ -383,7 +332,6 @@ func caSummary() string {
 func caHelp(out io.Writer) {
 	cf := newCaFlags()
 	out.Write([]byte("Usage of " + os.Args[0] + " " + caSummary() + "\n"))
-	out.Write([]byte(stdioHelpText))
 	cf.set.SetOutput(out)
 	cf.set.PrintDefaults()
 }
@@ -7,9 +7,7 @@ import (
 	"bytes"
 	"encoding/pem"
 	"errors"
-	"math/bits"
 	"os"
-	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -24,28 +22,15 @@ func Test_caSummary(t *testing.T) {
 }

 func Test_caHelp(t *testing.T) {
-	var (
-		defaultArgonMemory     string
-		defaultArgonIterations string
-	)
-	if bits.UintSize == 32 {
-		defaultArgonMemory = strconv.Itoa(64 * 1024)
-		defaultArgonIterations = strconv.Itoa(3)
-	} else {
-		defaultArgonMemory = strconv.Itoa(2 * 1024 * 1024)
-		defaultArgonIterations = strconv.Itoa(1)
-	}
-
 	ob := &bytes.Buffer{}
 	caHelp(ob)
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" ca <flags>: create a self signed certificate authority\n"+
-			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -argon-iterations uint\n"+
-			"    \tOptional: Argon2 iterations parameter used for encrypted private key passphrase (default "+defaultArgonIterations+")\n"+
+			"    \tOptional: Argon2 iterations parameter used for encrypted private key passphrase (default 1)\n"+
 			"  -argon-memory uint\n"+
-			"    \tOptional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase (default "+defaultArgonMemory+")\n"+
+			"    \tOptional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase (default 2097152)\n"+
 			"  -argon-parallelism uint\n"+
 			"    \tOptional: Argon2 parallelism parameter used for encrypted private key passphrase (default 4)\n"+
 			"  -curve string\n"+
@@ -99,7 +84,7 @@ func Test_ca(t *testing.T) {
 		err:      nil,
 	}

-	pwPromptEB := "Enter passphrase: "
+	pwPromptOb := "Enter passphrase: "

 	// required args
 	assertHelpError(t, ca(
@@ -183,8 +168,8 @@ func Test_ca(t *testing.T) {
 	eb.Reset()
 	args = []string{"-version", "1", "-encrypt", "-name", "test", "-duration", "100m", "-groups", "1,2,3,4,5", "-out-crt", crtF.Name(), "-out-key", keyF.Name()}
 	require.NoError(t, ca(args, ob, eb, testpw))
-	assert.Empty(t, ob.String())
-	assert.Equal(t, pwPromptEB, eb.String())
+	assert.Equal(t, pwPromptOb, ob.String())
+	assert.Empty(t, eb.String())

 	// test encrypted key with passphrase environment variable
 	os.Remove(keyF.Name())
@@ -202,16 +187,10 @@ func Test_ca(t *testing.T) {
 	k, _ := pem.Decode(rb)
 	ned, err := cert.UnmarshalNebulaEncryptedData(k.Bytes)
 	require.NoError(t, err)
-
-	if bits.UintSize == 32 {
-		assert.Equal(t, uint32(64*1024), ned.EncryptionMetadata.Argon2Parameters.Memory)
-		assert.Equal(t, uint32(3), ned.EncryptionMetadata.Argon2Parameters.Iterations)
-	} else {
-		assert.Equal(t, uint32(2*1024*1024), ned.EncryptionMetadata.Argon2Parameters.Memory)
-		assert.Equal(t, uint32(1), ned.EncryptionMetadata.Argon2Parameters.Iterations)
-	}
-
+	// we won't know salt in advance, so just check start of string
+	assert.Equal(t, uint32(2*1024*1024), ned.EncryptionMetadata.Argon2Parameters.Memory)
 	assert.Equal(t, uint8(4), ned.EncryptionMetadata.Argon2Parameters.Parallelism)
+	assert.Equal(t, uint32(1), ned.EncryptionMetadata.Argon2Parameters.Iterations)

 	// verify the key is valid and decrypt-able
 	var curve cert.Curve
@@ -228,8 +207,8 @@ func Test_ca(t *testing.T) {
 	eb.Reset()
 	args = []string{"-version", "1", "-encrypt", "-name", "test", "-duration", "100m", "-groups", "1,2,3,4,5", "-out-crt", crtF.Name(), "-out-key", keyF.Name()}
 	require.Error(t, ca(args, ob, eb, errpw))
-	assert.Empty(t, ob.String())
-	assert.Equal(t, pwPromptEB, eb.String())
+	assert.Equal(t, pwPromptOb, ob.String())
+	assert.Empty(t, eb.String())

 	// test when user fails to enter a password
 	os.Remove(keyF.Name())
@@ -238,8 +217,8 @@ func Test_ca(t *testing.T) {
 	eb.Reset()
 	args = []string{"-version", "1", "-encrypt", "-name", "test", "-duration", "100m", "-groups", "1,2,3,4,5", "-out-crt", crtF.Name(), "-out-key", keyF.Name()}
 	require.EqualError(t, ca(args, ob, eb, nopw), "no passphrase specified, remove -encrypt flag to write out-key in plaintext")
-	assert.Empty(t, ob.String())
-	assert.Equal(t, strings.Repeat(pwPromptEB, 5), eb.String()) // prompts 5 times before giving up
+	assert.Equal(t, strings.Repeat(pwPromptOb, 5), ob.String()) // prompts 5 times before giving up
+	assert.Empty(t, eb.String())

 	// create valid cert/key for overwrite tests
 	os.Remove(keyF.Name())
@@ -268,67 +247,3 @@ func Test_ca(t *testing.T) {
 	os.Remove(keyF.Name())

 }
-
-func Test_ca_stdio(t *testing.T) {
-	nopw := &StubPasswordReader{}
-
-	keyF, err := os.CreateTemp("", "ca.key")
-	require.NoError(t, err)
-	os.Remove(keyF.Name())
-	defer os.Remove(keyF.Name())
-
-	crtF, err := os.CreateTemp("", "ca.crt")
-	require.NoError(t, err)
-	os.Remove(crtF.Name())
-	defer os.Remove(crtF.Name())
-
-	// out-crt on stdout, out-key on disk
-	ob := &bytes.Buffer{}
-	eb := &bytes.Buffer{}
-	require.NoError(t, ca([]string{"-name", "test-ca", "-duration", "1h", "-out-crt", "-", "-out-key", keyF.Name()}, ob, eb, nopw))
-	assert.Empty(t, eb.String())
-	c, _, err := cert.UnmarshalCertificateFromPEM(ob.Bytes())
-	require.NoError(t, err)
-	assert.True(t, c.IsCA())
-	assert.Equal(t, "test-ca", c.Name())
-
-	// out-key on stdout, out-crt on disk
-	os.Remove(keyF.Name())
-	ob.Reset()
-	eb.Reset()
-	require.NoError(t, ca([]string{"-name", "test-ca", "-duration", "1h", "-out-crt", crtF.Name(), "-out-key", "-"}, ob, eb, nopw))
-	assert.Empty(t, eb.String())
-	_, _, curve, err := cert.UnmarshalSigningPrivateKeyFromPEM(ob.Bytes())
-	require.NoError(t, err)
-	assert.Equal(t, cert.Curve_CURVE25519, curve)
-
-	// dual stdout is rejected up front
-	os.Remove(crtF.Name())
-	ob.Reset()
-	eb.Reset()
-	require.EqualError(t,
-		ca([]string{"-name", "test-ca", "-duration", "1h", "-out-crt", "-", "-out-key", "-"}, ob, eb, nopw),
-		`-out-key and -out-crt both set to "-", only one output may write to stdout`)
-	assert.Empty(t, ob.String())
-
-	// an output conflict combined with -encrypt must error BEFORE prompting
-	// for a passphrase; pr would record any read attempt
-	tracker := &trackingPasswordReader{}
-	ob.Reset()
-	eb.Reset()
-	require.EqualError(t,
-		ca([]string{"-name", "test-ca", "-duration", "1h", "-encrypt", "-out-crt", "-", "-out-key", "-"}, ob, eb, tracker),
-		`-out-key and -out-crt both set to "-", only one output may write to stdout`)
-	assert.Empty(t, ob.String())
-	assert.Empty(t, eb.String())
-	assert.Zero(t, tracker.calls, "passphrase prompt should not have been called")
-}
-
-type trackingPasswordReader struct {
-	calls int
-}
-
-func (pr *trackingPasswordReader) ReadPassword() ([]byte, error) {
-	pr.calls++
-	return []byte(""), nil
-}
@@ -1,5 +0,0 @@
-//go:build fips140enforce
-
-//go:debug fips140=only
-
-package main
@@ -1,8 +1,6 @@
 package main

 import (
-	"crypto/fips140"
-	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -26,7 +24,7 @@ func newKeygenFlags() *keygenFlags {
 	cf.set.Usage = func() {}
 	cf.outPubPath = cf.set.String("out-pub", "", "Required: path to write the public key to")
 	cf.outKeyPath = cf.set.String("out-key", "", "Required: path to write the private key to")
-	cf.curve = cf.set.String("curve", defaultCurve(), "ECDH Curve (25519, P256)")
+	cf.curve = cf.set.String("curve", "25519", "ECDH Curve (25519, P256)")
 	cf.p11url = p11Flag(cf.set)
 	return &cf
 }
@@ -44,8 +42,6 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 		if err = mustFlagString("out-key", cf.outKeyPath); err != nil {
 			return err
 		}
-	} else if *cf.outKeyPath != "" {
-		return newHelpErrorf("cannot set -out-key with -pkcs11")
 	}
 	if err = mustFlagString("out-pub", cf.outPubPath); err != nil {
 		return err
@@ -63,9 +59,6 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 	} else {
 		switch *cf.curve {
 		case "25519", "X25519", "Curve25519", "CURVE25519":
-			if fips140.Enforced() {
-				return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
-			}
 			pub, rawPriv = x25519Keypair()
 			curve = cert.Curve_CURVE25519
 		case "P256":
@@ -76,14 +69,6 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 		}
 	}

-	var claims ioClaims
-	if err := reserveOutputs(&claims,
-		"out-key", *cf.outKeyPath,
-		"out-pub", *cf.outPubPath,
-	); err != nil {
-		return err
-	}
-
 	if isP11 {
 		p11Client, err := pkclient.FromUrl(*cf.p11url)
 		if err != nil {
@@ -97,12 +82,12 @@ func keygen(args []string, out io.Writer, errOut io.Writer) error {
 			return fmt.Errorf("error while getting public key: %w", err)
 		}
 	} else {
-		err = writeOutput(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
+		err = os.WriteFile(*cf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-key: %s", err)
 		}
 	}
-	err = writeOutput(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600, out)
+	err = os.WriteFile(*cf.outPubPath, cert.MarshalPublicKeyToPEM(curve, pub), 0600)
 	if err != nil {
 		return fmt.Errorf("error while writing out-pub: %s", err)
 	}
@@ -117,7 +102,6 @@ func keygenSummary() string {
 func keygenHelp(out io.Writer) {
 	cf := newKeygenFlags()
 	_, _ = out.Write([]byte("Usage of " + os.Args[0] + " " + keygenSummary() + "\n"))
-	_, _ = out.Write([]byte(stdioHelpText))
 	cf.set.SetOutput(out)
 	cf.set.PrintDefaults()
 }
@@ -20,7 +20,6 @@ func Test_keygenHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" keygen <flags>: create a public/private key pair. the public key can be passed to `nebula-cert sign`\n"+
-			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -curve string\n"+
 			"    \tECDH Curve (25519, P256) (default \"25519\")\n"+
 			"  -out-key string\n"+
@@ -94,43 +93,3 @@ func Test_keygen(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, lPub, 32)
 }
-
-func Test_keygen_stdio(t *testing.T) {
-	keyF, err := os.CreateTemp("", "test.key")
-	require.NoError(t, err)
-	os.Remove(keyF.Name())
-	defer os.Remove(keyF.Name())
-
-	pubF, err := os.CreateTemp("", "test.pub")
-	require.NoError(t, err)
-	os.Remove(pubF.Name())
-	defer os.Remove(pubF.Name())
-
-	// out-pub on stdout, out-key on disk
-	ob := &bytes.Buffer{}
-	eb := &bytes.Buffer{}
-	require.NoError(t, keygen([]string{"-out-pub", "-", "-out-key", keyF.Name()}, ob, eb))
-	assert.Empty(t, eb.String())
-	lPub, _, curve, err := cert.UnmarshalPublicKeyFromPEM(ob.Bytes())
-	require.NoError(t, err)
-	assert.Equal(t, cert.Curve_CURVE25519, curve)
-	assert.Len(t, lPub, 32)
-
-	// out-key on stdout, out-pub on disk
-	os.Remove(keyF.Name())
-	ob.Reset()
-	eb.Reset()
-	require.NoError(t, keygen([]string{"-out-pub", pubF.Name(), "-out-key", "-"}, ob, eb))
-	assert.Empty(t, eb.String())
-	lKey, _, curve, err := cert.UnmarshalPrivateKeyFromPEM(ob.Bytes())
-	require.NoError(t, err)
-	assert.Equal(t, cert.Curve_CURVE25519, curve)
-	assert.Len(t, lKey, 32)
-
-	// both on stdout is a conflict caught up front
-	ob.Reset()
-	eb.Reset()
-	require.EqualError(t, keygen([]string{"-out-pub", "-", "-out-key", "-"}, ob, eb),
-		`-out-key and -out-pub both set to "-", only one output may write to stdout`)
-	assert.Empty(t, ob.String())
-}
@@ -22,9 +22,7 @@ func (pr StdinPasswordReader) ReadPassword() ([]byte, error) {
 	}

 	password, err := term.ReadPassword(int(os.Stdin.Fd()))
-	// Terminal echo is off while reading, so the user's Enter key does not
-	// produce a visible newline. Emit one on stderr to match the prompt.
-	fmt.Fprintln(os.Stderr)
+	fmt.Println()

 	return password, err
 }
@@ -40,23 +40,11 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 		return err
 	}

-	var claims ioClaims
-	if err := reserveInputs(&claims, "path", *pf.path); err != nil {
-		return err
-	}
-	if err := reserveOutputs(&claims, "out-qr", *pf.outQRPath); err != nil {
-		return err
-	}
-
-	rawCert, err := readInput("path", *pf.path, &claims)
+	rawCert, err := os.ReadFile(*pf.path)
 	if err != nil {
 		return fmt.Errorf("unable to read cert; %s", err)
 	}

-	// When the QR is going to stdout, suppress the human-readable text/json
-	// output so the binary stream is not contaminated.
-	qrToStdout := isStdio(*pf.outQRPath)
-
 	var c cert.Certificate
 	var qrBytes []byte
 	part := 0
@@ -69,13 +57,11 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 			return fmt.Errorf("error while unmarshaling cert: %s", err)
 		}

-		if !qrToStdout {
-			if *pf.json {
-				jsonCerts = append(jsonCerts, c)
-			} else {
-				_, _ = out.Write([]byte(c.String()))
-				_, _ = out.Write([]byte("\n"))
-			}
+		if *pf.json {
+			jsonCerts = append(jsonCerts, c)
+		} else {
+			_, _ = out.Write([]byte(c.String()))
+			_, _ = out.Write([]byte("\n"))
 		}

 		if *pf.outQRPath != "" {
@@ -93,7 +79,7 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 		part++
 	}

-	if *pf.json && !qrToStdout {
+	if *pf.json {
 		b, _ := json.Marshal(jsonCerts)
 		_, _ = out.Write(b)
 		_, _ = out.Write([]byte("\n"))
@@ -105,7 +91,7 @@ func printCert(args []string, out io.Writer, errOut io.Writer) error {
 			return fmt.Errorf("error while generating qr code: %s", err)
 		}

-		err = writeOutput(*pf.outQRPath, b, 0600, out)
+		err = os.WriteFile(*pf.outQRPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-qr: %s", err)
 		}
@@ -121,7 +107,6 @@ func printSummary() string {
 func printHelp(out io.Writer) {
 	pf := newPrintFlags()
 	out.Write([]byte("Usage of " + os.Args[0] + " " + printSummary() + "\n"))
-	out.Write([]byte(stdioHelpText))
 	pf.set.SetOutput(out)
 	pf.set.PrintDefaults()
 }
@@ -25,7 +25,6 @@ func Test_printHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" print <flags>: prints details about a certificate\n"+
-			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -json\n"+
 			"    \tOptional: outputs certificates in json format\n"+
 			"  -out-qr string\n"+
@@ -179,44 +178,6 @@ func Test_printCert(t *testing.T) {
 		ob.String(),
 	)
 	assert.Empty(t, eb.String())
-
-	// read cert from stdin
-	ob.Reset()
-	eb.Reset()
-	withStdin(t, bytes.NewReader(p))
-	err = printCert([]string{"-json", "-path", "-"}, ob, eb)
-	require.NoError(t, err)
-	assert.Equal(
-		t,
-		`[{"details":{"curve":"CURVE25519","groups":["hi"],"isCa":false,"issuer":"`+c.Issuer()+`","name":"test","networks":["10.0.0.123/8"],"notAfter":"0001-01-01T00:00:00Z","notBefore":"0001-01-01T00:00:00Z","publicKey":"`+pk+`","unsafeNetworks":[]},"fingerprint":"`+fp+`","signature":"`+sig+`","version":1}]
-`,
-		ob.String(),
-	)
-	assert.Empty(t, eb.String())
-
-	// -out-qr - sends only the PNG to stdout, suppressing the cert dump
-	ob.Reset()
-	eb.Reset()
-	withStdin(t, bytes.NewReader(p))
-	err = printCert([]string{"-path", "-", "-out-qr", "-"}, ob, eb)
-	require.NoError(t, err)
-	assert.Empty(t, eb.String())
-	stdout := ob.Bytes()
-	require.NotEmpty(t, stdout)
-	// PNG magic, no PEM/JSON noise prepended
-	assert.Equal(t, []byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a}, stdout[:8])
-	assert.NotContains(t, string(stdout), "NebulaCertificate")
-	assert.NotContains(t, string(stdout), `"details"`)
-
-	// json + out-qr - still suppresses json
-	ob.Reset()
-	eb.Reset()
-	withStdin(t, bytes.NewReader(p))
-	err = printCert([]string{"-json", "-path", "-", "-out-qr", "-"}, ob, eb)
-	require.NoError(t, err)
-	assert.Empty(t, eb.String())
-	assert.Equal(t, []byte{0x89, 'P', 'N', 'G'}, ob.Bytes()[:4])
-	assert.NotContains(t, ob.String(), `"details"`)
 }

 // NewTestCaCert will generate a CA cert
@@ -2,7 +2,6 @@ package main

 import (
 	"crypto/ecdh"
-	"crypto/fips140"
 	"crypto/rand"
 	"errors"
 	"flag"
@@ -86,9 +85,6 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 	if !isP11 && *sf.inPubPath != "" && *sf.outKeyPath != "" {
 		return newHelpErrorf("cannot set both -in-pub and -out-key")
 	}
-	if isP11 && *sf.outKeyPath != "" {
-		return newHelpErrorf("cannot set -out-key with -pkcs11")
-	}

 	var v4Networks []netip.Prefix
 	var v6Networks []netip.Prefix
@@ -106,35 +102,13 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		return newHelpErrorf("-version must be either %v or %v", cert.Version1, cert.Version2)
 	}

-	if *sf.outKeyPath == "" {
-		*sf.outKeyPath = *sf.name + ".key"
-	}
-	if *sf.outCertPath == "" {
-		*sf.outCertPath = *sf.name + ".crt"
-	}
-
-	var claims ioClaims
-	if err := reserveInputs(&claims,
-		"ca-key", *sf.caKeyPath,
-		"ca-crt", *sf.caCertPath,
-		"in-pub", *sf.inPubPath,
-	); err != nil {
-		return err
-	}
-	if err := reserveOutputs(&claims,
-		"out-key", *sf.outKeyPath,
-		"out-crt", *sf.outCertPath,
-		"out-qr", *sf.outQRPath,
-	); err != nil {
-		return err
-	}
-
 	var curve cert.Curve
 	var caKey []byte

 	if !isP11 {
 		var rawCAKey []byte
-		rawCAKey, err = readInput("ca-key", *sf.caKeyPath, &claims)
+		rawCAKey, err := os.ReadFile(*sf.caKeyPath)
+
 		if err != nil {
 			return fmt.Errorf("error while reading ca-key: %s", err)
 		}
@@ -147,7 +121,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 			if len(passphrase) == 0 {
 				// ask for a passphrase until we get one
 				for i := 0; i < 5; i++ {
-					errOut.Write([]byte("Enter passphrase: "))
+					out.Write([]byte("Enter passphrase: "))
 					passphrase, err = pr.ReadPassword()

 					if errors.Is(err, ErrNoTerminal) {
@@ -173,7 +147,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		}
 	}

-	rawCACert, err := readInput("ca-crt", *sf.caCertPath, &claims)
+	rawCACert, err := os.ReadFile(*sf.caCertPath)
 	if err != nil {
 		return fmt.Errorf("error while reading ca-crt: %s", err)
 	}
@@ -269,13 +243,9 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		}(p11Client)
 	}

-	if fips140.Enforced() && curve == cert.Curve_CURVE25519 {
-		return errors.New("use of Curve25519 is not allowed in FIPS 140-only mode")
-	}
-
 	if *sf.inPubPath != "" {
 		var pubCurve cert.Curve
-		rawPub, err := readInput("in-pub", *sf.inPubPath, &claims)
+		rawPub, err := os.ReadFile(*sf.inPubPath)
 		if err != nil {
 			return fmt.Errorf("error while reading in-pub: %s", err)
 		}
@@ -296,10 +266,16 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		pub, rawPriv = newKeypair(curve)
 	}

-	if !isStdio(*sf.outCertPath) {
-		if _, err := os.Stat(*sf.outCertPath); err == nil {
-			return fmt.Errorf("refusing to overwrite existing cert: %s", *sf.outCertPath)
-		}
+	if *sf.outKeyPath == "" {
+		*sf.outKeyPath = *sf.name + ".key"
+	}
+
+	if *sf.outCertPath == "" {
+		*sf.outCertPath = *sf.name + ".crt"
+	}
+
+	if _, err := os.Stat(*sf.outCertPath); err == nil {
+		return fmt.Errorf("refusing to overwrite existing cert: %s", *sf.outCertPath)
 	}

 	var crts []cert.Certificate
@@ -384,13 +360,11 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 	}

 	if !isP11 && *sf.inPubPath == "" {
-		if !isStdio(*sf.outKeyPath) {
-			if _, err := os.Stat(*sf.outKeyPath); err == nil {
-				return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
-			}
+		if _, err := os.Stat(*sf.outKeyPath); err == nil {
+			return fmt.Errorf("refusing to overwrite existing key: %s", *sf.outKeyPath)
 		}

-		err = writeOutput(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600, out)
+		err = os.WriteFile(*sf.outKeyPath, cert.MarshalPrivateKeyToPEM(curve, rawPriv), 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-key: %s", err)
 		}
@@ -405,7 +379,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		b = append(b, sb...)
 	}

-	err = writeOutput(*sf.outCertPath, b, 0600, out)
+	err = os.WriteFile(*sf.outCertPath, b, 0600)
 	if err != nil {
 		return fmt.Errorf("error while writing out-crt: %s", err)
 	}
@@ -416,7 +390,7 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 			return fmt.Errorf("error while generating qr code: %s", err)
 		}

-		err = writeOutput(*sf.outQRPath, b, 0600, out)
+		err = os.WriteFile(*sf.outQRPath, b, 0600)
 		if err != nil {
 			return fmt.Errorf("error while writing out-qr: %s", err)
 		}
@@ -466,7 +440,6 @@ func signSummary() string {
 func signHelp(out io.Writer) {
 	sf := newSignFlags()
 	out.Write([]byte("Usage of " + os.Args[0] + " " + signSummary() + "\n"))
-	out.Write([]byte(stdioHelpText))
 	sf.set.SetOutput(out)
 	sf.set.PrintDefaults()
 }
@@ -27,7 +27,6 @@ func Test_signHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" sign <flags>: create and sign a certificate\n"+
-			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -ca-crt string\n"+
 			"    \tOptional: path to the signing CA cert (default \"ca.crt\")\n"+
 			"  -ca-key string\n"+
@@ -377,18 +376,15 @@ func Test_signCert(t *testing.T) {
 	// test with the proper password
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.NoError(t, signCert(args, ob, eb, testpw))
-	assert.Empty(t, ob.String())
-	assert.Equal(t, "Enter passphrase: ", eb.String())
+	assert.Equal(t, "Enter passphrase: ", ob.String())
+	assert.Empty(t, eb.String())

 	// test with the proper password in the environment
 	os.Remove(crtF.Name())
 	os.Remove(keyF.Name())
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	os.Setenv("NEBULA_CA_PASSPHRASE", string(passphrase))
-	ob.Reset()
-	eb.Reset()
 	require.NoError(t, signCert(args, ob, eb, testpw))
-	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
 	os.Setenv("NEBULA_CA_PASSPHRASE", "")

@@ -399,8 +395,8 @@ func Test_signCert(t *testing.T) {
 	testpw.password = []byte("invalid password")
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.Error(t, signCert(args, ob, eb, testpw))
-	assert.Empty(t, ob.String())
-	assert.Equal(t, "Enter passphrase: ", eb.String())
+	assert.Equal(t, "Enter passphrase: ", ob.String())
+	assert.Empty(t, eb.String())

 	// test with the wrong password in environment
 	ob.Reset()
@@ -420,8 +416,8 @@ func Test_signCert(t *testing.T) {
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.Error(t, signCert(args, ob, eb, nopw))
 	// normally the user hitting enter on the prompt would add newlines between these
-	assert.Empty(t, ob.String())
-	assert.Equal(t, "Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: ", eb.String())
+	assert.Equal(t, "Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: Enter passphrase: ", ob.String())
+	assert.Empty(t, eb.String())

 	// test an error condition
 	ob.Reset()
@@ -429,106 +425,6 @@ func Test_signCert(t *testing.T) {

 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
 	require.Error(t, signCert(args, ob, eb, errpw))
-	assert.Empty(t, ob.String())
-	assert.Equal(t, "Enter passphrase: ", eb.String())
-}
-
-func Test_signCert_stdio(t *testing.T) {
-	nopw := &StubPasswordReader{
-		password: []byte(""),
-		err:      nil,
-	}
-
-	caPub, caPriv, _ := ed25519.GenerateKey(rand.Reader)
-	rawCAKey := cert.MarshalSigningPrivateKeyToPEM(cert.Curve_CURVE25519, caPriv)
-
-	ca, _ := NewTestCaCert("ca", caPub, caPriv, time.Now(), time.Now().Add(time.Minute*200), nil, nil, nil)
-	rawCACrt, _ := ca.MarshalPEM()
-
-	caCrtF, err := os.CreateTemp("", "sign-cert.crt")
-	require.NoError(t, err)
-	defer os.Remove(caCrtF.Name())
-	caCrtF.Write(rawCACrt)
-
-	caKeyF, err := os.CreateTemp("", "sign-cert.key")
-	require.NoError(t, err)
-	defer os.Remove(caKeyF.Name())
-	caKeyF.Write(rawCAKey)
-
-	keyF, err := os.CreateTemp("", "sign.key")
-	require.NoError(t, err)
-	os.Remove(keyF.Name())
-	defer os.Remove(keyF.Name())
-
-	// ca-key on stdin, cert to stdout
-	withStdin(t, bytes.NewReader(rawCAKey))
-	ob := &bytes.Buffer{}
-	eb := &bytes.Buffer{}
-	args := []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", "-", "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", "-", "-out-key", keyF.Name(), "-duration", "100m"}
-	require.NoError(t, signCert(args, ob, eb, nopw))
+	assert.Equal(t, "Enter passphrase: ", ob.String())
 	assert.Empty(t, eb.String())
-
-	lCrt, _, err := cert.UnmarshalCertificateFromPEM(ob.Bytes())
-	require.NoError(t, err)
-	assert.Equal(t, "stdin-test", lCrt.Name())
-	assert.True(t, lCrt.CheckSignature(caPub))
-
-	// two flags reading from stdin should error before any read attempt;
-	// otherwise an interactive shell would hang on io.ReadAll
-	stdinIn := bytes.NewReader(rawCAKey)
-	withStdin(t, stdinIn)
-	ob.Reset()
-	eb.Reset()
-	args = []string{"-version", "1", "-ca-crt", "-", "-ca-key", "-", "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", "nope", "-out-key", "nope", "-duration", "100m"}
-	require.EqualError(t, signCert(args, ob, eb, nopw),
-		`-ca-key and -ca-crt both set to "-", only one input may read from stdin`)
-	assert.Equal(t, len(rawCAKey), stdinIn.Len(), "stdin should be untouched when conflict is caught up front")
-
-	// two flags writing to stdout should error before any output is written
-	// AND before stdin is consumed
-	stdinR := bytes.NewReader(rawCAKey)
-	withStdin(t, stdinR)
-	ob.Reset()
-	eb.Reset()
-	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", "-", "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", "-", "-out-key", "-", "-duration", "100m"}
-	require.EqualError(t, signCert(args, ob, eb, nopw),
-		`-out-key and -out-crt both set to "-", only one output may write to stdout`)
-	assert.Empty(t, ob.String())
-	// stdin should be untouched because the conflict was caught up front
-	assert.Equal(t, len(rawCAKey), stdinR.Len())
-
-	// out-key on stdout, cert on disk
-	keyF2, err := os.CreateTemp("", "sign.key")
-	require.NoError(t, err)
-	os.Remove(keyF2.Name())
-	defer os.Remove(keyF2.Name())
-	crtF, err := os.CreateTemp("", "sign.crt")
-	require.NoError(t, err)
-	os.Remove(crtF.Name())
-	defer os.Remove(crtF.Name())
-
-	ob.Reset()
-	eb.Reset()
-	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "stdin-test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", "-", "-duration", "100m"}
-	require.NoError(t, signCert(args, ob, eb, nopw))
-	assert.Empty(t, eb.String())
-	_, _, curve, err := cert.UnmarshalPrivateKeyFromPEM(ob.Bytes())
-	require.NoError(t, err)
-	assert.Equal(t, cert.Curve_CURVE25519, curve)
-
-	// in-pub on stdin (caller already has a keypair, only the cert is generated)
-	inPub, _ := x25519Keypair()
-	rawInPub := cert.MarshalPublicKeyToPEM(cert.Curve_CURVE25519, inPub)
-
-	withStdin(t, bytes.NewReader(rawInPub))
-	os.Remove(crtF.Name())
-	ob.Reset()
-	eb.Reset()
-	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "in-pub-test", "-ip", "1.1.1.1/24", "-in-pub", "-", "-out-crt", "-", "-duration", "100m"}
-	require.NoError(t, signCert(args, ob, eb, nopw))
-	assert.Empty(t, eb.String())
-	stdinCrt, _, err := cert.UnmarshalCertificateFromPEM(ob.Bytes())
-	require.NoError(t, err)
-	assert.Equal(t, "in-pub-test", stdinCrt.Name())
-	assert.Equal(t, inPub, stdinCrt.PublicKey())
 }
@@ -1,117 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"io"
-	"os"
-)
-
-// stdioPath is the special path value that selects stdin (for inputs) or
-// stdout (for outputs) instead of a file on disk.
-const stdioPath = "-"
-
-// stdioHelpText is rendered just under the Usage line of each subcommand
-// help so the - convention is documented once instead of on every flag.
-const stdioHelpText = "  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"
-
-// stdinReader is the source used when an input flag is set to "-".
-// It is a package level var so tests can swap in a deterministic reader.
-// Tests that mutate stdinReader cannot run with t.Parallel().
-var stdinReader io.Reader = os.Stdin
-
-// ioClaims tracks which flags have claimed stdin and stdout during a single
-// command invocation so we can refuse a second flag asking for the same
-// stream.
-type ioClaims struct {
-	in  string
-	out string
-}
-
-func (c *ioClaims) claimIn(flagName string) error {
-	if c.in != "" && c.in != flagName {
-		return fmt.Errorf("-%s and -%s both set to %q, only one input may read from stdin", c.in, flagName, stdioPath)
-	}
-	c.in = flagName
-	return nil
-}
-
-func (c *ioClaims) claimOut(flagName string) error {
-	if c.out != "" && c.out != flagName {
-		return fmt.Errorf("-%s and -%s both set to %q, only one output may write to stdout", c.out, flagName, stdioPath)
-	}
-	c.out = flagName
-	return nil
-}
-
-// reserveInputs walks alternating (flagName, path) pairs and claims stdin
-// for any path equal to stdioPath. It must be called before any input is
-// read so a conflict can be reported immediately instead of blocking on
-// io.ReadAll while waiting for input that will never arrive.
-func reserveInputs(claims *ioClaims, pairs ...string) error {
-	return reserveStdio(claims, "reserveInputs", (*ioClaims).claimIn, pairs)
-}
-
-// reserveOutputs walks alternating (flagName, path) pairs and claims stdout
-// for any path equal to stdioPath. It must be called before any output is
-// written so a conflict cannot leave one stream half written before the
-// second flag fails.
-func reserveOutputs(claims *ioClaims, pairs ...string) error {
-	return reserveStdio(claims, "reserveOutputs", (*ioClaims).claimOut, pairs)
-}
-
-func reserveStdio(claims *ioClaims, who string, claim func(*ioClaims, string) error, pairs []string) error {
-	if len(pairs)%2 != 0 {
-		panic(who + " requires alternating name, path pairs")
-	}
-	for i := 0; i < len(pairs); i += 2 {
-		name, path := pairs[i], pairs[i+1]
-		if path != stdioPath {
-			continue
-		}
-		if err := claim(claims, name); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// readInput returns the bytes referenced by path, reading from stdin when
-// path is stdioPath.
-func readInput(flagName, path string, claims *ioClaims) ([]byte, error) {
-	if path == stdioPath {
-		if err := claims.claimIn(flagName); err != nil {
-			return nil, err
-		}
-		return io.ReadAll(stdinReader)
-	}
-	return os.ReadFile(path)
-}
-
-// openInput returns a reader for path. When path is stdioPath the returned
-// reader wraps stdin and Close is a no-op.
-func openInput(flagName, path string, claims *ioClaims) (io.ReadCloser, error) {
-	if path == stdioPath {
-		if err := claims.claimIn(flagName); err != nil {
-			return nil, err
-		}
-		return io.NopCloser(stdinReader), nil
-	}
-	return os.Open(path)
-}
-
-// writeOutput writes data to path, or to stdout when path is stdioPath. perm
-// is only used for file output. The caller must have already claimed stdout
-// via reserveOutputs before invoking with stdioPath.
-func writeOutput(path string, data []byte, perm os.FileMode, stdout io.Writer) error {
-	if path == stdioPath {
-		_, err := stdout.Write(data)
-		return err
-	}
-	return os.WriteFile(path, data, perm)
-}
-
-// isStdio reports whether path is the stdio sentinel and so should skip
-// existence checks like "refuse to overwrite".
-func isStdio(path string) bool {
-	return path == stdioPath
-}
@@ -1,167 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// withStdin temporarily replaces stdinReader for the duration of t.
-func withStdin(t *testing.T, r io.Reader) {
-	t.Helper()
-	prev := stdinReader
-	stdinReader = r
-	t.Cleanup(func() { stdinReader = prev })
-}
-
-func Test_readInput_stdin(t *testing.T) {
-	withStdin(t, bytes.NewBufferString("hello"))
-	var claims ioClaims
-
-	got, err := readInput("path", "-", &claims)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("hello"), got)
-	assert.Equal(t, "path", claims.in)
-}
-
-func Test_readInput_file(t *testing.T) {
-	dir := t.TempDir()
-	p := filepath.Join(dir, "f")
-	require.NoError(t, os.WriteFile(p, []byte("file"), 0600))
-	var claims ioClaims
-
-	got, err := readInput("path", p, &claims)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("file"), got)
-	assert.Empty(t, claims.in)
-}
-
-func Test_readInput_doubleStdinErrors(t *testing.T) {
-	withStdin(t, bytes.NewBufferString("hello"))
-	var claims ioClaims
-
-	_, err := readInput("ca-key", "-", &claims)
-	require.NoError(t, err)
-
-	_, err = readInput("ca-crt", "-", &claims)
-	require.EqualError(t, err, `-ca-key and -ca-crt both set to "-", only one input may read from stdin`)
-}
-
-func Test_openInput_stdin(t *testing.T) {
-	withStdin(t, bytes.NewBufferString("hi"))
-	var claims ioClaims
-
-	r, err := openInput("ca", "-", &claims)
-	require.NoError(t, err)
-	defer r.Close()
-	b, err := io.ReadAll(r)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("hi"), b)
-}
-
-func Test_openInput_doubleStdinErrors(t *testing.T) {
-	withStdin(t, bytes.NewBufferString("hi"))
-	var claims ioClaims
-
-	r, err := openInput("ca", "-", &claims)
-	require.NoError(t, err)
-	r.Close()
-
-	_, err = openInput("crt", "-", &claims)
-	require.EqualError(t, err, `-ca and -crt both set to "-", only one input may read from stdin`)
-}
-
-func Test_writeOutput_stdout(t *testing.T) {
-	out := &bytes.Buffer{}
-
-	err := writeOutput("-", []byte("payload"), 0600, out)
-	require.NoError(t, err)
-	assert.Equal(t, "payload", out.String())
-}
-
-func Test_writeOutput_file(t *testing.T) {
-	dir := t.TempDir()
-	p := filepath.Join(dir, "f")
-	out := &bytes.Buffer{}
-
-	err := writeOutput(p, []byte("payload"), 0600, out)
-	require.NoError(t, err)
-	assert.Empty(t, out.String())
-	got, err := os.ReadFile(p)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("payload"), got)
-}
-
-func Test_reserveOutputs_noConflict(t *testing.T) {
-	var claims ioClaims
-	require.NoError(t, reserveOutputs(&claims,
-		"out-key", "/tmp/key",
-		"out-crt", "-",
-		"out-qr", "",
-	))
-	assert.Equal(t, "out-crt", claims.out)
-}
-
-func Test_reserveOutputs_conflict(t *testing.T) {
-	var claims ioClaims
-	err := reserveOutputs(&claims,
-		"out-key", "-",
-		"out-crt", "-",
-	)
-	require.EqualError(t, err, `-out-key and -out-crt both set to "-", only one output may write to stdout`)
-}
-
-func Test_reserveOutputs_panicsOnOddPairs(t *testing.T) {
-	defer func() {
-		r := recover()
-		require.NotNil(t, r)
-	}()
-	var claims ioClaims
-	_ = reserveOutputs(&claims, "out-key")
-}
-
-func Test_reserveInputs_noConflict(t *testing.T) {
-	var claims ioClaims
-	require.NoError(t, reserveInputs(&claims,
-		"ca-key", "/tmp/ca.key",
-		"ca-crt", "-",
-		"in-pub", "",
-	))
-	assert.Equal(t, "ca-crt", claims.in)
-}
-
-func Test_reserveInputs_conflict(t *testing.T) {
-	var claims ioClaims
-	err := reserveInputs(&claims,
-		"ca-key", "-",
-		"ca-crt", "-",
-	)
-	require.EqualError(t, err, `-ca-key and -ca-crt both set to "-", only one input may read from stdin`)
-}
-
-func Test_claimIn_idempotent(t *testing.T) {
-	// pre-claim then a lazy re-claim of the same flag should be a no-op
-	var claims ioClaims
-	require.NoError(t, claims.claimIn("ca-key"))
-	require.NoError(t, claims.claimIn("ca-key"))
-	assert.Equal(t, "ca-key", claims.in)
-}
-
-func Test_claimOut_idempotent(t *testing.T) {
-	var claims ioClaims
-	require.NoError(t, claims.claimOut("out-crt"))
-	require.NoError(t, claims.claimOut("out-crt"))
-	assert.Equal(t, "out-crt", claims.out)
-}
-
-func Test_isStdio(t *testing.T) {
-	assert.True(t, isStdio("-"))
-	assert.False(t, isStdio(""))
-	assert.False(t, isStdio("./-"))
-	assert.False(t, isStdio("foo"))
-}
@@ -39,26 +39,18 @@ func verify(args []string, out io.Writer, errOut io.Writer) error {
 		return err
 	}

-	var claims ioClaims
-	if err := reserveInputs(&claims,
-		"ca", *vf.caPath,
-		"crt", *vf.certPath,
-	); err != nil {
-		return err
-	}
-
-	caReader, err := openInput("ca", *vf.caPath, &claims)
+	caFile, err := os.Open(*vf.caPath)
 	if err != nil {
 		return fmt.Errorf("error while reading ca: %w", err)
 	}
-	defer caReader.Close()
+	defer caFile.Close()

-	caPool, err := cert.NewCAPoolFromPEMReader(caReader)
+	caPool, err := cert.NewCAPoolFromPEMReader(caFile)
 	if err != nil && !errors.Is(err, cert.ErrExpired) {
 		return fmt.Errorf("error while adding ca cert to pool: %w", err)
 	}

-	rawCert, err := readInput("crt", *vf.certPath, &claims)
+	rawCert, err := os.ReadFile(*vf.certPath)
 	if err != nil {
 		return fmt.Errorf("unable to read crt: %w", err)
 	}
@@ -93,7 +85,6 @@ func verifySummary() string {
 func verifyHelp(out io.Writer) {
 	vf := newVerifyFlags()
 	_, _ = out.Write([]byte("Usage of " + os.Args[0] + " " + verifySummary() + "\n"))
-	_, _ = out.Write([]byte(stdioHelpText))
 	vf.set.SetOutput(out)
 	vf.set.PrintDefaults()
 }
@@ -23,7 +23,6 @@ func Test_verifyHelp(t *testing.T) {
 	assert.Equal(
 		t,
 		"Usage of "+os.Args[0]+" verify <flags>: verifies a certificate isn't expired and was signed by a trusted authority.\n"+
-			"  Pass \"-\" to any path flag to read from stdin or write to stdout.\n"+
 			"  -ca string\n"+
 			"    \tRequired: path to a file containing one or more ca certificates\n"+
 			"  -crt string\n"+
@@ -123,46 +122,3 @@ func Test_verify(t *testing.T) {
 	assert.Empty(t, eb.String())
 	require.NoError(t, err)
 }
-
-func Test_verify_stdio(t *testing.T) {
-	ob := &bytes.Buffer{}
-	eb := &bytes.Buffer{}
-
-	caPub, caPriv, _ := ed25519.GenerateKey(rand.Reader)
-	ca, _ := NewTestCaCert("test-ca", caPub, caPriv, time.Now().Add(time.Hour*-1), time.Now().Add(time.Hour*2), nil, nil, nil)
-	caPEM, _ := ca.MarshalPEM()
-
-	crt, _ := NewTestCert(ca, caPriv, "test-cert", time.Now().Add(time.Hour*-1), time.Now().Add(time.Hour), nil, nil, nil)
-	crtPEM, _ := crt.MarshalPEM()
-
-	caFile, err := os.CreateTemp("", "verify-ca")
-	require.NoError(t, err)
-	defer os.Remove(caFile.Name())
-	caFile.Write(caPEM)
-
-	// crt on stdin, ca on disk
-	withStdin(t, bytes.NewReader(crtPEM))
-	require.NoError(t, verify([]string{"-ca", caFile.Name(), "-crt", "-"}, ob, eb))
-	assert.Empty(t, ob.String())
-	assert.Empty(t, eb.String())
-
-	// ca on stdin, crt on disk
-	certFile, err := os.CreateTemp("", "verify-cert")
-	require.NoError(t, err)
-	defer os.Remove(certFile.Name())
-	certFile.Write(crtPEM)
-
-	withStdin(t, bytes.NewReader(caPEM))
-	ob.Reset()
-	eb.Reset()
-	require.NoError(t, verify([]string{"-ca", "-", "-crt", certFile.Name()}, ob, eb))
-	assert.Empty(t, ob.String())
-	assert.Empty(t, eb.String())
-
-	// both flags on stdin should error
-	withStdin(t, bytes.NewReader(caPEM))
-	ob.Reset()
-	eb.Reset()
-	require.EqualError(t, verify([]string{"-ca", "-", "-crt", "-"}, ob, eb),
-		`-ca and -crt both set to "-", only one input may read from stdin`)
-}
@@ -1,5 +0,0 @@
-//go:build fips140enforce
-
-//go:debug fips140=only
-
-package main
@@ -53,12 +53,7 @@ func main() {
 	l := logging.NewLogger(os.Stdout)

 	if *serviceFlag != "" {
-		if *configTest {
-			fmt.Println("-test is not supported with -service, run the config test without -service")
-			os.Exit(1)
-		}
-
-		if err := doService(configPath, Build, serviceFlag); err != nil {
+		if err := doService(configPath, configTest, Build, serviceFlag); err != nil {
 			l.Error("Service command failed", "error", err)
 			os.Exit(1)
 		}
@@ -66,12 +61,9 @@ func main() {
 	}

 	if *configPath == "" {
-		p, err := config.DefaultPath()
-		if err != nil {
-			fmt.Println(err)
-			os.Exit(1)
-		}
-		*configPath = p
+		fmt.Println("-config flag must be set")
+		flag.Usage()
+		os.Exit(1)
 	}

 	c := config.NewC(l)
@@ -98,14 +90,15 @@ func main() {
 	}

 	if !*configTest {
-		if err := ctrl.Start(); err != nil {
+		wait, err := ctrl.Start()
+		if err != nil {
 			util.LogWithContextIfNeeded("Error while running", err, l)
 			os.Exit(1)
 		}

 		go ctrl.ShutdownBlock()

-		if err := ctrl.Wait(); err != nil {
+		if err := wait(); err != nil {
 			l.Error("Nebula stopped due to fatal error", "error", err)
 			os.Exit(2)
 		}
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"path/filepath"

 	"github.com/kardianos/service"
 	"github.com/slackhq/nebula"
@@ -15,6 +16,7 @@ var logger service.Logger

 type program struct {
 	configPath *string
+	configTest *bool
 	build      string
 	control    *nebula.Control
 }
@@ -40,47 +42,39 @@ func (p *program) Start(s service.Service) error {
 		}
 	})

-	p.control, err = nebula.Main(c, false, Build, l, nil)
+	p.control, err = nebula.Main(c, *p.configTest, Build, l, nil)
 	if err != nil {
 		return err
 	}

-	if err := p.control.Start(); err != nil {
-		return err
-	}
-
-	// Nebula can stop itself on a fatal packet reader error, make sure to log it if it happens.
-	go func() {
-		if err := p.control.Wait(); err != nil {
-			logger.Error(fmt.Sprintf("Nebula stopped due to fatal error: %v", err))
-			os.Exit(2)
-		}
-	}()
-
+	p.control.Start()
 	return nil
 }

 func (p *program) Stop(s service.Service) error {
 	logger.Info("Nebula service stopping.")
-	if p.control == nil {
-		return nil
-	}
-
 	p.control.Stop()
-
-	// block until nebula has fully drained before reporting stopped.
-	// error logging is handled by Start.
-	_ = p.control.Wait()
 	return nil
 }

-func doService(configPath *string, build string, serviceFlag *string) error {
+func fileExists(filename string) bool {
+	_, err := os.Stat(filename)
+	if os.IsNotExist(err) {
+		return false
+	}
+	return true
+}
+
+func doService(configPath *string, configTest *bool, build string, serviceFlag *string) error {
 	if *configPath == "" {
-		p, err := config.DefaultPath()
+		ex, err := os.Executable()
 		if err != nil {
 			return err
 		}
-		*configPath = p
+		*configPath = filepath.Dir(ex) + "/config.yaml"
+		if !fileExists(*configPath) {
+			*configPath = filepath.Dir(ex) + "/config.yml"
+		}
 	}

 	svcConfig := &service.Config{
@@ -92,6 +86,7 @@ func doService(configPath *string, build string, serviceFlag *string) error {

 	prg := &program{
 		configPath: configPath,
+		configTest: configTest,
 		build:      build,
 	}

@@ -123,9 +118,8 @@ func doService(configPath *string, build string, serviceFlag *string) error {
 	switch *serviceFlag {
 	case "run":
 		if err := s.Run(); err != nil {
-			// Route any errors to the system logger and report the failure
+			// Route any errors to the system logger
 			logger.Error(err)
-			return err
 		}
 	default:
 		if err := service.Control(s, *serviceFlag); err != nil {
@@ -1,96 +0,0 @@
-//go:build linux && !android && !e2e_testing
-
-package main
-
-import (
-	"fmt"
-	"net/netip"
-	"os"
-	"path/filepath"
-	"runtime"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula"
-	"github.com/slackhq/nebula/cert"
-	cert_test "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/test"
-	"github.com/stretchr/testify/require"
-)
-
-// TestControlStopClosesOnTimer reproduces the dnclient lifecycle: nebula runs as
-// a library, and on a config update dnclient calls Stop() in-process to tear the
-// old instance down before starting a new one. This boots a real nebula (real
-// blocking UDP sockets, tun disabled), lets it run, then Stop()s it on a timer
-// and asserts it actually closes. If the reader goroutines parked in recvmmsg
-// don't wake on Close(), Wait() blocks forever and this fails with a goroutine
-// dump instead of relying on a process signal to unstick them.
-func TestControlStopClosesOnTimer(t *testing.T) {
-	l := test.NewLogger()
-	dir := t.TempDir()
-
-	before := time.Now().Add(-time.Hour)
-	after := time.Now().Add(time.Hour)
-	ca, _, caKey, caPEM := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, before, after, nil, nil, nil)
-	networks := []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")}
-	_, _, keyPEM, certPEM := cert_test.NewTestCert(cert.Version2, cert.Curve_CURVE25519, ca, caKey, "close-on-timer", before, after, networks, nil, nil)
-
-	caPath := filepath.Join(dir, "ca.pem")
-	certPath := filepath.Join(dir, "cert.pem")
-	keyPath := filepath.Join(dir, "key.pem")
-	require.NoError(t, os.WriteFile(caPath, caPEM, 0o600))
-	require.NoError(t, os.WriteFile(certPath, certPEM, 0o600))
-	require.NoError(t, os.WriteFile(keyPath, keyPEM, 0o600))
-
-	// tun disabled so no device/root is needed; routines: 2 so we exercise the
-	// multi-socket (SO_REUSEPORT) teardown, which is where dnclient runs.
-	configBody := fmt.Sprintf(`
-pki:
-  ca: %s
-  cert: %s
-  key: %s
-listen:
-  host: 127.0.0.1
-  port: 0
-tun:
-  disabled: true
-firewall:
-  outbound:
-    - port: any
-      proto: any
-      host: any
-  inbound:
-    - port: any
-      proto: any
-      host: any
-routines: 2
-`, caPath, certPath, keyPath)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yml"), []byte(configBody), 0o600))
-
-	c := config.NewC(l)
-	require.NoError(t, c.Load(dir))
-
-	ctrl, err := nebula.Main(c, false, "close-on-timer", l, nil)
-	require.NoError(t, err)
-	require.NoError(t, ctrl.Start())
-
-	// Run like a live nebula, then close on a timer, exactly as dnclient does.
-	<-time.NewTimer(5 * time.Second).C
-
-	stopped := make(chan struct{})
-	go func() {
-		ctrl.Stop() // closes the udp sockets (shutdown(2)) and the tun
-		ctrl.Wait() // blocks until every reader goroutine has returned
-		close(stopped)
-	}()
-
-	select {
-	case <-stopped:
-		t.Log("nebula closed cleanly on timer")
-	case <-time.After(10 * time.Second):
-		buf := make([]byte, 1<<20)
-		n := runtime.Stack(buf, true)
-		t.Fatalf("nebula did NOT close within 10s of Stop(): a blocking reader never woke\n%s", buf[:n])
-	}
-}
@@ -1,5 +0,0 @@
-//go:build fips140enforce
-
-//go:debug fips140=only
-
-package main
@@ -50,12 +50,9 @@ func main() {
 	}

 	if *configPath == "" {
-		p, err := config.DefaultPath()
-		if err != nil {
-			fmt.Println(err)
-			os.Exit(1)
-		}
-		*configPath = p
+		fmt.Println("-config flag must be set")
+		flag.Usage()
+		os.Exit(1)
 	}

 	l := logging.NewLogger(os.Stdout)
@@ -84,7 +81,8 @@ func main() {
 	}

 	if !*configTest {
-		if err := ctrl.Start(); err != nil {
+		wait, err := ctrl.Start()
+		if err != nil {
 			util.LogWithContextIfNeeded("Error while running", err, l)
 			os.Exit(1)
 		}
@@ -92,7 +90,7 @@ func main() {
 		go ctrl.ShutdownBlock()
 		notifyReady(l)

-		if err := ctrl.Wait(); err != nil {
+		if err := wait(); err != nil {
 			l.Error("Nebula stopped due to fatal error", "error", err)
 			os.Exit(2)
 		}
@@ -1,29 +0,0 @@
-package config
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-)
-
-// DefaultPath returns a path to a config file alongside the running executable, preferring config.yaml over config.yml.
-// If neither file exists an error is returned that names both paths checked.
-func DefaultPath() (string, error) {
-	ex, err := os.Executable()
-	if err != nil {
-		return "", err
-	}
-	return defaultPathInDir(filepath.Dir(ex))
-}
-
-func defaultPathInDir(dir string) (string, error) {
-	yamlPath := filepath.Join(dir, "config.yaml")
-	if _, err := os.Stat(yamlPath); err == nil {
-		return yamlPath, nil
-	}
-	ymlPath := filepath.Join(dir, "config.yml")
-	if _, err := os.Stat(ymlPath); err == nil {
-		return ymlPath, nil
-	}
-	return "", fmt.Errorf("no default config found at %s or %s", yamlPath, ymlPath)
-}
@@ -1,67 +0,0 @@
-package config
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDefaultPathInDir(t *testing.T) {
-	t.Run("prefers config.yaml when both exist", func(t *testing.T) {
-		dir := t.TempDir()
-		want := filepath.Join(dir, "config.yaml")
-		other := filepath.Join(dir, "config.yml")
-		require.NoError(t, os.WriteFile(want, []byte("a: 1"), 0644))
-		require.NoError(t, os.WriteFile(other, []byte("a: 2"), 0644))
-
-		got, err := defaultPathInDir(dir)
-		require.NoError(t, err)
-		assert.Equal(t, want, got)
-	})
-
-	t.Run("returns config.yaml when only it exists", func(t *testing.T) {
-		dir := t.TempDir()
-		want := filepath.Join(dir, "config.yaml")
-		require.NoError(t, os.WriteFile(want, []byte("a: 1"), 0644))
-
-		got, err := defaultPathInDir(dir)
-		require.NoError(t, err)
-		assert.Equal(t, want, got)
-	})
-
-	t.Run("falls back to config.yml when only it exists", func(t *testing.T) {
-		dir := t.TempDir()
-		want := filepath.Join(dir, "config.yml")
-		require.NoError(t, os.WriteFile(want, []byte("a: 1"), 0644))
-
-		got, err := defaultPathInDir(dir)
-		require.NoError(t, err)
-		assert.Equal(t, want, got)
-	})
-
-	t.Run("errors when neither exists and names both paths", func(t *testing.T) {
-		dir := t.TempDir()
-		got, err := defaultPathInDir(dir)
-		assert.Empty(t, got)
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), filepath.Join(dir, "config.yaml"))
-		assert.Contains(t, err.Error(), filepath.Join(dir, "config.yml"))
-	})
-}
-
-func TestDefaultPath(t *testing.T) {
-	got, err := DefaultPath()
-	if err != nil {
-		ex, exErr := os.Executable()
-		require.NoError(t, exErr)
-		assert.Contains(t, err.Error(), filepath.Dir(ex))
-		return
-	}
-	ex, err := os.Executable()
-	require.NoError(t, err)
-	assert.Equal(t, filepath.Dir(ex), filepath.Dir(got))
-	assert.Contains(t, []string{"config.yaml", "config.yml"}, filepath.Base(got))
-}
@@ -105,18 +105,11 @@ func (cm *connectionManager) getInactivityTimeout() time.Duration {
 }

 func (cm *connectionManager) In(h *HostInfo) {
-	h.markIn()
+	h.in.Store(true)
 }

-// OutNoRebind records outbound traffic without consuming the rebind epoch, for relayed sends: the direct path
-// to the relay consumes the edge, the via send must not.
-func (cm *connectionManager) OutNoRebind(h *HostInfo) {
-	h.markOutOnly()
-}
-
-// Out records outbound traffic and reports whether we rebound since this tunnel last sent
-func (cm *connectionManager) Out(h *HostInfo) bool {
-	return h.markOut(cm.intf.rebindEpoch.Load())
+func (cm *connectionManager) Out(h *HostInfo) {
+	h.out.Store(true)
 }

 func (cm *connectionManager) RelayUsed(localIndex uint32) {
@@ -135,13 +128,22 @@ func (cm *connectionManager) RelayUsed(localIndex uint32) {
 // getAndResetTrafficCheck returns if there was any inbound or outbound traffic within the last tick and
 // resets the state for this local index
 func (cm *connectionManager) getAndResetTrafficCheck(h *HostInfo, now time.Time) (bool, bool) {
-	in, out := h.takeTraffic()
+	in := h.in.Swap(false)
+	out := h.out.Swap(false)
 	if in || out {
 		h.lastUsed = now
 	}
 	return in, out
 }

+// AddTrafficWatch must be called for every new HostInfo.
+// We will continue to monitor the HostInfo until the tunnel is dropped.
+func (cm *connectionManager) AddTrafficWatch(h *HostInfo) {
+	if h.out.Swap(true) == false {
+		cm.trafficTimer.Add(h.localIndexId, cm.checkInterval)
+	}
+}
+
 func (cm *connectionManager) Start(ctx context.Context) {
 	clockSource := time.NewTicker(cm.trafficTimer.t.tickDuration)
 	defer clockSource.Stop()
@@ -197,27 +199,6 @@ func (cm *connectionManager) doTrafficCheck(localIndex uint32, p, nb, out []byte
 	}

 	cm.resetRelayTrafficCheck(hostinfo)
-	cm.maintainLanes(localIndex, decision, hostinfo, now, nb, out)
-}
-
-// maintainLanes piggybacks multiport lane probing on the per-tunnel traffic
-// tick. This tick is the right place for it precisely because lanes are
-// demand-driven: a tunnel only lands here when it has traffic, which is the
-// same condition that raises lane demand.
-//
-// makeTrafficDecision returns a nil hostinfo on some keep-alive paths, so
-// re-resolve the index in that case.
-func (cm *connectionManager) maintainLanes(localIndex uint32, decision trafficDecision, hostinfo *HostInfo, now time.Time, nb, out []byte) {
-	if decision == deleteTunnel || decision == closeTunnel {
-		return
-	}
-	if hostinfo == nil {
-		hostinfo = cm.hostMap.QueryIndex(localIndex)
-		if hostinfo == nil {
-			return
-		}
-	}
-	cm.intf.probeLanes(hostinfo, now, nb, out)
 }

 func (cm *connectionManager) resetRelayTrafficCheck(hostinfo *HostInfo) {
@@ -325,8 +306,8 @@ func (cm *connectionManager) migrateRelayUsed(oldhostinfo, newhostinfo *HostInfo
 		} else {
 			cm.intf.SendMessageToHostInfo(header.Control, 0, newhostinfo, msg, make([]byte, 12), make([]byte, mtu))
 			cm.l.Info("send CreateRelayRequest",
-				"relayFrom", relayFrom,
-				"relayTo", relayTo,
+				"relayFrom", req.RelayFromAddr,
+				"relayTo", req.RelayToAddr,
 				"initiatorRelayIndex", req.InitiatorRelayIndex,
 				"responderRelayIndex", req.ResponderRelayIndex,
 				"vpnAddrs", newhostinfo.vpnAddrs,
@@ -350,15 +331,6 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 		return closeTunnel, hostinfo, nil
 	}

-	// The highest counter across the base session and its lanes: the lanes carry
-	// the data, so the base counter alone would sit near zero while a lane runs
-	// its keys past the nonce ceiling.
-	if hostinfo.maxMessageCounter() >= RejectAfterMessages {
-		// Send path can't encrypt a CloseTunnel notify, so just delete locally; the peer recovers via recv_error.
-		hostinfo.logger(cm.l).Error("Dropping tunnel, message counter is exhausted")
-		return deleteTunnel, hostinfo, nil
-	}
-
 	primary := cm.hostMap.Hosts[hostinfo.vpnAddrs[0]]
 	mainHostInfo := true
 	if primary != nil && primary != hostinfo {
@@ -376,7 +348,7 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 				"tunnelCheck", m{"state": "alive", "method": "passive"},
 			)
 		}
-		hostinfo.setPendingDeletion(false)
+		hostinfo.pendingDeletion.Store(false)

 		if mainHostInfo {
 			decision = tryRehandshake
@@ -399,7 +371,7 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 		return decision, hostinfo, primary
 	}

-	if hostinfo.isPendingDeletion() {
+	if hostinfo.pendingDeletion.Load() {
 		// We have already sent a test packet and nothing was returned, this hostinfo is dead
 		hostinfo.logger(cm.l).Info("Tunnel status",
 			"tunnelCheck", m{"state": "dead", "method": "active"},
@@ -450,7 +422,7 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 		}
 	}

-	hostinfo.setPendingDeletion(true)
+	hostinfo.pendingDeletion.Store(true)
 	cm.trafficTimer.Add(hostinfo.localIndexId, cm.pendingDeletionInterval)
 	return decision, hostinfo, nil
 }
@@ -461,7 +433,6 @@ func (cm *connectionManager) isInactive(hostinfo *HostInfo, now time.Time) (time
 		return 0, false
 	}

-	// Lane traffic is this hostinfo's traffic, so lastUsed already covers it.
 	inactiveDuration := now.Sub(hostinfo.lastUsed)
 	if inactiveDuration < cm.getInactivityTimeout() {
 		// It's not considered inactive
@@ -485,11 +456,6 @@ func (cm *connectionManager) shouldSwapPrimary(current *HostInfo) bool {
 		return false
 	}

-	if current.maxMessageCounter() >= RehandshakeAfterMessages {
-		// This tunnel is being rolled for counter exhaustion, never swap back onto its spent key.
-		return false
-	}
-
 	crt := cm.intf.pki.getCertState().getCertificate(current.ConnectionState.myCert.Version())
 	if crt == nil {
 		//my cert was reloaded away. We should definitely swap from this tunnel
@@ -586,15 +552,6 @@ func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 			"reason", "current cert version < pki.initiatingVersion",
 		)

-		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
-		return
-	}
-	if hostinfo.maxMessageCounter() >= RehandshakeAfterMessages {
-		cm.l.Info("Re-handshaking with remote",
-			"vpnAddrs", hostinfo.vpnAddrs,
-			"reason", "message counter rehandshake threshold reached",
-		)
-
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}
@@ -25,7 +25,6 @@ func newTestLighthouse() *LightHouse {
 	lighthouses := []netip.Addr{}
 	staticList := map[netip.Addr]struct{}{}

-	lh.localAddrsFn = func(*LocalAllowList) []netip.Addr { return nil }
 	lh.lighthouses.Store(&lighthouses)
 	lh.staticList.Store(&staticList)

@@ -86,25 +85,25 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 	// We saw traffic out to vpnIp
 	nc.Out(hostinfo)
 	nc.In(hostinfo)
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.False(t, hostinfo.pendingDeletion.Load())
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
-	assert.True(t, hostinfo.sentSinceCheck())
-	assert.True(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.True(t, hostinfo.out.Load())
+	assert.True(t, hostinfo.in.Load())

 	// Do a traffic check tick, should not be pending deletion but should not have any in/out packets recorded
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.False(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())

 	// Do another traffic check tick, this host should be pending deletion now
 	nc.Out(hostinfo)
-	assert.True(t, hostinfo.sentSinceCheck())
+	assert.True(t, hostinfo.out.Load())
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.True(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.True(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])

@@ -168,110 +167,37 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 	// We saw traffic out to vpnIp
 	nc.Out(hostinfo)
 	nc.In(hostinfo)
-	assert.True(t, (hostinfo.state.Load()&stateIn != 0))
-	assert.True(t, hostinfo.sentSinceCheck())
-	assert.False(t, hostinfo.isPendingDeletion())
+	assert.True(t, hostinfo.in.Load())
+	assert.True(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.pendingDeletion.Load())
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)

 	// Do a traffic check tick, should not be pending deletion but should not have any in/out packets recorded
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.False(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())

 	// Do another traffic check tick, this host should be pending deletion now
 	nc.Out(hostinfo)
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.True(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.True(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])

 	// We saw traffic, should no longer be pending deletion
 	nc.In(hostinfo)
 	nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
-	assert.False(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 }

-func Test_NewConnectionManager_CounterLimits(t *testing.T) {
-	l := test.NewLogger()
-	localrange := netip.MustParsePrefix("10.1.1.1/24")
-	vpnIp := netip.MustParseAddr("172.1.1.2")
-	preferredRanges := []netip.Prefix{localrange}
-
-	// Very incomplete mock objects
-	hostMap := newHostMap(l)
-	hostMap.preferredRanges.Store(&preferredRanges)
-
-	cs := &CertState{
-		initiatingVersion: cert.Version1,
-		privateKey:        []byte{},
-		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
-	}
-
-	lh := newTestLighthouse()
-	ifce := &Interface{
-		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
-		outside:          &udp.NoopConn{},
-		firewall:         &Firewall{},
-		lightHouse:       lh,
-		pki:              &PKI{},
-		myVpnAddrs:       []netip.Addr{netip.MustParseAddr("172.1.1.1")}, // sorts below vpnIp so shouldSwapPrimary can proceed
-		handshakeManager: NewHandshakeManager(l, hostMap, lh, &udp.NoopConn{}, defaultHandshakeConfig),
-		l:                l,
-	}
-	ifce.pki.cs.Store(cs)
-
-	conf := config.NewC(test.NewLogger())
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf, nil)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
-	nc.intf = ifce
-
-	hostinfo := &HostInfo{
-		vpnAddrs:      []netip.Addr{vpnIp},
-		localIndexId:  1099,
-		remoteIndexId: 9901,
-	}
-	hostinfo.ConnectionState = &ConnectionState{
-		myCert: &dummyCert{version: cert.Version1},
-	}
-	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
-
-	// Below the rehandshake threshold, no handshake is started
-	hostinfo.ConnectionState.messageCounter.Store(RehandshakeAfterMessages - 1)
-	nc.tryRehandshake(hostinfo)
-	assert.Nil(t, ifce.handshakeManager.QueryVpnAddr(vpnIp))
-
-	// A tunnel on its current cert would normally swap to primary
-	assert.True(t, nc.shouldSwapPrimary(hostinfo))
-
-	// At the rehandshake threshold, a new handshake is started
-	hostinfo.ConnectionState.messageCounter.Store(RehandshakeAfterMessages)
-	nc.tryRehandshake(hostinfo)
-	assert.NotNil(t, ifce.handshakeManager.QueryVpnAddr(vpnIp))
-
-	// An exhausted tunnel being rolled must never swap back to primary onto its spent key
-	assert.False(t, nc.shouldSwapPrimary(hostinfo))
-
-	// Still below the reject limit, the tunnel stays up
-	nc.In(hostinfo)
-	decision, _, _ := nc.makeTrafficDecision(hostinfo.localIndexId, time.Now())
-	assert.Equal(t, tryRehandshake, decision)
-
-	// At the reject limit, the tunnel is deleted locally without a doomed CloseTunnel notify
-	hostinfo.ConnectionState.messageCounter.Store(RejectAfterMessages)
-	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, time.Now())
-	assert.Equal(t, deleteTunnel, decision)
-}
-
 func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	l := test.NewLogger()
 	localrange := netip.MustParsePrefix("10.1.1.1/24")
@@ -326,31 +252,31 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	// Do a traffic check tick, in and out should be cleared but should not be pending deletion
 	nc.Out(hostinfo)
 	nc.In(hostinfo)
-	assert.True(t, hostinfo.sentSinceCheck())
-	assert.True(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.True(t, hostinfo.out.Load())
+	assert.True(t, hostinfo.in.Load())

 	now := time.Now()
 	decision, _, _ := nc.makeTrafficDecision(hostinfo.localIndexId, now)
 	assert.Equal(t, tryRehandshake, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())

 	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, now.Add(time.Second*5))
 	assert.Equal(t, doNothing, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())

 	// Do another traffic check tick, should still not be pending deletion
 	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, now.Add(time.Second*10))
 	assert.Equal(t, doNothing, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])

@@ -358,9 +284,9 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, now.Add(time.Minute*10))
 	assert.Equal(t, closeTunnel, decision)
 	assert.Equal(t, now, hostinfo.lastUsed)
-	assert.False(t, hostinfo.isPendingDeletion())
-	assert.False(t, hostinfo.sentSinceCheck())
-	assert.False(t, (hostinfo.state.Load()&stateIn != 0))
+	assert.False(t, hostinfo.pendingDeletion.Load())
+	assert.False(t, hostinfo.out.Load())
+	assert.False(t, hostinfo.in.Load())
 	assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 }
@@ -1,41 +1,16 @@
 package nebula

 import (
-	"crypto/hkdf"
-	"crypto/sha256"
 	"encoding/json"
-	"fmt"
-	"log/slog"
-	"strconv"
 	"sync"
 	"sync/atomic"

 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/handshake"
-	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/noiseutil"
 )

-const (
-	ReplayWindow = 8192
-
-	// RehandshakeAfterMessages rolls keys inside the AES-GCM data-volume margin (~2^-36 advantage at 64KB frames).
-	RehandshakeAfterMessages = uint64(1) << 34
-
-	// RejectAfterMessages is the nonce ceiling enforced by noiseutil; a tunnel here is deleted locally, not notified.
-	RejectAfterMessages = noiseutil.RejectAfterMessages
-)
-
-// RehandshakeAfterMessages must stay below RejectAfterMessages so tunnels roll before the hard send stop.
-const _ = RejectAfterMessages - RehandshakeAfterMessages
-
-// sessionEpoch hands out a receiver-local ordinal to every ConnectionState at creation. The RX
-// staging sort (overlay/batch) orders packets by (epoch, message counter). A re-handshake never
-// rekeys an existing tunnel; it brings up a new hostinfo and ConnectionState with a counter space
-// starting near zero, while the old tunnel keeps decrypting until torn down. During that cutover
-// one flush batch can hold packets from both tunnels, and the epoch keeps the old tunnel's
-// packets sorted first.
-var sessionEpoch atomic.Uint64
+const ReplayWindow = 8192

 type ConnectionState struct {
 	eKey           noiseutil.CipherState
@@ -45,22 +20,14 @@ type ConnectionState struct {
 	initiator      bool
 	messageCounter atomic.Uint64
 	window         *Bits
-	decryptLock    sync.Mutex
 	writeLock      sync.Mutex
-	// epoch is this session's sessionEpoch ordinal. Immutable after creation.
-	epoch uint64
 }

 // newConnectionStateFromResult builds a fully-populated ConnectionState from a
 // completed handshake.Result. It seeds messageCounter and the replay window so
 // that the post-handshake message indices already used on the wire don't count
 // as missed traffic in the data plane.
-func newConnectionStateFromResult(r *handshake.Result) (*ConnectionState, error) {
-	// Refuse a MessageIndex too big for the replay window: it can only be a bug, and would spin the seed loop below.
-	if r.MessageIndex >= ReplayWindow {
-		return nil, fmt.Errorf("handshake message index %d exceeds replay window", r.MessageIndex)
-	}
-
+func newConnectionStateFromResult(r *handshake.Result) *ConnectionState {
 	ci := &ConnectionState{
 		myCert:    r.MyCert,
 		initiator: r.Initiator,
@@ -68,60 +35,12 @@ func newConnectionStateFromResult(r *handshake.Result) (*ConnectionState, error)
 		eKey:      noiseutil.NewCipherState(r.EKey, r.Cipher),
 		dKey:      noiseutil.NewCipherState(r.DKey, r.Cipher),
 		window:    NewBits(ReplayWindow),
-		epoch:     sessionEpoch.Add(1),
 	}
 	ci.messageCounter.Add(r.MessageIndex)
 	for i := uint64(1); i <= r.MessageIndex; i++ {
 		ci.window.Update(nil, i)
 	}
-	return ci, nil
-}
-
-// newLaneConnectionState derives multiport lane s's session from the base
-// tunnel's material. Each key is an HKDF expansion of the base tunnel's matching
-// key, labelled with the lane index, so the pair stays matched with no extra
-// negotiation: Noise leaves our send key equal to the peer's receive key, and
-// expanding both with the same label preserves that.
-//
-// The lane gets its own counter and replay window starting from zero. No
-// handshake messages were spent on it, so unlike the base session there is
-// nothing to seed.
-func newLaneConnectionState(m *laneMaterial, lane uint8) (*ConnectionState, error) {
-	if lane == 0 {
-		return nil, fmt.Errorf("lane 0 is the base session")
-	}
-
-	eKey, err := deriveLaneKey(m.eKey, lane)
-	if err != nil {
-		return nil, err
-	}
-	dKey, err := deriveLaneKey(m.dKey, lane)
-	if err != nil {
-		return nil, err
-	}
-
-	return &ConnectionState{
-		myCert:    m.myCert,
-		initiator: m.initiator,
-		peerCert:  m.peerCert,
-		eKey:      noiseutil.NewCipherStateFromKey(eKey, m.cipher),
-		dKey:      noiseutil.NewCipherStateFromKey(dKey, m.cipher),
-		window:    NewBits(ReplayWindow),
-		epoch:     sessionEpoch.Add(1),
-	}, nil
-}
-
-// deriveLaneKey expands a base tunnel key into the key for one lane.
-func deriveLaneKey(base [32]byte, lane uint8) ([32]byte, error) {
-	var out [32]byte
-	// The base key is already unique to this tunnel and direction, so the lane
-	// index is the only thing that needs to vary; no salt is required.
-	k, err := hkdf.Key(sha256.New, base[:], nil, laneKeyInfo+" "+strconv.Itoa(int(lane)), len(out))
-	if err != nil {
-		return out, err
-	}
-	copy(out[:], k)
-	return out, nil
+	return ci
 }

 func (cs *ConnectionState) MarshalJSON() ([]byte, error) {
@@ -132,76 +51,6 @@ func (cs *ConnectionState) MarshalJSON() ([]byte, error) {
 	})
 }

-// NextMessageCounter reserves the next 1-based counter; RejectAfterMessages is the first we refuse, pinned to not wrap.
-func (cs *ConnectionState) NextMessageCounter() (uint64, bool) {
-	c := cs.messageCounter.Add(1)
-	if c >= RejectAfterMessages {
-		cs.messageCounter.Store(RejectAfterMessages)
-		return c, false
-	}
-	return c, true
-}
-
 func (cs *ConnectionState) Curve() cert.Curve {
 	return cs.myCert.Curve()
 }
-
-func (cs *ConnectionState) Decrypt(l *slog.Logger, messageCounter uint64, packet []byte, nb []byte) ([]byte, error) {
-	cs.decryptLock.Lock()
-	result := cs.window.Check(l, messageCounter)
-	cs.decryptLock.Unlock()
-	if !result {
-		return nil, ErrAlreadySeen
-	}
-
-	out, err := cs.dKey.DecryptDanger(packet[header.Len:header.Len], packet[:header.Len], packet[header.Len:], messageCounter, nb)
-	if err != nil {
-		return nil, err
-	}
-
-	cs.decryptLock.Lock()
-	result = cs.window.Update(l, messageCounter)
-	cs.decryptLock.Unlock()
-	if !result {
-		return nil, ErrAlreadySeen
-	}
-	return out, nil
-}
-
-// noteSeen records a counter that some other session for the same keys already
-// accepted, so a packet doesn't become replayable just because the session that
-// decrypted it was thrown away. See laneSet.installSession, its only caller.
-func (cs *ConnectionState) noteSeen(l *slog.Logger, messageCounter uint64) {
-	cs.decryptLock.Lock()
-	cs.window.Update(l, messageCounter)
-	cs.decryptLock.Unlock()
-}
-
-func (cs *ConnectionState) VerifyRelay(l *slog.Logger, messageCounter uint64, packet []byte, nb []byte) error {
-	cs.decryptLock.Lock()
-	result := cs.window.Check(l, messageCounter)
-	cs.decryptLock.Unlock()
-	if !result {
-		return ErrAlreadySeen
-	}
-
-	// The entire body is sent as AD, not encrypted.
-	// The packet consists of a 16-byte parsed Nebula header, Associated Data-protected payload, and a trailing 16-byte AEAD signature value.
-	// The packet is guaranteed to be at least 16 bytes at this point, b/c it got past the h.Parse() call above. If it's
-	// otherwise malformed (meaning, there is no trailing 16 byte AEAD value), then this will result in at worst a 0-length slice
-	// which will gracefully fail in the DecryptDanger call.
-	signedPayload := packet[:len(packet)-cs.dKey.Overhead()]
-	signatureValue := packet[len(packet)-cs.dKey.Overhead():]
-	_, err := cs.dKey.DecryptDanger(nil, signedPayload, signatureValue, messageCounter, nb)
-	if err != nil {
-		return err
-	}
-
-	cs.decryptLock.Lock()
-	result = cs.window.Update(l, messageCounter)
-	cs.decryptLock.Unlock()
-	if !result {
-		return ErrAlreadySeen
-	}
-	return nil
-}
@@ -6,13 +6,10 @@ import (
 	"time"

 	"github.com/flynn/noise"
-	"github.com/rcrowley/go-metrics"
 	"github.com/slackhq/nebula/cert"
 	ct "github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/handshake"
 	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/test"
-	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -58,7 +55,6 @@ func runTestHandshake(t *testing.T) (initR, respR *handshake.Result) {
 		cert.Version2, initCreds, verifier,
 		func() (uint32, error) { return 1000, nil },
 		true, header.HandshakeIXPSK0,
-		nil,
 	)
 	require.NoError(t, err)

@@ -66,7 +62,6 @@ func runTestHandshake(t *testing.T) (initR, respR *handshake.Result) {
 		cert.Version2, respCreds, verifier,
 		func() (uint32, error) { return 2000, nil },
 		false, header.HandshakeIXPSK0,
-		nil,
 	)
 	require.NoError(t, err)

@@ -84,77 +79,11 @@ func runTestHandshake(t *testing.T) (initR, respR *handshake.Result) {
 	return initR, respR
 }

-func TestConnectionState_NextMessageCounter(t *testing.T) {
-	cs := &ConnectionState{}
-	cs.messageCounter.Store(RejectAfterMessages - 2)
-
-	c, ok := cs.NextMessageCounter()
-	assert.True(t, ok)
-	assert.Equal(t, RejectAfterMessages-1, c)
-
-	// Hitting the limit refuses and pins the counter there
-	c, ok = cs.NextMessageCounter()
-	assert.False(t, ok)
-	assert.Equal(t, RejectAfterMessages, c)
-	assert.Equal(t, RejectAfterMessages, cs.messageCounter.Load())
-
-	// Continued send attempts stay refused and the counter never wraps
-	for i := 0; i < 10; i++ {
-		_, ok = cs.NextMessageCounter()
-		assert.False(t, ok)
-	}
-	assert.Equal(t, RejectAfterMessages, cs.messageCounter.Load())
-}
-
-// TestSendNoMetricsDropsExhausted drives the send path to the exhausted drop; metric and out flag prove it.
-func TestSendNoMetricsDropsExhausted(t *testing.T) {
-	initR, _ := runTestHandshake(t)
-	ci, err := newConnectionStateFromResult(initR)
-	require.NoError(t, err)
-	ci.messageCounter.Store(RejectAfterMessages - 1)
-
-	f := &Interface{l: test.NewLogger(), messageMetrics: &MessageMetrics{txExhausted: metrics.NewCounter()}}
-	hostinfo := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.1")}, ConnectionState: ci}
-
-	f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, []byte{}, make([]byte, 12), make([]byte, mtu), 0)
-
-	// The crossing send is refused: it records an exhaustion drop and never reaches connectionManager.Out.
-	assert.Equal(t, int64(1), f.messageMetrics.txExhausted.Count())
-	assert.False(t, hostinfo.sentSinceCheck())
-}
-
-// TestSendNoMetricsCloseTunnelKeepsRebindEpoch pins that a closing tunnel does not consume a rebind, a later
-// packet on a re-established tunnel still needs that edge to trigger the far-side punch.
-func TestSendNoMetricsCloseTunnelKeepsRebindEpoch(t *testing.T) {
-	initR, _ := runTestHandshake(t)
-	ci, err := newConnectionStateFromResult(initR)
-	require.NoError(t, err)
-
-	f := &Interface{
-		l:                 test.NewLogger(),
-		messageMetrics:    &MessageMetrics{txExhausted: metrics.NewCounter()},
-		writers:           []udp.Conn{udp.NoopConn{}},
-		connectionManager: &connectionManager{},
-	}
-	hostinfo := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.1")}, ConnectionState: ci}
-
-	// Tunnel is on epoch 0, then we rebind.
-	hostinfo.markOut(0)
-	f.rebindEpoch.Add(1)
-
-	remote := netip.MustParseAddrPort("10.0.0.2:4242")
-	f.sendNoMetrics(header.CloseTunnel, 0, ci, hostinfo, remote, []byte{}, make([]byte, 12), make([]byte, mtu), 0)
-
-	// markOut at the new epoch still reports the move, so the edge was preserved.
-	assert.True(t, hostinfo.markOut(1), "a CloseTunnel send must not consume the rebind epoch")
-}
-
 func TestNewConnectionStateFromResult(t *testing.T) {
 	initR, respR := runTestHandshake(t)

 	t.Run("initiator", func(t *testing.T) {
-		ci, err := newConnectionStateFromResult(initR)
-		require.NoError(t, err)
+		ci := newConnectionStateFromResult(initR)
 		assert.True(t, ci.initiator)
 		assert.Equal(t, initR.MyCert, ci.myCert)
 		assert.Equal(t, initR.RemoteCert, ci.peerCert)
@@ -173,17 +102,8 @@ func TestNewConnectionStateFromResult(t *testing.T) {
 		assert.True(t, ci.window.Check(nil, 3), "counter 3 must not be pre-seeded")
 	})

-	t.Run("message index too large is refused", func(t *testing.T) {
-		bad := *initR
-		bad.MessageIndex = ReplayWindow
-		ci, err := newConnectionStateFromResult(&bad)
-		require.Error(t, err)
-		assert.Nil(t, ci)
-	})
-
 	t.Run("responder", func(t *testing.T) {
-		ci, err := newConnectionStateFromResult(respR)
-		require.NoError(t, err)
+		ci := newConnectionStateFromResult(respR)
 		assert.False(t, ci.initiator)
 		assert.Equal(t, respR.MyCert, ci.myCert)
 		assert.Equal(t, respR.RemoteCert, ci.peerCert)
@@ -53,7 +53,6 @@ type Control struct {
 	statsStart             func()
 	dnsStart               func()
 	lighthouseStart        func()
-	networkChangeStart     func(rebind func())
 	connectionManagerStart func(context.Context)
 }

@@ -67,42 +66,32 @@ type ControlHostInfo struct {
 	CurrentRemote          netip.AddrPort   `json:"currentRemote"`
 	CurrentRelaysToMe      []netip.Addr     `json:"currentRelaysToMe"`
 	CurrentRelaysThroughMe []netip.Addr     `json:"currentRelaysThroughMe"`
-	Lanes                  []ControlLane    `json:"lanes,omitempty"`
-}
-
-// ControlLane reports one multiport lane of a tunnel. Only lanes we may send on
-// are listed; receive-only lanes have no state worth showing.
-type ControlLane struct {
-	Index          uint8          `json:"index"`
-	Up             bool           `json:"up"`
-	Remote         netip.AddrPort `json:"remote,omitempty"`
-	MessageCounter uint64         `json:"messageCounter"`
 }

 // Start actually runs nebula, this is a nonblocking call.
-// Use Wait to block until nebula has fully stopped and to learn whether a fatal reader error caused the shutdown.
-func (c *Control) Start() error {
+// The returned function blocks until nebula has fully stopped and returns the
+// first fatal reader error (if any). A nil error means nebula shut down
+// gracefully; a non-nil error means a reader hit an unexpected failure that
+// triggered the shutdown.
+func (c *Control) Start() (func() error, error) {
 	c.stateLock.Lock()
 	defer c.stateLock.Unlock()
 	switch c.state {
 	case StateReady:
 		//yay!
 	case StateStopped, StateStopping:
-		return ErrAlreadyStopped
+		return nil, ErrAlreadyStopped
 	case StateStarted:
-		return ErrAlreadyStarted
+		return nil, ErrAlreadyStarted
 	default:
-		return ErrUnknownState
+		return nil, ErrUnknownState
 	}

 	// Activate the interface
 	err := c.f.activate()
 	if err != nil {
-		// Cancel before Close so a caller returning from Wait always observes a dead Context
-		c.cancel()
-		_ = c.f.Close()
 		c.state = StateStopped
-		return err
+		return nil, err
 	}

 	// Call all the delayed funcs that waited patiently for the interface to be created.
@@ -115,9 +104,6 @@ func (c *Control) Start() error {
 	if c.dnsStart != nil {
 		go c.dnsStart()
 	}
-	if c.networkChangeStart != nil {
-		go c.networkChangeStart(c.RebindUDPServer)
-	}
 	if c.connectionManagerStart != nil {
 		go c.connectionManagerStart(c.ctx)
 	}
@@ -125,12 +111,16 @@ func (c *Control) Start() error {
 		c.lighthouseStart()
 	}

-	c.f.triggerShutdown = func() { go c.Stop() }
+	c.f.triggerShutdown = c.Stop

 	// Start reading packets.
-	c.f.run()
+	out, err := c.f.run()
+	if err != nil {
+		c.state = StateStopped
+		return nil, err
+	}
 	c.state = StateStarted
-	return nil
+	return out, nil
 }

 func (c *Control) State() RunState {
@@ -143,26 +133,10 @@ func (c *Control) Context() context.Context {
 	return c.ctx
 }

-// Stop tears nebula down, closing all tunnels and releasing everything it holds.
-// Use Wait to block until the shutdown has completed.
-// A Control that has been stopped cannot be started again, Start will return ErrAlreadyStopped.
+// Stop is a non-blocking call that signals nebula to close all tunnels and shut down
 func (c *Control) Stop() {
 	c.stateLock.Lock()
-	switch c.state {
-	case StateStarted:
-		// Fall through to the full teardown below
-
-	case StateReady:
-		// Never started
-		c.cancel()
-		c.state = StateStopped
-		if err := c.f.Close(); err != nil {
-			c.l.Error("Close interface failed", "error", err)
-		}
-		c.stateLock.Unlock()
-		return
-
-	default:
+	if c.state != StateStarted {
 		c.stateLock.Unlock()
 		// We are stopping or stopped already
 		return
@@ -171,26 +145,19 @@ func (c *Control) Stop() {
 	c.state = StateStopping
 	c.stateLock.Unlock()

-	// Closing tunnels can be slow with a large hostmap, don't hold the lock for it
+	// Stop the handshakeManager (and other services), to prevent new tunnels from
+	// being created while we're shutting them all down.
 	c.cancel()
-	c.CloseAllTunnels(false)

-	c.stateLock.Lock()
-	c.state = StateStopped
+	c.CloseAllTunnels(false)
 	if err := c.f.Close(); err != nil {
 		c.l.Error("Close interface failed", "error", err)
 	}
+	c.stateLock.Lock()
+	c.state = StateStopped
 	c.stateLock.Unlock()
 }

-// Wait blocks until nebula has fully stopped, either via Stop or an internal fatal error,
-// and returns the first fatal packet reader error if there was one.
-// It is safe to call from multiple goroutines and at any point in the lifecycle,
-// but a Wait on a Control that is never started and never stopped will block forever.
-func (c *Control) Wait() error {
-	return c.f.wait()
-}
-
 // ShutdownBlock will listen for and block on term and interrupt signals, calling Control.Stop() once signalled
 func (c *Control) ShutdownBlock() {
 	sigChan := make(chan os.Signal, 1)
@@ -203,31 +170,15 @@ func (c *Control) ShutdownBlock() {
 	c.Stop()
 }

-// RebindUDPServer asks the UDP listener to rebind it's listener. Mainly used on mobile clients when interfaces change.
+// RebindUDPServer asks the UDP listener to rebind it's listener. Mainly used on mobile clients when interfaces change
 func (c *Control) RebindUDPServer() {
-	c.stateLock.Lock()
-	defer c.stateLock.Unlock()
-
-	if c.state != StateStarted {
-		return
-	}
-
-	// Every socket needs rebinding, not just the base: with multiport each one is bound to its own lane port, and
-	// even without it the surplus SO_REUSEPORT sockets stay pinned to the interface we came up on otherwise.
-	//
-	// A failure here means we are likely still pinned to the interface we came up on, so the rest of this is
-	// unlikely to help. Say so instead of silently carrying on as if we rebound.
-	for i, w := range c.f.writers {
-		if err := w.Rebind(); err != nil {
-			c.l.Error("Failed to rebind udp socket", "error", err, "writer", i)
-		}
-	}
+	_ = c.f.outside.Rebind()

 	// Trigger a lighthouse update, useful for mobile clients that should have an update interval of 0
 	c.f.lightHouse.SendUpdate()

 	// Let the main interface know that we rebound so that underlying tunnels know to trigger punches from their remotes
-	c.f.rebindEpoch.Add(1)
+	c.f.rebindCount++
 }

 // ListHostmapHosts returns details about the actual or pending (handshaking) hostmap by vpn ip
@@ -354,7 +305,7 @@ func (c *Control) CloseAllTunnels(excludeLighthouses bool) (closed int) {

 		c.l.Debug("Sending close tunnel message",
 			"vpnAddrs", h.vpnAddrs,
-			"udpAddr", h.GetRemote(),
+			"udpAddr", h.remote,
 		)
 		closed++
 	}
@@ -399,8 +350,7 @@ func copyHostInfo(h *HostInfo, preferredRanges []netip.Prefix) ControlHostInfo {
 		RemoteAddrs:            h.remotes.CopyAddrs(preferredRanges),
 		CurrentRelaysToMe:      h.relayState.CopyRelayIps(),
 		CurrentRelaysThroughMe: h.relayState.CopyRelayForIps(),
-		CurrentRemote:          h.GetRemote(),
-		Lanes:                  copyLanes(h),
+		CurrentRemote:          h.remote,
 	}

 	for i, a := range h.vpnAddrs {
@@ -418,30 +368,6 @@ func copyHostInfo(h *HostInfo, preferredRanges []netip.Prefix) ControlHostInfo {
 	return chi
 }

-// copyLanes snapshots the sendable multiport lanes of a tunnel, or nil when it
-// has none. txAddr is the lane's gate as well as its destination, so a nil load
-// is exactly "this lane is down and its routine is riding the base tunnel".
-func copyLanes(h *HostInfo) []ControlLane {
-	ls := h.lanes
-	if ls == nil || ls.txLanes < 2 {
-		return nil
-	}
-
-	lanes := make([]ControlLane, 0, ls.txLanes-1)
-	for s := 1; s < ls.txLanes; s++ {
-		l := ControlLane{Index: uint8(s)}
-		if addr := ls.txAddr[s].Load(); addr != nil {
-			l.Up = true
-			l.Remote = *addr
-		}
-		if cs := ls.sessions[s].Load(); cs != nil {
-			l.MessageCounter = cs.messageCounter.Load()
-		}
-		lanes = append(lanes, l)
-	}
-	return lanes
-}
-
 func listHostMapHosts(hl controlHostLister) []ControlHostInfo {
 	hosts := make([]ControlHostInfo, 0)
 	pr := hl.GetPreferredRanges()
@@ -1,309 +0,0 @@
-package nebula
-
-import (
-	"context"
-	"errors"
-	"io"
-	"net/netip"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/gaissmai/bart"
-	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/batch"
-	"github.com/slackhq/nebula/overlay/tio"
-	"github.com/slackhq/nebula/routing"
-	"github.com/slackhq/nebula/test"
-	"github.com/slackhq/nebula/udp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type fakeDevice struct {
-	closeOnce sync.Once
-	closedCh  chan struct{}
-	closed    bool
-}
-
-func newFakeDevice() *fakeDevice {
-	return &fakeDevice{closedCh: make(chan struct{})}
-}
-
-// Read blocks until Close like a real tun with no traffic, then reports EOF
-// the same way a closed device does
-func (d *fakeDevice) Read() ([]tio.Packet, error) {
-	<-d.closedCh
-	return nil, io.EOF
-}
-
-func (d *fakeDevice) Write(p []byte) (int, error) { return len(p), nil }
-
-func (d *fakeDevice) Close() error {
-	d.closeOnce.Do(func() {
-		d.closed = true
-		close(d.closedCh)
-	})
-	return nil
-}
-
-func (d *fakeDevice) Activate() error                       { return nil }
-func (d *fakeDevice) Networks() []netip.Prefix              { return nil }
-func (d *fakeDevice) Name() string                          { return "fake" }
-func (d *fakeDevice) RoutesFor(netip.Addr) routing.Gateways { return nil }
-
-func (d *fakeDevice) Queues(int) ([]tio.Queue, error) { return []tio.Queue{d}, nil }
-
-// newReadyControl hand-builds the minimum Control that Main would have
-// produced right before Start, including the construction token NewInterface
-// takes so waiters block until Close releases the resources
-func newReadyControl(t *testing.T) (*Control, *fakeDevice, *fakeConn) {
-	l := test.NewLogger()
-	dev := newFakeDevice()
-	conn := &fakeConn{}
-	ctx, cancel := context.WithCancel(context.Background())
-
-	myVpnNet := netip.MustParsePrefix("10.128.0.1/16")
-	nt := new(bart.Lite)
-	nt.Insert(myVpnNet)
-	cs := &CertState{
-		myVpnNetworks:      []netip.Prefix{myVpnNet},
-		myVpnNetworksTable: nt,
-	}
-	lh, err := NewLightHouseFromConfig(ctx, l, config.NewC(l), cs, nil, nil)
-	require.NoError(t, err)
-
-	f := &Interface{
-		ctx:        ctx,
-		inside:     dev,
-		outside:    conn,
-		writers:    []udp.Conn{conn},
-		batchers:   make([]*batch.MultiCoalescer, 1),
-		routines:   1,
-		hostMap:    newHostMap(l),
-		lightHouse: lh,
-		l:          l,
-	}
-	f.wg.Add(1)
-
-	return &Control{
-		state:  StateReady,
-		f:      f,
-		l:      l,
-		ctx:    ctx,
-		cancel: cancel,
-	}, dev, conn
-}
-
-func TestControl_StopBeforeStart(t *testing.T) {
-	c, dev, conn := newReadyControl(t)
-
-	// A Stop on a never started control must release everything Main acquired
-	c.Stop()
-	assert.Equal(t, StateStopped, c.State())
-	assert.True(t, dev.closed, "the tun device should have been closed")
-	assert.True(t, conn.closed, "the udp socket should have been closed")
-	require.ErrorIs(t, c.ctx.Err(), context.Canceled, "the service context should have been cancelled")
-
-	// Wait must return promptly now that the resources are released
-	require.NoError(t, c.Wait())
-
-	// A stopped control can never be started
-	err := c.Start()
-	require.ErrorIs(t, err, ErrAlreadyStopped)
-
-	// A second Stop is a harmless no-op
-	c.Stop()
-	assert.Equal(t, StateStopped, c.State())
-	require.NoError(t, c.Wait())
-}
-
-func TestControl_WaitBlocksUntilStop(t *testing.T) {
-	c, _, _ := newReadyControl(t)
-
-	done := make(chan error, 1)
-	go func() { done <- c.Wait() }()
-
-	select {
-	case <-done:
-		t.Fatal("Wait returned before Stop")
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	c.Stop()
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(time.Second):
-		t.Fatal("Wait did not return after Stop")
-	}
-}
-
-type fakeConn struct {
-	closed  bool
-	rebinds int
-}
-
-func (c *fakeConn) Rebind() error                             { c.rebinds++; return nil }
-func (c *fakeConn) LocalAddr() (netip.AddrPort, error)        { return netip.AddrPort{}, nil }
-func (c *fakeConn) ListenOut(_ udp.EncReader, _ func()) error { return nil }
-func (c *fakeConn) WriteTo(_ []byte, _ netip.AddrPort) error  { return nil }
-func (c *fakeConn) WriteBatch(bufs [][]byte, _ []netip.AddrPort) (int, error) {
-	return len(bufs), nil
-}
-func (c *fakeConn) ReloadConfig(_ *config.C)      {}
-func (c *fakeConn) SupportsMultipleReaders() bool { return true }
-func (c *fakeConn) Close() error                  { c.closed = true; return nil }
-
-type multiqueueDevice struct {
-	*fakeDevice
-}
-
-// Queues claims multiqueue support but fails to open the second queue,
-// exercising the activation error path.
-func (d *multiqueueDevice) Queues(n int) ([]tio.Queue, error) {
-	if n > 1 {
-		return nil, errors.New("second queue failed to open")
-	}
-	return d.fakeDevice.Queues(n)
-}
-
-func TestControl_StartMultiqueueFailureReleases(t *testing.T) {
-	dev := &multiqueueDevice{fakeDevice: newFakeDevice()}
-	conn := &fakeConn{}
-	ctx, cancel := context.WithCancel(context.Background())
-	f := &Interface{
-		ctx:      ctx,
-		inside:   dev,
-		outside:  conn,
-		writers:  []udp.Conn{conn},
-		batchers: make([]*batch.MultiCoalescer, 2),
-		routines: 2,
-		l:        test.NewLogger(),
-	}
-	f.wg.Add(1)
-
-	c := &Control{
-		state:  StateReady,
-		f:      f,
-		l:      test.NewLogger(),
-		ctx:    ctx,
-		cancel: cancel,
-	}
-
-	// The second reader fails to open, everything must be released
-	err := c.Start()
-	require.Error(t, err)
-	assert.Equal(t, StateStopped, c.State())
-	assert.True(t, dev.closed, "the tun device should have been closed")
-	assert.True(t, conn.closed, "the udp socket should have been closed")
-	require.ErrorIs(t, c.ctx.Err(), context.Canceled)
-
-	// And Wait must not hang on the construction token
-	require.NoError(t, c.Wait())
-}
-
-func TestInterface_CloseIsIdempotent(t *testing.T) {
-	dev := newFakeDevice()
-	f := &Interface{
-		inside: dev,
-		l:      test.NewLogger(),
-	}
-	f.wg.Add(1)
-
-	require.NoError(t, f.Close())
-	assert.True(t, dev.closed)
-
-	// A second Close must not double release the wg token or the device
-	require.NoError(t, f.Close())
-	require.NoError(t, f.wait())
-}
-
-func TestControl_FatalErrorReportsThroughWait(t *testing.T) {
-	c, dev, conn := newReadyControl(t)
-
-	// Mirror what Start wires up, without needing real packet readers
-	c.f.triggerShutdown = c.Stop
-	c.state = StateStarted
-
-	boom := errors.New("boom")
-	c.f.onFatal(boom)
-
-	require.ErrorIs(t, c.Wait(), boom)
-	assert.Equal(t, StateStopped, c.State())
-	assert.True(t, dev.closed)
-	assert.True(t, conn.closed)
-
-	// A second fatal error must not fire the shutdown again or replace the first
-	c.f.onFatal(errors.New("later"))
-	require.ErrorIs(t, c.Wait(), boom)
-
-	// Wait stays factual, a Stop after the death does not mask the error
-	c.Stop()
-	require.ErrorIs(t, c.Wait(), boom)
-}
-
-func TestControl_ConcurrentStopAndStart(t *testing.T) {
-	c, _, _ := newReadyControl(t)
-
-	var wg sync.WaitGroup
-	for i := 0; i < 2; i++ {
-		wg.Go(func() { c.Stop() })
-	}
-	wg.Go(func() { _ = c.Start() })
-	wg.Go(func() {
-		_ = c.Wait()
-		// A returned Wait must always observe the final state, no matter how
-		// the race resolved
-		assert.Equal(t, StateStopped, c.State())
-	})
-	wg.Wait()
-
-	// However the race resolves, the control must end fully stopped with no
-	// panic and Wait must observe the final state
-	require.NoError(t, c.Wait())
-	assert.Equal(t, StateStopped, c.State())
-	err := c.Start()
-	require.ErrorIs(t, err, ErrAlreadyStopped)
-}
-
-func TestControl_StartStopLifecycle(t *testing.T) {
-	c, dev, conn := newReadyControl(t)
-
-	err := c.Start()
-	require.NoError(t, err)
-	assert.Equal(t, StateStarted, c.State())
-	err = c.Start()
-	require.ErrorIs(t, err, ErrAlreadyStarted)
-
-	// Stop must unpark the reader blocked in the device and release everything
-	c.Stop()
-	assert.Equal(t, StateStopped, c.State())
-	assert.True(t, dev.closed, "the tun device should have been closed")
-	assert.True(t, conn.closed, "the udp socket should have been closed")
-	require.ErrorIs(t, c.ctx.Err(), context.Canceled)
-
-	// The reader drained off a closed device, that is not a fatal error
-	require.NoError(t, c.Wait())
-	err = c.Start()
-	require.ErrorIs(t, err, ErrAlreadyStopped)
-}
-
-func TestControl_RebindIsGatedByState(t *testing.T) {
-	c, _, conn := newReadyControl(t)
-
-	// A rebind before Start reaches nothing, the interface is not up
-	c.RebindUDPServer()
-	assert.Equal(t, 0, conn.rebinds, "rebind before start must be a no-op")
-
-	err := c.Start()
-	require.NoError(t, err)
-	c.RebindUDPServer()
-	assert.Equal(t, 1, conn.rebinds, "rebind while started must reach the conn")
-
-	// A rebind racing a completed stop must not touch the closed conn
-	c.Stop()
-	require.NoError(t, c.Wait())
-	c.RebindUDPServer()
-	assert.Equal(t, 1, conn.rebinds, "rebind after stop must be a no-op")
-}
@@ -1,8 +1,6 @@
 package nebula

 import (
-	"bytes"
-	"log/slog"
 	"net"
 	"net/netip"
 	"reflect"
@@ -11,7 +9,6 @@ import (
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestControl_GetHostInfoByVpnIp(t *testing.T) {
@@ -45,7 +42,8 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 	assert.True(t, ok)

 	crt := &dummyCert{}
-	hi := &HostInfo{
+	hm.unlockedAddHostInfo(&HostInfo{
+		remote:  remote1,
 		remotes: remotes,
 		ConnectionState: &ConnectionState{
 			peerCert: &cert.CachedCertificate{Certificate: crt},
@@ -58,14 +56,13 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 			relayForByAddr: map[netip.Addr]*Relay{},
 			relayForByIdx:  map[uint32]*Relay{},
 		},
-	}
-	hi.remote.Store(&remote1)
-	hm.unlockedAddHostInfo(hi, &Interface{})
+	}, &Interface{})

 	vpnIp2, ok := netip.AddrFromSlice(ipNet2.IP)
 	assert.True(t, ok)

-	hi2 := &HostInfo{
+	hm.unlockedAddHostInfo(&HostInfo{
+		remote:  remote1,
 		remotes: remotes,
 		ConnectionState: &ConnectionState{
 			peerCert: nil,
@@ -78,9 +75,7 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 			relayForByAddr: map[netip.Addr]*Relay{},
 			relayForByIdx:  map[uint32]*Relay{},
 		},
-	}
-	hi2.remote.Store(&remote1)
-	hm.unlockedAddHostInfo(hi2, &Interface{})
+	}, &Interface{})

 	c := Control{
 		state: StateReady,
@@ -105,7 +100,7 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 	}

 	// Make sure we don't have any unexpected fields
-	assertFields(t, []string{"VpnAddrs", "LocalIndex", "RemoteIndex", "RemoteAddrs", "Cert", "MessageCounter", "CurrentRemote", "CurrentRelaysToMe", "CurrentRelaysThroughMe", "Lanes"}, thi)
+	assertFields(t, []string{"VpnAddrs", "LocalIndex", "RemoteIndex", "RemoteAddrs", "Cert", "MessageCounter", "CurrentRemote", "CurrentRelaysToMe", "CurrentRelaysThroughMe"}, thi)
 	assert.Equal(t, &expectedInfo, thi)
 	test.AssertDeepCopyEqual(t, &expectedInfo, thi)

@@ -124,153 +119,3 @@ func assertFields(t *testing.T, expected []string, actualStruct any) {

 	assert.Equal(t, expected, fields)
 }
-
-// alwaysAllowV4/V6 are check funcs that accept every entry (including nil pointers),
-// letting us inject a nil *V4AddrPort/*V6AddrPort into a RemoteList's reported cache
-// the same way a malformed proto message off the wire could.
-func alwaysAllowV4(netip.Addr, *V4AddrPort) bool { return true }
-func alwaysAllowV6(netip.Addr, *V6AddrPort) bool { return true }
-
-// TestGetRelays_SkipsNilRelayAddrs proves GetRelays tolerates nil entries in the
-// RelayVpnAddrs proto slice (which protoAddrToNetAddr would nil-deref on) and still
-// returns the valid relays, including the legacy OldRelayVpnAddrs.
-func TestGetRelays_SkipsNilRelayAddrs(t *testing.T) {
-	good := netip.MustParseAddr("10.0.0.9")
-
-	d := &NebulaMetaDetails{
-		OldRelayVpnAddrs: []uint32{0x0a000001}, // 10.0.0.1
-		RelayVpnAddrs: []*Addr{
-			nil,
-			netAddrToProtoAddr(good),
-			nil,
-		},
-	}
-
-	var relays []netip.Addr
-	require.NotPanics(t, func() { relays = d.GetRelays() })
-
-	assert.Equal(t, []netip.Addr{
-		netip.MustParseAddr("10.0.0.1"),
-		good,
-	}, relays)
-}
-
-// TestGetRelays_AllNil ensures an all-nil RelayVpnAddrs slice yields no relays and no panic.
-func TestGetRelays_AllNil(t *testing.T) {
-	d := &NebulaMetaDetails{RelayVpnAddrs: []*Addr{nil, nil}}
-	var relays []netip.Addr
-	require.NotPanics(t, func() { relays = d.GetRelays() })
-	assert.Empty(t, relays)
-}
-
-// TestRemoteList_CopyCache_SkipsNilReported proves CopyCache skips nil reported
-// pointers (v4 and v6) instead of nil-dereferencing them in protoV*AddrPortToNetAddrPort.
-func TestRemoteList_CopyCache_SkipsNilReported(t *testing.T) {
-	owner := netip.MustParseAddr("10.0.0.1")
-	rl := NewRemoteList([]netip.Addr{owner}, nil)
-
-	rl.unlockedSetV4(owner, owner, []*V4AddrPort{
-		nil,
-		newIp4AndPortFromString("1.2.3.4:5"),
-		nil,
-	}, alwaysAllowV4)
-
-	rl.unlockedSetV6(owner, owner, []*V6AddrPort{
-		nil,
-		newIp6AndPortFromString("[1::1]:6"),
-		nil,
-	}, alwaysAllowV6)
-
-	var cm *CacheMap
-	require.NotPanics(t, func() { cm = rl.CopyCache() })
-
-	c := (*cm)[owner.String()]
-	require.NotNil(t, c)
-	assert.ElementsMatch(t, []netip.AddrPort{
-		netip.MustParseAddrPort("1.2.3.4:5"),
-		netip.MustParseAddrPort("[1::1]:6"),
-	}, c.Reported)
-}
-
-// TestRemoteList_Rebuild_SkipsNilReported drives unlockedCollect (via Rebuild) with
-// nil reported entries and confirms only the valid addresses survive, with no panic.
-func TestRemoteList_Rebuild_SkipsNilReported(t *testing.T) {
-	owner := netip.MustParseAddr("10.0.0.1")
-	rl := NewRemoteList([]netip.Addr{owner}, nil)
-
-	rl.unlockedSetV4(owner, owner, []*V4AddrPort{
-		nil,
-		newIp4AndPortFromString("1.2.3.4:5"),
-	}, alwaysAllowV4)
-	rl.unlockedSetV6(owner, owner, []*V6AddrPort{
-		newIp6AndPortFromString("[1::1]:6"),
-		nil,
-	}, alwaysAllowV6)
-
-	require.NotPanics(t, func() { rl.Rebuild([]netip.Prefix{}) })
-
-	assert.ElementsMatch(t, []netip.AddrPort{
-		netip.MustParseAddrPort("1.2.3.4:5"),
-		netip.MustParseAddrPort("[1::1]:6"),
-	}, rl.addrs)
-}
-
-// newRelayControl marshals a NebulaControl the way it arrives on the wire so we can feed
-// it through HandleControlMsg's unmarshal + validate path.
-func newRelayControl(t *testing.T, typ NebulaControl_MessageType, from, to *Addr) []byte {
-	t.Helper()
-	msg := &NebulaControl{
-		Type:          typ,
-		RelayFromAddr: from,
-		RelayToAddr:   to,
-	}
-	b, err := msg.Marshal()
-	require.NoError(t, err)
-	return b
-}
-
-// TestRelayManager_HandleControlMsg_NilRelayAddrs verifies the validation block added to
-// HandleControlMsg: CreateRelay{Request,Response} carrying a nil RelayFromAddr or
-// RelayToAddr are dropped with a debug log rather than nil-dereferencing downstream.
-func TestRelayManager_HandleControlMsg_NilRelayAddrs(t *testing.T) {
-	good := netAddrToProtoAddr(netip.MustParseAddr("10.0.0.9"))
-
-	cases := []struct {
-		name    string
-		typ     NebulaControl_MessageType
-		from    *Addr
-		to      *Addr
-		wantLog string // debug substring expected, "" == expect no drop log
-	}{
-		{"request nil from", NebulaControl_CreateRelayRequest, nil, good, "nil RelayFromAddr"},
-		{"request nil to", NebulaControl_CreateRelayRequest, good, nil, "nil RelayToAddr"},
-		{"request both nil", NebulaControl_CreateRelayRequest, nil, nil, "nil RelayFromAddr"},
-		{"response nil from", NebulaControl_CreateRelayResponse, nil, good, "nil RelayFromAddr"},
-		{"response nil to", NebulaControl_CreateRelayResponse, good, nil, "nil RelayToAddr"},
-		// A non-relay control type is not subject to the relay-addr validation and must
-		// pass through it untouched (the final switch simply no-ops on it).
-		{"unrelated type nil addrs", NebulaControl_None, nil, nil, ""},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			var buf bytes.Buffer
-			l := test.NewLoggerWithOutputAndLevel(&buf, slog.LevelDebug)
-			rm := &relayManager{l: l, hostmap: newHostMap(l)}
-			rm.useRelays.Store(true)
-
-			f := &Interface{l: l}
-			h := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.2")}, localIndexId: 1}
-
-			d := newRelayControl(t, tc.typ, tc.from, tc.to)
-
-			require.NotPanics(t, func() { rm.HandleControlMsg(h, d, f) })
-
-			if tc.wantLog == "" {
-				assert.NotContains(t, buf.String(), "nil Relay")
-			} else {
-				assert.Contains(t, buf.String(), tc.wantLog)
-			}
-		})
-	}
-}
@@ -108,29 +108,7 @@ func (c *Control) GetVpnAddrs() []netip.Addr {
 }

 func (c *Control) GetUDPAddr() netip.AddrPort {
-	return c.f.outside.(*udp.TesterConn).GetAddr()
-}
-
-// SetUDPAddr moves this node to a new underlay address, standing in for a laptop waking up on a different
-// network. Register the new address with the router as well or nothing will route back.
-func (c *Control) SetUDPAddr(addr netip.AddrPort) {
-	c.f.outside.(*udp.TesterConn).SetAddr(addr)
-}
-
-// SetLocalAddrsFn replaces underlay address discovery so a test can advertise its simulated address instead of
-// whatever this machine's NICs happen to be. Call it before Start, SendUpdate reads it from the update worker.
-func (c *Control) SetLocalAddrsFn(fn func(*LocalAllowList) []netip.Addr) {
-	c.f.lightHouse.localAddrsFn = fn
-}
-
-// GetRebindEpochFor returns the rebind epoch a tunnel last sent under, so a test can tell whether a send
-// consumed the epoch edge without having to infer it from lighthouse traffic.
-func (c *Control) GetRebindEpochFor(vpnAddr netip.Addr) (uint32, bool) {
-	h := c.f.hostMap.QueryVpnAddr(vpnAddr)
-	if h == nil {
-		return 0, false
-	}
-	return h.state.Load() >> stateEpochShift, true
+	return c.f.outside.(*udp.TesterConn).Addr
 }

 func (c *Control) KillPendingTunnel(vpnIp netip.Addr) bool {
@@ -147,14 +125,6 @@ func (c *Control) GetHostmap() *HostMap {
 	return c.f.hostMap
 }

-// GetHostmapIndexCount returns the number of entries in the main hostmap Indexes table, holding
-// the hostmap read lock so tests can poll it while connection manager churns tunnels.
-func (c *Control) GetHostmapIndexCount() int {
-	c.f.hostMap.RLock()
-	defer c.f.hostMap.RUnlock()
-	return len(c.f.hostMap.Indexes)
-}
-
 func (c *Control) GetF() *Interface {
 	return c.f
 }
@@ -1,187 +0,0 @@
-// Package cpupick chooses which CPUs the tun reader threads pin to when the
-// operator has not chosen for us (tun.cpu_affinity). The stock spread —
-// allowed[i] for routine i — has two failure modes this package exists to fix:
-//
-//   - every co-located nebula starts its spread at allowed[0], so N instances
-//     on one box stack their readers onto the same cores, and allowed[0] is
-//     usually CPU 0, the core housekeeping and default IRQ affinity already
-//     favor;
-//   - on heterogeneous CPUs (ARM big.LITTLE, Intel P/E hybrids, AMD compact
-//     cores) low IDs are not necessarily fast cores, and pinning an encrypt
-//     thread to an efficiency core caps that queue's throughput.
-//
-// Default instead returns a preference-ordered pin list: the allowed set
-// filtered to performance cores (when the platform distinguishes them and
-// enough remain for every routine), confined to a single NUMA node and spread
-// across distinct physical cores when the topology permits, CPU 0's physical
-// core demoted to last resort, and the order rotated by a stable per-instance
-// key so co-located instances spread instead of stacking.
-package cpupick
-
-import (
-	"log/slog"
-
-	"github.com/slackhq/nebula/util"
-)
-
-// topology is the slice of machine layout arrange consults: the NUMA node
-// and the physical core behind each candidate CPU, plus which core CPU 0
-// lives on (zeroCore, -1 when unknown — tracked separately because CPU 0's
-// SMT sibling deserves demotion even when CPU 0 itself isn't a candidate).
-// Probed from sysfs on Linux; flatTopology stands in when the platform can't
-// say, which turns every topology rule into a no-op rather than a wrong
-// answer.
-type topology struct {
-	nodeOf   map[int]int
-	coreOf   map[int]int
-	zeroCore int
-}
-
-// flatTopology places every CPU on node 0 and on a physical core of its own.
-func flatTopology(cpus []int) topology {
-	t := topology{
-		nodeOf:   make(map[int]int, len(cpus)),
-		coreOf:   make(map[int]int, len(cpus)),
-		zeroCore: -1,
-	}
-	for i, c := range cpus {
-		t.nodeOf[c] = 0
-		t.coreOf[c] = i
-		if c == 0 {
-			t.zeroCore = i
-		}
-	}
-	return t
-}
-
-// Default computes the pin order for `routines` tun readers. key is any
-// stable per-instance value; the bound UDP port is ideal — distinct across
-// co-located instances, stable across restarts so benchmark runs stay
-// comparable. Returns nil when there is nothing useful to say (no affinity
-// support on this platform, lookup failure); callers keep their existing
-// fallback spread.
-func Default(routines int, key uint64, l *slog.Logger) []int {
-	allowed, err := util.AllowedCPUs()
-	if err != nil || len(allowed) == 0 {
-		return nil
-	}
-	perf, signal := perfCPUs(allowed)
-	cands := pickCandidates(allowed, perf, routines)
-	if len(cands) == 0 {
-		return nil
-	}
-	if len(perf) < routines {
-		signal = ""
-	}
-	cpus := arrange(cands, readTopology(cands), routines, splitmix64(key))
-	if l != nil {
-		l.Info("chose default pin CPUs for tun readers",
-			"cpus", cpus[:min(routines, len(cpus))],
-			"perfSignal", signal)
-	}
-	return cpus
-}
-
-// pickCandidates applies the enough-for-everyone guard: a perf filter that
-// leaves fewer candidates than routines is discarded — giving every reader
-// its own (possibly slow) core beats stacking two readers on a fast one.
-func pickCandidates(allowed, perf []int, routines int) []int {
-	if len(perf) < routines {
-		return allowed
-	}
-	return perf
-}
-
-// arrange turns the candidate set into the final pin order:
-//
-//  1. NUMA: when at least one node holds enough candidates for every
-//     routine, confine to one such node, chosen by the instance hash. The
-//     readers share hostmap and cipher state, so splitting one instance
-//     across nodes taxes every packet — and co-located instances that hash
-//     to different nodes stop competing entirely. When no node is big
-//     enough, span nodes rather than stack readers.
-//  2. Rotate the preferred candidates by the hash so instances spread.
-//  3. SMT: emit one thread per physical core before any of their siblings —
-//     two encrypt threads on one core split its execution units. Siblings
-//     still follow for the routines > cores case.
-//  4. CPU 0's whole physical core goes last: housekeeping and default IRQ
-//     noise on CPU 0 bleeds into its SMT sibling too. Within that tail the
-//     sibling precedes CPU 0 itself, which only catches the bleed-through.
-//
-// The rotation happens before the SMT pass so each instance's one-per-core
-// walk also starts at a different core, and CPU 0's core is excluded from
-// the rotation so no hash value can put it back at the front.
-func arrange(cands []int, topo topology, routines int, h uint64) []int {
-	byNode := map[int][]int{}
-	var nodes []int
-	for _, c := range cands {
-		n := topo.nodeOf[c]
-		if _, ok := byNode[n]; !ok {
-			nodes = append(nodes, n)
-		}
-		byNode[n] = append(byNode[n], c)
-	}
-	var eligible []int
-	for _, n := range nodes {
-		if len(byNode[n]) >= routines {
-			eligible = append(eligible, n)
-		}
-	}
-	if len(eligible) > 0 {
-		cands = byNode[eligible[int(h%uint64(len(eligible)))]]
-	}
-
-	// Split off CPU 0's core: its siblings tail the list, CPU 0 tails them.
-	preferred := make([]int, 0, len(cands))
-	var zeroTail []int
-	hasZero := false
-	for _, c := range cands {
-		switch {
-		case c == 0:
-			hasZero = true
-		case topo.zeroCore >= 0 && topo.coreOf[c] == topo.zeroCore:
-			zeroTail = append(zeroTail, c)
-		default:
-			preferred = append(preferred, c)
-		}
-	}
-	if hasZero {
-		zeroTail = append(zeroTail, 0)
-	}
-	if len(preferred) == 0 {
-		return zeroTail // CPU 0's core is all we have
-	}
-
-	// The node pick consumed the low hash bits; rotate by the high ones so
-	// the two choices stay independent.
-	off := int((h >> 32) % uint64(len(preferred)))
-	rot := make([]int, 0, len(preferred))
-	rot = append(rot, preferred[off:]...)
-	rot = append(rot, preferred[:off]...)
-
-	seenCore := make(map[int]bool, len(rot))
-	out := make([]int, 0, len(cands))
-	var siblings []int
-	for _, c := range rot {
-		g := topo.coreOf[c]
-		if seenCore[g] {
-			siblings = append(siblings, c)
-			continue
-		}
-		seenCore[g] = true
-		out = append(out, c)
-	}
-	out = append(out, siblings...)
-	out = append(out, zeroTail...)
-	return out
-}
-
-// splitmix64 decorrelates instance keys before the selection modulos: ports
-// on one box often share spacing (4242/4243, or round steps like +1000) that
-// raw key%len arithmetic would fold onto the same offset.
-func splitmix64(x uint64) uint64 {
-	x += 0x9e3779b97f4a7c15
-	x = (x ^ (x >> 30)) * 0xbf58476d1ce4e5b9
-	x = (x ^ (x >> 27)) * 0x94d049bb133111eb
-	return x ^ (x >> 31)
-}
@@ -1,171 +0,0 @@
-package cpupick
-
-import (
-	"slices"
-	"testing"
-)
-
-// pairTopo builds a topology where consecutive candidate pairs are SMT
-// siblings: (cpus[0],cpus[1]) share a core, (cpus[2],cpus[3]) the next, ...
-// All CPUs land on node 0.
-func pairTopo(cpus []int) topology {
-	t := topology{
-		nodeOf:   make(map[int]int, len(cpus)),
-		coreOf:   make(map[int]int, len(cpus)),
-		zeroCore: -1,
-	}
-	for i, c := range cpus {
-		t.nodeOf[c] = 0
-		t.coreOf[c] = i / 2
-		if c == 0 {
-			t.zeroCore = i / 2
-		}
-	}
-	return t
-}
-
-func TestArrangeDemotesZeroForEveryKey(t *testing.T) {
-	candidates := []int{0, 1, 2, 3, 4, 5, 6, 7}
-	for key := range uint64(64) {
-		got := arrange(candidates, flatTopology(candidates), 4, splitmix64(key))
-		if len(got) != len(candidates) {
-			t.Fatalf("key %d: len=%d want %d", key, len(got), len(candidates))
-		}
-		if got[0] == 0 {
-			t.Errorf("key %d: CPU 0 at the front: %v", key, got)
-		}
-		if got[len(got)-1] != 0 {
-			t.Errorf("key %d: CPU 0 not demoted to last: %v", key, got)
-		}
-		sorted := slices.Clone(got)
-		slices.Sort(sorted)
-		if !slices.Equal(sorted, candidates) {
-			t.Errorf("key %d: not a permutation: %v", key, got)
-		}
-	}
-}
-
-func TestArrangeDemotesZeroSiblings(t *testing.T) {
-	// Pairs (0,1),(2,3),(4,5),(6,7): CPU 0's core — 0 and its sibling 1 —
-	// must tail the list, sibling ahead of 0 itself.
-	candidates := []int{0, 1, 2, 3, 4, 5, 6, 7}
-	for key := range uint64(64) {
-		got := arrange(candidates, pairTopo(candidates), 2, splitmix64(key))
-		n := len(got)
-		if got[n-1] != 0 || got[n-2] != 1 {
-			t.Fatalf("key %d: tail = %v, want [... 1 0]", key, got)
-		}
-	}
-}
-
-func TestArrangeZeroSiblingWithoutZero(t *testing.T) {
-	// CPU 0 excluded (cpuset) but its sibling 1 remains: the sibling still
-	// tails the list when the topology knows which core CPU 0 lives on.
-	candidates := []int{1, 2, 3, 4, 5}
-	topo := pairTopo([]int{0, 1, 2, 3, 4, 5})
-	got := arrange(candidates, topo, 2, splitmix64(7))
-	if got[len(got)-1] != 1 {
-		t.Errorf("CPU 0's sibling not demoted: %v", got)
-	}
-}
-
-func TestArrangeRotatesByKey(t *testing.T) {
-	candidates := []int{1, 2, 3, 4, 5, 6, 7, 8}
-	seen := map[int]bool{}
-	for key := range uint64(64) {
-		seen[arrange(candidates, flatTopology(candidates), 4, splitmix64(key))[0]] = true
-	}
-	// 64 hashed keys over 8 slots must hit more than one starting CPU, or
-	// co-located instances would all stack again.
-	if len(seen) < 2 {
-		t.Errorf("rotation never varied across keys: %v", seen)
-	}
-}
-
-func TestArrangeStableForSameKey(t *testing.T) {
-	candidates := []int{0, 2, 4, 6}
-	topo := flatTopology(candidates)
-	a := arrange(candidates, topo, 2, splitmix64(4242))
-	b := arrange(candidates, topo, 2, splitmix64(4242))
-	if !slices.Equal(a, b) {
-		t.Errorf("same key ordered differently: %v vs %v", a, b)
-	}
-}
-
-func TestArrangeZeroOnly(t *testing.T) {
-	if got := arrange([]int{0}, flatTopology([]int{0}), 1, splitmix64(7)); !slices.Equal(got, []int{0}) {
-		t.Errorf("sole CPU 0 must survive: %v", got)
-	}
-}
-
-func TestArrangeSMTSiblingsLast(t *testing.T) {
-	// Pairs (1,2),(3,4),(5,6),(7,8): the first four picks must cover four
-	// distinct physical cores before any sibling repeats.
-	candidates := []int{1, 2, 3, 4, 5, 6, 7, 8}
-	topo := pairTopo(candidates)
-	for key := range uint64(16) {
-		got := arrange(candidates, topo, 4, splitmix64(key))
-		seen := map[int]bool{}
-		for _, c := range got[:4] {
-			g := topo.coreOf[c]
-			if seen[g] {
-				t.Fatalf("key %d: sibling before all cores covered: %v", key, got)
-			}
-			seen[g] = true
-		}
-	}
-}
-
-func TestArrangeNUMAConfinesToOneNode(t *testing.T) {
-	// Two nodes of four; both fit routines=3, so the result must sit
-	// entirely inside one of them, and the hash must pick both across keys.
-	candidates := []int{1, 2, 3, 4, 10, 11, 12, 13}
-	topo := flatTopology(candidates)
-	for _, c := range []int{10, 11, 12, 13} {
-		topo.nodeOf[c] = 1
-	}
-	nodesSeen := map[int]bool{}
-	for key := range uint64(32) {
-		got := arrange(candidates, topo, 3, splitmix64(key))
-		if len(got) != 4 {
-			t.Fatalf("key %d: not confined to one node: %v", key, got)
-		}
-		n := topo.nodeOf[got[0]]
-		for _, c := range got {
-			if topo.nodeOf[c] != n {
-				t.Fatalf("key %d: spans nodes: %v", key, got)
-			}
-		}
-		nodesSeen[n] = true
-	}
-	if len(nodesSeen) != 2 {
-		t.Errorf("hash never spread instances across nodes: %v", nodesSeen)
-	}
-}
-
-func TestArrangeNUMASpansWhenNoNodeFits(t *testing.T) {
-	candidates := []int{1, 2, 3, 4, 10, 11, 12, 13}
-	topo := flatTopology(candidates)
-	for _, c := range []int{10, 11, 12, 13} {
-		topo.nodeOf[c] = 1
-	}
-	got := arrange(candidates, topo, 6, splitmix64(1))
-	if len(got) != len(candidates) {
-		t.Errorf("undersized nodes must span, got %v", got)
-	}
-}
-
-func TestPickCandidates(t *testing.T) {
-	allowed := []int{0, 1, 2, 3, 4, 5, 6, 7}
-	perf := []int{4, 5}
-
-	// Enough perf cores for every routine: only they are used.
-	if got := pickCandidates(allowed, perf, 2); !slices.Equal(got, perf) {
-		t.Errorf("perf filter not applied: %v", got)
-	}
-	// Perf filter too small for the routine count: discarded, everyone
-	// gets their own core from the full allowed set.
-	if got := pickCandidates(allowed, perf, 4); !slices.Equal(got, allowed) {
-		t.Errorf("undersized perf filter not discarded: %v", got)
-	}
-}
@@ -1,154 +0,0 @@
-//go:build linux
-
-package cpupick
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-)
-
-// capacityKeepPct is the cpu_capacity admission threshold, relative to the
-// fastest allowed core. LITTLE cores are normalized to ~250-400 of the big
-// core's 1024 while mid cores sit at ~75%+, so half of max separates little
-// from the rest without splitting prime from mid on three-tier parts.
-const capacityKeepPct = 50
-
-// freqKeepPct is the cpuinfo_max_freq admission threshold. Favored-core
-// turbo skew is 2-4% and ARM mid-vs-prime ~12%, while E-cores, LITTLE
-// cores, and AMD compact cores all sit >= 20% below their siblings' max.
-const freqKeepPct = 85
-
-// perfCPUs partitions allowed into the subset that are "performance" cores,
-// consulting (in order of authority):
-//
-//  1. cpu_capacity — arch_topology's normalized per-CPU capacity, exposed on
-//     arm/arm64/riscv; the scheduler's own view of big vs LITTLE.
-//  2. /sys/devices/cpu_core/cpus — the Intel hybrid P-core PMU mask, present
-//     only on P/E parts (x86 has no cpu_capacity) and naming P cores outright.
-//  3. cpuinfo_max_freq — the cross-vendor fallback; catches AMD compact
-//     cores, which neither of the above covers.
-//
-// Returns allowed unchanged (signal "") when nothing distinguishes the
-// cores: homogeneous parts, VMs without cpufreq, sysfs unavailable.
-func perfCPUs(allowed []int) ([]int, string) {
-	return perfCPUsFrom("/sys/devices/system/cpu", "/sys/devices/cpu_core/cpus", allowed)
-}
-
-func perfCPUsFrom(cpuDir, intelCoreMask string, allowed []int) ([]int, string) {
-	if cpus, ok := byPerCPUValue(cpuDir, "cpu_capacity", allowed, capacityKeepPct); ok {
-		return cpus, "cpu_capacity"
-	}
-	if cpus, ok := byIntelCoreMask(intelCoreMask, allowed); ok {
-		return cpus, "intel_core_pmu"
-	}
-	if cpus, ok := byPerCPUValue(cpuDir, "cpufreq/cpuinfo_max_freq", allowed, freqKeepPct); ok {
-		return cpus, "max_freq"
-	}
-	return allowed, ""
-}
-
-// byPerCPUValue keeps the allowed CPUs whose per-CPU sysfs value is at least
-// keepPct percent of the maximum across allowed. Inconclusive (ok=false)
-// when any CPU is missing the file or when every value is equal.
-func byPerCPUValue(cpuDir, file string, allowed []int, keepPct int) ([]int, bool) {
-	vals := make([]int, len(allowed))
-	minV, maxV := 0, 0
-	for i, cpu := range allowed {
-		v, err := readIntFile(filepath.Join(cpuDir, fmt.Sprintf("cpu%d", cpu), file))
-		if err != nil {
-			return nil, false
-		}
-		vals[i] = v
-		if i == 0 || v < minV {
-			minV = v
-		}
-		if v > maxV {
-			maxV = v
-		}
-	}
-	if minV == maxV {
-		return nil, false // homogeneous by this signal; try the next one
-	}
-	keep := make([]int, 0, len(allowed))
-	for i, cpu := range allowed {
-		if vals[i]*100 >= maxV*keepPct {
-			keep = append(keep, cpu)
-		}
-	}
-	return keep, true
-}
-
-// byIntelCoreMask keeps the allowed CPUs named by the hybrid P-core PMU
-// mask. Inconclusive when the file is absent (non-hybrid x86, other arches)
-// or no allowed CPU is in the mask (the process was deliberately confined
-// to E-cores; nothing useful to prefer within that).
-func byIntelCoreMask(maskPath string, allowed []int) ([]int, bool) {
-	b, err := os.ReadFile(maskPath)
-	if err != nil {
-		return nil, false
-	}
-	set, err := parseCPUList(strings.TrimSpace(string(b)))
-	if err != nil || len(set) == 0 {
-		return nil, false
-	}
-	pcore := make(map[int]bool, len(set))
-	for _, c := range set {
-		pcore[c] = true
-	}
-	keep := make([]int, 0, len(allowed))
-	for _, cpu := range allowed {
-		if pcore[cpu] {
-			keep = append(keep, cpu)
-		}
-	}
-	if len(keep) == 0 {
-		return nil, false
-	}
-	return keep, true
-}
-
-// parseCPUList decodes the kernel's cpulist format ("0-7,16-23", "3") into
-// individual CPU IDs. Empty input yields an empty list.
-func parseCPUList(s string) ([]int, error) {
-	if s == "" {
-		return nil, nil
-	}
-	var out []int
-	for part := range strings.SplitSeq(s, ",") {
-		part = strings.TrimSpace(part)
-		if part == "" {
-			continue
-		}
-		lo, hi, isRange := strings.Cut(part, "-")
-		a, err := strconv.Atoi(lo)
-		if err != nil {
-			return nil, fmt.Errorf("bad cpulist entry %q: %w", part, err)
-		}
-		if !isRange {
-			out = append(out, a)
-			continue
-		}
-		b, err := strconv.Atoi(hi)
-		if err != nil {
-			return nil, fmt.Errorf("bad cpulist entry %q: %w", part, err)
-		}
-		if b < a || b-a > 8192 {
-			return nil, fmt.Errorf("bad cpulist range %q", part)
-		}
-		for v := a; v <= b; v++ {
-			out = append(out, v)
-		}
-	}
-	return out, nil
-}
-
-func readIntFile(path string) (int, error) {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return 0, err
-	}
-	return strconv.Atoi(strings.TrimSpace(string(b)))
-}
@@ -1,163 +0,0 @@
-//go:build linux
-
-package cpupick
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"slices"
-	"testing"
-)
-
-// fakeSysfs builds a cpuDir tree with the given per-CPU file values.
-// A nil map for a file means "file absent on every CPU".
-func fakeSysfs(t *testing.T, capacity, maxFreq map[int]int) string {
-	t.Helper()
-	dir := t.TempDir()
-	write := func(cpu int, rel string, v int) {
-		p := filepath.Join(dir, fmt.Sprintf("cpu%d", cpu), rel)
-		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(p, fmt.Appendf(nil, "%d\n", v), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for cpu, v := range capacity {
-		write(cpu, "cpu_capacity", v)
-	}
-	for cpu, v := range maxFreq {
-		write(cpu, "cpufreq/cpuinfo_max_freq", v)
-	}
-	return dir
-}
-
-func writeCoreMask(t *testing.T, mask string) string {
-	t.Helper()
-	p := filepath.Join(t.TempDir(), "cpus")
-	if err := os.WriteFile(p, []byte(mask+"\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	return p
-}
-
-func TestPerfCPUsBigLittleCapacity(t *testing.T) {
-	// 4 big (1024) + 4 LITTLE (~290): capacity is authoritative on ARM.
-	dir := fakeSysfs(t, map[int]int{
-		0: 1024, 1: 1024, 2: 1024, 3: 1024,
-		4: 290, 5: 290, 6: 290, 7: 290,
-	}, nil)
-	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3, 4, 5, 6, 7})
-	if signal != "cpu_capacity" {
-		t.Fatalf("signal = %q", signal)
-	}
-	if !slices.Equal(got, []int{0, 1, 2, 3}) {
-		t.Errorf("got %v", got)
-	}
-}
-
-func TestPerfCPUsThreeTierKeepsMid(t *testing.T) {
-	// prime (1024) + mid (~780) + little (~280): 50% keeps prime+mid.
-	dir := fakeSysfs(t, map[int]int{
-		0: 280, 1: 280, 2: 280, 3: 280,
-		4: 780, 5: 780, 6: 780,
-		7: 1024,
-	}, nil)
-	got, _ := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3, 4, 5, 6, 7})
-	if !slices.Equal(got, []int{4, 5, 6, 7}) {
-		t.Errorf("got %v", got)
-	}
-}
-
-func TestPerfCPUsIntelHybridMask(t *testing.T) {
-	// No cpu_capacity on x86; the P-core PMU mask decides.
-	dir := fakeSysfs(t, nil, nil)
-	mask := writeCoreMask(t, "0-7")
-	got, signal := perfCPUsFrom(dir, mask, []int{0, 1, 2, 3, 8, 9, 10, 11})
-	if signal != "intel_core_pmu" {
-		t.Fatalf("signal = %q", signal)
-	}
-	if !slices.Equal(got, []int{0, 1, 2, 3}) {
-		t.Errorf("got %v", got)
-	}
-}
-
-func TestPerfCPUsIntelMaskDisjointFallsThrough(t *testing.T) {
-	// Confined to E-cores only: the mask can't help, and equal freqs below
-	// mean nothing else distinguishes them either -> allowed unchanged.
-	dir := fakeSysfs(t, nil, map[int]int{8: 4300000, 9: 4300000})
-	mask := writeCoreMask(t, "0-7")
-	got, signal := perfCPUsFrom(dir, mask, []int{8, 9})
-	if signal != "" || !slices.Equal(got, []int{8, 9}) {
-		t.Errorf("got %v signal %q", got, signal)
-	}
-}
-
-func TestPerfCPUsMaxFreqCompactCores(t *testing.T) {
-	// AMD-style compact cores: no capacity, no Intel mask; 3.3 vs 5.7 GHz.
-	dir := fakeSysfs(t, nil, map[int]int{
-		0: 5700000, 1: 5700000, 2: 3300000, 3: 3300000,
-	})
-	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3})
-	if signal != "max_freq" {
-		t.Fatalf("signal = %q", signal)
-	}
-	if !slices.Equal(got, []int{0, 1}) {
-		t.Errorf("got %v", got)
-	}
-}
-
-func TestPerfCPUsFavoredCoreSkewKept(t *testing.T) {
-	// Turbo Boost Max favored cores run a few percent hot; they must not
-	// shrink the candidate set to one or two cores.
-	dir := fakeSysfs(t, nil, map[int]int{
-		0: 5800000, 1: 5700000, 2: 5700000, 3: 5600000,
-	})
-	got, _ := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2, 3})
-	if !slices.Equal(got, []int{0, 1, 2, 3}) {
-		t.Errorf("favored-core skew filtered CPUs: %v", got)
-	}
-}
-
-func TestPerfCPUsHomogeneousInconclusive(t *testing.T) {
-	dir := fakeSysfs(t, nil, map[int]int{0: 3000000, 1: 3000000})
-	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1})
-	if signal != "" || !slices.Equal(got, []int{0, 1}) {
-		t.Errorf("got %v signal %q", got, signal)
-	}
-}
-
-func TestPerfCPUsNoSysfs(t *testing.T) {
-	dir := t.TempDir()
-	got, signal := perfCPUsFrom(dir, filepath.Join(dir, "nope"), []int{0, 1, 2})
-	if signal != "" || !slices.Equal(got, []int{0, 1, 2}) {
-		t.Errorf("got %v signal %q", got, signal)
-	}
-}
-
-func TestParseCPUList(t *testing.T) {
-	cases := []struct {
-		in      string
-		want    []int
-		wantErr bool
-	}{
-		{"0-3", []int{0, 1, 2, 3}, false},
-		{"0-1,16-17", []int{0, 1, 16, 17}, false},
-		{"5", []int{5}, false},
-		{"", nil, false},
-		{"3-1", nil, true},
-		{"a-b", nil, true},
-		{"1,x", nil, true},
-	}
-	for _, c := range cases {
-		got, err := parseCPUList(c.in)
-		if (err != nil) != c.wantErr {
-			t.Errorf("%q: err=%v wantErr=%v", c.in, err, c.wantErr)
-			continue
-		}
-		if !c.wantErr && !slices.Equal(got, c.want) {
-			t.Errorf("%q: got %v want %v", c.in, got, c.want)
-		}
-	}
-}
@@ -1,10 +0,0 @@
-//go:build !linux
-
-package cpupick
-
-// perfCPUs is Linux-only sysfs walking; elsewhere report "no distinction".
-// Default already returns nil off-Linux (util.AllowedCPUs has no answer
-// there), so this exists to keep the package compiling everywhere.
-func perfCPUs(allowed []int) ([]int, string) {
-	return allowed, ""
-}
@@ -1,118 +0,0 @@
-//go:build linux
-
-package cpupick
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-)
-
-// readTopology probes the NUMA node and physical-core layout of cpus from
-// sysfs. Anything sysfs won't say degrades toward flatTopology: an unknown
-// node becomes node 0, an unknown core becomes a core of its own — either
-// way the corresponding arrange rule becomes a no-op instead of a wrong
-// answer.
-func readTopology(cpus []int) topology {
-	return readTopologyFrom("/sys/devices/system/node", "/sys/devices/system/cpu", cpus)
-}
-
-func readTopologyFrom(nodeDir, cpuDir string, cpus []int) topology {
-	coreOf, zeroCore := coreGroups(cpuDir, cpus)
-	return topology{
-		nodeOf:   numaNodes(nodeDir, cpus),
-		coreOf:   coreOf,
-		zeroCore: zeroCore,
-	}
-}
-
-// numaNodes maps each cpu to its NUMA node via
-// /sys/devices/system/node/nodeN/cpulist. CPUs no node claims (or no node
-// dirs at all: VMs, non-NUMA kernels) land on node 0.
-func numaNodes(nodeDir string, cpus []int) map[int]int {
-	out := make(map[int]int, len(cpus))
-	for _, c := range cpus {
-		out[c] = 0
-	}
-	entries, err := os.ReadDir(nodeDir)
-	if err != nil {
-		return out
-	}
-	want := make(map[int]bool, len(cpus))
-	for _, c := range cpus {
-		want[c] = true
-	}
-	for _, e := range entries {
-		id, ok := strings.CutPrefix(e.Name(), "node")
-		if !ok {
-			continue
-		}
-		n, err := strconv.Atoi(id)
-		if err != nil {
-			continue // has_cpu, possible, ... share the prefix
-		}
-		b, err := os.ReadFile(filepath.Join(nodeDir, e.Name(), "cpulist"))
-		if err != nil {
-			continue
-		}
-		list, err := parseCPUList(strings.TrimSpace(string(b)))
-		if err != nil {
-			continue
-		}
-		for _, c := range list {
-			if want[c] {
-				out[c] = n
-			}
-		}
-	}
-	return out
-}
-
-// coreGroups maps each cpu to a dense physical-core id derived from its
-// (physical_package_id, core_id) pair — core_id alone repeats across
-// sockets. CPUs whose topology files are unreadable get a core of their own.
-// The second return is the group id of the core CPU 0 lives on, or -1 when
-// that can't be determined; CPU 0's own files are consulted even when 0 is
-// not a candidate, so its SMT siblings are recognized under cpusets that
-// exclude CPU 0 itself.
-func coreGroups(cpuDir string, cpus []int) (map[int]int, int) {
-	type pkgCore struct{ pkg, core int }
-	pairOf := func(cpu int) (pkgCore, bool) {
-		topoDir := filepath.Join(cpuDir, fmt.Sprintf("cpu%d", cpu), "topology")
-		pkg, err1 := readIntFile(filepath.Join(topoDir, "physical_package_id"))
-		core, err2 := readIntFile(filepath.Join(topoDir, "core_id"))
-		if err1 != nil || err2 != nil {
-			return pkgCore{}, false
-		}
-		return pkgCore{pkg, core}, true
-	}
-
-	ids := map[pkgCore]int{}
-	out := make(map[int]int, len(cpus))
-	next := 0
-	for _, cpu := range cpus {
-		k, ok := pairOf(cpu)
-		if !ok {
-			out[cpu] = next
-			next++
-			continue
-		}
-		id, ok := ids[k]
-		if !ok {
-			id = next
-			next++
-			ids[k] = id
-		}
-		out[cpu] = id
-	}
-
-	zeroCore := -1
-	if k, ok := pairOf(0); ok {
-		if id, ok := ids[k]; ok {
-			zeroCore = id
-		}
-	}
-	return out, zeroCore
-}
@@ -1,111 +0,0 @@
-//go:build linux
-
-package cpupick
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// fakeTopoSysfs builds nodeDir/cpuDir trees. nodes maps node id -> cpulist
-// string; cores maps cpu -> (package, core) pair.
-func fakeTopoSysfs(t *testing.T, nodes map[int]string, cores map[int][2]int) (string, string) {
-	t.Helper()
-	base := t.TempDir()
-	nodeDir := filepath.Join(base, "node")
-	cpuDir := filepath.Join(base, "cpu")
-	for n, list := range nodes {
-		d := filepath.Join(nodeDir, fmt.Sprintf("node%d", n))
-		if err := os.MkdirAll(d, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(d, "cpulist"), []byte(list+"\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for cpu, pc := range cores {
-		d := filepath.Join(cpuDir, fmt.Sprintf("cpu%d", cpu), "topology")
-		if err := os.MkdirAll(d, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(d, "physical_package_id"), fmt.Appendf(nil, "%d\n", pc[0]), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(d, "core_id"), fmt.Appendf(nil, "%d\n", pc[1]), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	return nodeDir, cpuDir
-}
-
-func TestReadTopology(t *testing.T) {
-	// Two nodes; SMT pairs (0,4),(1,5) on node 0 and (2,6),(3,7) on node 1.
-	// core_id repeats across packages on purpose: the pair must disambiguate.
-	nodeDir, cpuDir := fakeTopoSysfs(t,
-		map[int]string{0: "0-1,4-5", 1: "2-3,6-7"},
-		map[int][2]int{
-			0: {0, 0}, 4: {0, 0}, 1: {0, 1}, 5: {0, 1},
-			2: {1, 0}, 6: {1, 0}, 3: {1, 1}, 7: {1, 1},
-		})
-	cpus := []int{0, 1, 2, 3, 4, 5, 6, 7}
-	topo := readTopologyFrom(nodeDir, cpuDir, cpus)
-
-	for _, c := range []int{0, 1, 4, 5} {
-		if topo.nodeOf[c] != 0 {
-			t.Errorf("cpu %d on node %d, want 0", c, topo.nodeOf[c])
-		}
-	}
-	for _, c := range []int{2, 3, 6, 7} {
-		if topo.nodeOf[c] != 1 {
-			t.Errorf("cpu %d on node %d, want 1", c, topo.nodeOf[c])
-		}
-	}
-	pairs := [][2]int{{0, 4}, {1, 5}, {2, 6}, {3, 7}}
-	for _, p := range pairs {
-		if topo.coreOf[p[0]] != topo.coreOf[p[1]] {
-			t.Errorf("siblings %v not grouped: %d vs %d", p, topo.coreOf[p[0]], topo.coreOf[p[1]])
-		}
-	}
-	if topo.coreOf[0] == topo.coreOf[2] {
-		t.Error("cross-package cores with equal core_id must not merge")
-	}
-	if topo.zeroCore != topo.coreOf[0] {
-		t.Errorf("zeroCore = %d, want %d", topo.zeroCore, topo.coreOf[0])
-	}
-}
-
-func TestReadTopologyZeroCoreWithoutZeroCandidate(t *testing.T) {
-	// CPU 0 is not a candidate (cpuset excludes it) but its sibling 4 is:
-	// zeroCore must still identify their shared core.
-	nodeDir, cpuDir := fakeTopoSysfs(t,
-		map[int]string{0: "0-7"},
-		map[int][2]int{0: {0, 0}, 4: {0, 0}, 1: {0, 1}, 5: {0, 1}})
-	topo := readTopologyFrom(nodeDir, cpuDir, []int{1, 4, 5})
-	if topo.zeroCore < 0 || topo.coreOf[4] != topo.zeroCore {
-		t.Errorf("zeroCore = %d, coreOf[4] = %d; sibling of CPU 0 not identified", topo.zeroCore, topo.coreOf[4])
-	}
-	if topo.coreOf[1] == topo.zeroCore {
-		t.Error("cpu 1 wrongly grouped with CPU 0's core")
-	}
-}
-
-func TestReadTopologyMissingSysfs(t *testing.T) {
-	base := t.TempDir()
-	cpus := []int{0, 1, 2}
-	topo := readTopologyFrom(filepath.Join(base, "nope"), filepath.Join(base, "also-nope"), cpus)
-	seen := map[int]bool{}
-	for _, c := range cpus {
-		if topo.nodeOf[c] != 0 {
-			t.Errorf("cpu %d node = %d, want 0", c, topo.nodeOf[c])
-		}
-		if seen[topo.coreOf[c]] {
-			t.Errorf("cpu %d shares a fallback core group", c)
-		}
-		seen[topo.coreOf[c]] = true
-	}
-	if topo.zeroCore != -1 {
-		t.Errorf("zeroCore = %d, want -1 when unknown", topo.zeroCore)
-	}
-}
@@ -1,10 +0,0 @@
-//go:build !linux
-
-package cpupick
-
-// readTopology has no sysfs to consult off Linux; the flat stand-in makes
-// arrange's NUMA and SMT rules no-ops. Default is already nil off Linux
-// (util.AllowedCPUs has no answer there) — this keeps the package compiling.
-func readTopology(cpus []int) topology {
-	return flatTopology(cpus)
-}
@@ -1,526 +0,0 @@
-# Multiport lanes
-
-Status: experimental. Linux only. Off unless `multiport.ports` is set.
-
-## The problem
-
-A nebula tunnel is one UDP 4-tuple. Everything between the two hosts that makes
-a decision per flow makes it once, for the whole tunnel:
-
- **ECMP / LAG** hashes the 4-tuple and picks one path. A tunnel gets one path's
-  worth of bandwidth no matter how many exist.
- **NIC RSS** hashes the 4-tuple to one receive queue, so one CPU takes every
-  interrupt for the tunnel and receive is capped by a single core.
- **Per-flow policers and shapers** see one flow and rate-limit it as one.
- **Cloud per-flow bandwidth caps** are the hard version of that. AWS EC2 meters
-  each 5-tuple separately and caps a single flow well below what the instance can
-  do in aggregate -- on the order of 5 Gbps for a single flow within a VPC (more
-  inside a cluster placement group, or with ENA Express; check the current EC2
-  network-limits docs for exact numbers) on instances whose aggregate allowance
-  is many times that. Other providers do the same. Nothing about the path is
-  saturated when this fires, and no amount of retuning changes it: the hypervisor
-  is metering *the flow*, so the only way to get more is to be more than one
-  flow.
-
-Running `routines: N` does not help. Those N sockets share one port through
-`SO_REUSEPORT`, and the group is keyed on the exact `(addr, port)` pair, so the
-kernel's reuseport hash is the *only* thing spreading the work -- every hash
-outside this host still sees a single flow.
-
-Multiport gives one tunnel several underlay 4-tuples, so all of those per-flow
-decisions get made several times, independently. A tunnel with N lanes is N
-flows to everything counting flows: N ECMP hashes, N receive queues, N of the
-cloud provider's per-flow buckets.
-
-There is a second bottleneck, and it is inside this host rather than out on the
-network: in FIPS 140 mode the AES-GCM implementation refuses to seal twice under
-the same nonce, which forces every encrypt on a session to be serialized behind
-one mutex. `routines: N` does not help there either. Because each lane is a
-separate session, multiport splits that mutex as well -- see
-[The FIPS 140 encrypt lock](#the-fips-140-encrypt-lock).
-
-## What a lane is
-
-A lane is **not** a second tunnel. It is an extra session on the same
-`HostInfo`.
-
-Noise leaves both sides with `A.eKey == B.dKey` and `A.dKey == B.eKey`. Expanding
-both keys through HKDF-SHA256 with the same per-lane label preserves that
-equality, so both sides land on a matched key pair having exchanged nothing:
-
-```
-lane s send key = HKDF(base eKey, info: "nebula multiport lane v1 <s>")
-lane s recv key = HKDF(base dKey, info: "nebula multiport lane v1 <s>")
-```
-
-(`connection_state.go:deriveLaneKey`. The base key is already unique per tunnel
-and per direction, so the lane index is the only thing that needs to vary and no
-salt is required.)
-
-Consequences worth stating plainly:
-
- A lane costs **no handshake** and has no half-established state.
- A lane dies exactly when its base tunnel dies. There is no independent
-  lifetime to reason about, no second teardown path.
- Each lane is a **full** session: its own message counter, its own replay
-  window, its own cipher states, its own encrypt lock. Flows on different paths
-  never contend for shared replay state, which is what makes reordering across
-  lanes harmless, and under FIPS 140 the separate encrypt locks are what let one
-  tunnel encrypt on more than one core.
- Rolling the base tunnel replaces every lane key, because lanes are derived
-  from it. `maxMessageCounter` therefore reports the max across the base and all
-  lane counters, so rehandshake and exhaustion thresholds see the real data
-  volume rather than the base session's small share.
-
-Which lane a packet belongs to travels in the nebula header, in the low 8 bits
-of what used to be `Reserved` (see `header/header.go`). It is part of the AEAD's
-associated data, so a lane index cannot be altered in flight -- a packet
-decrypts on the lane it claims or not at all.
-
-**Lane 0 is the base tunnel itself**: `HostInfo.ConnectionState`, the base port,
-the peer's real remote address. It is not a special case reserved for control
-traffic; it carries its share of data flows like any other lane.
-
-## Socket layout
-
-`routines` is **per port**. Each of `multiport.ports` consecutive ports gets its
-own full group of `routines` sockets sharing it through `SO_REUSEPORT`, so total
-sockets = total routines = total tun queues = `routines * multiport.ports`.
-
-```
-routines: 2, multiport.ports: 3, listen.port: 4242
-
-              port 4242         port 4243         port 4244
-             (lane 0/base)       (lane 1)          (lane 2)
-            +-------------+   +-------------+   +-------------+
- writers[]  |  0  |  1    |   |  2  |  3    |   |  4  |  5    |
-            +-------------+   +-------------+   +-------------+
- routine        0     1           0     1           0     1
-```
-
-Sockets are laid out **port-major**: `writers[s*routinesPerPort + r]` is the
-r'th socket on port `listen.port+s`. So:
-
-```go
-laneSock(q, s) = s*routinesPerPort + q%routinesPerPort   // inside.go
-egressSock(q)  = laneSock(q, 0)                          // base traffic
-```
-
-Two properties fall out of this, and the rest of the design depends on both:
-
-1. **Every routine owns exactly one socket.** `listenIn` blocks in `recvmmsg`
-   and everything downstream of it -- the batcher, the conntrack cache, the
-   `txQueue` -- is single-owner and lock-free. More sockets than routines would
-   need epoll or locks.
-2. **Every routine has a sibling socket at the same group position on every
-   port.** So socket selection is a pure function of `(queue, lane)` with no
-   borrowing and no shared state, and each port's traffic spreads across its
-   whole group rather than funnelling into one socket.
-
-The second property is why `routines` is per port rather than a total to divide
-up. With one socket per port, each port would be served by a single core -- worst
-of all the base port, which carries every handshake, every lighthouse and punch
-packet, every peer without multiport, and every tunnel whose lanes are down.
-
-## Negotiation
-
-Multiport capability rides the existing handshake payload as two new protobuf
-fields (`handshake/payload.go`): `InitiatorLanes` field 9 and `ResponderLanes`
-field 10, each a `LaneDetails{PortCount, BasePort, TxLanes}`.
-
- `PortCount` / `BasePort` -- the contiguous port range the sender bound, so the
-  peer knows where to aim its lanes.
- `TxLanes` -- how many lanes the sender may send on, so the peer knows how many
-  lane sessions it must be prepared to receive on.
-
-Both are `nil` when multiport is off, which keeps the encoded payload
-**byte-identical** to a vanilla one. A peer that has never heard of lanes skips
-unknown fields as protobuf requires, and gets a plain tunnel.
-
-From the result, `newLaneSet` computes:
-
-```go
-sessions  = min(max(myLanes, peerTxLanes), 256)  // we must be able to RECEIVE all of theirs
-txLanes   = min(myLanes, peerPortCount, sessions) // we may only SEND on ports they bound
-```
-
-Sizing RX by the peer's count and TX by our own is what lets asymmetric hosts
-work: a 4-port laptop talking to a 32-port server sends on 4 lanes and receives
-on 32.
-
-### Port pairing
-
-Lane `s` targets `peerBasePort + ((s + portOffset) % peerPortCount)`.
-
-`portOffset` is a per-pair FNV hash of the sorted vpn-address pair. Without it,
-every small peer would aim its few lanes at a big peer's first few ports and
-concentrate that peer's receive work on a couple of sockets.
-
-The rotation has to cancel, though, or the two directions of one flow would take
-unrelated 4-tuples and neither side's traffic would arrive through the conntrack
-or NAT entry the other's probe opened. So both sides hash the *same* sorted pair
-and the higher-addressed side **negates** the result. When the port counts match,
-the two rotations cancel exactly: our lane `s`'s 4-tuple is the reverse of the
-peer's lane `s`. `laneBias` does the matching rotation on the flow hash for the
-same reason.
-
-That pairing only exists when our lane indices map one-to-one onto the peer's
-ports, which is exactly the `txLanes == peerPortCount` test `newLaneSet` applies
-before setting `laneBias`. If we send on 4 lanes and the peer bound 8 ports, four
-of its ports have no lane of ours pointing at them, and no choice of rotation can
-make our lane `s` and its lane `s` be each other's reverse. So in that case
-`laneBias` stays 0 and each side hashes the flow to a lane on its own. The flow
-still works and is still spread; the two directions simply take two unrelated
-4-tuples instead of one 4-tuple and its exact reverse, and each direction depends
-on its own lane's probe having opened its own conntrack or NAT entry.
-
-## Bringing a lane up
-
-Receiving on a lane needs no permission: the keys are derivable the moment the
-base handshake completes. **Sending** on one needs proof the new 4-tuple actually
-works, because nothing else would notice a middlebox quietly dropping it. So:
-
-```
-lane down  --probe (Test/LaneProbe on lane s, from port base+s to peer's lane port)-->
-           <--ack (Test/LaneProbeAck, on the BASE tunnel)--
-lane up
-```
-
- The probe is encrypted with **the lane's own session**, so an ack proves the
-  whole lane end to end: our source port reached the peer, its reply reached us,
-  and the keys we derived match the ones it derived.
- The ack rides the **base tunnel** on purpose. A probe proves the peer's lane
-  works in *its* send direction; answering on our own lane `s` would make the
-  result depend on a second path that can be broken independently.
- The ack echoes the header's lane, not the payload's, so a peer cannot get us to
-  vouch for a lane it did not probe.
- A generation byte in the probe is echoed in the ack, so a late ack cannot
-  promote a lane on the strength of a superseded probe.
-
-`txAddr[s]` is a single `atomic.Pointer[netip.AddrPort]` that is *both* the TX
-gate and the destination, so a data-plane routine that loads non-nil has
-everything it needs in one atomic read and there is no window where one is set
-and the other is not.
-
-Probing is driven by the connection manager's per-tunnel traffic tick
-(`maintainLanes` -> `probeLanes`), which only fires for a tunnel with traffic --
-the same condition that makes a lane worth having. Timers:
-
-| timer | value |
-|---|---|
-| probe timeout | 2s (shorter than the 5s tick on purpose) |
-| keepalive | 30s |
-| retry backoff | 5s, doubling to 60s |
-| max failure count | 8 |
-
-Traffic on a lane is not evidence the lane works -- that is the whole reason
-lanes need probing -- so a lane that silently breaks is only caught by the
-keepalive.
-
-Every lane starts out **demanded**, so the first traffic tick probes all of them
-at once. This matters more than it looks: see "flow pinning" below. A lane that
-is down also raises demand from the TX path each time a flow wants it, so a
-lane that keeps failing is retried only while something still wants it, and an
-idle tunnel costs nothing.
-
-A lane aims **only** at its own port. There is no fallback to the peer's base
-port when the lane port doesn't answer: a lane sharing the base port's
-destination would gain only a source port of its own while costing the peer the
-receive spread that is the entire point. A lane that can't reach its port stays
-down and its flows ride the base tunnel.
-
-## Flow -> lane -> routine: keeping a flow consistent
-
-This is the part that took the most iterations to get right, so it's worth
-spelling out why it is shaped the way it is.
-
-### The kernel's tun queue feedback loop
-
-On Linux, a multiqueue tun device does not simply hash a flow to a queue. It
-also *learns*: `tun_flow_update` records "this flow was last seen on queue *q*"
-from the packets **we write in**, and `tun_automq_select_queue` prefers what it
-learned over the hash for as long as the flow stays busy.
-
-We write an inbound packet to the tun queue with the same index as the UDP
-routine that received it (`batchers[rxc.q]`). So the queue a flow's *outbound*
-packets arrive on is decided by the socket its *inbound* packets landed on, at
-the far end, one RTT ago.
-
-### Why the lane comes from the flow, not the routine
-
-The obvious design -- routine `q` sends on lane `q` -- deadlocks against that
-feedback loop:
-
-1. A tunnel comes up. All lanes are down, so all traffic goes out lane 0.
-2. The peer receives it all on socket 0 and writes it all to tun queue 0.
-3. Both kernels now believe every flow belongs on queue 0.
-4. Every flow is read by routine 0, so every flow picks lane 0.
-5. Go to 2. The tunnel is pinned to lane 0 for as long as its flows stay busy.
-
-So the lane comes from **the flow's own 5-tuple**, not from the routine index:
-
-```go
-s = (laneFlowHash(fwPacket) + laneBias) % txLanes    // lanes.go:txLaneForFlow
-```
-
-This makes lane spread completely independent of how the kernel steers tun
-queues. It also gives the properties you actually want from a flow's point of
-view:
-
- **A flow stays on one lane for its life.** The hash is a pure function of the
-  5-tuple, so there is no per-packet lane hopping and therefore no reordering
-  introduced by multiport.
- **One lane's replay window sees one stable set of flows.**
- **Both directions of a flow pick partner lanes.** `laneFlowHash` orders the two
-  endpoints before hashing, so it returns the same value from either end, and
-  `laneBias` lines the two sides' choices up. The two directions are exact
-  reverse 4-tuples, which is what NAT and stateful firewalls need.
-
-`newLaneSet` demanding every lane up front is the other half of this. Lanes have
-to be up *before* the flows are: a flow that starts while the lanes are still
-down gets its queue pinned by step 2 above and can stay there for its whole
-life. Eager demand costs one probe per lane on any tunnel that has traffic, and
-nothing at all on one that doesn't.
-
-### The full path
-
-```
-  outbound                                     inbound (at the peer)
-  --------                                     ---------------------
-  inside flow
-     |  kernel tun hash, or the queue it
-     |  learned from our last write
-     v
-  tun queue q  ->  routine q
-     |
-     |  s = laneFlowHash(flow) % txLanes      lane s arrives on port base+s
-     v                                           |
-  lane s session                                 |  SO_REUSEPORT hash of the
-     |                                           |  4-tuple picks one socket
-     |  writers[laneSock(q,s)]                   v
-     v                                       routine q' (owner of that socket)
-  port base+s  ------------------------->        |
-                                                 v
-                                             tun queue q'  (teaches the kernel
-                                                            flow -> q')
-```
-
-Note that RX is entirely socket-agnostic: the lane comes from the header byte,
-not from the port the packet arrived on, and roaming is skipped for `lane != 0`
-(a lane's source address is a per-lane 4-tuple, not the tunnel's remote -- letting
-it roam the hostinfo would point every non-lane packet at a lane port). So a
-lane packet may legitimately arrive on any socket, which is what makes the
-reuseport spread within a port safe.
-
-### Ordering and locking
-
-Several routines can write to one socket, since the routines whose lane
-arithmetic lands on the same index share it. Linux's `batchWriter` serializes
-`sendmmsg` with a mutex. Per-flow wire order still holds regardless: a flow is
-hashed onto one lane and read by one routine, so nothing else is writing that
-flow.
-
-Each routine holds one `txQueue` with one shared arena (~1.16 MB) and builds a
-`SendBatch` per lane lazily, on the first packet that picks it, so a routine that
-never sends on a lane never pays for one.
-
-### The FIPS 140 encrypt lock
-
-In FIPS 140 mode -- a `boringcrypto` build, or `GODEBUG=fips140=on` -- nebula
-uses `noiseutil.CipherAESGCMFIPS140` instead of the plain AES-GCM cipher. That
-cipher is the TLS 1.3 GCM (`GCMWithXORCounterNonce`), which **panics** if it is
-asked to seal with a counter that is not strictly greater than the last one. That
-check is the point: it is the nonce-reuse protection FIPS 140 requires, and
-`noiseutil`'s startup self-test refuses to run if the check has gone missing.
-
-The check means encrypts on one session cannot overlap, so
-`noiseutil.EncryptLockNeeded` is true and every send path takes that session's
-`ConnectionState.writeLock`:
-
-```go
-if noiseutil.EncryptLockNeeded {
-        ci.writeLock.Lock()
-}
-c := ci.messageCounter.Add(1)
-out = header.EncodeLane(scratch, ..., c, lane)
-out, encErr := ci.eKey.EncryptDanger(out, out, seg, c, nb)
-if noiseutil.EncryptLockNeeded {
-        ci.writeLock.Unlock()
-}
-```
-
-The lock has to cover the seal and not just the counter increment. Reserving
-counters atomically is easy; the requirement is that the seals *arrive at the
-AEAD in counter order*, and only holding the lock across both gives that.
-
-So under FIPS 140 the encrypt cost of a tunnel is pinned to one core. `routines:
-N` gives N readers, but every one of them that has a packet for the same peer
-queues on the same mutex, and with TSO/USO the lock is taken and released once
-per segment -- up to ~45 times for a single superpacket
-(`sendInsideEncrypt`). Receive is not affected: `extractFIPSAEAD` deliberately
-pulls the inner FIPS AEAD out of the `crypto/tls` wrapper because that inner
-implementation is safe to `Open` concurrently, and `decryptLock` is only ever
-held around the replay-window check and update.
-
-Lanes split the lock because a lane is a separate `ConnectionState`: its own
-`writeLock`, its own message counter, its own nonce sequence. A peer we send to
-on `txLanes` lanes has `txLanes` independent encrypt locks, so encrypt for that
-one tunnel can run on that many cores at once.
-
-The flow hash is what makes this work rather than merely legal. A flow maps to
-one lane, so all of a flow's packets take one lock in counter order -- exactly
-what the FIPS AEAD demands -- while different flows to the same peer land on
-different locks. Contention is divided, not eliminated: any routine may send on
-any lane, so two routines whose flows hash to the same lane still serialize
-against each other.
-
-Two caveats. This is only a FIPS 140 benefit -- in a normal build
-`EncryptLockNeeded` is false, encrypt is lock-free, and lanes buy path and queue
-spread only. And it is not unilateral: `txLanes` is bounded by the peer's port
-count, so a peer that binds one port leaves us back on one encrypt lock however
-many ports we bound ourselves.
-
-## Falling back to the old behavior
-
-Multiport degrades rather than failing, at every level. This is deliberate:
-managed deployments can't be hard-errored on config they don't control.
-
-### Whole-node: back to one port
-
-Any of these turns multiport off, logs why, and leaves a node that binds one
-port with `routines` `SO_REUSEPORT` sockets -- bit-for-bit the pre-multiport
-configuration:
-
-| condition | log |
-|---|---|
-| `multiport.enabled: false` | - |
-| `multiport.ports` unset, 0, or 1 | `multiport disabled: set multiport.ports > 1 ...` |
-| `listen.port + ports - 1 > 65535` | `multiport disabled: would bind ports beyond 65535` |
-| platform can't run multiple UDP readers | `multiport disabled: this platform does not support multiple udp readers` |
-| that capability couldn't be probed | `multiport disabled: could not probe udp reader support` |
-
-`multiport.ports` is also clamped to 256 (the lane header limit) and to
-`maxRoutines / routines`, with a warning, rather than being rejected.
-
-With a dynamic `listen.port: 0`, the first socket binds dynamically and the
-range is claimed above it; a partially-occupied range re-rolls with a fresh
-dynamic port up to 6 times.
-
-`laneSock` collapses to the identity when multiport is off, so the send path is
-unchanged: a routine writes to its own socket and no lane batches are built at
-all.
-
-### Per-tunnel: back to a single session
-
-`newLaneSet` returns `nil`, and the tunnel is an ordinary one, when:
-
- the peer advertised no port count (vanilla peer, or multiport off there), or
- `sessions < 2`, i.e. neither side offers a lane.
-
-`txLanes` can also land at 1 -- we bound ports but the peer bound only one -- in
-which case the set exists for RX but we never send on a lane.
-
-### Per-packet: back to the base tunnel
-
-`txLaneForFlow` returns a nil session and the packet rides the base tunnel,
-decided per packet with no state to unwind:
-
- the flow hashed onto lane 0 (its fair share of flows);
- the lane it hashed onto has never come up;
- the lane was **demoted** -- a probe or keepalive went unanswered. Fallback is
-  immediate, on the very next packet, and the miss re-raises demand so the lane
-  is re-probed;
- the tunnel is **relayed** -- lanes are direct-only, so `probeLanes` drops them
-  all when there is no direct path and rebuilds when one returns;
- the peer **roamed** -- a new NAT mapping has no derivable relationship to the
-  old lane ports, so every lane is torn down and re-probed from a clean backoff.
-  Standing demand is deliberately kept across a reset, so the lanes that were
-  actually carrying data come back first.
-
-### Always on the base tunnel
-
-Handshakes, lighthouse traffic, punching, relay carriers, close packets, rejects,
-and lane probe *acks* all use the base session and a socket on the base port
-(`egressSock`). Base traffic must keep the base source port or a vanilla peer
-would see the tunnel's address move and roam-thrash.
-
-`recv_error` is the one deliberate exception: it replies from the socket the
-offending packet arrived on, because a lane peer's spoof guard compares our
-source address against that lane's remote and would discard a reply from the
-base port.
-
-### Wire compatibility
-
- A vanilla sender emits lane 0 in a field it thinks is reserved, and lane 0 is
-  the base tunnel, so it reads correctly with no version check.
- We always send the upper 8 reserved bits as zero.
- A lane index above what this tunnel has (a stale lane from a rolled tunnel, or
-  a peer sending above what it advertised) is dropped **silently** -- a
-  `recv_error` would tear down a perfectly good base tunnel on the strength of
-  one odd packet.
- Lane ciphertext wrapped in a relay carrier is refused before the session
-  lookup, so a junk relay packet can't make us derive a session.
-
-## Security notes
-
- The lane index is in the AEAD's associated data, so it is authenticated, not
-  just carried.
- On RX, a lane session derived for an unrecognized lane is **not installed**
-  until the packet actually decrypts. Anyone who can spoof this tunnel's local
-  index can name any lane; installing on sight would let them make us hold a
-  replay window and two cipher states per lane, per tunnel, for lanes they never
-  send on.
- Two routines racing on a lane's first packet each derive a session. The loser's
-  is dropped, and its replay-window entry for the packet it just accepted is
-  handed to the winner (`installSession`) -- the keys are identical, so it is the
-  same window in every respect that matters.
-
-## Configuration
-
-```yaml
-routines: 8          # PER PORT under multiport; total workers = routines * ports
-multiport:
-  enabled: true      # default true, but inert without ports
-  ports: 4           # consecutive ports from listen.port; must be > 1, no default
-  lanes: 0           # 0 = one per bound port; lower to send on a subset
-```
-
-`multiport.ports` has no default on purpose: under these semantics a default
-would silently multiply the worker count. Nothing here is reloadable.
-
-Both sides need a port range, and the range
-`[listen.port, listen.port+ports-1]` must be open in both directions. Opening
-only the base port is the common failure and gives you exactly one working lane
-- the one whose rotation happens to land on the base port.
-
-## Observability
-
-```
-nebula-ssh> print-tunnel -vpn-addr <peer>
-```
-
-`lanes[]` gives per-lane `up`, `remote` and `messageCounter`, which is the fastest
-way to tell "no lanes negotiated" (key absent) from "lanes up but traffic on one"
-(counters).
-
-Metrics, registered only when multiport is running so they don't sit at zero on
-nodes without it:
-
- `multiport.lanes.up` -- lanes currently carrying traffic
- `multiport.lanes.tunnels` -- tunnels with any lanes
-
-Both are counted by walking the hostmap rather than kept at promotion/demotion,
-because a counter would drift upward forever: a tunnel torn down with its lanes
-up never demotes them.
-
-Logs worth grepping: `multiport enabled` and `multiport routines` at startup, the
-`lanes` attr on handshake completion (`tx`, `sessions`, `peerBasePort`,
-`peerPorts`, `portOffset`), and `Multiport lane up` / `Multiport lane demoted`,
-both of which name the `udpAddr` involved.
-
-## Known gaps
-
- No `readOutsidePackets`-level test for the RX lane drop paths.
- No multiport coverage in the e2e suite.
- `routines * ports > 256` fails at startup from the kernel's tun queue limit
-  rather than being clamped with a warning.
@@ -62,7 +62,7 @@ function nebula.dissector(tvbuf, pktinfo, root)
    tree:add(pf_version, tvbuf:range(0,1))
    local type = tree:add(pf_type,    tvbuf:range(0,1))

-    local nebula_type = bit.band(tvbuf:range(0,1):uint(), 0x0F)
+    local nebula_type = bit32.band(tvbuf:range(0,1):uint(), 0x0F)
    if nebula_type == 0 then
        local stage = tvbuf(8,8):uint64()
        tree:add(pf_subtype_handshake, tvbuf:range(1,1))
@@ -11,21 +11,19 @@ import (
 	"sync"
 	"sync/atomic"

+	"github.com/gaissmai/bart"
 	"github.com/miekg/dns"
 	"github.com/slackhq/nebula/config"
 )

 type dnsServer struct {
 	sync.RWMutex
-	l       *slog.Logger
-	ctx     context.Context
-	dnsMap4 map[string]netip.Addr
-	dnsMap6 map[string]netip.Addr
-	hostMap *HostMap
-	pki     *PKI
-
-	// selfHost is the cached FQDN we last seeded for ourselves
-	selfHost string
+	l               *slog.Logger
+	ctx             context.Context
+	dnsMap4         map[string]netip.Addr
+	dnsMap6         map[string]netip.Addr
+	hostMap         *HostMap
+	myVpnAddrsTable *bart.Lite

 	mux *dns.ServeMux

@@ -57,14 +55,14 @@ type dnsServer struct {
 // they no-op when DNS isn't enabled. Each Start invocation owns a ctx-cancel
 // watcher that tears the listener down on nebula shutdown. The returned
 // pointer is always non-nil, even on error.
-func newDnsServerFromConfig(ctx context.Context, l *slog.Logger, pki *PKI, hostMap *HostMap, c *config.C) (*dnsServer, error) {
+func newDnsServerFromConfig(ctx context.Context, l *slog.Logger, cs *CertState, hostMap *HostMap, c *config.C) (*dnsServer, error) {
 	ds := &dnsServer{
-		l:       l,
-		ctx:     ctx,
-		dnsMap4: make(map[string]netip.Addr),
-		dnsMap6: make(map[string]netip.Addr),
-		hostMap: hostMap,
-		pki:     pki,
+		l:               l,
+		ctx:             ctx,
+		dnsMap4:         make(map[string]netip.Addr),
+		dnsMap6:         make(map[string]netip.Addr),
+		hostMap:         hostMap,
+		myVpnAddrsTable: cs.myVpnAddrsTable,
 	}
 	ds.mux = dns.NewServeMux()
 	ds.mux.HandleFunc(".", ds.handleDnsRequest)
@@ -78,7 +76,6 @@ func newDnsServerFromConfig(ctx context.Context, l *slog.Logger, pki *PKI, hostM
 	if err := ds.reload(c, true); err != nil {
 		return ds, err
 	}
-	ds.seedSelf()
 	return ds, nil
 }

@@ -97,7 +94,8 @@ func (d *dnsServer) reload(c *config.C, initial bool) error {
 	newAddr := getDnsServerAddr(c)

 	d.serverMu.Lock()
-	running := d.server != nil
+	running := d.server
+	runningStarted := d.started
 	sameAddr := d.addr == newAddr
 	d.addr = newAddr
 	d.enabled.Store(enabled)
@@ -111,26 +109,29 @@ func (d *dnsServer) reload(c *config.C, initial bool) error {
 	}

 	if !enabled {
-		if running {
+		if running != nil {
 			d.Stop()
 		}
 		// Drop any records that accumulated while enabled; a later re-enable
-		// will repopulate from fresh handshakes and a fresh seedSelf.
+		// will repopulate from fresh handshakes.
 		d.clearRecords()
 		return nil
 	}

-	if !running {
+	if running == nil {
 		// Was disabled (or never started); bring it up now.
 		go d.Start()
-	} else if !sameAddr {
-		// Stop clears the slot before shutting down, otherwise the Start below can find the dying server and refuse
-		d.Stop()
-		go d.Start()
+		return nil
 	}

-	// Refresh the self entry every enabled reload so cert renewals that change our name or VPN addresses are picked up.
-	d.seedSelf()
+	if sameAddr {
+		return nil
+	}
+
+	d.shutdownServer(running, runningStarted, "reload")
+	// Old Start goroutine has now exited; bring up a fresh listener on the
+	// new address.
+	go d.Start()
 	return nil
 }

@@ -161,9 +162,7 @@ func (d *dnsServer) Start() {

 	started := make(chan struct{})
 	d.serverMu.Lock()
-	// Re-check enabled under the lock, a disable that raced our check above snapshots the slot under it too.
-	// Two reloads in quick succession can both spawn a Start, the loser would orphan the live listener past Stop
-	if d.ctx.Err() != nil || d.server != nil || !d.enabled.Load() {
+	if d.ctx.Err() != nil {
 		d.serverMu.Unlock()
 		return
 	}
@@ -201,14 +200,6 @@ func (d *dnsServer) Start() {
 		close(started)
 	}

-	// Release our slot, unless a reload already replaced us, so a dead listener can't block a future Start
-	d.serverMu.Lock()
-	if d.server == server {
-		d.server = nil
-		d.started = nil
-	}
-	d.serverMu.Unlock()
-
 	if err != nil {
 		d.l.Warn("Failed to run the DNS responder", "error", err)
 	}
@@ -258,20 +249,6 @@ func (d *dnsServer) QueryCert(data string) string {
 		return ""
 	}

-	// The hostmap only ever contains peers we have handshaked with, so it never carries an entry for ourselves.
-	// Answer self lookups straight from the local cert state.
-	if cs := d.certState(); cs != nil && cs.myVpnAddrsTable != nil && cs.myVpnAddrsTable.Contains(ip) {
-		c := cs.GetDefaultCertificate()
-		if c == nil {
-			return ""
-		}
-		b, err := c.MarshalJSON()
-		if err != nil {
-			return ""
-		}
-		return string(b)
-	}
-
 	hostinfo := d.hostMap.QueryVpnAddr(ip)
 	if hostinfo == nil {
 		return ""
@@ -289,60 +266,12 @@ func (d *dnsServer) QueryCert(data string) string {
 	return string(b)
 }

-// clearRecords drops all DNS records, including the self entry.
+// clearRecords drops all DNS records.
 func (d *dnsServer) clearRecords() {
 	d.Lock()
 	defer d.Unlock()
 	clear(d.dnsMap4)
 	clear(d.dnsMap6)
-	d.selfHost = ""
-}
-
-// seedSelf inserts (or refreshes) a record for our own cert name pointing at our VPN addresses,
-// so a single-lighthouse network can resolve the lighthouse's own hostname without the two-process workaround.
-func (d *dnsServer) seedSelf() {
-	if !d.enabled.Load() {
-		return
-	}
-	cs := d.certState()
-	if cs == nil {
-		return
-	}
-	c := cs.GetDefaultCertificate()
-	if c == nil {
-		return
-	}
-	newHost := strings.ToLower(c.Name()) + "."
-
-	d.Lock()
-	defer d.Unlock()
-	if d.selfHost != "" && d.selfHost != newHost {
-		delete(d.dnsMap4, d.selfHost)
-		delete(d.dnsMap6, d.selfHost)
-	}
-	d.selfHost = newHost
-	delete(d.dnsMap4, newHost)
-	delete(d.dnsMap6, newHost)
-	haveV4, haveV6 := false, false
-	for _, addr := range cs.myVpnAddrs {
-		if addr.Is4() && !haveV4 {
-			d.dnsMap4[newHost] = addr
-			haveV4 = true
-		} else if addr.Is6() && !haveV6 {
-			d.dnsMap6[newHost] = addr
-			haveV6 = true
-		}
-		if haveV4 && haveV6 {
-			break
-		}
-	}
-}
-
-func (d *dnsServer) certState() *CertState {
-	if d.pki == nil {
-		return nil
-	}
-	return d.pki.getCertState()
 }

 // Add adds the first IPv4 and IPv6 address that appears in `addresses` as the record for `host`
@@ -380,12 +309,8 @@ func (d *dnsServer) isSelfNebulaOrLocalhost(addr string) bool {
 		return true
 	}

-	cs := d.certState()
-	if cs == nil || cs.myVpnAddrsTable == nil {
-		return false
-	}
 	//if we found it in this table, it's good
-	return cs.myVpnAddrsTable.Contains(b)
+	return d.myVpnAddrsTable.Contains(b)
 }

 func (d *dnsServer) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
@@ -9,10 +9,7 @@ import (
 	"testing"
 	"time"

-	"github.com/gaissmai/bart"
 	"github.com/miekg/dns"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/config"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -194,51 +191,14 @@ func TestDnsServer_reload_initial_serveDnsWithoutLighthouse(t *testing.T) {
 }

 func TestDnsServer_reload_sameAddr_noOp(t *testing.T) {
-	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", port, true, true)
+	setDnsConfig(c, "127.0.0.1", "0", true, true)
+
 	require.NoError(t, ds.reload(c, true))
-
-	go ds.Start()
-	waitForBind(t, ds)
-
-	ds.serverMu.Lock()
-	before := ds.server
-	ds.serverMu.Unlock()
-	require.NotNil(t, before)
-
-	// Same address, so the running listener must be left alone rather than rebuilt under live queries
+	// No server running yet, no addr change. Reload should not spawn anything.
 	require.NoError(t, ds.reload(c, false))
 	assert.True(t, ds.enabled.Load())
-
-	ds.serverMu.Lock()
-	after := ds.server
-	ds.serverMu.Unlock()
-	assert.Same(t, before, after, "a same-address reload must not restart the listener")
-
-	ds.Stop()
-}
-
-// The branch the old sameAddr test was accidentally hitting: enabled with nothing running means reload starts it.
-func TestDnsServer_reload_whenNotRunning_starts(t *testing.T) {
-	port := freeUDPPort(t)
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", port, true, true)
-
-	// initial only records config, it never starts anything
-	require.NoError(t, ds.reload(c, true))
-	ds.serverMu.Lock()
-	assert.Nil(t, ds.server, "the initial reload must not start a listener")
-	ds.serverMu.Unlock()
-
-	require.NoError(t, ds.reload(c, false))
-	waitForBind(t, ds)
-
-	ds.serverMu.Lock()
-	assert.NotNil(t, ds.server, "a reload with nothing running should bring DNS up")
-	ds.serverMu.Unlock()
-
-	ds.Stop()
+	assert.Nil(t, ds.server)
 }

 func TestDnsServer_StartStop_lifecycle(t *testing.T) {
@@ -316,92 +276,6 @@ func TestDnsServer_Stop_beforeBind_doesNotHang(t *testing.T) {
 	}
 }

-// newTestPKI builds a minimal *PKI with a single v1 cert whose name and
-// VPN addresses are caller-provided, suitable for exercising seedSelf and
-// QueryCert self handling.
-func newTestPKI(t *testing.T, name string, addrs []netip.Addr) *PKI {
-	t.Helper()
-	networks := make([]netip.Prefix, 0, len(addrs))
-	for _, a := range addrs {
-		bits := 32
-		if a.Is6() {
-			bits = 128
-		}
-		networks = append(networks, netip.PrefixFrom(a, bits))
-	}
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil)
-	c, _, _, _ := cert_test.NewTestCert(cert.Version2, cert.Curve_CURVE25519, ca, caKey, name, time.Time{}, time.Time{}, networks, nil, nil)
-
-	addrsTable := new(bart.Lite)
-	for _, a := range addrs {
-		addrsTable.Insert(netip.PrefixFrom(a, a.BitLen()))
-	}
-
-	cs := &CertState{
-		v2Cert:            c,
-		initiatingVersion: cert.Version2,
-		myVpnAddrs:        addrs,
-		myVpnAddrsTable:   addrsTable,
-	}
-	pki := &PKI{}
-	pki.cs.Store(cs)
-	return pki
-}
-
-func TestDnsServer_seedSelf_addsOwnRecord(t *testing.T) {
-	ds, c := newTestDnsServer(t)
-	myV4 := netip.MustParseAddr("10.0.0.1")
-	myV6 := netip.MustParseAddr("fd00::1")
-	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{myV4, myV6})
-	setDnsConfig(c, "127.0.0.1", "0", true, true)
-	require.NoError(t, ds.reload(c, true))
-
-	ds.seedSelf()
-	got4, exists := ds.Query(dns.TypeA, "lighthouse.")
-	assert.True(t, exists)
-	assert.Equal(t, myV4, got4)
-	got6, exists := ds.Query(dns.TypeAAAA, "lighthouse.")
-	assert.True(t, exists)
-	assert.Equal(t, myV6, got6)
-}
-
-func TestDnsServer_seedSelf_disabled_noOp(t *testing.T) {
-	ds, c := newTestDnsServer(t)
-	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{netip.MustParseAddr("10.0.0.1")})
-	setDnsConfig(c, "127.0.0.1", "0", true, false)
-	require.NoError(t, ds.reload(c, true))
-
-	ds.seedSelf()
-	_, exists := ds.Query(dns.TypeA, "lighthouse.")
-	assert.False(t, exists)
-}
-
-func TestDnsServer_clearRecords_dropsSelfHost(t *testing.T) {
-	ds, c := newTestDnsServer(t)
-	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{netip.MustParseAddr("10.0.0.1")})
-	setDnsConfig(c, "127.0.0.1", "0", true, true)
-	require.NoError(t, ds.reload(c, true))
-	ds.seedSelf()
-	require.NotEmpty(t, ds.selfHost)
-
-	ds.clearRecords()
-	assert.Empty(t, ds.selfHost)
-	_, exists := ds.Query(dns.TypeA, "lighthouse.")
-	assert.False(t, exists)
-}
-
-func TestDnsServer_QueryCert_returnsOwnCert(t *testing.T) {
-	ds, _ := newTestDnsServer(t)
-	myV4 := netip.MustParseAddr("10.0.0.1")
-	ds.pki = newTestPKI(t, "lighthouse", []netip.Addr{myV4})
-
-	got := ds.QueryCert(myV4.String() + ".")
-	assert.NotEmpty(t, got, "TXT lookup of our own VPN address should return our cert")
-
-	other := netip.MustParseAddr("10.0.0.99")
-	assert.Empty(t, ds.QueryCert(other.String()+"."), "unknown peer IP should return nothing")
-}
-
 func TestDnsServer_reload_disable_stopsRunningServer(t *testing.T) {
 	port := freeUDPPort(t)
 	ds, c := newTestDnsServer(t)
@@ -464,168 +338,3 @@ func waitFor(t *testing.T, cond func() bool) {
 	}
 	t.Fatal("timed out waiting for condition")
 }
-
-// Two reloads in quick succession, or a HUP before Control.Start, can race two Starts at the same listener.
-func TestDnsServer_Start_isIdempotent(t *testing.T) {
-	port := freeUDPPort(t)
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", port, true, true)
-	require.NoError(t, ds.reload(c, true))
-
-	go ds.Start()
-	waitForBind(t, ds)
-
-	ds.serverMu.Lock()
-	first := ds.server
-	ds.serverMu.Unlock()
-	require.NotNil(t, first)
-
-	// If the second Start replaces the tracked server, Stop kills the wrong one and the port leaks
-	done := make(chan struct{})
-	go func() {
-		ds.Start()
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(time.Second * 5):
-		t.Fatal("second Start never returned")
-	}
-
-	ds.serverMu.Lock()
-	second := ds.server
-	ds.serverMu.Unlock()
-	assert.Same(t, first, second, "a second Start must not replace the running server")
-
-	// The real proof, after Stop the port must actually be free
-	ds.Stop()
-	waitFor(t, func() bool {
-		pc, err := net.ListenPacket("udp", "127.0.0.1:"+port)
-		if err != nil {
-			return false
-		}
-		_ = pc.Close()
-		return true
-	})
-}
-
-// An address change must actually end up listening on the new port. Start's guard refuses when a server is already
-// installed, so reload has to clear the slot before shutting the old one down.
-func TestDnsServer_reload_addrChange_restarts(t *testing.T) {
-	first := freeUDPPort(t)
-	second := freeUDPPort(t)
-
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", first, true, true)
-	require.NoError(t, ds.reload(c, true))
-
-	go ds.Start()
-	waitForBind(t, ds)
-
-	// Cycle a few times, the failure this guards against depends on which goroutine wins serverMu
-	for i := range 8 {
-		want := second
-		if i%2 == 1 {
-			want = first
-		}
-		setDnsConfig(c, "127.0.0.1", want, true, true)
-		require.NoError(t, ds.reload(c, false))
-		waitForBind(t, ds)
-
-		ds.serverMu.Lock()
-		srv := ds.server
-		ds.serverMu.Unlock()
-		require.NotNil(t, srv, "reload left DNS down instead of restarting it")
-		require.Equal(t, "127.0.0.1:"+want, srv.Addr, "reload should be serving the new address")
-	}
-
-	// Land back on second so the port assertions below are meaningful
-	setDnsConfig(c, "127.0.0.1", second, true, true)
-	require.NoError(t, ds.reload(c, false))
-	waitForBind(t, ds)
-
-	// The old port must be released and the new one actually held
-	waitFor(t, func() bool {
-		pc, err := net.ListenPacket("udp", "127.0.0.1:"+first)
-		if err != nil {
-			return false
-		}
-		_ = pc.Close()
-		return true
-	})
-	_, err := net.ListenPacket("udp", "127.0.0.1:"+second)
-	require.Error(t, err, "the new address should be bound by the DNS responder")
-
-	ds.Stop()
-}
-
-// A listener that dies on its own must release the slot, or a later same-addr reload sees it as running and no-ops.
-func TestDnsServer_Start_bindFailure_releasesSlot(t *testing.T) {
-	port := freeUDPPort(t)
-	blocker, err := net.ListenPacket("udp", "127.0.0.1:"+port)
-	require.NoError(t, err)
-
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", port, true, true)
-	require.NoError(t, ds.reload(c, true))
-
-	ds.Start() // returns once the bind fails
-
-	ds.serverMu.Lock()
-	assert.Nil(t, ds.server, "a listener that failed to bind must not stay parked in the slot")
-	ds.serverMu.Unlock()
-
-	// With the slot released, a reload can retry once the port frees up
-	require.NoError(t, blocker.Close())
-	require.NoError(t, ds.reload(c, false))
-	waitForBind(t, ds)
-
-	ds.serverMu.Lock()
-	assert.NotNil(t, ds.server, "a same-addr reload should retry after a failed bind")
-	ds.serverMu.Unlock()
-
-	ds.Stop()
-}
-
-// A disable that lands while Start is between its unlocked check and the guard must not leave a listener behind.
-func TestDnsServer_Start_refusesWhenDisabledUnderLock(t *testing.T) {
-	port := freeUDPPort(t)
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", port, true, true)
-	require.NoError(t, ds.reload(c, true))
-	require.True(t, ds.enabled.Load())
-
-	// Holding serverMu parks Start on the lock, the only way to land the disable in that window on purpose
-	ds.serverMu.Lock()
-
-	done := make(chan struct{})
-	go func() {
-		ds.Start()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		ds.serverMu.Unlock()
-		t.Fatal("Start returned early, the test never exercised the window")
-	case <-time.After(time.Millisecond * 100):
-	}
-
-	// The disable reload's critical section. It sees nothing running, so it never calls Stop.
-	ds.enabled.Store(false)
-	ds.serverMu.Unlock()
-
-	select {
-	case <-done:
-	case <-time.After(time.Second * 5):
-		t.Fatal("Start never returned")
-	}
-
-	ds.serverMu.Lock()
-	assert.Nil(t, ds.server, "Start must not install a listener a disable already cancelled")
-	ds.serverMu.Unlock()
-
-	pc, err := net.ListenPacket("udp", "127.0.0.1:"+port)
-	require.NoError(t, err, "an orphaned listener is still holding the port")
-	_ = pc.Close()
-}
@@ -1,16 +1,6 @@
 FROM gcr.io/distroless/static:latest

 ARG TARGETOS TARGETARCH
-
-ARG VERSION=dev
-ARG REVISION=unknown
-LABEL org.opencontainers.image.title="nebula" \
-      org.opencontainers.image.description="A scalable overlay networking tool with a focus on performance, simplicity and security" \
-      org.opencontainers.image.vendor="Nebula OSS" \
-      org.opencontainers.image.source="https://github.com/slackhq/nebula" \
-      org.opencontainers.image.version="${VERSION}" \
-      org.opencontainers.image.revision="${REVISION}"
-
 COPY build/$TARGETOS-$TARGETARCH/nebula /nebula
 COPY build/$TARGETOS-$TARGETARCH/nebula-cert /nebula-cert

@@ -1,85 +0,0 @@
-//go:build e2e_testing
-// +build e2e_testing
-
-package e2e
-
-import (
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/udp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func assertTestRequestEchoed(t *testing.T, cipher string) {
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	over := m{"cipher": cipher}
-	a, aNet, aUdp, _ := newSimpleServer(cert.Version1, ca, caKey, "a", "10.128.0.1/24", over)
-	b, bNet, bUdp, _ := newSimpleServer(cert.Version1, ca, caKey, "b", "10.128.0.2/24", over)
-
-	a.InjectLightHouseAddr(bNet[0].Addr(), bUdp)
-	b.InjectLightHouseAddr(aNet[0].Addr(), aUdp)
-	a.Start()
-	b.Start()
-	t.Cleanup(func() { a.Stop(); b.Stop() })
-	r := router.NewR(t, a, b)
-	defer r.RenderFlow()
-
-	assertTunnel(t, aNet[0].Addr(), bNet[0].Addr(), a, b, r)
-	drainUDPTx(a)
-	drainUDPTx(b)
-
-	payload := []byte("a test payload well over sixteen bytes long, wow it's so very long long long!")
-	require.Greater(t, len(payload), header.Len)
-	a.GetF().SendMessageToVpnAddr(header.Test, header.TestRequest, bNet[0].Addr(), payload, make([]byte, 12, 12), make([]byte, udp.MTU))
-
-	// Deliver A's request to B; B must echo a reply back
-	b.InjectUDPPacket(a.GetFromUDP(true))
-	reply := nextUDPTxOfType(t, b, header.Test, header.TestReply, 2*time.Second)
-
-	assert.Equal(t, aUdp, reply.To, "the reply must go back to the requester")
-	// header + echoed payload + 16-byte AEAD tag: proves the whole payload
-	// round-tripped rather than being dropped or truncated.
-	assert.Equal(t, header.Len+len(payload)+16, len(reply.Data), "the full payload must be echoed back")
-}
-
-func TestTestRequestEchoesLongPayloadAES(t *testing.T) {
-	assertTestRequestEchoed(t, "aes")
-}
-
-func TestTestRequestEchoesLongPayloadChaChaPoly(t *testing.T) {
-	assertTestRequestEchoed(t, "chachapoly")
-}
-
-// drainUDPTx empties a control's UDP tx queue without blocking.
-func drainUDPTx(c *nebula.Control) {
-	for c.GetFromUDP(false) != nil {
-	}
-}
-
-// nextUDPTxOfType returns the next packet a control transmits whose nebula
-// header matches (wantType, wantSub), skipping unrelated packets.
-// It fails the test if none arrives within the timeout.
-func nextUDPTxOfType(t *testing.T, c *nebula.Control, wantType header.MessageType, wantSub header.MessageSubType, within time.Duration) *udp.Packet {
-	t.Helper()
-	ch := c.GetUDPTxChan()
-	timeout := time.After(within)
-	for {
-		select {
-		case p := <-ch:
-			var h header.H
-			if err := h.Parse(p.Data); err == nil && h.Type == wantType && h.Subtype == wantSub {
-				return p
-			}
-		case <-timeout:
-			t.Fatalf("timed out waiting for a %v/%v packet on the udp tx queue", wantType, wantSub)
-			return nil
-		}
-	}
-}
@@ -405,7 +405,7 @@ func TestStage1Race(t *testing.T) {

 	r.Log("Spin until connection manager tears down a tunnel")

-	for myControl.GetHostmapIndexCount()+theirControl.GetHostmapIndexCount() > 2 {
+	for len(myControl.GetHostmap().Indexes)+len(theirControl.GetHostmap().Indexes) > 2 {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -453,11 +453,9 @@ func TestUncleanShutdownRaceLoser(t *testing.T) {

 	r.Log("Nuke my hostmap")
 	myHostmap := myControl.GetHostmap()
-	myHostmap.Lock()
 	myHostmap.Hosts = map[netip.Addr]*nebula.HostInfo{}
 	myHostmap.Indexes = map[uint32]*nebula.HostInfo{}
 	myHostmap.RemoteIndexes = map[uint32]*nebula.HostInfo{}
-	myHostmap.Unlock()

 	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me again")))
 	p = r.RouteForAllUntilTxTun(theirControl)
@@ -467,10 +465,10 @@ func TestUncleanShutdownRaceLoser(t *testing.T) {
 	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)

 	r.Log("Wait for the dead index to go away")
-	start := theirControl.GetHostmapIndexCount()
+	start := len(theirControl.GetHostmap().Indexes)
 	for {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-		if theirControl.GetHostmapIndexCount() < start {
+		if len(theirControl.GetHostmap().Indexes) < start {
 			break
 		}
 		time.Sleep(time.Second)
@@ -506,11 +504,9 @@ func TestUncleanShutdownRaceWinner(t *testing.T) {

 	r.Log("Nuke my hostmap")
 	theirHostmap := theirControl.GetHostmap()
-	theirHostmap.Lock()
 	theirHostmap.Hosts = map[netip.Addr]*nebula.HostInfo{}
 	theirHostmap.Indexes = map[uint32]*nebula.HostInfo{}
 	theirHostmap.RemoteIndexes = map[uint32]*nebula.HostInfo{}
-	theirHostmap.Unlock()

 	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them again")))
 	p = r.RouteForAllUntilTxTun(myControl)
@@ -521,10 +517,10 @@ func TestUncleanShutdownRaceWinner(t *testing.T) {
 	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)

 	r.Log("Wait for the dead index to go away")
-	start := myControl.GetHostmapIndexCount()
+	start := len(myControl.GetHostmap().Indexes)
 	for {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-		if myControl.GetHostmapIndexCount() < start {
+		if len(myControl.GetHostmap().Indexes) < start {
 			break
 		}
 		time.Sleep(time.Second)
@@ -632,10 +628,10 @@ func TestReestablishRelays(t *testing.T) {
 	r.Log("Close the tunnel")
 	relayControl.CloseTunnel(theirVpnIpNet[0].Addr(), true)

-	start := myControl.GetHostmapIndexCount()
-	curIndexes := myControl.GetHostmapIndexCount()
+	start := len(myControl.GetHostmap().Indexes)
+	curIndexes := len(myControl.GetHostmap().Indexes)
 	for curIndexes >= start {
-		curIndexes = myControl.GetHostmapIndexCount()
+		curIndexes = len(myControl.GetHostmap().Indexes)
 		r.Logf("Wait for the dead index to go away:start=%v indexes, current=%v indexes", start, curIndexes)
 		myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me should fail")))

@@ -725,70 +721,6 @@ func TestReestablishRelays(t *testing.T) {

 }

-func TestRelayHandshakeOverDisestablishedEntry(t *testing.T) {
-	t.Parallel()
-	// If them tears down the tunnel while me keeps Established relay state, me's next
-	// handshake flows through the relay with no fresh CreateRelayRequest and lands on
-	// them's Disestablished terminal relay entry. them must re-establish that entry, or
-	// its first transmit deletes its only relay and the tunnel is born transmit-dead:
-	// them can receive but every send is silently dropped.
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them   ", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
-
-	// Teach my how to get to the relay and that their can be reached via the relay
-	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	// Build a router so we don't have to reason who gets which packet
-	r := router.NewR(t, myControl, relayControl, theirControl)
-	defer r.RenderFlow()
-
-	// Start the servers
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
-
-	p := r.RouteForAllUntilTxTun(theirControl)
-	assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-	oldIdx := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false).LocalIndex
-
-	t.Log("Close the tunnel on them only, marking their relay entry Disestablished")
-	theirControl.CloseTunnel(myVpnIpNet[0].Addr(), true)
-
-	t.Log("Re-handshake from me, riding the still-Established relay state")
-	myControl.ReHandshake(theirVpnIpNet[0].Addr())
-	for {
-		h := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-		if h != nil && h.LocalIndex != oldIdx && h.RemoteIndex != 0 {
-			break
-		}
-		r.RouteForAllExitFunc(func(*udp.Packet, *nebula.Control) router.ExitType {
-			return router.RouteAndExit
-		})
-	}
-
-	hAtThem := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	require.NotNil(t, hAtThem, "them should have completed the relayed handshake")
-	require.Equal(t, []netip.Addr{relayVpnIpNet[0].Addr()}, hAtThem.CurrentRelaysToMe, "them should know a relay for the new tunnel")
-
-	t.Log("Send from them to me; their only relay entry must survive the transmit")
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them")))
-	require.Never(t, func() bool {
-		h := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-		return h == nil || len(h.CurrentRelaysToMe) == 0
-	}, time.Second, 10*time.Millisecond, "them deleted its only relay entry; the tunnel is permanently transmit-dead")
-
-	p = r.RouteForAllUntilTxTun(myControl)
-	assertUdpPacket(t, []byte("Hi from them"), p, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), 80, 80)
-	r.RenderHostmaps("Final hostmaps", myControl, relayControl, theirControl)
-}
-
 func TestStage1RaceRelays(t *testing.T) {
 	t.Parallel()
 	//NOTE: this is a race between me and relay resulting in a full tunnel from me to them via relay
@@ -887,18 +819,18 @@ func TestStage1RaceRelays2(t *testing.T) {

 	t.Log("Wait until we remove extra tunnels")
 	t.Logf("Waiting for hostinfos to be removed... myControl=%d theirControl=%d relayControl=%d",
-		myControl.GetHostmapIndexCount(),
-		theirControl.GetHostmapIndexCount(),
-		relayControl.GetHostmapIndexCount(),
+		len(myControl.GetHostmap().Indexes),
+		len(theirControl.GetHostmap().Indexes),
+		len(relayControl.GetHostmap().Indexes),
 	)
-	hostInfos := myControl.GetHostmapIndexCount() + theirControl.GetHostmapIndexCount() + relayControl.GetHostmapIndexCount()
+	hostInfos := len(myControl.GetHostmap().Indexes) + len(theirControl.GetHostmap().Indexes) + len(relayControl.GetHostmap().Indexes)
 	retries := 60
 	for hostInfos > 6 && retries > 0 {
-		hostInfos = myControl.GetHostmapIndexCount() + theirControl.GetHostmapIndexCount() + relayControl.GetHostmapIndexCount()
+		hostInfos = len(myControl.GetHostmap().Indexes) + len(theirControl.GetHostmap().Indexes) + len(relayControl.GetHostmap().Indexes)
 		t.Logf("Waiting for hostinfos to be removed... myControl=%d theirControl=%d relayControl=%d",
-			myControl.GetHostmapIndexCount(),
-			theirControl.GetHostmapIndexCount(),
-			relayControl.GetHostmapIndexCount(),
+			len(myControl.GetHostmap().Indexes),
+			len(theirControl.GetHostmap().Indexes),
+			len(relayControl.GetHostmap().Indexes),
 		)
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
@@ -992,24 +924,24 @@ func TestRehandshakingRelays(t *testing.T) {
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 	r.RenderHostmaps("working hostmaps", myControl, relayControl, theirControl)
 	// We should have two hostinfos on all sides
-	for myControl.GetHostmapIndexCount() != 2 {
-		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", myControl.GetHostmapIndexCount())
+	for len(myControl.GetHostmap().Indexes) != 2 {
+		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(myControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("myControl hostinfos got cleaned up!")
-	for theirControl.GetHostmapIndexCount() != 2 {
-		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", theirControl.GetHostmapIndexCount())
+	for len(theirControl.GetHostmap().Indexes) != 2 {
+		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(theirControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("theirControl hostinfos got cleaned up!")
-	for relayControl.GetHostmapIndexCount() != 2 {
-		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", relayControl.GetHostmapIndexCount())
+	for len(relayControl.GetHostmap().Indexes) != 2 {
+		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(relayControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
@@ -1097,24 +1029,24 @@ func TestRehandshakingRelaysPrimary(t *testing.T) {
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 	r.RenderHostmaps("working hostmaps", myControl, relayControl, theirControl)
 	// We should have two hostinfos on all sides
-	for myControl.GetHostmapIndexCount() != 2 {
-		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", myControl.GetHostmapIndexCount())
+	for len(myControl.GetHostmap().Indexes) != 2 {
+		t.Logf("Waiting for myControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(myControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("myControl hostinfos got cleaned up!")
-	for theirControl.GetHostmapIndexCount() != 2 {
-		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", theirControl.GetHostmapIndexCount())
+	for len(theirControl.GetHostmap().Indexes) != 2 {
+		t.Logf("Waiting for theirControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(theirControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
 		time.Sleep(time.Second)
 	}
 	t.Logf("theirControl hostinfos got cleaned up!")
-	for relayControl.GetHostmapIndexCount() != 2 {
-		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", relayControl.GetHostmapIndexCount())
+	for len(relayControl.GetHostmap().Indexes) != 2 {
+		t.Logf("Waiting for relayControl hostinfos (%v != 2) to get cleaned up from lack of use...", len(relayControl.GetHostmap().Indexes))
 		r.Log("Assert the relay tunnel still works")
 		assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 		r.Log("yupitdoes")
@@ -1191,7 +1123,7 @@ func TestRehandshaking(t *testing.T) {
 	theirConfig.ReloadConfigString(string(rc))

 	r.Log("Spin until there is only 1 tunnel")
-	for myControl.GetHostmapIndexCount()+theirControl.GetHostmapIndexCount() > 2 {
+	for len(myControl.GetHostmap().Indexes)+len(theirControl.GetHostmap().Indexes) > 2 {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -1291,7 +1223,7 @@ func TestRehandshakingLoser(t *testing.T) {
 	myConfig.ReloadConfigString(string(rc))

 	r.Log("Spin until there is only 1 tunnel")
-	for myControl.GetHostmapIndexCount()+theirControl.GetHostmapIndexCount() > 2 {
+	for len(myControl.GetHostmap().Indexes)+len(theirControl.GetHostmap().Indexes) > 2 {
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -1603,78 +1535,3 @@ func TestGoodHandshakeUnsafeDest(t *testing.T) {
 	myControl.Stop()
 	theirControl.Stop()
 }
-
-func TestMultiVpnAddrDeletePrimaryKeepsSecondAddr(t *testing.T) {
-	t.Parallel()
-	// Regression for the hostmap multi-vpnAddr delete bug. A dual-stack (v4+v6) V2-cert peer that
-	// handshakes twice at once ends up with two hostinfos linked in the shared next/prev chain, with the
-	// primary owning both addresses. Deleting that primary (e.g. connection manager dropping it, a
-	// CloseTunnel, a collision) must promote the surviving sibling for EVERY address. The pre-fix code
-	// unlinked the chain once per address, so it promoted the sibling for the first address and orphaned
-	// the second: the peer stayed reachable at its v4 addr but not its v6 addr despite a live tunnel.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me  ", "10.128.0.1/24,fd00::1/64", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.2/24,fd00::2/64", nil)
-
-	// This bug only exists for peers carrying more than one vpn address
-	require.Len(t, theirVpnIpNet, 2)
-	theirV4 := theirVpnIpNet[0].Addr()
-	theirV6 := theirVpnIpNet[1].Addr()
-
-	// Put their info in our lighthouse and vice versa
-	myControl.InjectLightHouseAddr(theirV4, theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	// Build a router so we don't have to reason who gets which packet
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	myControl.Start()
-	theirControl.Start()
-
-	// Race a handshake so both of us build a hostinfo for the other, leaving my hostmap with a single
-	// host (them) backed by two linked hostinfos, just like TestStage1Race.
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirV4, 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirV4, 80, []byte("Hi from them")))
-
-	myHsForThem := myControl.GetFromUDP(true)
-	theirHsForMe := theirControl.GetFromUDP(true)
-
-	r.InjectUDPPacket(theirControl, myControl, theirHsForMe)
-	r.InjectUDPPacket(myControl, theirControl, myHsForThem)
-
-	r.RouteForAllUntilTxTun(theirControl)
-	r.RouteForAllUntilTxTun(myControl)
-
-	r.RenderHostmaps("Racing hostmaps", myControl, theirControl)
-
-	// Two hostinfos for them means the shared next/prev chain has a sibling to promote. The Hosts map has
-	// one entry per vpn address (two, for dual stack), so the index count is what tells us there are two
-	// hostinfos.
-	require.Len(t, myControl.ListHostmapIndexes(false), 2)
-
-	// The primary owns both of their addresses
-	primaryV4 := myControl.GetHostInfoByVpnAddr(theirV4, false)
-	primaryV6 := myControl.GetHostInfoByVpnAddr(theirV6, false)
-	require.NotNil(t, primaryV4)
-	require.NotNil(t, primaryV6)
-	require.Equal(t, primaryV4.LocalIndex, primaryV6.LocalIndex, "both addrs should point at the same primary")
-
-	// Delete the primary tunnel. localOnly so we don't perturb their side, we only care about my hostmap.
-	require.True(t, myControl.CloseTunnel(theirV4, true))
-
-	// The surviving sibling must still serve BOTH addresses.
-	survivorV4 := myControl.GetHostInfoByVpnAddr(theirV4, false)
-	survivorV6 := myControl.GetHostInfoByVpnAddr(theirV6, false)
-	require.NotNil(t, survivorV4, "v4 addr should still resolve to the surviving tunnel")
-	// Pre-fix this is nil: the second address was orphaned when the primary was deleted.
-	require.NotNil(t, survivorV6, "v6 addr was orphaned after deleting the primary (multi-vpnAddr delete bug)")
-	assert.Equal(t, survivorV4.LocalIndex, survivorV6.LocalIndex, "both addrs should promote to the same survivor")
-	assert.NotEqual(t, primaryV4.LocalIndex, survivorV4.LocalIndex, "a different hostinfo should now be primary")
-
-	r.RenderHostmaps("Final hostmaps", myControl, theirControl)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
@@ -1,282 +0,0 @@
-//go:build e2e_testing
-// +build e2e_testing
-
-package e2e
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/udp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// reportedAddrs is what the lighthouse would hand a peer asking where vpnAddr is.
-func reportedAddrs(t *testing.T, lh *nebula.Control, vpnAddr netip.Addr) []netip.AddrPort {
-	t.Helper()
-	cm := lh.QueryLighthouse(vpnAddr)
-	if cm == nil {
-		return nil
-	}
-	var out []netip.AddrPort
-	for _, c := range *cm {
-		out = append(out, c.Reported...)
-		out = append(out, c.Learned...)
-	}
-	return out
-}
-
-// waitForLighthouseMsg routes until a lighthouse message lands on lh, or gives up. Reports whether one arrived.
-func waitForLighthouseMsg(t *testing.T, r *router.R, lh *nebula.Control, wait time.Duration) bool {
-	t.Helper()
-	h := &header.H{}
-	return r.RouteForAllExitFuncOrTimeout(wait, func(p *udp.Packet, c *nebula.Control) router.ExitType {
-		if c != lh {
-			return router.KeepRouting
-		}
-		// Punches are a single byte and never parse, they are just not what we are after
-		if err := h.Parse(p.Data); err != nil {
-			return router.KeepRouting
-		}
-		if h.Type == header.LightHouse {
-			return router.RouteAndExit
-		}
-		return router.KeepRouting
-	})
-}
-
-// A laptop that changes networks has to tell the lighthouse promptly, otherwise the lighthouse keeps handing peers
-// the old address and their punches land nowhere. On a long lighthouse interval the only thing that closes that
-// window is the rebind, which on darwin the network change monitor drives. The e2e build compiles the monitor out,
-// so we call RebindUDPServer directly, which is the same thing the monitor does.
-func TestRebindSendsLighthouseUpdate(t *testing.T) {
-	t.Parallel()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
-		"lighthouse": m{"am_lighthouse": true},
-	})
-
-	// 600s interval, so nothing scheduled can send an update during this test. A rebind is the only thing that can.
-	myControl, _, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", m{
-		"lighthouse": m{
-			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
-			"interval": 600,
-		},
-		"static_host_map": m{
-			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
-		},
-	})
-
-	r := router.NewR(t, lhControl, myControl)
-	defer r.RenderFlow()
-
-	lhControl.Start()
-	myControl.Start()
-
-	// Let the startup registration finish, then clear everything it left behind
-	require.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5), "expected an initial registration")
-	r.RouteFor(time.Millisecond * 400)
-
-	// Nothing should be talking to the lighthouse on its own now
-	require.False(t, waitForLighthouseMsg(t, r, lhControl, time.Millisecond*200),
-		"nothing should reach the lighthouse before the rebind")
-
-	myControl.RebindUDPServer()
-
-	assert.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5),
-		"a rebind should push an update to the lighthouse rather than waiting out the interval")
-
-	lhControl.Stop()
-	myControl.Stop()
-}
-
-// The other half of a rebind: every live tunnel requeries the lighthouse on its next send. That query is what makes
-// the lighthouse tell the peer to punch toward our new address, which is the part that actually revives a tunnel
-// whose remote NAT state died while we were on a different network.
-func TestRebindRequeriesPeersOnNextSend(t *testing.T) {
-	t.Parallel()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
-		"lighthouse": m{"am_lighthouse": true},
-	})
-
-	lhCfg := m{
-		"lighthouse": m{
-			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
-			"interval": 600,
-			// Without this the peers advertise this machine's real addresses and then try to punch at them,
-			// which the router has no route for.
-			"local_allow_list": m{
-				"10.0.0.0/24": true,
-				"::/0":        false,
-			},
-		},
-		"static_host_map": m{
-			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
-		},
-	}
-
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", lhCfg)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.3/24", lhCfg)
-
-	r := router.NewR(t, lhControl, myControl, theirControl)
-	defer r.RenderFlow()
-
-	lhControl.Start()
-	myControl.Start()
-	theirControl.Start()
-	r.RouteFor(time.Millisecond * 500)
-
-	// Point the peers at each other directly, this test is about the rebind and not about lighthouse discovery
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("initial")))
-	r.RouteFor(time.Second)
-	require.NotNil(t, myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false), "expected a tunnel to them")
-	r.RouteFor(time.Millisecond * 300)
-
-	// Assert on what the peer sees rather than on lighthouse traffic. A query for them makes the lighthouse send
-	// them a punch notification, which is the whole point. Our own update to the lighthouse sends them nothing,
-	// so this cannot be satisfied by the update the rebind itself pushes.
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("quiet")))
-	require.False(t, waitForLighthouseMsg(t, r, theirControl, time.Millisecond*300),
-		"an ordinary send should not requery the lighthouse")
-
-	myControl.RebindUDPServer()
-	r.RouteFor(time.Millisecond * 300) // let the update the rebind itself sends pass by
-
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("after rebind")))
-	assert.True(t, waitForLighthouseMsg(t, r, theirControl, time.Second*5),
-		"the first send after a rebind should requery the lighthouse, which then tells the peer to punch at us")
-
-	lhControl.Stop()
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-// The scenario this whole thing exists for: a laptop sleeps at the office and wakes up at home on a new address.
-// Until it tells the lighthouse, the lighthouse keeps handing peers the office address, so their punches land
-// nowhere and the tunnel stays dead. On a long interval the rebind is the only thing that closes that window.
-func TestRebindAdvertisesNewAddressAfterMove(t *testing.T) {
-	t.Parallel()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
-		"lighthouse": m{"am_lighthouse": true},
-	})
-
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", m{
-		"lighthouse": m{
-			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
-			"interval": 600,
-		},
-		"static_host_map": m{
-			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
-		},
-	})
-
-	// Advertise wherever we currently are rather than this machine's real NICs, read fresh each time so a move
-	// is picked up.
-	myControl.SetLocalAddrsFn(func(*nebula.LocalAllowList) []netip.Addr {
-		return []netip.Addr{myControl.GetUDPAddr().Addr()}
-	})
-
-	r := router.NewR(t, lhControl, myControl)
-	defer r.RenderFlow()
-
-	lhControl.Start()
-	myControl.Start()
-
-	require.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5), "expected an initial registration")
-	r.RouteFor(time.Millisecond * 400)
-
-	require.Contains(t, reportedAddrs(t, lhControl, myVpnIpNet[0].Addr()), myUdpAddr,
-		"the lighthouse should know the address we started on")
-
-	// Wake up somewhere else
-	newAddr := netip.MustParseAddrPort("10.0.0.99:4242")
-	myControl.SetUDPAddr(newAddr)
-	r.AddRoute(newAddr.Addr(), newAddr.Port(), myControl)
-
-	// Nothing has told the lighthouse, and with interval 600 nothing scheduled will
-	r.RouteFor(time.Millisecond * 400)
-	require.NotContains(t, reportedAddrs(t, lhControl, myVpnIpNet[0].Addr()), newAddr,
-		"the lighthouse should still be handing out the old address before the rebind")
-
-	myControl.RebindUDPServer()
-	require.True(t, waitForLighthouseMsg(t, r, lhControl, time.Second*5), "expected an update after the rebind")
-	r.RouteFor(time.Millisecond * 400)
-
-	assert.Contains(t, reportedAddrs(t, lhControl, myVpnIpNet[0].Addr()), newAddr,
-		"after the rebind the lighthouse should hand peers our new address")
-
-	lhControl.Stop()
-	myControl.Stop()
-}
-
-// A relayed send records traffic but must not consume the rebind epoch. If it does, the next direct send to the
-// relay host sees the epoch already current and never requeries, so the far side is never told to punch at our
-// new address. This pins the SendVia call site, which the unit tests cannot reach.
-func TestRebindRequeriesAfterRelayedSend(t *testing.T) {
-	t.Parallel()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	// No lighthouse on purpose: it would hand out a direct address for them and nothing would relay.
-	// Long connection manager timers so it never fires a direct test packet at the relay tunnel and bumps its
-	// epoch mid-test, which is the only other thing that touches that tunnel and would flake the assertion below.
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24",
-		m{"relay": m{"use_relays": true}, "timers": m{"connection_alive_interval": 3600, "pending_deletion_interval": 3600}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
-
-	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	r := router.NewR(t, myControl, relayControl, theirControl)
-	defer r.RenderFlow()
-
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("establish")))
-	r.RouteForAllUntilTxTun(theirControl)
-	r.RouteFor(time.Millisecond * 500)
-
-	hi := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-	require.NotNil(t, hi, "expected a tunnel to them")
-	require.NotEmpty(t, hi.CurrentRelaysToMe, "them must be reachable only via the relay for this test to mean anything")
-	// sendNoMetrics only reaches SendVia when there is no direct remote, so pin that too. Without this the test
-	// keeps passing while quietly sending direct and never exercising the relay path.
-	require.False(t, hi.CurrentRemote.IsValid(), "them must have no direct remote, otherwise SendVia is never called")
-
-	before, ok := myControl.GetRebindEpochFor(relayVpnIpNet[0].Addr())
-	require.True(t, ok, "expected a tunnel to the relay")
-
-	myControl.RebindUDPServer()
-
-	// Traffic to them goes through SendVia on the relay tunnel. That must record traffic without consuming the
-	// relay tunnel's own epoch edge, which belongs to the direct path.
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("relayed")))
-	r.RouteForAllUntilTxTun(theirControl)
-
-	after, ok := myControl.GetRebindEpochFor(relayVpnIpNet[0].Addr())
-	require.True(t, ok)
-	assert.Equal(t, before, after,
-		"a relayed send consumed the relay tunnel's rebind epoch, so the next direct send will not requery")
-
-	myControl.Stop()
-	relayControl.Stop()
-	theirControl.Stop()
-}
@@ -1,136 +0,0 @@
-//go:build e2e_testing
-// +build e2e_testing
-
-package e2e
-
-import (
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/udp"
-)
-
-// TestRecoveryTiming measures how long a tunnel takes to come back after the peer stops accepting our traffic,
-// which is what a laptop waking on a new network looks like from the peer's side: its NAT has no state for where
-// we are now, so everything we send disappears.
-//
-// It is a measurement, not a pass/fail assertion. Recovery is timed to the moment the peer punches back at us,
-// since that is when its NAT opens and the tunnel is usable again.
-//
-//	go test -tags e2e_testing -v -run TestRecoveryTiming ./e2e/
-func TestRecoveryTiming(t *testing.T) {
-	for _, tc := range []struct {
-		name   string
-		rebind bool
-	}{
-		{"no trigger", false},
-		{"rebind counter", true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			d, lost := measureRecovery(t, tc.rebind)
-			t.Logf("RESULT %-16s recovered in %-9v (%d packets lost)", tc.name, d.Round(time.Millisecond), lost)
-		})
-	}
-}
-
-// measureRecovery returns how long until the peer punched back, and how many of our packets died meanwhile. When
-// rebind is true we call RebindUDPServer once the tunnel goes dark, which is what the darwin network change
-// monitor does and what iOS has always done. When false, nothing tells nebula anything is wrong.
-func measureRecovery(t *testing.T, rebind bool) (time.Duration, int) {
-	t.Helper()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{
-		"lighthouse": m{"am_lighthouse": true},
-	})
-
-	peerCfg := m{
-		"lighthouse": m{
-			"hosts":    []any{lhVpnIpNet[0].Addr().String()},
-			"interval": 600,
-			"local_allow_list": m{
-				"10.0.0.0/24": true,
-				"::/0":        false,
-			},
-		},
-		"static_host_map": m{
-			lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
-		},
-	}
-
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", peerCfg)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.3/24", peerCfg)
-
-	r := router.NewR(t, lhControl, myControl, theirControl)
-	defer r.RenderFlow()
-	defer func() {
-		lhControl.Stop()
-		myControl.Stop()
-		theirControl.Stop()
-	}()
-
-	lhControl.Start()
-	myControl.Start()
-	theirControl.Start()
-	r.RouteFor(time.Millisecond * 500)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("establish")))
-	r.RouteFor(time.Second)
-	if myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false) == nil {
-		t.Fatal("failed to establish the tunnel we are measuring")
-	}
-	r.RouteFor(time.Millisecond * 500)
-
-	// From here the peer's NAT has no state for us, everything we send it disappears
-	start := time.Now()
-	blackholed := 0
-	var recovered time.Duration
-
-	if rebind {
-		myControl.RebindUDPServer()
-	}
-
-	// Keep the tun busy the way someone retrying a stalled connection would
-	stop := make(chan struct{})
-	defer close(stop)
-	go func() {
-		tick := time.NewTicker(time.Millisecond * 200)
-		defer tick.Stop()
-		for {
-			select {
-			case <-stop:
-				return
-			case <-tick.C:
-				myControl.InjectTunPacket(BuildTunUDPPacket(
-					theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("retry")))
-			}
-		}
-	}()
-
-	r.RouteForAllExitFuncOrTimeout(time.Second*30, func(p *udp.Packet, c *nebula.Control) router.ExitType {
-		if c == theirControl && p.From == myControl.GetUDPAddr() {
-			blackholed++
-			return router.Drop
-		}
-
-		// The peer reaching us directly is the moment its NAT opened, whether that is a punch or a handshake
-		if c == myControl && p.From == theirUdpAddr {
-			recovered = time.Since(start)
-			return router.RouteAndExit
-		}
-
-		return router.KeepRouting
-	})
-
-	if recovered == 0 {
-		t.Fatalf("no recovery within 30s (%d packets blackholed)", blackholed)
-	}
-	return recovered, blackholed
-}
@@ -6,13 +6,11 @@ package router
 import (
 	"context"
 	"fmt"
-	"maps"
 	"net/netip"
 	"os"
 	"path/filepath"
 	"reflect"
 	"regexp"
-	"slices"
 	"sort"
 	"sync"
 	"sync/atomic"
@@ -24,6 +22,7 @@ import (
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/udp"
+	"golang.org/x/exp/maps"
 )

 // outNatKey is the (from, to) pair used by outNat. Comparable struct, so it works as a map key without the
@@ -115,28 +114,6 @@ type packet struct {
 	packet *udp.Packet
 	tun    bool // a packet pulled off a tun device
 	rx     bool // the packet was received by a udp device
-
-	// h is the nebula header, parsed once when the packet is recorded. parseErr says why there isn't one, which
-	// the flow log reports rather than hiding. Punchy sends a single byte, so an unparseable packet is normal.
-	h        header.H
-	parseErr error
-}
-
-// fromAddr and toAddr are the addresses this packet actually travelled between. Reading them off the control
-// instead would misreport the whole history once a test moves a node. Tun packets are synthesized without
-// addresses, so they fall back to the control.
-func (p *packet) fromAddr() netip.AddrPort {
-	if p.tun || !p.packet.From.IsValid() {
-		return p.from.GetUDPAddr()
-	}
-	return p.packet.From
-}
-
-func (p *packet) toAddr() netip.AddrPort {
-	if p.tun || !p.packet.To.IsValid() {
-		return p.to.GetUDPAddr()
-	}
-	return p.packet.To
 }

 func (p *packet) WasReceived() {
@@ -154,9 +131,6 @@ const (
 	ExitNow ExitType = 1
 	// RouteAndExit routes this packet and exits immediately afterwards
 	RouteAndExit ExitType = 2
-	// Drop discards this packet without delivering it and keeps routing. Use it to simulate a blackhole, such as
-	// a restrictive NAT refusing traffic from an address it has not seen.
-	Drop ExitType = 3
 )

 type ExitFunc func(packet *udp.Packet, receiver *nebula.Control) ExitType
@@ -167,9 +141,7 @@ type ExitFunc func(packet *udp.Packet, receiver *nebula.Control) ExitType
 func NewR(t testing.TB, controls ...*nebula.Control) *R {
 	ctx, cancel := context.WithCancel(context.Background())

-	// t.Name() contains a slash for subtests, so the flow log can land in a nested directory
-	fn := filepath.Join("mermaid", fmt.Sprintf("%s.md", t.Name()))
-	if err := os.MkdirAll(filepath.Dir(fn), 0755); err != nil {
+	if err := os.MkdirAll("mermaid", 0755); err != nil {
 		panic(err)
 	}

@@ -180,7 +152,7 @@ func NewR(t testing.TB, controls ...*nebula.Control) *R {
 		outNat:       make(map[outNatKey]netip.AddrPort),
 		flow:         []flowEntry{},
 		ignoreFlows:  []ignoreFlow{},
-		fn:           fn,
+		fn:           filepath.Join("mermaid", fmt.Sprintf("%s.md", t.Name())),
 		t:            t,
 		cancelRender: cancel,
 	}
@@ -277,7 +249,7 @@ func (r *R) renderFlow() {
 			continue
 		}

-		addr := e.packet.fromAddr()
+		addr := e.packet.from.GetUDPAddr()
 		if _, ok := participants[addr]; ok {
 			continue
 		}
@@ -296,6 +268,7 @@ func (r *R) renderFlow() {
 	}

 	// Print packets
+	h := &header.H{}
 	for _, e := range r.flow {
 		if e.packet == nil {
 			//fmt.Fprintf(f, "    note over %s: %s\n", strings.Join(participantsVals, ", "), e.note)
@@ -307,22 +280,21 @@ func (r *R) renderFlow() {
 			fmt.Fprintln(f, r.formatUdpPacket(p))

 		} else {
+			if err := h.Parse(p.packet.Data); err != nil {
+				panic(err)
+			}
+
 			line := "--x"
 			if p.rx {
 				line = "->>"
 			}

-			detail := fmt.Sprintf("%s(%s), index %v, counter: %v",
-				p.h.TypeName(), p.h.SubTypeName(), p.h.RemoteIndex, p.h.MessageCounter)
-			if p.parseErr != nil {
-				detail = fmt.Sprintf("unparsed, %v (%d bytes)", p.parseErr, len(p.packet.Data))
-			}
-
-			fmt.Fprintf(f, "    %s%s%s: %s\n",
-				normalizeName(p.fromAddr().String()),
+			fmt.Fprintf(f,
+				"    %s%s%s: %s(%s), index %v, counter: %v\n",
+				normalizeName(p.from.GetUDPAddr().String()),
 				line,
-				normalizeName(p.toAddr().String()),
-				detail,
+				normalizeName(p.to.GetUDPAddr().String()),
+				h.TypeName(), h.SubTypeName(), h.RemoteIndex, h.MessageCounter,
 			)
 		}
 	}
@@ -375,7 +347,7 @@ func (r *R) RenderHostmaps(title string, controls ...*nebula.Control) {
 }

 func (r *R) renderHostmaps(title string) {
-	c := slices.AppendSeq(make([]*nebula.Control, 0, len(r.controls)), maps.Values(r.controls))
+	c := maps.Values(r.controls)
 	sort.SliceStable(c, func(i, j int) bool {
 		return c[i].GetVpnAddrs()[0].Compare(c[j].GetVpnAddrs()[0]) > 0
 	})
@@ -436,34 +408,29 @@ func (r *R) unlockedInjectFlow(from, to *nebula.Control, p *udp.Packet, tun bool

 	r.renderHostmaps(fmt.Sprintf("Packet %v", len(r.flow)))

-	var h header.H
-	var parseErr error
-	if !tun {
-		parseErr = h.Parse(p.Data)
-	}
-
-	// Decide before copying, the copy comes from a freelist and an ignored packet would never be released
-	for _, i := range r.ignoreFlows {
-		if tun {
-			if i.tun.HasValue && i.tun.IsTrue {
-				return nil
-			}
-			continue
+	if len(r.ignoreFlows) > 0 {
+		var h header.H
+		err := h.Parse(p.Data)
+		if err != nil {
+			panic(err)
 		}

-		// A packet we could not parse has no type to match against, so no rule can ignore it
-		if parseErr == nil && i.messageType == h.Type && i.subType == h.Subtype {
-			return nil
+		for _, i := range r.ignoreFlows {
+			if !tun {
+				if i.messageType == h.Type && i.subType == h.Subtype {
+					return nil
+				}
+			} else if i.tun.HasValue && i.tun.IsTrue {
+				return nil
+			}
 		}
 	}

 	fp := &packet{
-		from:     from,
-		to:       to,
-		packet:   p.Copy(),
-		tun:      tun,
-		h:        h,
-		parseErr: parseErr,
+		from:   from,
+		to:     to,
+		packet: p.Copy(),
+		tun:    tun,
 	}

 	r.flow = append(r.flow, flowEntry{packet: fp})
@@ -693,10 +660,6 @@ func (r *R) RouteExitFunc(sender *nebula.Control, whatDo ExitFunc) {
 			p.Release()
 			return

-		case Drop:
-			// Record it so the flow log shows the attempt, but never hand it to the receiver
-			r.unlockedInjectFlow(sender, receiver, p, false)
-
 		case KeepRouting:
 			fp := r.unlockedInjectFlow(sender, receiver, p, false)
 			receiver.InjectUDPPacket(p)
@@ -727,85 +690,6 @@ func (r *R) RouteUntilAfterMsgType(sender *nebula.Control, msgType header.Messag
 	})
 }

-// RouteFor routes everything that shows up for the given duration and then returns. Use it to let a test settle
-// deterministically rather than sleeping and hoping: a single FlushAll races a completing handshake, which queues
-// more packets right behind it.
-func (r *R) RouteFor(d time.Duration) {
-	r.RouteForAllExitFuncOrTimeout(d, func(*udp.Packet, *nebula.Control) ExitType {
-		return KeepRouting
-	})
-}
-
-// RouteForAllExitFuncOrTimeout is RouteForAllExitFunc with a deadline, reporting whether whatDo asked to exit
-// before time ran out. The unbounded version blocks forever on a quiet network, so this is what a test needs to
-// assert that something does NOT happen, or to route for a fixed settling period.
-func (r *R) RouteForAllExitFuncOrTimeout(timeout time.Duration, whatDo ExitFunc) bool {
-	sc := make([]reflect.SelectCase, 0, len(r.controls)+1)
-	cm := make([]*nebula.Control, 0, len(r.controls))
-
-	for _, c := range r.controls {
-		sc = append(sc, reflect.SelectCase{
-			Dir:  reflect.SelectRecv,
-			Chan: reflect.ValueOf(c.GetUDPTxChan()),
-			Send: reflect.Value{},
-		})
-		cm = append(cm, c)
-	}
-
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-	sc = append(sc, reflect.SelectCase{
-		Dir:  reflect.SelectRecv,
-		Chan: reflect.ValueOf(timer.C),
-		Send: reflect.Value{},
-	})
-
-	for {
-		x, rx, _ := reflect.Select(sc)
-		if x == len(cm) {
-			return false
-		}
-
-		r.Lock()
-		p := rx.Interface().(*udp.Packet)
-		receiver := r.getControl(cm[x].GetUDPAddr(), p.To, p)
-		if receiver == nil {
-			r.Unlock()
-			panic("Can't RouteForAllExitFuncOrTimeout for host: " + p.To.String())
-		}
-
-		e := whatDo(p, receiver)
-		switch e {
-		case ExitNow:
-			r.Unlock()
-			p.Release()
-			return true
-
-		case RouteAndExit:
-			fp := r.unlockedInjectFlow(cm[x], receiver, p, false)
-			receiver.InjectUDPPacket(p)
-			fp.WasReceived()
-			r.Unlock()
-			p.Release()
-			return true
-
-		case Drop:
-			// Record it so the flow log shows the attempt, but never hand it to the receiver
-			r.unlockedInjectFlow(cm[x], receiver, p, false)
-
-		case KeepRouting:
-			fp := r.unlockedInjectFlow(cm[x], receiver, p, false)
-			receiver.InjectUDPPacket(p)
-			fp.WasReceived()
-
-		default:
-			panic(fmt.Sprintf("Unknown exitFunc return: %v", e))
-		}
-		r.Unlock()
-		p.Release()
-	}
-}
-
 func (r *R) RouteForAllUntilAfterMsgTypeTo(receiver *nebula.Control, msgType header.MessageType, subType header.MessageSubType) {
 	h := &header.H{}
 	r.RouteForAllExitFunc(func(p *udp.Packet, r *nebula.Control) ExitType {
@@ -898,10 +782,6 @@ func (r *R) RouteForAllExitFunc(whatDo ExitFunc) {
 			p.Release()
 			return

-		case Drop:
-			// Record it so the flow log shows the attempt, but never hand it to the receiver
-			r.unlockedInjectFlow(cm[x], receiver, p, false)
-
 		case KeepRouting:
 			fp := r.unlockedInjectFlow(cm[x], receiver, p, false)
 			receiver.InjectUDPPacket(p)
@@ -15,7 +15,6 @@ import (
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v3"
 )

@@ -43,8 +42,8 @@ func TestDropInactiveTunnels(t *testing.T) {
 	r.Log("Go inactive and wait for the tunnels to get dropped")
 	waitStart := time.Now()
 	for {
-		myIndexes := myControl.GetHostmapIndexCount()
-		theirIndexes := theirControl.GetHostmapIndexCount()
+		myIndexes := len(myControl.GetHostmap().Indexes)
+		theirIndexes := len(theirControl.GetHostmap().Indexes)
 		if myIndexes == 0 && theirIndexes == 0 {
 			break
 		}
@@ -374,100 +373,6 @@ func TestCrossStackRelaysWork(t *testing.T) {
 	//relayControl.Stop()
 }

-// TestRelayReplayProtection asserts that a relay (forwarding-type) node rejects
-// replayed relay frames. A captured relay frame, re-injected with the same
-// message counter, must be dropped by the replay window rather than re-forwarded
-// to the relay target. Before the fix, handleOutsideRelayPacket authenticated the
-// frame but never advanced the replay window, so every replay was re-forwarded.
-func TestRelayReplayProtection(t *testing.T) {
-	t.Parallel()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24,fc00::1/64", m{"relay": m{"use_relays": true}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "10.128.0.128/24,fc00::128/64", m{"relay": m{"am_relay": true}})
-	theirUdp := netip.MustParseAddrPort("10.0.0.2:4242")
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServerWithUdp(cert.Version2, ca, caKey, "them   ", "fc00::2/64", theirUdp, m{"relay": m{"use_relays": true}})
-
-	myVpnV6 := myVpnIpNet[1]
-	relayVpnV4 := relayVpnIpNet[0]
-	relayVpnV6 := relayVpnIpNet[1]
-	theirVpnV6 := theirVpnIpNet[0]
-
-	// Teach me how to reach the relay and that them is reachable via the relay
-	myControl.InjectLightHouseAddr(relayVpnV4.Addr(), relayUdpAddr)
-	myControl.InjectLightHouseAddr(relayVpnV6.Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnV6.Addr(), []netip.Addr{relayVpnV6.Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnV6.Addr(), theirUdpAddr)
-
-	r := router.NewR(t, myControl, relayControl, theirControl)
-	defer r.RenderFlow()
-
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	// Establish the relayed tunnel in both directions so all handshakes complete.
-	t.Log("Establish the relayed tunnel")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnV6.Addr(), 80, myVpnV6.Addr(), 80, []byte("Hi from me")))
-	p := r.RouteForAllUntilTxTun(theirControl)
-	assertUdpPacket(t, []byte("Hi from me"), p, myVpnV6.Addr(), theirVpnV6.Addr(), 80, 80)
-	theirControl.InjectTunPacket(BuildTunUDPPacket(myVpnV6.Addr(), 80, theirVpnV6.Addr(), 80, []byte("Hi from them")))
-	p = r.RouteForAllUntilTxTun(myControl)
-	assertUdpPacket(t, []byte("Hi from them"), p, theirVpnV6.Addr(), myVpnV6.Addr(), 80, 80)
-
-	// Drain anything still queued on me's UDP tx so the next packet we pull is the
-	// relay frame we are about to generate.
-	for myControl.GetFromUDP(false) != nil {
-	}
-
-	// Capture a single legitimate relay frame that me transmits toward the relay.
-	t.Log("Capture a relay frame from me -> relay")
-	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnV6.Addr(), 80, myVpnV6.Addr(), 80, []byte("replay me")))
-	relayFrame := myControl.GetFromUDP(true)
-	require.Equal(t, relayUdpAddr, relayFrame.To, "captured frame should be addressed to the relay")
-	var fh header.H
-	require.NoError(t, fh.Parse(relayFrame.Data))
-	require.Equal(t, header.Message, fh.Type)
-	require.Equal(t, header.MessageRelay, fh.Subtype)
-
-	// drainForwards counts relay frames the relay forwards toward them within the
-	// settle window. We match on destination + (Message, MessageRelay) so the
-	// relay's own direct traffic to them can't be miscounted.
-	drainForwards := func(settle time.Duration) int {
-		ch := relayControl.GetUDPTxChan()
-		count := 0
-		for {
-			select {
-			case pkt := <-ch:
-				var ph header.H
-				if pkt.To == theirUdpAddr && ph.Parse(pkt.Data) == nil &&
-					ph.Type == header.Message && ph.Subtype == header.MessageRelay {
-					count++
-				}
-				pkt.Release()
-			case <-time.After(settle):
-				return count
-			}
-		}
-	}
-
-	// First delivery of the captured frame: the relay should forward it once.
-	t.Log("Deliver the captured frame once; relay forwards it to them")
-	relayControl.InjectUDPPacket(relayFrame)
-	require.Equal(t, 1, drainForwards(200*time.Millisecond), "relay should forward the first, legitimate copy")
-
-	// Replay the exact same frame several times. A correct replay window rejects
-	// these duplicates so the relay forwards none of them.
-	t.Log("Replay the captured frame; relay must drop the duplicates")
-	const replays = 3
-	for i := 0; i < replays; i++ {
-		relayControl.InjectUDPPacket(relayFrame)
-	}
-	forwarded := drainForwards(200 * time.Millisecond)
-	assert.Equal(t, 0, forwarded, "relay re-forwarded %d/%d replayed relay frames; replay protection is ineffective on relay tunnels", forwarded, replays)
-
-	r.RenderHostmaps("Final hostmaps", myControl, relayControl, theirControl)
-}
-
 func TestCloseTunnelAuthenticated(t *testing.T) {
 	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -493,8 +398,8 @@ func TestCloseTunnelAuthenticated(t *testing.T) {

 	waitStart := time.Now()
 	for {
-		myIndexes := myControl.GetHostmapIndexCount()
-		theirIndexes := theirControl.GetHostmapIndexCount()
+		myIndexes := len(myControl.GetHostmap().Indexes)
+		theirIndexes := len(theirControl.GetHostmap().Indexes)
 		if myIndexes == 0 && theirIndexes == 0 {
 			break
 		}
@@ -548,8 +453,8 @@ func TestCloseTunnelAuthenticated(t *testing.T) {
 	r.Log("Injected bogus close tunnel. Let's see!")
 	waitStart = time.Now()
 	for {
-		myIndexes := myControl.GetHostmapIndexCount()
-		theirIndexes := theirControl.GetHostmapIndexCount()
+		myIndexes := len(myControl.GetHostmap().Indexes)
+		theirIndexes := len(theirControl.GetHostmap().Indexes)
 		if myIndexes == 0 {
 			t.Fatal("myIndexes should not be 0")
 		}
@@ -0,0 +1,124 @@
+package nebula
+
+import (
+	"log/slog"
+	"testing"
+)
+
+func TestInnerECN(t *testing.T) {
+	cases := []struct {
+		name string
+		pkt  []byte
+		want byte
+	}{
+		{"empty", nil, 0},
+		{"v4_NotECT", v4WithToS(0x00), 0x00},
+		{"v4_ECT0", v4WithToS(0x02), 0x02},
+		{"v4_ECT1", v4WithToS(0x01), 0x01},
+		{"v4_CE", v4WithToS(0x03), 0x03},
+		{"v4_DSCP_then_NotECT", v4WithToS(0x88 | 0x00), 0x00},
+		{"v4_DSCP_then_CE", v4WithToS(0x88 | 0x03), 0x03},
+		{"v6_NotECT", v6WithTC(0x00), 0x00},
+		{"v6_ECT0", v6WithTC(0x02), 0x02},
+		{"v6_CE", v6WithTC(0x03), 0x03},
+		{"v6_DSCP_then_CE", v6WithTC(0x88 | 0x03), 0x03},
+		{"unknown_version", []byte{0xa5, 0xff}, 0},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got := innerECN(c.pkt)
+			if got != c.want {
+				t.Errorf("innerECN=0x%02x want 0x%02x", got, c.want)
+			}
+		})
+	}
+}
+
+// v4WithToS returns a 2-byte slice tall enough for innerECN: byte 0 carries
+// version=4 in the high nibble, byte 1 is the full ToS so we exercise both
+// the DSCP and ECN portions through the byte 1 mask.
+func v4WithToS(tos byte) []byte {
+	return []byte{0x45, tos}
+}
+
+// v6WithTC builds a 2-byte slice that places a known traffic class value
+// across bytes 0 (high nibble of TC) and 1 (low nibble of TC). innerECN
+// extracts ECN as (b[1]>>4)&0x03, which corresponds to TC[1:0].
+func v6WithTC(tc byte) []byte {
+	return []byte{0x60 | (tc>>4)&0x0f, (tc & 0x0f) << 4}
+}
+
+func TestApplyOuterECN(t *testing.T) {
+	silent := slog.New(slog.DiscardHandler)
+	hi := &HostInfo{}
+
+	// Build a v4 packet helper with a given inner ECN field.
+	v4 := func(innerECN byte) []byte {
+		// 20-byte minimal IPv4 header with ToS = innerECN (DSCP zeroed).
+		return []byte{
+			0x45, innerECN, 0, 28,
+			0, 0, 0x40, 0,
+			64, 6, 0, 0,
+			10, 0, 0, 1,
+			10, 0, 0, 2,
+		}
+	}
+	// Build a v6 packet helper with a given inner ECN field. ECN occupies
+	// TC[1:0] which sit at byte 1 mask 0x30.
+	v6 := func(innerECN byte) []byte {
+		// 40-byte minimal IPv6 header with TC[1:0] = innerECN.
+		pkt := make([]byte, 40)
+		pkt[0] = 0x60                   // version=6, TC[7:4]=0
+		pkt[1] = (innerECN & 0x03) << 4 // TC[3:0]: low 2 bits = ECN, top 2 = DSCP-low (0)
+		return pkt
+	}
+
+	type cell struct {
+		outer    byte
+		inner    byte
+		wantECN  byte
+		wantSame bool // expect inner unchanged (true => verify the byte didn't move)
+	}
+
+	// RFC 6040 normal-mode combine table. Only outer==CE causes mutation.
+	table := []cell{
+		{ecnNotECT, ecnNotECT, ecnNotECT, true},
+		{ecnNotECT, ecnECT0, ecnECT0, true},
+		{ecnNotECT, ecnECT1, ecnECT1, true},
+		{ecnNotECT, ecnCE, ecnCE, true},
+
+		{ecnECT0, ecnNotECT, ecnNotECT, true},
+		{ecnECT0, ecnECT0, ecnECT0, true},
+		{ecnECT0, ecnECT1, ecnECT1, true},
+		{ecnECT0, ecnCE, ecnCE, true},
+
+		{ecnECT1, ecnNotECT, ecnNotECT, true},
+		{ecnECT1, ecnECT0, ecnECT0, true},
+		{ecnECT1, ecnECT1, ecnECT1, true},
+		{ecnECT1, ecnCE, ecnCE, true},
+
+		{ecnCE, ecnNotECT, ecnNotECT, true}, // legacy: log, leave alone
+		{ecnCE, ecnECT0, ecnCE, false},      // CE folded in
+		{ecnCE, ecnECT1, ecnCE, false},
+		{ecnCE, ecnCE, ecnCE, true},
+	}
+
+	for _, c := range table {
+		t.Run("v4", func(t *testing.T) {
+			pkt := v4(c.inner)
+			applyOuterECN(pkt, c.outer, hi, silent)
+			got := pkt[1] & 0x03
+			if got != c.wantECN {
+				t.Errorf("v4 outer=0x%02x inner=0x%02x: got 0x%02x want 0x%02x", c.outer, c.inner, got, c.wantECN)
+			}
+		})
+		t.Run("v6", func(t *testing.T) {
+			pkt := v6(c.inner)
+			applyOuterECN(pkt, c.outer, hi, silent)
+			got := (pkt[1] >> 4) & 0x03
+			if got != c.wantECN {
+				t.Errorf("v6 outer=0x%02x inner=0x%02x: got 0x%02x want 0x%02x", c.outer, c.inner, got, c.wantECN)
+			}
+		})
+	}
+}
@@ -131,9 +131,6 @@ listen:
  port: 4242
  # Sets the max number of packets to pull from the kernel for each syscall (under systems that support recvmmsg)
  # default is 64, does not support reload
-  # Note: on Linux with UDP GRO (kernel 5.10+), each receive slot is sized for a full 64KiB coalesced
-  # superpacket, so the receive scratch is batch * 64KiB per listening socket (~4MiB per routine at the
-  # default of 64). Lower this to trade peak per-syscall throughput for memory on constrained hosts.
  #batch: 64
  # Configure socket buffers for the udp side (outside), leave unset to use the system defaults. Values will be doubled by the kernel
  # Default is net.core.rmem_default and net.core.wmem_default (/proc/sys/net/core/rmem_default and /proc/sys/net/core/rmem_default)
@@ -149,14 +146,6 @@ listen:
  # Default true; set to false to leave WDF in charge of inbound decisions on the listener port. Not reloadable.
  #windows_bypass_wdf: true

-  # On macOS only
-  # macOS scopes the udp socket to the interface it was created on, so moving between networks (wifi to wired,
-  # office to home) leaves Nebula sending out an interface that no longer has a route. When true, Nebula watches
-  # the routing socket and rebinds the listener once the change settles.
-  # iOS does not use this, the host app drives the same rebind itself.
-  # Default true. Not reloadable.
-  #rebind_on_network_change: true
-
  # By default, Nebula replies to packets it has no tunnel for with a "recv_error" packet. This packet helps speed up reconnection
  # in the case that Nebula on either side did not shut down cleanly. This response can be abused as a way to discover if Nebula is running
  # on a host though. This option lets you configure if you want to send "recv_error" packets always, never, or only to private network remotes.
@@ -172,61 +161,14 @@ listen:
  # allowing for more precise routing decisions based on the packet tags. Default is 0 meaning no mark is set.
  # This setting is reloadable.
  #so_mark: 0
-  # the udp_offloads setting controls if Nebula will attempt to enable GSO and GRO for its UDP socket(s). Linux only, not reloadable.
-  # udp_offloads: false

 # Routines is the number of thread pairs to run that consume from the tun and UDP queues.
 # Currently, this defaults to 1 which means we have 1 tun queue reader and 1
 # UDP queue reader. Setting this above one will set IFF_MULTI_QUEUE on the tun
 # device and SO_REUSEPORT on the UDP socket to allow multiple queues.
-# With multiport enabled this is the number of routines *per port*, so the total
-# is routines * multiport.ports.
 # This option is only supported on Linux.
 #routines: 1

-# EXPERIMENTAL: multiport lanes give each pair of hosts multiple underlay UDP
-# flows so overlay traffic is no longer bottlenecked by a single 5-tuple
-# (one ECMP path, one NIC RSS queue, one per-flow policer). Instead of every
-# socket sharing listen.port, multiport.ports consecutive ports are bound and
-# each gets its own group of `routines` sockets sharing it via SO_REUSEPORT, so
-# no port (the base port above all, which carries every handshake and every
-# vanilla peer) depends on a single core. One extra tunnel ("lane") per port is
-# negotiated with capable peers: lane i handshakes from local port listen.port+i
-# to the peer's advertised base+((i + pair_offset) mod peer_ports), where
-# pair_offset is a per-pair hash that spreads many small peers across a big
-# peer's whole port range.
-# Each lane is a full Noise session with its own
-# keys, nonce counter and replay window, so flows taking different paths
-# never fight over shared replay state.
-#
-# Peers negotiate lanes in the handshake; vanilla peers get a single normal
-# tunnel. All control traffic (handshakes, lighthouse, punching, relays) and
-# the data fallback stay on the base tunnel/port. Lanes are built lazily: a
-# lane is only established once a routine actually has traffic for that peer
-# and no lane to carry it, so a peer you exchange a trickle with costs one
-# tunnel regardless of how many routines are configured. Established lanes
-# are kept alive with their own keepalives, and traffic falls back to the base
-# tunnel while a lane is down or not yet up.
-#
-# Requirements: multiport.ports > 1, Linux, and the port range
-# [listen.port, listen.port+multiport.ports-1] reachable through firewalls on
-# both sides. A lane whose port is unreachable stays down and its traffic rides
-# the base tunnel. With listen.port 0 the base port is dynamic and the next
-# ports-1 ports above it are claimed. Degrades to a single port when the
-# requirements don't hold. Not reloadable.
-#multiport:
-  #enabled: true
-  # How many consecutive UDP ports to bind, starting at listen.port. Must be
-  # greater than 1 for multiport to do anything; there is no default, since
-  # each port costs a full set of `routines` threads and sockets. Capped at 256
-  # (the lane header limit). 4-8 is plenty to escape a single ECMP path.
-  #ports: 0
-  # How many lanes to run, counting the base tunnel as lane 0. 0 (default)
-  # means one per bound port. Lowering this sends on a subset of the range,
-  # which bounds how many extra tunnels each peer pair maintains (useful on a
-  # big server with many peers); the ports are bound and read either way.
-  #lanes: 0
-
 punchy:
  # Continues to punch inbound/outbound at a regular interval to avoid expiration of firewall nat mappings
  # This setting is reloadable.
@@ -312,33 +254,6 @@ tun:
  # Default MTU for every packet, safe setting is (and the default) 1300 for internet based traffic
  mtu: 1300

-  # the use_offloads setting controls if Nebula will attempt to enable GSO and GRO for the tun device. Linux only, not reloadable.
-  #use_offloads: false
-
-  # Linux only. pin_threads pins each tun reader/encrypt OS thread to a single CPU. This keeps every goroutine's
-  # batched sends flowing through one XPS-selected NIC TX ring, so packets within a flow stay ordered on the wire
-  # instead of being sprayed across multiple TX rings and reordered. Not reloadable. Coerced to false if routines <= 1.
-  #pin_threads: true
-
-  # pin_threads_key helps the CPU-auto-selector shuffle which CPUs are chosen for pinning.
-  # Valid options are "pid" or "port". Use "port" if you want Nebula to choose the same cores every time, which is nice for benchmarking.
-  # Linux only, not reloadable.
-  #pin_threads_key: "pid"
-
-  # Linux only. cpu_affinity overrides which CPUs the tun reader threads pin to: a list of CPU IDs, one per routine
-  # (see the top-level `routines` setting). Lists shorter than `routines` are modulo-cycled across the queues; extra
-  # entries are ignored. IDs must be within the process's allowed CPU set, so this respects taskset / cgroup cpusets;
-  # a non-integer or not-allowed entry disables the override, leaving the default pin selection described below.
-  # Only meaningful while pin_threads is true. Not reloadable.
-  # When unset (or rejected), the default spread prefers performance cores on heterogeneous CPUs (ARM big.LITTLE,
-  # Intel P/E hybrids, AMD compact cores), keeps all readers on one NUMA node and on distinct physical cores when the
-  # topology allows (SMT siblings last), leaves CPU 0's physical core as a last resort, and rotates its starting
-  # point per instance (keyed by the bound UDP port) so co-located nebulas don't stack their readers onto the
-  # same cores.
-  #cpu_affinity:
-  #  - 2
-  #  - 4
-
  # Route based MTU overrides, you have known vpn ip paths that can support larger MTUs you can increase/decrease them here
  routes:
    #- mtu: 8800
@@ -482,7 +397,7 @@ firewall:
  #   `drop` (default): silently drop the packet.
  #   `reject`: send a reject reply.
  #     - For TCP, this will be a RST "Connection Reset" packet.
-  #     - For other protocols, this will be an ICMP "Destination unreachable: Communication administratively prohibited" packet.
+  #     - For other protocols, this will be an ICMP port unreachable packet.
  outbound_action: drop
  inbound_action: drop

@@ -8,15 +8,6 @@ Before=sshd.service
 Type=notify
 NotifyAccess=main
 SyslogIdentifier=nebula
-
-# Uncomment to run as an unprivileged user with only CAP_NET_ADMIN. Requires a
-# nebula user that owns the config directory. Add CAP_NET_BIND_SERVICE to both
-# lines if any listener (lighthouse DNS, listen.port, stats, sshd) binds <1024.
-#User=nebula
-#Group=nebula
-#CapabilityBoundingSet=CAP_NET_ADMIN
-#AmbientCapabilities=CAP_NET_ADMIN
-
 ExecReload=/bin/kill -HUP $MAINPID
 ExecStart=/usr/local/bin/nebula -config /etc/nebula/config.yml
 Restart=always
@@ -21,7 +21,6 @@ import (
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/firewall"
-	"github.com/slackhq/nebula/iputil"
 )

 type FirewallInterface interface {
@@ -45,8 +44,8 @@ type Firewall struct {
 	InRules  *FirewallTable
 	OutRules *FirewallTable

-	InboundSendReject  bool
-	OutboundSendReject bool
+	InSendReject  bool
+	OutSendReject bool

 	//TODO: we should have many more options for TCP, an option for ICMP, and mimic the kernel a bit better
 	// https://www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt
@@ -59,9 +58,8 @@ type Firewall struct {
 	routableNetworks *bart.Lite

 	// assignedNetworks is a list of vpn networks assigned to us in the certificate.
-	assignedNetworks []netip.Prefix
-	// unsafeNetworks is the list of unsafe networks issued to us in the certificate
-	unsafeNetworks []netip.Prefix
+	assignedNetworks  []netip.Prefix
+	hasUnsafeNetworks bool

 	rules        string
 	rulesVersion uint16
@@ -160,9 +158,10 @@ func NewFirewall(l *slog.Logger, tcpTimeout, UDPTimeout, defaultTimeout time.Dur
 		assignedNetworks = append(assignedNetworks, network)
 	}

-	unsafeNetworks := c.UnsafeNetworks()
-	for _, n := range unsafeNetworks {
+	hasUnsafeNetworks := false
+	for _, n := range c.UnsafeNetworks() {
 		routableNetworks.Insert(n)
+		hasUnsafeNetworks = true
 	}

 	return &Firewall{
@@ -170,15 +169,15 @@ func NewFirewall(l *slog.Logger, tcpTimeout, UDPTimeout, defaultTimeout time.Dur
 			Conns:      make(map[firewall.Packet]*conn),
 			TimerWheel: NewTimerWheel[firewall.Packet](tmin, tmax),
 		},
-		InRules:          newFirewallTable(),
-		OutRules:         newFirewallTable(),
-		TCPTimeout:       tcpTimeout,
-		UDPTimeout:       UDPTimeout,
-		DefaultTimeout:   defaultTimeout,
-		routableNetworks: routableNetworks,
-		assignedNetworks: assignedNetworks,
-		unsafeNetworks:   unsafeNetworks,
-		l:                l,
+		InRules:           newFirewallTable(),
+		OutRules:          newFirewallTable(),
+		TCPTimeout:        tcpTimeout,
+		UDPTimeout:        UDPTimeout,
+		DefaultTimeout:    defaultTimeout,
+		routableNetworks:  routableNetworks,
+		assignedNetworks:  assignedNetworks,
+		hasUnsafeNetworks: hasUnsafeNetworks,
+		l:                 l,

 		incomingMetrics: firewallMetrics{
 			droppedLocalAddr:  metrics.GetOrRegisterCounter("firewall.incoming.dropped.local_addr", nil),
@@ -217,23 +216,23 @@ func NewFirewallFromConfig(l *slog.Logger, cs *CertState, c *config.C) (*Firewal
 	inboundAction := c.GetString("firewall.inbound_action", "drop")
 	switch inboundAction {
 	case "reject":
-		fw.InboundSendReject = true
+		fw.InSendReject = true
 	case "drop":
-		fw.InboundSendReject = false
+		fw.InSendReject = false
 	default:
 		l.Warn("invalid firewall.inbound_action, defaulting to `drop`", "action", inboundAction)
-		fw.InboundSendReject = false
+		fw.InSendReject = false
 	}

 	outboundAction := c.GetString("firewall.outbound_action", "drop")
 	switch outboundAction {
 	case "reject":
-		fw.OutboundSendReject = true
+		fw.OutSendReject = true
 	case "drop":
-		fw.OutboundSendReject = false
+		fw.OutSendReject = false
 	default:
 		l.Warn("invalid firewall.outbound_action, defaulting to `drop`", "action", outboundAction)
-		fw.OutboundSendReject = false
+		fw.OutSendReject = false
 	}

 	err := AddFirewallRulesFromConfig(l, false, c, fw)
@@ -263,11 +262,11 @@ func (f *Firewall) AddRule(incoming bool, proto uint8, startPort int32, endPort
 	}

 	switch proto {
-	case iputil.IPProtocolTCP:
+	case firewall.ProtoTCP:
 		fp = ft.TCP
-	case iputil.IPProtocolUDP:
+	case firewall.ProtoUDP:
 		fp = ft.UDP
-	case iputil.IPProtocolICMP, iputil.IPProtocolICMPv6:
+	case firewall.ProtoICMP, firewall.ProtoICMPv6:
 		//ICMP traffic doesn't have ports, so we always coerce to "any", even if a value is provided
 		if startPort != firewall.PortAny {
 			f.l.Warn("ignoring port specification for ICMP firewall rule", "startPort", startPort)
@@ -365,13 +364,13 @@ func AddFirewallRulesFromConfig(l *slog.Logger, inbound bool, c *config.C, fw Fi
 			proto = firewall.ProtoAny
 			startPort, endPort, err = parsePort(sPort)
 		case "tcp":
-			proto = iputil.IPProtocolTCP
+			proto = firewall.ProtoTCP
 			startPort, endPort, err = parsePort(sPort)
 		case "udp":
-			proto = iputil.IPProtocolUDP
+			proto = firewall.ProtoUDP
 			startPort, endPort, err = parsePort(sPort)
 		case "icmp":
-			proto = iputil.IPProtocolICMP
+			proto = firewall.ProtoICMP
 			startPort = firewall.PortAny
 			endPort = firewall.PortAny
 			if sPort != "" {
@@ -424,6 +423,11 @@ var ErrNoMatchingRule = errors.New("no matching rule in firewall table")
 // Drop returns an error if the packet should be dropped, explaining why. It
 // returns nil if the packet should not be dropped.
 func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {
+	// Check if we spoke to this tuple, if we did then allow this packet
+	if f.inConns(fp, h, caPool, localCache) {
+		return nil
+	}
+
 	// Make sure remote address matches nebula certificate, and determine how to treat it
 	if h.networks == nil {
 		// Simple case: Certificate has one address and no unsafe networks
@@ -457,11 +461,6 @@ func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *
 		return ErrInvalidLocalIP
 	}

-	// Check if we spoke to this tuple, if we did then allow this packet
-	if f.inConns(fp, h, caPool, localCache) {
-		return nil
-	}
-
 	table := f.OutRules
 	if incoming {
 		table = f.InRules
@@ -561,9 +560,9 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 	}

 	switch fp.Protocol {
-	case iputil.IPProtocolTCP:
+	case firewall.ProtoTCP:
 		c.Expires = time.Now().Add(f.TCPTimeout)
-	case iputil.IPProtocolUDP:
+	case firewall.ProtoUDP:
 		c.Expires = time.Now().Add(f.UDPTimeout)
 	default:
 		c.Expires = time.Now().Add(f.DefaultTimeout)
@@ -583,9 +582,9 @@ func (f *Firewall) addConn(fp firewall.Packet, incoming bool) {
 	c := &conn{}

 	switch fp.Protocol {
-	case iputil.IPProtocolTCP:
+	case firewall.ProtoTCP:
 		timeout = f.TCPTimeout
-	case iputil.IPProtocolUDP:
+	case firewall.ProtoUDP:
 		timeout = f.UDPTimeout
 	default:
 		timeout = f.DefaultTimeout
@@ -636,15 +635,15 @@ func (ft *FirewallTable) match(p firewall.Packet, incoming bool, c *cert.CachedC
 	}

 	switch p.Protocol {
-	case iputil.IPProtocolTCP:
+	case firewall.ProtoTCP:
 		if ft.TCP.match(p, incoming, c, caPool) {
 			return true
 		}
-	case iputil.IPProtocolUDP:
+	case firewall.ProtoUDP:
 		if ft.UDP.match(p, incoming, c, caPool) {
 			return true
 		}
-	case iputil.IPProtocolICMP, iputil.IPProtocolICMPv6:
+	case firewall.ProtoICMP, firewall.ProtoICMPv6:
 		if ft.ICMP.match(p, incoming, c, caPool) {
 			return true
 		}
@@ -681,7 +680,7 @@ func (fp firewallPort) match(p firewall.Packet, incoming bool, c *cert.CachedCer
 	}

 	// this branch is here to catch traffic from FirewallTable.Any.match and FirewallTable.ICMP.match
-	if p.Protocol == iputil.IPProtocolICMP || p.Protocol == iputil.IPProtocolICMPv6 {
+	if p.Protocol == firewall.ProtoICMP || p.Protocol == firewall.ProtoICMPv6 {
 		// port numbers are re-used for connection tracking of ICMP,
 		// but we don't want to actually filter on them.
 		return fp[firewall.PortAny].match(p, c, caPool)
@@ -898,7 +897,7 @@ func (flc *firewallLocalCIDR) addRule(f *Firewall, localCidr string) error {
 	}

 	if localCidr == "" {
-		if len(f.unsafeNetworks) == 0 || f.defaultLocalCIDRAny {
+		if !f.hasUnsafeNetworks || f.defaultLocalCIDRAny {
 			flc.Any = true
 			return nil
 		}
@@ -1056,6 +1055,7 @@ func (r *rule) sanity() error {
 }

 func parsePort(s string) (int32, int32, error) {
+	var err error
 	const notAPort int32 = -2
 	if s == "any" {
 		return firewall.PortAny, firewall.PortAny, nil
@@ -1064,11 +1064,11 @@ func parsePort(s string) (int32, int32, error) {
 		return firewall.PortFragment, firewall.PortFragment, nil
 	}
 	if !strings.Contains(s, `-`) {
-		rPort, err := parsePortValue("", s)
+		rPort, err := strconv.Atoi(s)
 		if err != nil {
-			return notAPort, notAPort, err
+			return notAPort, notAPort, fmt.Errorf("was not a number; `%s`", s)
 		}
-		return rPort, rPort, nil
+		return int32(rPort), int32(rPort), nil
 	}

 	sPorts := strings.SplitN(s, `-`, 2)
@@ -1079,40 +1079,22 @@ func parsePort(s string) (int32, int32, error) {
 		return notAPort, notAPort, fmt.Errorf("appears to be a range but could not be parsed; `%s`", s)
 	}

-	startPort, err := parsePortValue("beginning range ", sPorts[0])
+	rStartPort, err := strconv.Atoi(sPorts[0])
 	if err != nil {
-		return notAPort, notAPort, err
+		return notAPort, notAPort, fmt.Errorf("beginning range was not a number; `%s`", sPorts[0])
 	}

-	endPort, err := parsePortValue("ending range ", sPorts[1])
+	rEndPort, err := strconv.Atoi(sPorts[1])
 	if err != nil {
-		return notAPort, notAPort, err
+		return notAPort, notAPort, fmt.Errorf("ending range was not a number; `%s`", sPorts[1])
 	}

+	startPort := int32(rStartPort)
+	endPort := int32(rEndPort)
+
 	if startPort == firewall.PortAny {
 		endPort = firewall.PortAny
 	}

 	return startPort, endPort, nil
 }
-
-// parsePortValue accepts a base-10 decimal in [0, 65535] and returns it
-// widened to int32. Using strconv.ParseUint with bitSize 16 rejects
-// negative input, out-of-range input (>65535), and any non-decimal byte
-// by construction, so the int32 widening that follows is provably safe
-// and cannot collide with firewall.PortAny (0) or firewall.PortFragment
-// (-1) via integer truncation.
-//
-// prefix is prepended to both error messages so callers can disambiguate
-// the single-port path (prefix="") from the range bounds (prefix="beginning
-// range " / "ending range "), preserving the historical error strings.
-func parsePortValue(prefix, s string) (int32, error) {
-	n, err := strconv.ParseUint(s, 10, 16)
-	if err == nil {
-		return int32(n), nil
-	}
-	if errors.Is(err, strconv.ErrRange) {
-		return 0, fmt.Errorf("%sout of range [0,65535]; `%s`", prefix, s)
-	}
-	return 0, fmt.Errorf("%swas not a number; `%s`", prefix, s)
-}
@@ -4,14 +4,17 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/netip"
-
-	"github.com/slackhq/nebula/iputil"
 )

 type m = map[string]any

 const (
-	ProtoAny     = 0  // When we want to handle HOPOPT (0) we can change this, if ever
+	ProtoAny    = 0 // When we want to handle HOPOPT (0) we can change this, if ever
+	ProtoTCP    = 6
+	ProtoUDP    = 17
+	ProtoICMP   = 1
+	ProtoICMPv6 = 58
+
 	PortAny      = 0  // Special value for matching `port: any`
 	PortFragment = -1 // Special value for matching `port: fragment`
 )
@@ -42,13 +45,13 @@ func (fp *Packet) Copy() *Packet {
 func (fp Packet) MarshalJSON() ([]byte, error) {
 	var proto string
 	switch fp.Protocol {
-	case iputil.IPProtocolTCP:
+	case ProtoTCP:
 		proto = "tcp"
-	case iputil.IPProtocolICMP:
+	case ProtoICMP:
 		proto = "icmp"
-	case iputil.IPProtocolICMPv6:
+	case ProtoICMPv6:
 		proto = "icmpv6"
-	case iputil.IPProtocolUDP:
+	case ProtoUDP:
 		proto = "udp"
 	default:
 		proto = fmt.Sprintf("unknown %v", fp.Protocol)
@@ -62,12 +65,3 @@ func (fp Packet) MarshalJSON() ([]byte, error) {
 		"Fragment":   fp.Fragment,
 	})
 }
-
-// ParsedPacket is a Packet plus the parse byproducts the RX path reuses
-type ParsedPacket struct {
-	Packet
-	IPHdrLen int
-	// FragAny reports any fragmentation at all: MF flag or nonzero offset for IPv4, a fragment extension header for IPv6.
-	// Distinct from Packet.Fragment, which is true only for NON-FIRST fragments
-	FragAny bool
-}
@@ -13,7 +13,6 @@ import (
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/firewall"
-	"github.com/slackhq/nebula/iputil"
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -73,20 +72,20 @@ func TestFirewall_AddRule(t *testing.T) {
 	ti6, err := netip.ParsePrefix("fd12::34/128")
 	require.NoError(t, err)

-	require.NoError(t, fw.AddRule(true, iputil.IPProtocolTCP, 1, 1, []string{}, "", "", "", "", ""))
+	require.NoError(t, fw.AddRule(true, firewall.ProtoTCP, 1, 1, []string{}, "", "", "", "", ""))
 	// An empty rule is any
 	assert.True(t, fw.InRules.TCP[1].Any.Any.Any)
 	assert.Empty(t, fw.InRules.TCP[1].Any.Groups)
 	assert.Empty(t, fw.InRules.TCP[1].Any.Hosts)

 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c)
-	require.NoError(t, fw.AddRule(true, iputil.IPProtocolUDP, 1, 1, []string{"g1"}, "", "", "", "", ""))
+	require.NoError(t, fw.AddRule(true, firewall.ProtoUDP, 1, 1, []string{"g1"}, "", "", "", "", ""))
 	assert.Nil(t, fw.InRules.UDP[1].Any.Any)
 	assert.Contains(t, fw.InRules.UDP[1].Any.Groups[0].Groups, "g1")
 	assert.Empty(t, fw.InRules.UDP[1].Any.Hosts)

 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c)
-	require.NoError(t, fw.AddRule(true, iputil.IPProtocolICMP, 1, 1, []string{}, "h1", "", "", "", ""))
+	require.NoError(t, fw.AddRule(true, firewall.ProtoICMP, 1, 1, []string{}, "h1", "", "", "", ""))
 	//no matter what port is given for icmp, it should end up as "any"
 	assert.Nil(t, fw.InRules.ICMP[firewall.PortAny].Any.Any)
 	assert.Empty(t, fw.InRules.ICMP[firewall.PortAny].Any.Groups)
@@ -117,11 +116,11 @@ func TestFirewall_AddRule(t *testing.T) {
 	assert.True(t, ok)

 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c)
-	require.NoError(t, fw.AddRule(true, iputil.IPProtocolUDP, 1, 1, []string{"g1"}, "", "", "", "ca-name", ""))
+	require.NoError(t, fw.AddRule(true, firewall.ProtoUDP, 1, 1, []string{"g1"}, "", "", "", "ca-name", ""))
 	assert.Contains(t, fw.InRules.UDP[1].CANames, "ca-name")

 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c)
-	require.NoError(t, fw.AddRule(true, iputil.IPProtocolUDP, 1, 1, []string{"g1"}, "", "", "", "", "ca-sha"))
+	require.NoError(t, fw.AddRule(true, firewall.ProtoUDP, 1, 1, []string{"g1"}, "", "", "", "", "ca-sha"))
 	assert.Contains(t, fw.InRules.UDP[1].CAShas, "ca-sha")

 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c)
@@ -186,7 +185,7 @@ func TestFirewall_Drop(t *testing.T) {
 		RemoteAddr: netip.MustParseAddr("1.2.3.4"),
 		LocalPort:  10,
 		RemotePort: 90,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}

@@ -264,7 +263,7 @@ func TestFirewall_DropV6(t *testing.T) {
 		RemoteAddr: netip.MustParseAddr("fd12::34"),
 		LocalPort:  10,
 		RemotePort: 90,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}

@@ -351,7 +350,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			Certificate: &dummyCert{},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolUDP}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoUDP}, true, c, cp))
 		}
 	})

@@ -361,7 +360,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			Certificate: &dummyCert{},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 1}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 1}, true, c, cp))
 		}
 	})

@@ -371,7 +370,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 		}
 		ip := netip.MustParsePrefix("9.254.254.254/32")
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 100, LocalAddr: ip.Addr()}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 100, LocalAddr: ip.Addr()}, true, c, cp))
 		}
 	})
 	b.Run("pass proto, port, fail on local CIDRv6", func(b *testing.B) {
@@ -380,7 +379,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 		}
 		ip := netip.MustParsePrefix("fd99::99/128")
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 100, LocalAddr: ip.Addr()}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 100, LocalAddr: ip.Addr()}, true, c, cp))
 		}
 	})

@@ -393,7 +392,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"nope": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 10}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 10}, true, c, cp))
 		}
 	})
 	b.Run("pass proto, port, any local CIDRv6, fail all group, name, and cidr", func(b *testing.B) {
@@ -405,7 +404,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"nope": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 10}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 10}, true, c, cp))
 		}
 	})

@@ -418,7 +417,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"nope": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 100, LocalAddr: pfix.Addr()}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 100, LocalAddr: pfix.Addr()}, true, c, cp))
 		}
 	})
 	b.Run("pass proto, port, specific local CIDRv6, fail all group, name, and cidr", func(b *testing.B) {
@@ -430,7 +429,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"nope": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.False(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 100, LocalAddr: pfix6.Addr()}, true, c, cp))
+			assert.False(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 100, LocalAddr: pfix6.Addr()}, true, c, cp))
 		}
 	})

@@ -442,7 +441,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"good-group": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.True(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 10}, true, c, cp))
+			assert.True(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 10}, true, c, cp))
 		}
 	})

@@ -454,7 +453,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"good-group": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.True(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 100, LocalAddr: pfix.Addr()}, true, c, cp))
+			assert.True(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 100, LocalAddr: pfix.Addr()}, true, c, cp))
 		}
 	})
 	b.Run("pass on group on specific local cidr6", func(b *testing.B) {
@@ -465,7 +464,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"good-group": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			assert.True(b, ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 100, LocalAddr: pfix6.Addr()}, true, c, cp))
+			assert.True(b, ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 100, LocalAddr: pfix6.Addr()}, true, c, cp))
 		}
 	})

@@ -477,7 +476,7 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 			InvertedGroups: map[string]struct{}{"nope": {}},
 		}
 		for n := 0; n < b.N; n++ {
-			ft.match(firewall.Packet{Protocol: iputil.IPProtocolTCP, LocalPort: 10}, true, c, cp)
+			ft.match(firewall.Packet{Protocol: firewall.ProtoTCP, LocalPort: 10}, true, c, cp)
 		}
 	})
 }
@@ -493,7 +492,7 @@ func TestFirewall_Drop2(t *testing.T) {
 		RemoteAddr: netip.MustParseAddr("1.2.3.4"),
 		LocalPort:  10,
 		RemotePort: 90,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}

@@ -551,7 +550,7 @@ func TestFirewall_Drop3(t *testing.T) {
 		RemoteAddr: netip.MustParseAddr("1.2.3.4"),
 		LocalPort:  1,
 		RemotePort: 1,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}

@@ -639,7 +638,7 @@ func TestFirewall_Drop3V6(t *testing.T) {
 		RemoteAddr: netip.MustParseAddr("fd12::34"),
 		LocalPort:  1,
 		RemotePort: 1,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}

@@ -676,7 +675,7 @@ func TestFirewall_DropConntrackReload(t *testing.T) {
 		RemoteAddr: netip.MustParseAddr("1.2.3.4"),
 		LocalPort:  10,
 		RemotePort: 90,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}
 	network := netip.MustParsePrefix("1.2.3.4/24")
@@ -759,13 +758,13 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 	templ := firewall.Packet{
 		LocalAddr:  netip.MustParseAddr("1.2.3.4"),
 		RemoteAddr: netip.MustParseAddr("1.2.3.4"),
-		Protocol:   iputil.IPProtocolICMP,
+		Protocol:   firewall.ProtoICMP,
 		Fragment:   false,
 	}

 	t.Run("ICMP allowed", func(t *testing.T) {
 		fw := NewFirewall(l, time.Second, time.Minute, time.Hour, c.Certificate)
-		require.NoError(t, fw.AddRule(true, iputil.IPProtocolICMP, 0, 0, []string{"any"}, "", "", "", "", ""))
+		require.NoError(t, fw.AddRule(true, firewall.ProtoICMP, 0, 0, []string{"any"}, "", "", "", "", ""))
 		t.Run("zero ports", func(t *testing.T) {
 			p := templ.Copy()
 			p.LocalPort = 0
@@ -911,165 +910,12 @@ func TestFirewall_DropIPSpoofing(t *testing.T) {
 		RemoteAddr: netip.MustParseAddr("192.0.2.3"),
 		LocalPort:  1,
 		RemotePort: 1,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}
 	assert.Equal(t, fw.Drop(p, true, &h1, cp, nil), ErrInvalidRemoteIP)
 }

-func TestFirewall_ConntrackSourceSpoofingAcrossPeers(t *testing.T) {
-	l := test.NewLoggerWithOutput(&bytes.Buffer{})
-
-	myVpnNetworksTable := new(bart.Lite)
-	myVpnNetworksTable.Insert(netip.MustParsePrefix("192.0.2.1/24"))
-
-	owner := &dummyCert{
-		name:     "owner",
-		networks: []netip.Prefix{netip.MustParsePrefix("192.0.2.1/24")},
-	}
-
-	victim := &cert.CachedCertificate{
-		Certificate: &dummyCert{
-			name:     "victim",
-			networks: []netip.Prefix{netip.MustParsePrefix("192.0.2.2/24")},
-		},
-	}
-	victimHI := HostInfo{
-		ConnectionState: &ConnectionState{peerCert: victim},
-		vpnAddrs:        []netip.Addr{netip.MustParseAddr("192.0.2.2")},
-	}
-	victimHI.buildNetworks(myVpnNetworksTable, victim.Certificate)
-
-	attacker := &cert.CachedCertificate{
-		Certificate: &dummyCert{
-			name:     "attacker",
-			networks: []netip.Prefix{netip.MustParsePrefix("192.0.2.3/24")},
-		},
-	}
-	attackerHI := HostInfo{
-		ConnectionState: &ConnectionState{peerCert: attacker},
-		vpnAddrs:        []netip.Addr{netip.MustParseAddr("192.0.2.3")},
-	}
-	attackerHI.buildNetworks(myVpnNetworksTable, attacker.Certificate)
-
-	fw := NewFirewall(l, time.Second, time.Minute, time.Hour, owner)
-	// Allow any inbound traffic that passes the cert / source-IP checks.
-	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"any"}, "", "", "", "", ""))
-	cp := cert.NewCAPool()
-
-	flow := firewall.Packet{
-		LocalAddr:  netip.MustParseAddr("192.0.2.1"),
-		RemoteAddr: netip.MustParseAddr("192.0.2.2"),
-		LocalPort:  443,
-		RemotePort: 55000,
-		Protocol:   iputil.IPProtocolUDP,
-	}
-
-	require.NoError(t, fw.Drop(flow, true, &victimHI, cp, nil),
-		"victim's own traffic from its own overlay IP must be allowed")
-
-	unseen := flow
-	unseen.RemotePort = 55001
-	assert.Equal(t, ErrInvalidRemoteIP, fw.Drop(unseen, true, &attackerHI, cp, nil),
-		"sanity: attacker forging victim's source IP must be rejected when no conntrack entry exists")
-
-	got := fw.Drop(flow, true, &attackerHI, cp, nil)
-	t.Logf("attacker replaying victim's 4-tuple: Drop returned %v (nil == packet ALLOWED == spoof succeeded)", got)
-	assert.Equal(t, ErrInvalidRemoteIP, got,
-		"SECURITY: attacker spoofed victim's overlay source IP (192.0.2.2) by reusing an existing conntrack 4-tuple; Drop returned %v instead of rejecting", got)
-}
-
-// BenchmarkFirewallDropConntrackHit measures Drop on an already-established flow
-// (a conntrack hit). This is the fast path that the source-IP<->cert binding
-// reordering adds work to, so it quantifies the cost of moving the address checks
-// ahead of the conntrack lookup. Cases:
-//   - simple:  peer cert has one address, no unsafe networks (h.networks == nil),
-//     so the remote-address check is a single netip.Addr compare.
-//   - complex: peer cert has unsafe networks (h.networks populated), so the
-//     remote-address check is a BART lookup.
-//   - noCache/localCache: whether a per-batch ConntrackCache is supplied, which in
-//     the original code let the fast path skip straight past the address checks.
-func BenchmarkFirewallDropConntrackHit(b *testing.B) {
-	l := test.NewLoggerWithOutput(&bytes.Buffer{})
-
-	myVpnNetworksTable := new(bart.Lite)
-	myVpnNetworksTable.Insert(netip.MustParsePrefix("192.0.2.1/24"))
-
-	owner := &dummyCert{
-		name:     "owner",
-		networks: []netip.Prefix{netip.MustParsePrefix("192.0.2.1/24")},
-	}
-
-	simpleCert := &cert.CachedCertificate{
-		Certificate: &dummyCert{
-			name:     "simple",
-			networks: []netip.Prefix{netip.MustParsePrefix("192.0.2.2/24")},
-		},
-	}
-	simpleHost := &HostInfo{
-		ConnectionState: &ConnectionState{peerCert: simpleCert},
-		vpnAddrs:        []netip.Addr{netip.MustParseAddr("192.0.2.2")},
-	}
-	simpleHost.buildNetworks(myVpnNetworksTable, simpleCert.Certificate)
-
-	complexCert := &cert.CachedCertificate{
-		Certificate: &dummyCert{
-			name:           "complex",
-			networks:       []netip.Prefix{netip.MustParsePrefix("192.0.2.2/24")},
-			unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("198.51.100.0/24")},
-		},
-	}
-	complexHost := &HostInfo{
-		ConnectionState: &ConnectionState{peerCert: complexCert},
-		vpnAddrs:        []netip.Addr{netip.MustParseAddr("192.0.2.2")},
-	}
-	complexHost.buildNetworks(myVpnNetworksTable, complexCert.Certificate)
-
-	cp := cert.NewCAPool()
-
-	flow := firewall.Packet{
-		LocalAddr:  netip.MustParseAddr("192.0.2.1"),
-		RemoteAddr: netip.MustParseAddr("192.0.2.2"),
-		LocalPort:  443,
-		RemotePort: 55000,
-		Protocol:   iputil.IPProtocolUDP,
-	}
-
-	cases := []struct {
-		name     string
-		host     *HostInfo
-		useCache bool
-	}{
-		{"simple/noCache", simpleHost, false},
-		{"simple/localCache", simpleHost, true},
-		{"complex/noCache", complexHost, false},
-		{"complex/localCache", complexHost, true},
-	}
-
-	for _, tc := range cases {
-		b.Run(tc.name, func(b *testing.B) {
-			fw := NewFirewall(l, time.Second, time.Minute, time.Hour, owner)
-			require.NoError(b, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"any"}, "", "", "", "", ""))
-
-			// Establish the conntrack entry so every benchmarked Drop is a hit.
-			require.NoError(b, fw.Drop(flow, true, tc.host, cp, nil))
-
-			var cache firewall.ConntrackCache
-			if tc.useCache {
-				cache = firewall.ConntrackCache{}
-			}
-
-			b.ReportAllocs()
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				if err := fw.Drop(flow, true, tc.host, cp, cache); err != nil {
-					b.Fatal(err)
-				}
-			}
-		})
-	}
-}
-
 func BenchmarkLookup(b *testing.B) {
 	ml := func(m map[string]struct{}, a [][]string) {
 		for n := 0; n < b.N; n++ {
@@ -1183,75 +1029,6 @@ func Test_parsePort(t *testing.T) {
 	require.NoError(t, err)
 }

-// Test_parsePort_invalid covers inputs that must error. The named bug is
-// that int32(strconv.Atoi("4294967296")) truncates to 0 == firewall.PortAny,
-// silently turning a typo into a match-all-ports rule; the rest are
-// representative syntax/range probes.
-func Test_parsePort_invalid(t *testing.T) {
-	tests := []struct {
-		name            string
-		input           string
-		wantErrContains string
-	}{
-		// Numeric overflow (the named bug + boundary).
-		{"named bug: 2^32 truncates to PortAny", "4294967296", "out of range"},
-		{"just above max real port", "65536", "out of range"},
-
-		// Negatives route through the range branch and hit the empty-half
-		// guard; included as defense in depth so a future refactor cannot
-		// accidentally reach the int32 cast.
-		{"negative", "-1", "could not be parsed"},
-
-		// Syntax probes.
-		{"NUL between digits", "4\x002", "was not a number"},
-		{"hex notation", "0x10", "was not a number"},
-		{"scientific notation", "1e3", "was not a number"},
-		{"leading whitespace", " 42", "was not a number"},
-		{"fullwidth digits", "４２", "was not a number"},
-
-		// Range branch.
-		{"range upper out of range", "1-65536", "ending range out of range"},
-		{"range lower out of range", "65536-65537", "beginning range out of range"},
-		{"range with negative upper", "1--1", "ending range was not a number"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			_, _, err := parsePort(tc.input)
-			require.Error(t, err, "input %q must error", tc.input)
-			require.ErrorContains(t, err, tc.wantErrContains)
-		})
-	}
-}
-
-// Test_parsePort_valid_boundaries locks in success cases at 0, 1, and 65535
-// so a future refactor cannot regress the boundaries.
-func Test_parsePort_valid_boundaries(t *testing.T) {
-	tests := []struct {
-		name      string
-		input     string
-		wantStart int32
-		wantEnd   int32
-	}{
-		{"zero is PortAny", "0", 0, 0},
-		{"min real port", "1", 1, 1},
-		{"max real port", "65535", 65535, 65535},
-		{"range zero to max forces end to zero", "0-65535", 0, 0},
-		{"range max to max", "65535-65535", 65535, 65535},
-		{"range one to max", "1-65535", 1, 65535},
-		{"range with whitespace inside", " 1 - 2    ", 1, 2},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			s, e, err := parsePort(tc.input)
-			require.NoError(t, err)
-			assert.Equal(t, tc.wantStart, s, "start port")
-			assert.Equal(t, tc.wantEnd, e, "end port")
-		})
-	}
-}
-
 func TestNewFirewallFromConfig(t *testing.T) {
 	l := test.NewLogger()
 	// Test a bad rule definition
@@ -1318,28 +1095,28 @@ func TestAddFirewallRulesFromConfig(t *testing.T) {
 	mf := &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"port": "1", "proto": "tcp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
-	assert.Equal(t, addRuleCall{incoming: false, proto: iputil.IPProtocolTCP, startPort: 1, endPort: 1, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
+	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoTCP, startPort: 1, endPort: 1, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)

 	// Test adding udp rule
 	conf = config.NewC(test.NewLogger())
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"port": "1", "proto": "udp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
-	assert.Equal(t, addRuleCall{incoming: false, proto: iputil.IPProtocolUDP, startPort: 1, endPort: 1, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
+	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoUDP, startPort: 1, endPort: 1, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)

 	// Test adding icmp rule
 	conf = config.NewC(test.NewLogger())
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"port": "1", "proto": "icmp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
-	assert.Equal(t, addRuleCall{incoming: false, proto: iputil.IPProtocolICMP, startPort: firewall.PortAny, endPort: firewall.PortAny, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
+	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoICMP, startPort: firewall.PortAny, endPort: firewall.PortAny, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)

 	// Test adding icmp rule no port
 	conf = config.NewC(test.NewLogger())
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"proto": "icmp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
-	assert.Equal(t, addRuleCall{incoming: false, proto: iputil.IPProtocolICMP, startPort: firewall.PortAny, endPort: firewall.PortAny, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
+	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoICMP, startPort: firewall.PortAny, endPort: firewall.PortAny, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)

 	// Test adding any rule
 	conf = config.NewC(test.NewLogger())
@@ -1583,7 +1360,7 @@ func buildTestCase(setup testsetup, err error, theirPrefixes ...netip.Prefix) te
 		RemoteAddr: theirPrefixes[0].Addr(),
 		LocalPort:  10,
 		RemotePort: 90,
-		Protocol:   iputil.IPProtocolUDP,
+		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}
 	return testcase{
@@ -1,36 +1,38 @@
 module github.com/slackhq/nebula

-go 1.26.0
+go 1.25.0

 require (
 	dario.cat/mergo v1.0.2
 	filippo.io/bigmod v0.1.0
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/armon/go-radix v1.0.0
+	github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432
 	github.com/flynn/noise v1.1.0
-	github.com/gaissmai/bart v0.28.0
+	github.com/gaissmai/bart v0.26.1
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
-	github.com/kardianos/service v1.3.0
+	github.com/kardianos/service v1.2.4
 	github.com/miekg/dns v1.1.72
 	github.com/miekg/pkcs11 v1.1.2
 	github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f
-	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_golang v1.23.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
-	github.com/stretchr/testify v1.12.0
+	github.com/stretchr/testify v1.11.1
 	github.com/vishvananda/netlink v1.3.1
 	go.uber.org/goleak v1.3.0
-	go.yaml.in/yaml/v3 v3.0.5
-	golang.org/x/crypto v0.54.0
-	golang.org/x/net v0.57.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/sys v0.47.0
-	golang.org/x/term v0.45.0
+	go.yaml.in/yaml/v3 v3.0.4
+	golang.org/x/crypto v0.50.0
+	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
+	golang.org/x/net v0.53.0
+	golang.org/x/sync v0.20.0
+	golang.org/x/sys v0.43.0
+	golang.org/x/term v0.42.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
-	golang.zx2c4.com/wireguard/windows v1.0.1
+	golang.zx2c4.com/wireguard/windows v0.6.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 	gvisor.dev/gvisor v0.0.0-20240423190808-9d7a357edefe
@@ -39,13 +41,16 @@ require (
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/btree v1.1.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
-	golang.org/x/mod v0.36.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/mod v0.34.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/tools v0.43.0 // indirect
 )
@@ -19,12 +19,15 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432 h1:M5QgkYacWj0Xs8MhpIK/5uwU02icXpEoSo9sM2aRCps=
+github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432/go.mod h1:xwIwAxMvYnVrGJPe2FKx5prTrnAjGOD8zvDOnxnrrkM=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg=
 github.com/flynn/noise v1.1.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
-github.com/gaissmai/bart v0.28.0 h1:89yZLo8NmyqD0RYgJ3QO9HhqqGGw+oWhf90cZm69Lko=
-github.com/gaissmai/bart v0.28.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
+github.com/gaissmai/bart v0.26.1 h1:+w4rnLGNlA2GDVn382Tfe3jOsK5vOr5n4KmigJ9lbTo=
+github.com/gaissmai/bart v0.26.1/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -63,18 +66,19 @@ github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
-github.com/kardianos/service v1.3.0 h1:/LGy+xPP2TM+GLTiCZ2di7cy0Jd/qrawlTUfqKYFdTI=
-github.com/kardianos/service v1.3.0/go.mod h1:E4V9ufUuY82F7Ztlu1eN9VXWIQxg8NoLQlmFe0MtrXc=
+github.com/kardianos/service v1.2.4 h1:XNlGtZOYNx2u91urOdg/Kfmc+gfmuIo1Dd3rEi2OgBk=
+github.com/kardianos/service v1.2.4/go.mod h1:E4V9ufUuY82F7Ztlu1eN9VXWIQxg8NoLQlmFe0MtrXc=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
-github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
@@ -98,13 +102,14 @@ github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f/go.
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
-github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -113,16 +118,18 @@ github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvM
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
+github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
@@ -136,8 +143,8 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=
-github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
@@ -146,23 +153,25 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 h1:Di6/M8l0O2lCLc6VVRWhgCiApHV8MnQurBnFSHsQtNY=
+golang.org/x/exp v0.0.0-20230725093048-515e97ebf090/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -173,8 +182,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -182,8 +191,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -199,11 +208,11 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -214,8 +223,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -224,8 +233,8 @@ golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeu
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
 golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
-golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8=
-golang.zx2c4.com/wireguard/windows v1.0.1/go.mod h1:+fbT3FFdX4zzYDLwJh5+HPEcNN/3HyNdzhNSVsQM+zs=
+golang.zx2c4.com/wireguard/windows v0.6.1 h1:XMaKojH1Hs/raMrmnir4n35nTvzvWj7NmSYzHn2F4qU=
+golang.zx2c4.com/wireguard/windows v0.6.1/go.mod h1:04aqInu5GYuTFvMuDw/rKBAF7mHrltW/3rekpfbbZDM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1,117 +0,0 @@
-package nebula
-
-// This file is a trimmed, inlined copy of the graphite exporter from
-// github.com/cyberdelia/go-metrics-graphite, retaining only the Config type and
-// the Once entrypoint that Nebula uses. The upstream package has been
-// unmaintained for 10+ years, so it was vendored here to drop the dependency.
-// See https://github.com/slackhq/nebula/issues/1831.
-//
-// Copyright 2015 Timothée Peignier. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are met:
-//
-//  1. Redistributions of source code must retain the above copyright notice,
-//     this list of conditions and the following disclaimer.
-//
-//  2. Redistributions in binary form must reproduce the above copyright notice,
-//     this list of conditions and the following disclaimer in the documentation
-//     and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-import (
-	"bufio"
-	"fmt"
-	"net"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/rcrowley/go-metrics"
-)
-
-// graphiteConfigExport provides a container with configuration parameters for
-// the Graphite exporter.
-type graphiteConfigExport struct {
-	Addr          *net.TCPAddr     // Network address to connect to
-	Registry      metrics.Registry // Registry to be exported
-	FlushInterval time.Duration    // Flush interval
-	DurationUnit  time.Duration    // Time conversion unit for durations
-	Prefix        string           // Prefix to be prepended to metric names
-	Percentiles   []float64        // Percentiles to export from timers and histograms
-}
-
-// graphiteOnce performs a single submission to Graphite, returning a non-nil
-// error on failed connections.
-func graphiteOnce(c graphiteConfigExport) error {
-	now := time.Now().Unix()
-	du := float64(c.DurationUnit)
-	flushSeconds := float64(c.FlushInterval) / float64(time.Second)
-	conn, err := net.DialTCP("tcp", nil, c.Addr)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-	w := bufio.NewWriter(conn)
-	c.Registry.Each(func(name string, i any) {
-		switch metric := i.(type) {
-		case metrics.Counter:
-			count := metric.Count()
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, count, now)
-			fmt.Fprintf(w, "%s.%s.count_ps %.2f %d\n", c.Prefix, name, float64(count)/flushSeconds, now)
-		case metrics.Gauge:
-			fmt.Fprintf(w, "%s.%s.value %d %d\n", c.Prefix, name, metric.Value(), now)
-		case metrics.GaugeFloat64:
-			fmt.Fprintf(w, "%s.%s.value %f %d\n", c.Prefix, name, metric.Value(), now)
-		case metrics.Histogram:
-			h := metric.Snapshot()
-			ps := h.Percentiles(c.Percentiles)
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, h.Count(), now)
-			fmt.Fprintf(w, "%s.%s.min %d %d\n", c.Prefix, name, h.Min(), now)
-			fmt.Fprintf(w, "%s.%s.max %d %d\n", c.Prefix, name, h.Max(), now)
-			fmt.Fprintf(w, "%s.%s.mean %.2f %d\n", c.Prefix, name, h.Mean(), now)
-			fmt.Fprintf(w, "%s.%s.std-dev %.2f %d\n", c.Prefix, name, h.StdDev(), now)
-			for psIdx, psKey := range c.Percentiles {
-				key := strings.Replace(strconv.FormatFloat(psKey*100.0, 'f', -1, 64), ".", "", 1)
-				fmt.Fprintf(w, "%s.%s.%s-percentile %.2f %d\n", c.Prefix, name, key, ps[psIdx], now)
-			}
-		case metrics.Meter:
-			m := metric.Snapshot()
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, m.Count(), now)
-			fmt.Fprintf(w, "%s.%s.one-minute %.2f %d\n", c.Prefix, name, m.Rate1(), now)
-			fmt.Fprintf(w, "%s.%s.five-minute %.2f %d\n", c.Prefix, name, m.Rate5(), now)
-			fmt.Fprintf(w, "%s.%s.fifteen-minute %.2f %d\n", c.Prefix, name, m.Rate15(), now)
-			fmt.Fprintf(w, "%s.%s.mean %.2f %d\n", c.Prefix, name, m.RateMean(), now)
-		case metrics.Timer:
-			t := metric.Snapshot()
-			ps := t.Percentiles(c.Percentiles)
-			count := t.Count()
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, count, now)
-			fmt.Fprintf(w, "%s.%s.count_ps %.2f %d\n", c.Prefix, name, float64(count)/flushSeconds, now)
-			fmt.Fprintf(w, "%s.%s.min %d %d\n", c.Prefix, name, t.Min()/int64(du), now)
-			fmt.Fprintf(w, "%s.%s.max %d %d\n", c.Prefix, name, t.Max()/int64(du), now)
-			fmt.Fprintf(w, "%s.%s.mean %.2f %d\n", c.Prefix, name, t.Mean()/du, now)
-			fmt.Fprintf(w, "%s.%s.std-dev %.2f %d\n", c.Prefix, name, t.StdDev()/du, now)
-			for psIdx, psKey := range c.Percentiles {
-				key := strings.Replace(strconv.FormatFloat(psKey*100.0, 'f', -1, 64), ".", "", 1)
-				fmt.Fprintf(w, "%s.%s.%s-percentile %.2f %d\n", c.Prefix, name, key, ps[psIdx]/du, now)
-			}
-			fmt.Fprintf(w, "%s.%s.one-minute %.2f %d\n", c.Prefix, name, t.Rate1(), now)
-			fmt.Fprintf(w, "%s.%s.five-minute %.2f %d\n", c.Prefix, name, t.Rate5(), now)
-			fmt.Fprintf(w, "%s.%s.fifteen-minute %.2f %d\n", c.Prefix, name, t.Rate15(), now)
-			fmt.Fprintf(w, "%s.%s.mean-rate %.2f %d\n", c.Prefix, name, t.RateMean(), now)
-		}
-		w.Flush()
-	})
-	return nil
-}
@@ -13,7 +13,6 @@ var (
 	ErrUnknownSubtype          = errors.New("unknown handshake subtype")
 	ErrMissingContent          = errors.New("expected handshake content but message was empty")
 	ErrUnexpectedContent       = errors.New("received unexpected handshake content")
-	ErrInvalidRemoteIndex      = errors.New("peer sent an invalid index in handshake payload")
 	ErrIndexAllocation         = errors.New("failed to allocate local index")
 	ErrNoCredential            = errors.New("no handshake credential available for cert version")
 	ErrAsymmetricCipherKeys    = errors.New("noise produced only one cipher key")
@@ -26,18 +26,4 @@ message NebulaHandshakeDetails {
  uint32 CertVersion = 8;
  // reserved for WIP multiport
  reserved 6, 7;
-  // Multiport lane negotiation. Absent on hosts without multiport enabled;
-  // vanilla nebula treats 9 and 10 as unknown fields and skips them.
-  LaneDetails InitiatorLanes = 9;
-  LaneDetails ResponderLanes = 10;
-}
-
-// LaneDetails advertises a host's multiport lane capability. On a base
-// handshake LaneIndex is 0 and PortCount/BasePort describe the sender's
-// consecutively bound UDP ports. On a lane handshake the initiator sets
-// LaneIndex to its (nonzero) lane number.
-message LaneDetails {
-  uint32 PortCount = 1;
-  uint32 BasePort = 2;
-  uint32 LaneIndex = 3;
 }
@@ -71,7 +71,6 @@ func newTestMachine(
 		cs.version, cs.getCredential,
 		verifier, func() (uint32, error) { return localIndex, nil },
 		initiator, header.HandshakeIXPSK0,
-		nil,
 	)
 	require.NoError(t, err)
 	return m
@@ -39,14 +39,6 @@ type Result struct {
 	HandshakeTime uint64
 	MessageIndex  uint64 // number of messages exchanged during the handshake
 	Initiator     bool
-
-	// Multiport lane negotiation, from the peer's LaneDetails. All zero when
-	// the peer did not advertise (vanilla peer or multiport disabled).
-	// PeerTxLanes is how many lanes the peer may send on, which is how many lane
-	// sessions we need in order to receive everything it sends.
-	PeerPortCount uint32
-	PeerBasePort  uint32
-	PeerTxLanes   uint32
 }

 // Machine drives a Noise handshake through N messages. It handles Noise
@@ -69,7 +61,6 @@ type Machine struct {
 	verifier       CertVerifier
 	result         *Result
 	msgs           []msgFlags
-	lanes          *LaneDetails // our multiport advert; nil emits a vanilla payload
 	myVersion      cert.Version
 	subtype        header.MessageSubType
 	indexAllocated bool
@@ -82,8 +73,6 @@ type Machine struct {
 // the noise pattern and the per-message content layout. The credential for
 // `version` is fetched via getCred and used to seed the noise.HandshakeState.
 // IndexAllocator is called lazily when the first outgoing payload is built.
-// lanes, when non-nil, is emitted as this side's multiport advert on every
-// payload-bearing message; nil produces byte-identical vanilla payloads.
 func NewMachine(
 	version cert.Version,
 	getCred GetCredentialFunc,
@@ -91,7 +80,6 @@ func NewMachine(
 	allocIndex IndexAllocator,
 	initiator bool,
 	subtype header.MessageSubType,
-	lanes *LaneDetails,
 ) (*Machine, error) {
 	info, err := subtypeInfoFor(subtype)
 	if err != nil {
@@ -115,7 +103,6 @@ func NewMachine(
 		getCred:    getCred,
 		allocIndex: allocIndex,
 		verifier:   verifier,
-		lanes:      lanes,
 		myVersion:  version,
 		result: &Result{
 			Initiator: initiator,
@@ -311,8 +298,7 @@ func (m *Machine) processPayload(msg []byte, flags msgFlags) error {
 	}

 	// Assert the payload contains exactly what we expect
-	hasPayloadData := payload.InitiatorIndex != 0 || payload.ResponderIndex != 0 || payload.Time != 0 ||
-		payload.InitiatorLanes != nil || payload.ResponderLanes != nil
+	hasPayloadData := payload.InitiatorIndex != 0 || payload.ResponderIndex != 0 || payload.Time != 0
 	if hasPayloadData != flags.expectsPayload {
 		m.failed = true
 		return ErrUnexpectedContent
@@ -326,38 +312,13 @@ func (m *Machine) processPayload(msg []byte, flags msgFlags) error {

 	// Process payload
 	if flags.expectsPayload {
-		var remoteIndex uint32
 		if m.result.Initiator {
-			remoteIndex = payload.ResponderIndex
+			m.result.RemoteIndex = payload.ResponderIndex
 		} else {
-			remoteIndex = payload.InitiatorIndex
+			m.result.RemoteIndex = payload.InitiatorIndex
 		}
-		// The payload presence check above can be satisfied by Time alone, so a payload
-		// could still carry a zero index here. We need to reject it.
-		if remoteIndex == 0 {
-			m.failed = true
-			return ErrInvalidRemoteIndex
-		}
-		m.result.RemoteIndex = remoteIndex
 		m.result.HandshakeTime = payload.Time
 		m.payloadSet = true
-
-		// Multiport advert from the peer's side of the exchange. Out-of-range
-		// values mean a peer we can't pair lanes with; ignore the advert
-		// rather than failing the handshake — the tunnel itself is fine, it
-		// just won't get lanes. Semantic policing (port-count caps, lane
-		// clamping) belongs to the handshake manager.
-		var peerLanes *LaneDetails
-		if m.result.Initiator {
-			peerLanes = payload.ResponderLanes
-		} else {
-			peerLanes = payload.InitiatorLanes
-		}
-		if peerLanes != nil && peerLanes.BasePort <= 0xffff && peerLanes.PortCount <= 0xffff && peerLanes.TxLanes <= 0xffff {
-			m.result.PeerPortCount = peerLanes.PortCount
-			m.result.PeerBasePort = peerLanes.BasePort
-			m.result.PeerTxLanes = peerLanes.TxLanes
-		}
 	}

 	// Process certificate
@@ -428,11 +389,9 @@ func (m *Machine) marshalOutgoing(flags msgFlags) ([]byte, error) {

 		if m.result.Initiator {
 			p.InitiatorIndex = m.result.LocalIndex
-			p.InitiatorLanes = m.lanes
 		} else {
 			p.ResponderIndex = m.result.LocalIndex
 			p.InitiatorIndex = m.result.RemoteIndex
-			p.ResponderLanes = m.lanes
 		}
 		p.Time = uint64(time.Now().UnixNano())
 	}
@@ -1,111 +0,0 @@
-package handshake
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula/cert"
-	ct "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/header"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// newTestLaneMachine is newTestMachine with a lane advert attached.
-func newTestLaneMachine(
-	t *testing.T,
-	cs *testCertState,
-	verifier CertVerifier,
-	initiator bool,
-	localIndex uint32,
-	lanes *LaneDetails,
-) *Machine {
-	t.Helper()
-	m, err := NewMachine(
-		cs.version, cs.getCredential,
-		verifier, func() (uint32, error) { return localIndex, nil },
-		initiator, header.HandshakeIXPSK0,
-		lanes,
-	)
-	require.NoError(t, err)
-	return m
-}
-
-func doFullLaneHandshake(t *testing.T, initLanes, respLanes *LaneDetails) (initR, respR *Result) {
-	t.Helper()
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	v := testVerifier(caPool)
-
-	initCS := newTestCertState(t, ca, caKey, "initiator", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	respCS := newTestCertState(t, ca, caKey, "responder", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-
-	initM := newTestLaneMachine(t, initCS, v, true, 1000, initLanes)
-	respM := newTestLaneMachine(t, respCS, v, false, 2000, respLanes)
-
-	msg1, err := initM.Initiate(nil)
-	require.NoError(t, err)
-
-	resp, respR, err := respM.ProcessPacket(nil, msg1)
-	require.NoError(t, err)
-	require.NotNil(t, respR)
-
-	_, initR, err = initM.ProcessPacket(nil, resp)
-	require.NoError(t, err)
-	require.NotNil(t, initR)
-	return initR, respR
-}
-
-func TestMachineLaneAdvertBothSides(t *testing.T) {
-	initR, respR := doFullLaneHandshake(t,
-		&LaneDetails{PortCount: 8, BasePort: 4242, TxLanes: 8},
-		&LaneDetails{PortCount: 4, BasePort: 5353, TxLanes: 3},
-	)
-
-	// Each side's Result carries the peer's advert.
-	assert.Equal(t, uint32(4), initR.PeerPortCount)
-	assert.Equal(t, uint32(5353), initR.PeerBasePort)
-	assert.Equal(t, uint32(3), initR.PeerTxLanes)
-
-	assert.Equal(t, uint32(8), respR.PeerPortCount)
-	assert.Equal(t, uint32(4242), respR.PeerBasePort)
-	assert.Equal(t, uint32(8), respR.PeerTxLanes)
-}
-
-func TestMachineLaneAdvertAsymmetric(t *testing.T) {
-	// Vanilla initiator, multiport responder and vice versa: the nil side
-	// yields all-zero peer fields on the other end.
-	initR, respR := doFullLaneHandshake(t, nil, &LaneDetails{PortCount: 4, BasePort: 5353})
-	assert.Equal(t, uint32(4), initR.PeerPortCount)
-	assert.Equal(t, uint32(0), respR.PeerPortCount)
-	assert.Equal(t, uint32(0), respR.PeerBasePort)
-
-	initR, respR = doFullLaneHandshake(t, &LaneDetails{PortCount: 8, BasePort: 4242}, nil)
-	assert.Equal(t, uint32(0), initR.PeerPortCount)
-	assert.Equal(t, uint32(8), respR.PeerPortCount)
-}
-
-func TestMachineLaneAdvertOutOfRangeIgnored(t *testing.T) {
-	// A BasePort that can't be a real UDP port is ignored, not fatal.
-	initR, respR := doFullLaneHandshake(t,
-		&LaneDetails{PortCount: 8, BasePort: 70000, TxLanes: 8},
-		&LaneDetails{PortCount: 4, BasePort: 5353, TxLanes: 4},
-	)
-	assert.Equal(t, uint32(0), respR.PeerPortCount)
-	assert.Equal(t, uint32(0), respR.PeerBasePort)
-	assert.Equal(t, uint32(0), respR.PeerTxLanes)
-	// The sane side still negotiates.
-	assert.Equal(t, uint32(4), initR.PeerPortCount)
-
-	// An out-of-range TxLanes drops the whole advert the same way: a lane index
-	// that does not fit the header is as unusable as an impossible port.
-	initR, respR = doFullLaneHandshake(t,
-		&LaneDetails{PortCount: 8, BasePort: 4242, TxLanes: 0x10000},
-		&LaneDetails{PortCount: 4, BasePort: 5353, TxLanes: 4},
-	)
-	assert.Equal(t, uint32(0), respR.PeerPortCount)
-	assert.Equal(t, uint32(4), initR.PeerPortCount)
-}
@@ -229,24 +229,6 @@ func TestMachineProcessPayload(t *testing.T) {
 		require.ErrorIs(t, err, ErrUnexpectedContent)
 		assert.True(t, m.Failed())
 	})
-
-	t.Run("zero initiator index on responder is fatal", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		bytes := MarshalPayload(nil, Payload{InitiatorIndex: 0, Time: 1})
-		err := m.processPayload(bytes, msgFlags{expectsPayload: true})
-		require.ErrorIs(t, err, ErrInvalidRemoteIndex)
-		assert.True(t, m.Failed())
-		assert.Zero(t, m.result.RemoteIndex)
-	})
-
-	t.Run("zero responder index on initiator is fatal", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, true, 100)
-		bytes := MarshalPayload(nil, Payload{InitiatorIndex: 100, ResponderIndex: 0, Time: 1})
-		err := m.processPayload(bytes, msgFlags{expectsPayload: true})
-		require.ErrorIs(t, err, ErrInvalidRemoteIndex)
-		assert.True(t, m.Failed())
-		assert.Zero(t, m.result.RemoteIndex)
-	})
 }

 // TestMachineRequireComplete checks the fail-on-incomplete-handshake path
@@ -444,7 +426,6 @@ func TestMachineThreeMessagePattern(t *testing.T) {
 		initCS.getCredential, v,
 		func() (uint32, error) { return 1000, nil },
 		true, header.HandshakeXXPSK0,
-		nil,
 	)
 	require.NoError(t, err)

@@ -453,7 +434,6 @@ func TestMachineThreeMessagePattern(t *testing.T) {
 		respCS.getCredential, v,
 		func() (uint32, error) { return 2000, nil },
 		false, header.HandshakeXXPSK0,
-		nil,
 	)
 	require.NoError(t, err)

@@ -20,40 +20,15 @@ type Payload struct {
 	ResponderIndex uint32
 	Time           uint64
 	CertVersion    uint32
-
-	// Multiport lane negotiation; nil when the sender has multiport disabled
-	// (which keeps the encoded payload byte-identical to a vanilla one).
-	InitiatorLanes *LaneDetails
-	ResponderLanes *LaneDetails
-}
-
-// LaneDetails advertises multiport lane capability: the contiguous UDP port
-// range the sender bound, and how many lanes it may send on. The receiver needs
-// PortCount/BasePort to aim its own lanes and TxLanes to know how many lane
-// sessions to derive for receiving.
-type LaneDetails struct {
-	PortCount uint32
-	BasePort  uint32
-	TxLanes   uint32
 }

 // Proto field numbers for NebulaHandshakeDetails
 const (
-	fieldCert           = 1  // bytes
-	fieldInitiatorIndex = 2  // uint32
-	fieldResponderIndex = 3  // uint32
-	fieldTime           = 5  // uint64
-	fieldCertVersion    = 8  // uint32
-	fieldInitiatorLanes = 9  // LaneDetails
-	fieldResponderLanes = 10 // LaneDetails
-)
-
-// Proto field numbers for LaneDetails.
-// Field 3 was a per-lane handshake index and is permanently reserved.
-const (
-	fieldLanePortCount = 1 // uint32
-	fieldLaneBasePort  = 2 // uint32
-	fieldLaneTxLanes   = 4 // uint32
+	fieldCert           = 1 // bytes
+	fieldInitiatorIndex = 2 // uint32
+	fieldResponderIndex = 3 // uint32
+	fieldTime           = 5 // uint64
+	fieldCertVersion    = 8 // uint32
 )

 // MarshalPayload encodes a handshake payload in protobuf wire format compatible
@@ -82,16 +57,6 @@ func MarshalPayload(out []byte, p Payload) []byte {
 		details = protowire.AppendTag(details, fieldCertVersion, protowire.VarintType)
 		details = protowire.AppendVarint(details, uint64(p.CertVersion))
 	}
-	// Emitted last to keep the encoding in ascending field-number order, which
-	// is what protoc-gen-go would produce for the same message.
-	if p.InitiatorLanes != nil {
-		details = protowire.AppendTag(details, fieldInitiatorLanes, protowire.BytesType)
-		details = protowire.AppendBytes(details, p.InitiatorLanes.marshal(nil))
-	}
-	if p.ResponderLanes != nil {
-		details = protowire.AppendTag(details, fieldResponderLanes, protowire.BytesType)
-		details = protowire.AppendBytes(details, p.ResponderLanes.marshal(nil))
-	}

 	out = protowire.AppendTag(out, 1, protowire.BytesType)
 	out = protowire.AppendBytes(out, details)
@@ -99,20 +64,6 @@ func MarshalPayload(out []byte, p Payload) []byte {
 	return out
 }

-// marshal appends the LaneDetails submessage fields to out. All fields are
-// emitted unconditionally: a LaneDetails is only present at all when multiport
-// is negotiating, and explicit zeros keep the parser's presence semantics
-// trivial.
-func (d *LaneDetails) marshal(out []byte) []byte {
-	out = protowire.AppendTag(out, fieldLanePortCount, protowire.VarintType)
-	out = protowire.AppendVarint(out, uint64(d.PortCount))
-	out = protowire.AppendTag(out, fieldLaneBasePort, protowire.VarintType)
-	out = protowire.AppendVarint(out, uint64(d.BasePort))
-	out = protowire.AppendTag(out, fieldLaneTxLanes, protowire.VarintType)
-	out = protowire.AppendVarint(out, uint64(d.TxLanes))
-	return out
-}
-
 // UnmarshalPayload decodes a protobuf-encoded NebulaHandshake message.
 func UnmarshalPayload(b []byte) (Payload, error) {
 	var p Payload
@@ -210,72 +161,6 @@ func unmarshalPayloadDetails(p *Payload, b []byte) error {
 			}
 			p.CertVersion = uint32(v)
 			b = b[n:]
-		case fieldInitiatorLanes:
-			if typ != protowire.BytesType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeBytes(b)
-			if n < 0 {
-				return errInvalidHandshakeDetails
-			}
-			p.InitiatorLanes = new(LaneDetails)
-			if err := unmarshalLaneDetails(p.InitiatorLanes, v); err != nil {
-				return err
-			}
-			b = b[n:]
-		case fieldResponderLanes:
-			if typ != protowire.BytesType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeBytes(b)
-			if n < 0 {
-				return errInvalidHandshakeDetails
-			}
-			p.ResponderLanes = new(LaneDetails)
-			if err := unmarshalLaneDetails(p.ResponderLanes, v); err != nil {
-				return err
-			}
-			b = b[n:]
-		default:
-			n := protowire.ConsumeFieldValue(num, typ, b)
-			if n < 0 {
-				return errInvalidHandshakeDetails
-			}
-			b = b[n:]
-		}
-	}
-	return nil
-}
-
-func unmarshalLaneDetails(d *LaneDetails, b []byte) error {
-	for len(b) > 0 {
-		num, typ, n := protowire.ConsumeTag(b)
-		if n < 0 {
-			return errInvalidHandshakeDetails
-		}
-		b = b[n:]
-
-		// Same contract as the details parser: known fields hard-fail on a
-		// wire-type mismatch, unknown fields are skipped, repeated singular
-		// fields follow proto3 last-wins.
-		switch num {
-		case fieldLanePortCount, fieldLaneBasePort, fieldLaneTxLanes:
-			if typ != protowire.VarintType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeVarint(b)
-			if n < 0 || v > math.MaxUint32 {
-				return errInvalidHandshakeDetails
-			}
-			switch num {
-			case fieldLanePortCount:
-				d.PortCount = uint32(v)
-			case fieldLaneBasePort:
-				d.BasePort = uint32(v)
-			case fieldLaneTxLanes:
-				d.TxLanes = uint32(v)
-			}
-			b = b[n:]
 		default:
 			n := protowire.ConsumeFieldValue(num, typ, b)
 			if n < 0 {
@@ -117,134 +117,23 @@ func TestPayloadUnknownFields(t *testing.T) {
 		assert.Equal(t, uint32(88), got.ResponderIndex)
 	})

-	t.Run("unknown field inside LaneDetails is skipped", func(t *testing.T) {
-		var lane []byte
-		lane = protowire.AppendTag(lane, fieldLanePortCount, protowire.VarintType)
-		lane = protowire.AppendVarint(lane, 4)
-		lane = protowire.AppendTag(lane, 50, protowire.VarintType) // unknown subfield
-		lane = protowire.AppendVarint(lane, 9999)
-		lane = protowire.AppendTag(lane, fieldLaneBasePort, protowire.VarintType)
-		lane = protowire.AppendVarint(lane, 4242)
-
+	t.Run("reserved fields 6 and 7 are skipped", func(t *testing.T) {
+		// Fields 6 and 7 are reserved in the proto definition
 		var details []byte
 		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
 		details = protowire.AppendVarint(details, 100)
-		details = protowire.AppendTag(details, fieldInitiatorLanes, protowire.BytesType)
-		details = protowire.AppendBytes(details, lane)
+		details = protowire.AppendTag(details, 6, protowire.VarintType)
+		details = protowire.AppendVarint(details, 1)
+		details = protowire.AppendTag(details, 7, protowire.VarintType)
+		details = protowire.AppendVarint(details, 2)

-		got, err := UnmarshalPayload(wrapDetails(details))
+		var data []byte
+		data = protowire.AppendTag(data, 1, protowire.BytesType)
+		data = protowire.AppendBytes(data, details)
+
+		got, err := UnmarshalPayload(data)
 		require.NoError(t, err)
 		assert.Equal(t, uint32(100), got.InitiatorIndex)
-		require.NotNil(t, got.InitiatorLanes)
-		assert.Equal(t, uint32(4), got.InitiatorLanes.PortCount)
-		assert.Equal(t, uint32(4242), got.InitiatorLanes.BasePort)
-	})
-}
-
-func TestPayloadLaneDetails(t *testing.T) {
-	t.Run("round trip both sides", func(t *testing.T) {
-		data := MarshalPayload(nil, Payload{
-			InitiatorIndex: 12345,
-			Time:           999,
-			InitiatorLanes: &LaneDetails{PortCount: 8, BasePort: 4242, TxLanes: 3},
-			ResponderLanes: &LaneDetails{PortCount: 4, BasePort: 5353},
-		})
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-		require.NotNil(t, got.InitiatorLanes)
-		assert.Equal(t, LaneDetails{PortCount: 8, BasePort: 4242, TxLanes: 3}, *got.InitiatorLanes)
-		require.NotNil(t, got.ResponderLanes)
-		assert.Equal(t, LaneDetails{PortCount: 4, BasePort: 5353}, *got.ResponderLanes)
-	})
-
-	t.Run("zero-valued LaneDetails survives the round trip", func(t *testing.T) {
-		// Presence is what negotiation keys on; an all-zero advert must not
-		// decay to nil.
-		data := MarshalPayload(nil, Payload{
-			InitiatorIndex: 1,
-			InitiatorLanes: &LaneDetails{},
-		})
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-		require.NotNil(t, got.InitiatorLanes)
-		assert.Equal(t, LaneDetails{}, *got.InitiatorLanes)
-		assert.Nil(t, got.ResponderLanes)
-	})
-
-	t.Run("nil lanes marshal byte-identical to a vanilla payload", func(t *testing.T) {
-		p := Payload{
-			Cert:           []byte("cert"),
-			CertVersion:    2,
-			InitiatorIndex: 100,
-			Time:           999,
-		}
-		// The vanilla encoding of the same fields, built by hand in field order.
-		var details []byte
-		details = protowire.AppendTag(details, fieldCert, protowire.BytesType)
-		details = protowire.AppendBytes(details, p.Cert)
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, uint64(p.InitiatorIndex))
-		details = protowire.AppendTag(details, fieldTime, protowire.VarintType)
-		details = protowire.AppendVarint(details, p.Time)
-		details = protowire.AppendTag(details, fieldCertVersion, protowire.VarintType)
-		details = protowire.AppendVarint(details, uint64(p.CertVersion))
-
-		assert.Equal(t, wrapDetails(details), MarshalPayload(nil, p))
-	})
-
-	t.Run("lane field with wrong wire type rejected", func(t *testing.T) {
-		for _, field := range []protowire.Number{fieldInitiatorLanes, fieldResponderLanes} {
-			var details []byte
-			details = protowire.AppendTag(details, field, protowire.VarintType)
-			details = protowire.AppendVarint(details, 1)
-			_, err := UnmarshalPayload(wrapDetails(details))
-			assert.Error(t, err)
-		}
-	})
-
-	t.Run("lane subfield with wrong wire type rejected", func(t *testing.T) {
-		var lane []byte
-		lane = protowire.AppendTag(lane, fieldLanePortCount, protowire.BytesType)
-		lane = protowire.AppendBytes(lane, []byte{1, 2, 3})
-
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorLanes, protowire.BytesType)
-		details = protowire.AppendBytes(details, lane)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated LaneDetails submessage rejected", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorLanes, protowire.BytesType)
-		details = append(details, 0x0a, 0x01, 0x02) // length 10, only 2 bytes
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated varint inside LaneDetails rejected", func(t *testing.T) {
-		var lane []byte
-		lane = protowire.AppendTag(lane, fieldLaneBasePort, protowire.VarintType)
-		lane = append(lane, 0x80) // incomplete varint
-
-		var details []byte
-		details = protowire.AppendTag(details, fieldResponderLanes, protowire.BytesType)
-		details = protowire.AppendBytes(details, lane)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("lane subfield varint overflow rejected", func(t *testing.T) {
-		var lane []byte
-		lane = protowire.AppendTag(lane, fieldLaneTxLanes, protowire.VarintType)
-		lane = protowire.AppendVarint(lane, math.MaxUint32+1)
-
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorLanes, protowire.BytesType)
-		details = protowire.AppendBytes(details, lane)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
 	})
 }

@@ -439,12 +328,6 @@ func FuzzPayload(f *testing.F) {
 		Time:           3,
 		CertVersion:    2,
 	}))
-	f.Add(MarshalPayload(nil, Payload{
-		InitiatorIndex: 1,
-		Time:           3,
-		InitiatorLanes: &LaneDetails{PortCount: 8, BasePort: 4242, TxLanes: 2},
-		ResponderLanes: &LaneDetails{PortCount: 4, BasePort: 5353},
-	}))
 	f.Add([]byte{})
 	f.Add([]byte{0xff})

@@ -474,14 +357,5 @@ func payloadsEqual(a, b Payload) bool {
 		a.InitiatorIndex == b.InitiatorIndex &&
 		a.ResponderIndex == b.ResponderIndex &&
 		a.Time == b.Time &&
-		a.CertVersion == b.CertVersion &&
-		laneDetailsEqual(a.InitiatorLanes, b.InitiatorLanes) &&
-		laneDetailsEqual(a.ResponderLanes, b.ResponderLanes)
-}
-
-func laneDetailsEqual(a, b *LaneDetails) bool {
-	if a == nil || b == nil {
-		return a == b
-	}
-	return *a == *b
+		a.CertVersion == b.CertVersion
 }
@@ -50,14 +50,6 @@ type HandshakeConfig struct {
 	retries       int64
 	triggerBuffer int

-	// Multiport lane parameters; laneCount == 0 means multiport is disabled.
-	// laneCount includes implicit lane 0 (the base tunnel), so lanes
-	// 1..laneCount-1 may carry traffic. lanePortCount/laneBasePort describe our
-	// own bound port range and are advertised in every handshake payload.
-	laneCount     int
-	lanePortCount uint16
-	laneBasePort  uint16
-
 	messageMetrics *MessageMetrics
 }

@@ -91,7 +83,6 @@ type HandshakeHostInfo struct {
 	initiatingVersionOverride cert.Version     // Should we use a non-default cert version for this handshake?
 	counter                   int64            // How many attempts have we made so far
 	lastRemotes               []netip.AddrPort // Remotes that we sent to during the previous attempt
-	lastRelays                []netip.Addr     // Relays we attempted to use during the previous attempt
 	packetStore               []*cachedPacket  // A set of packets to be transmitted once the handshake completes

 	hostinfo *HostInfo
@@ -226,6 +217,7 @@ func (hm *HandshakeManager) handleOutbound(vpnIp netip.Addr, lighthouseTriggered
 		fields := []any{
 			"udpAddrs", hh.hostinfo.remotes.CopyAddrs(hm.mainHostMap.GetPreferredRanges()),
 			"initiatorIndex", hh.hostinfo.localIndexId,
+			"remoteIndex", hh.hostinfo.remoteIndexId,
 			"durationNs", time.Since(hh.startTime).Nanoseconds(),
 		}
 		// hh.machine can be nil here if buildStage0Packet never succeeded
@@ -303,13 +295,7 @@ func (hm *HandshakeManager) handleOutbound(vpnIp netip.Addr, lighthouseTriggered
 		hm.messageMetrics.Tx(header.Handshake, hh.machine.Subtype(), 1)
 		err := hm.outside.WriteTo(stage0, addr)
 		if err != nil {
-			// These repeat every attempt, so match the success log below and only shout when the remotes changed
-			level := slog.LevelDebug
-			if remotesHaveChanged {
-				level = slog.LevelError
-			}
-
-			hostinfo.logger(hm.l).Log(context.Background(), level, "Failed to send handshake message",
+			hostinfo.logger(hm.l).Error("Failed to send handshake message",
 				"udpAddr", addr,
 				"initiatorIndex", hostinfo.localIndexId,
 				"handshake", hsFields,
@@ -337,7 +323,7 @@ func (hm *HandshakeManager) handleOutbound(vpnIp netip.Addr, lighthouseTriggered
 		)
 	}

-	hm.f.relayManager.StartRelays(hm.f, vpnIp, hh, stage0)
+	hm.f.relayManager.StartRelays(hm.f, vpnIp, hostinfo, stage0)

 	// If a lighthouse triggered this attempt then we are still in the timer wheel and do not need to re-add
 	if !lighthouseTriggered {
@@ -444,11 +430,14 @@ func (hm *HandshakeManager) CheckAndComplete(hostinfo *HostInfo, handshakePacket
 	// Check if we already have a tunnel with this vpn ip
 	existingHostInfo, found := hm.mainHostMap.Hosts[hostinfo.vpnAddrs[0]]
 	if found && existingHostInfo != nil {
-		// Is it just a delayed handshake packet? Check every hostinfo we hold for this address.
-		for _, testHostInfo := range hm.mainHostMap.unlockedGetHostList(hostinfo.vpnAddrs[0]) {
+		testHostInfo := existingHostInfo
+		for testHostInfo != nil {
+			// Is it just a delayed handshake packet?
 			if bytes.Equal(hostinfo.HandshakePacket[handshakePacket], testHostInfo.HandshakePacket[handshakePacket]) {
 				return testHostInfo, ErrAlreadySeen
 			}
+
+			testHostInfo = testHostInfo.next
 		}

 		// Is this a newer handshake?
@@ -476,6 +465,7 @@ func (hm *HandshakeManager) CheckAndComplete(hostinfo *HostInfo, handshakePacket
 		// We have a collision, but this can happen since we can't control
 		// the remote ID. Just log about the situation as a note.
 		hostinfo.logger(hm.l).Info("New host shadows existing host remoteIndex",
+			"remoteIndex", hostinfo.remoteIndexId,
 			"collision", existingRemoteIndex.vpnAddrs,
 		)
 	}
@@ -498,6 +488,7 @@ func (hm *HandshakeManager) Complete(hostinfo *HostInfo, f *Interface) {
 		// We have a collision, but this can happen since we can't control
 		// the remote ID. Just log about the situation as a note.
 		hostinfo.logger(hm.l).Info("New host shadows existing host remoteIndex",
+			"remoteIndex", hostinfo.remoteIndexId,
 			"collision", existingRemoteIndex.vpnAddrs,
 		)
 	}
@@ -543,12 +534,7 @@ func (hm *HandshakeManager) DeleteHostInfo(hostinfo *HostInfo) {

 func (hm *HandshakeManager) unlockedDeleteHostInfo(hostinfo *HostInfo) {
 	for _, addr := range hostinfo.vpnAddrs {
-		// Only delete the pending entry if it is actually ours: an
-		// unconditional delete could evict a concurrently pending handshake for
-		// the same address.
-		if cur, ok := hm.vpnIps[addr]; ok && cur.hostinfo == hostinfo {
-			delete(hm.vpnIps, addr)
-		}
+		delete(hm.vpnIps, addr)
 	}

 	if len(hm.vpnIps) == 0 {
@@ -683,7 +669,6 @@ func (hm *HandshakeManager) buildStage0Packet(hh *HandshakeHostInfo) bool {
 		v, cs.GetCredential,
 		hm.certVerifier(), func() (uint32, error) { return hm.allocateIndex(hh) },
 		true, header.HandshakeIXPSK0,
-		hm.laneAdvert(),
 	)
 	if err != nil {
 		hm.f.l.Error("Failed to create handshake machine",
@@ -707,35 +692,6 @@ func (hm *HandshakeManager) buildStage0Packet(hh *HandshakeHostInfo) bool {
 	return true
 }

-// laneAdvert returns our multiport advert for a handshake payload, or nil
-// when multiport is disabled (which keeps the payload byte-identical to
-// vanilla).
-func (hm *HandshakeManager) laneAdvert() *handshake.LaneDetails {
-	if hm.config.laneCount == 0 {
-		return nil
-	}
-	return &handshake.LaneDetails{
-		PortCount: uint32(hm.config.lanePortCount),
-		BasePort:  uint32(hm.config.laneBasePort),
-		TxLanes:   uint32(hm.config.laneCount),
-	}
-}
-
-// maybeAllocLanes sets up the multiport lanes for a just-completed tunnel. Must
-// run before the hostinfo becomes visible in the hostmap: the data plane reads
-// hostinfo.lanes without synchronizing on it. The sessions themselves are derived
-// later, on the first packet that needs each one.
-func (hm *HandshakeManager) maybeAllocLanes(hostinfo *HostInfo, result *handshake.Result) {
-	if hm.config.laneCount == 0 || result.PeerPortCount == 0 {
-		return
-	}
-	if len(hm.f.myVpnAddrs) == 0 || len(hostinfo.vpnAddrs) == 0 {
-		return
-	}
-
-	hostinfo.lanes = newLaneSet(result, hm.config.laneCount, hm.f.myVpnAddrs[0], hostinfo.vpnAddrs[0])
-}
-
 // beginHandshake handles an incoming handshake packet that doesn't match any
 // existing pending handshake. It creates a new responder Machine and processes
 // the first message.
@@ -754,7 +710,6 @@ func (hm *HandshakeManager) beginHandshake(via ViaSender, packet []byte, h *head
 		v, cs.GetCredential,
 		hm.certVerifier(), func() (uint32, error) { return generateIndex(f.l) },
 		false, header.HandshakeIXPSK0,
-		hm.laneAdvert(),
 	)
 	if err != nil {
 		f.l.Error("Failed to create handshake machine", "from", via, "error", err)
@@ -791,14 +746,8 @@ func (hm *HandshakeManager) beginHandshake(via ViaSender, packet []byte, h *head
 		return
 	}

-	connState, err := newConnectionStateFromResult(result)
-	if err != nil {
-		f.l.Error("Discarding handshake with an invalid message index", "error", err, "vpnAddrs", vpnAddrs)
-		return
-	}
-
 	hostinfo := &HostInfo{
-		ConnectionState:   connState,
+		ConnectionState:   newConnectionStateFromResult(result),
 		localIndexId:      result.LocalIndex,
 		remoteIndexId:     result.RemoteIndex,
 		vpnAddrs:          vpnAddrs,
@@ -811,10 +760,6 @@ func (hm *HandshakeManager) beginHandshake(via ViaSender, packet []byte, h *head
 		},
 	}

-	// Lanes are allocated before the log line so it can report what was actually
-	// negotiated, and must in any case be in place before CheckAndComplete below.
-	hm.maybeAllocLanes(hostinfo, result)
-
 	msg := "Handshake message received"
 	if !anyVpnAddrsInCommon {
 		msg = "Handshake message received, but no vpnNetworks in common."
@@ -829,7 +774,6 @@ func (hm *HandshakeManager) beginHandshake(via ViaSender, packet []byte, h *head
 		"initiatorIndex", result.RemoteIndex,
 		"responderIndex", result.LocalIndex,
 		"handshake", m{"stage": uint64(machine.MessageIndex()), "style": header.SubTypeName(header.Handshake, machine.Subtype())},
-		laneLogAttr(hm.config.laneCount, hostinfo.lanes),
 	)

 	// packet aliases the listener's incoming buffer, so this copy must stay.
@@ -854,6 +798,7 @@ func (hm *HandshakeManager) beginHandshake(via ViaSender, packet []byte, h *head
 	}

 	hm.sendHandshakeResponse(via, response, hostinfo, false)
+	f.connectionManager.AddTrafficWatch(hostinfo)
 	hostinfo.remotes.RefreshFromHandshake(vpnAddrs)

 	// Don't wait for UpdateWorker
@@ -921,13 +866,7 @@ func (hm *HandshakeManager) continueHandshake(via ViaSender, hh *HandshakeHostIn
 	}

 	// Handshake complete; build the ConnectionState now that we have keys and a verified peer cert.
-	cs, err := newConnectionStateFromResult(result)
-	if err != nil {
-		f.l.Error("Discarding handshake with an invalid message index", "error", err, "vpnAddrs", hostinfo.vpnAddrs)
-		hm.DeleteHostInfo(hostinfo)
-		return
-	}
-	hostinfo.ConnectionState = cs
+	hostinfo.ConnectionState = newConnectionStateFromResult(result)

 	remoteCert := result.RemoteCert
 	if remoteCert == nil {
@@ -1004,14 +943,6 @@ func (hm *HandshakeManager) continueHandshake(via ViaSender, hh *HandshakeHostIn
 	}

 	duration := time.Since(hh.startTime).Nanoseconds()
-
-	hostinfo.vpnAddrs = vpnAddrs
-	hostinfo.buildNetworks(f.myVpnNetworksTable, remoteCert.Certificate)
-
-	// Lanes are allocated before the log line so it can report what was actually
-	// negotiated, and must in any case be in place before Complete below.
-	hm.maybeAllocLanes(hostinfo, result)
-
 	msg := "Handshake message received"
 	if !anyVpnAddrsInCommon {
 		msg = "Handshake message received, but no vpnNetworks in common."
@@ -1028,10 +959,13 @@ func (hm *HandshakeManager) continueHandshake(via ViaSender, hh *HandshakeHostIn
 		"handshake", m{"stage": uint64(machine.MessageIndex()), "style": header.SubTypeName(header.Handshake, machine.Subtype())},
 		"durationNs", duration,
 		"sentCachedPackets", len(hh.packetStore),
-		laneLogAttr(hm.config.laneCount, hostinfo.lanes),
 	)

+	hostinfo.vpnAddrs = vpnAddrs
+	hostinfo.buildNetworks(f.myVpnNetworksTable, remoteCert.Certificate)
+
 	hm.Complete(hostinfo, f)
+	f.connectionManager.AddTrafficWatch(hostinfo)

 	if len(hh.packetStore) > 0 {
 		if f.l.Enabled(context.Background(), slog.LevelDebug) {
@@ -1040,9 +974,7 @@ func (hm *HandshakeManager) continueHandshake(via ViaSender, hh *HandshakeHostIn
 		nb := make([]byte, 12, 12)
 		out := make([]byte, mtu)
 		for _, cp := range hh.packetStore {
-			// TODO: use a SendBatch here. Each callback lands in
-			// sendNoMetrics -> WriteTo: one syscall per cached packet,
-			// where one sendmmsg could flush the whole store.
+			//todo use a sendbatcher
 			cp.callback(cp.messageType, cp.messageSubType, hostinfo, cp.packet, nb, out)
 		}
 		f.cachedPacketMetrics.sent.Inc(int64(len(hh.packetStore)))
@@ -1139,10 +1071,7 @@ func (hm *HandshakeManager) sendHandshakeResponse(via ViaSender, msg []byte, hos

 	if !via.IsRelayed {
 		fields := append(logFields, "from", via)
-		// Reply from the socket the handshake arrived on so the initiator sees
-		// the source port it targeted. Identical to f.outside under vanilla
-		// config (all writers share one port); required for multiport lanes.
-		err := f.writers[via.SockIdx].WriteTo(msg, via.UdpAddr)
+		err := f.outside.WriteTo(msg, via.UdpAddr)
 		if err != nil {
 			f.l.Error("Failed to send handshake message", append(fields, "error", err)...)
 		} else {
@@ -1156,8 +1085,8 @@ func (hm *HandshakeManager) sendHandshakeResponse(via ViaSender, msg []byte, hos
 		hostinfo.relayState.InsertRelayTo(via.relayHI.vpnAddrs[0])
 		// We received a valid handshake on this relay, so make sure the relay
 		// state reflects that, in case it had been marked Disestablished.
-		via.relayHI.relayState.UpdateRelayForByIdxState(via.relay.LocalIndex, Established)
-		f.SendVia(via.relayHI, via.relay, msg, make([]byte, 12), make([]byte, mtu), false, 0)
+		via.relayHI.relayState.UpdateRelayForByIdxState(via.remoteIdx, Established)
+		f.SendVia(via.relayHI, via.relay, msg, make([]byte, 12), make([]byte, mtu), false)
 		f.l.Info("Handshake message sent", append(logFields, "relay", via.relayHI.vpnAddrs[0])...)
 	}
 }
@@ -84,7 +84,7 @@ func (mw *mockEncWriter) SendMessageToVpnAddr(_ header.MessageType, _ header.Mes
 	return
 }

-func (mw *mockEncWriter) SendVia(via *HostInfo, relay *Relay, ad, nb, out []byte, nocopy bool, q int) {
+func (mw *mockEncWriter) SendVia(_ *HostInfo, _ *Relay, _, _, _ []byte, _ bool) {
 	return
 }

@@ -8,28 +8,16 @@ import (
 )

 //Version 1 header:
-// 0                                                                                  31
-// |------------------------------------------------------------------------------------|
-// | Version (uint4) | Type (uint4) | Subtype (uint8) | Reserved (uint8) | Lane (uint8) | 32
-// |------------------------------------------------------------------------------------|
-// |                               Remote index (uint32)                                | 64
-// |------------------------------------------------------------------------------------|
-// |                                  Message counter                                   | 96
-// |                                      (uint64)                                      | 128
-// |------------------------------------------------------------------------------------|
-// |                                     payload...                                     |
-//
-// Lane is the multiport lane index, carved out of the low 8 bits of what was a
-// single Reserved (uint16) before multiport. Lane 0 is the base tunnel, which is
-// what every sender that does not know about lanes emits and what every non-lane
-// packet — handshakes, lighthouse, relays, close — carries, so the field is
-// compatible in both directions with a peer that has never heard of it. The
-// remaining 8 bits stay reserved and are always sent as zero. The H struct still
-// holds the pair as one Reserved field; use H.Lane and EncodeLane to reach the
-// low byte.
-//
-// Lane is part of the AEAD's associated data, so a lane index cannot be altered
-// in flight: a packet decrypts on the lane it claims or not at all.
+// 0                                                                       31
+// |-----------------------------------------------------------------------|
+// | Version (uint4) | Type (uint4) |  Subtype (uint8) | Reserved (uint16) | 32
+// |-----------------------------------------------------------------------|
+// |                        Remote index (uint32)                          | 64
+// |-----------------------------------------------------------------------|
+// |                           Message counter                             | 96
+// |                               (uint64)                                | 128
+// |-----------------------------------------------------------------------|
+// |                               payload...                              |

 type m = map[string]any

@@ -69,18 +57,8 @@ const (
 const (
 	TestRequest MessageSubType = 0
 	TestReply   MessageSubType = 1
-	// LaneProbe is sent on a multiport lane to prove the lane's 5-tuple is
-	// usable; LaneProbeAck answers it on the base tunnel.
-	LaneProbe    MessageSubType = 2
-	LaneProbeAck MessageSubType = 3
 )

-// MaxLane is the largest lane index the header can carry.
-const MaxLane = 0xff
-
-// laneMask covers the bits of Reserved that hold the lane index.
-const laneMask uint16 = 0x00ff
-
 const (
 	HandshakeIXPSK0 MessageSubType = 0
 	HandshakeXXPSK0 MessageSubType = 1
@@ -89,10 +67,8 @@ const (
 var ErrHeaderTooShort = errors.New("header is too short")

 var subTypeTestMap = map[MessageSubType]string{
-	TestRequest:  "testRequest",
-	TestReply:    "testReply",
-	LaneProbe:    "laneProbe",
-	LaneProbeAck: "laneProbeAck",
+	TestRequest: "testRequest",
+	TestReply:   "testReply",
 }

 var subTypeNoneMap = map[MessageSubType]string{0: "none"}
@@ -124,16 +100,10 @@ type H struct {
 // Encode uses the provided byte array to encode the provided header values into.
 // Byte array must be capped higher than HeaderLen or this will panic
 func Encode(b []byte, v uint8, t MessageType, st MessageSubType, ri uint32, c uint64) []byte {
-	return EncodeLane(b, v, t, st, ri, c, 0)
-}
-
-// EncodeLane is Encode with an explicit multiport lane index, which is carried
-// in the low 8 bits of Reserved.
-func EncodeLane(b []byte, v uint8, t MessageType, st MessageSubType, ri uint32, c uint64, lane uint8) []byte {
 	b = b[:Len]
 	b[0] = v<<4 | byte(t&0x0f)
 	b[1] = byte(st)
-	binary.BigEndian.PutUint16(b[2:4], uint16(lane))
+	binary.BigEndian.PutUint16(b[2:4], 0)
 	binary.BigEndian.PutUint32(b[4:8], ri)
 	binary.BigEndian.PutUint64(b[8:16], c)
 	return b
@@ -166,13 +136,7 @@ func (h *H) Encode(b []byte) ([]byte, error) {
 		return nil, errors.New("nil header")
 	}

-	return EncodeLane(b, h.Version, h.Type, h.Subtype, h.RemoteIndex, h.MessageCounter, h.Lane()), nil
-}
-
-// Lane returns the multiport lane index carried in Reserved. Lane 0 is the base
-// tunnel, which is what any sender that does not know about lanes will report.
-func (h *H) Lane() uint8 {
-	return uint8(h.Reserved & laneMask)
+	return Encode(b, h.Version, h.Type, h.Subtype, h.RemoteIndex, h.MessageCounter), nil
 }

 // Parse is a helper function to parses given bytes into new Header struct
@@ -226,18 +190,13 @@ func SubTypeName(t MessageType, s MessageSubType) string {
 }

 func IsValidSubType(t MessageType, s MessageSubType) bool {
-	switch t {
-	case Message:
-		return s == MessageNone || s == MessageRelay
-	case Handshake:
-		return s == HandshakeIXPSK0
-	case Test:
-		return s == TestReply || s == TestRequest || s == LaneProbe || s == LaneProbeAck
-	case Control, CloseTunnel, RecvError, LightHouse:
-		return s == 0
-	default:
-		return false
+	if n, ok := subTypeMap[t]; ok {
+		if _, ok := (*n)[s]; ok {
+			return true
+		}
 	}
+
+	return false
 }

 // NewHeader turns bytes into a header
@@ -52,28 +52,6 @@ func TestParse(t *testing.T) {
 	}
 }

-func TestEncodeLane(t *testing.T) {
-	b := EncodeLane(make([]byte, Len), Version, Message, MessageNone, 10, 9, 3)
-	assert.Equal(t, []byte{0x11, 0x0, 0x0, 0x3}, b[:4])
-
-	h := &H{}
-	require.NoError(t, h.Parse(b))
-	assert.Equal(t, uint16(3), h.Reserved)
-	assert.Equal(t, uint8(3), h.Lane())
-
-	// Encode is EncodeLane on the base tunnel, and the H method round trips the lane.
-	assert.Equal(t,
-		EncodeLane(make([]byte, Len), Version, Message, MessageNone, 10, 9, 0),
-		Encode(make([]byte, Len), Version, Message, MessageNone, 10, 9))
-
-	rt, err := h.Encode(make([]byte, Len))
-	require.NoError(t, err)
-	assert.Equal(t, b, rt)
-
-	// Only the low 8 bits of Reserved are the lane.
-	assert.Equal(t, uint8(0x2a), (&H{Reserved: 0xff2a}).Lane())
-}
-
 func TestTypeName(t *testing.T) {
 	assert.Equal(t, "test", TypeName(Test))
 	assert.Equal(t, "test", (&H{Type: Test}).TypeName())
@@ -124,59 +102,6 @@ func TestTypeMap(t *testing.T) {
 	}, subTypeMap)
 }

-// mapIsValidSubType is the pre-refactor, map-driven definition of a valid
-// subtype. IsValidSubType was reimplemented as an explicit switch; this keeps
-// the original behavior around so we can prove the switch is equivalent to it.
-func mapIsValidSubType(t MessageType, s MessageSubType) bool {
-	if n, ok := subTypeMap[t]; ok {
-		if _, ok := (*n)[s]; ok {
-			return true
-		}
-	}
-	return false
-}
-
-func TestIsValidSubType(t *testing.T) {
-	// Explicit intent table: documents exactly which subtypes are valid so the
-	// test stays meaningful even if both the switch and subTypeMap change.
-	assert.True(t, IsValidSubType(Message, MessageNone))
-	assert.True(t, IsValidSubType(Message, MessageRelay))
-	assert.False(t, IsValidSubType(Message, 2))
-
-	assert.True(t, IsValidSubType(Handshake, HandshakeIXPSK0))
-	// HandshakeXXPSK0 is defined but not a wire-valid subtype.
-	assert.False(t, IsValidSubType(Handshake, HandshakeXXPSK0))
-
-	assert.True(t, IsValidSubType(Test, TestRequest))
-	assert.True(t, IsValidSubType(Test, TestReply))
-	assert.True(t, IsValidSubType(Test, LaneProbe))
-	assert.True(t, IsValidSubType(Test, LaneProbeAck))
-	assert.False(t, IsValidSubType(Test, 4))
-
-	// These types only ever carry subtype 0.
-	for _, mt := range []MessageType{Control, CloseTunnel, RecvError, LightHouse} {
-		assert.True(t, IsValidSubType(mt, 0), "type %d subtype 0 should be valid", mt)
-		assert.False(t, IsValidSubType(mt, 1), "type %d subtype 1 should be invalid", mt)
-	}
-
-	// Unknown/unassigned types are never valid.
-	assert.False(t, IsValidSubType(99, 0))
-
-	// Exhaustive proof of equivalence with the original map-driven logic across
-	// the entire (type, subtype) input space.
-	for ti := 0; ti <= 0xff; ti++ {
-		for si := 0; si <= 0xff; si++ {
-			mt, mst := MessageType(ti), MessageSubType(si)
-			assert.Equalf(t, mapIsValidSubType(mt, mst), IsValidSubType(mt, mst),
-				"IsValidSubType(%d, %d) diverged from map-driven definition", ti, si)
-		}
-	}
-
-	// H method must delegate to the package function.
-	assert.True(t, (&H{Type: Test, Subtype: TestReply}).IsValidSubType())
-	assert.False(t, (&H{Type: Handshake, Subtype: HandshakeXXPSK0}).IsValidSubType())
-}
-
 func TestHeader_String(t *testing.T) {
 	assert.Equal(
 		t,
@@ -56,20 +56,11 @@ type Relay struct {
 }

 type HostMap struct {
-	sync.RWMutex  //Because we concurrently read and write to our maps
-	Indexes       map[uint32]*HostInfo
-	Relays        map[uint32]*HostInfo // Maps a Relay IDX to a Relay HostInfo object
-	RemoteIndexes map[uint32]*HostInfo
-	// Hosts maps a vpn address to its primary hostinfo, one entry per address we hold a tunnel
-	// for. moreHosts only has an entry while an address is held by 2 or more hostinfos and stores
-	// the full most-recent-first list; moreHosts[a][0] is always the same hostinfo as Hosts[a].
-	// Each address gets its own independent list, so a hostinfo owning multiple addresses can
-	// never corrupt another address's ordering the way the old shared next/prev chain could.
-	// Entries in moreHosts are only ever written by unlockedSetHostsForAddr; Hosts is written
-	// directly only in the single-hostinfo fast paths where moreHosts is known to have no entry,
-	// and unlockedDeleteHostInfo swaps either map for a fresh one when it fully drains.
+	sync.RWMutex    //Because we concurrently read and write to our maps
+	Indexes         map[uint32]*HostInfo
+	Relays          map[uint32]*HostInfo // Maps a Relay IDX to a Relay HostInfo object
+	RemoteIndexes   map[uint32]*HostInfo
 	Hosts           map[netip.Addr]*HostInfo
-	moreHosts       map[netip.Addr][]*HostInfo
 	preferredRanges atomic.Pointer[[]netip.Prefix]
 	l               *slog.Logger
 }
@@ -147,9 +138,9 @@ func (rs *RelayState) InsertRelayTo(ip netip.Addr) {
 }

 func (rs *RelayState) CopyRelayIps() []netip.Addr {
+	ret := make([]netip.Addr, len(rs.relays))
 	rs.RLock()
 	defer rs.RUnlock()
-	ret := make([]netip.Addr, len(rs.relays))
 	copy(ret, rs.relays)
 	return ret
 }
@@ -238,16 +229,12 @@ const (
 )

 type HostInfo struct {
-	remote          atomic.Pointer[netip.AddrPort]
+	remote          netip.AddrPort
+	remotes         *RemoteList
+	promoteCounter  atomic.Uint32
 	ConnectionState *ConnectionState
-
-	// Traffic bits, pendingDeletion, and the rebind epoch we last sent under
-	state atomic.Uint32
-
-	promoteCounter atomic.Uint32
-	remoteIndexId  uint32
-	localIndexId   uint32
-	remotes        *RemoteList
+	remoteIndexId   uint32
+	localIndexId    uint32

 	// vpnAddrs is a list of vpn addresses assigned to this host that are within our own vpn networks
 	// The host may have other vpn addresses that are outside our
@@ -266,6 +253,11 @@ type HostInfo struct {
 	// This is used to limit lighthouse re-queries in chatty clients
 	nextLHQuery atomic.Int64

+	// lastRebindCount is the other side of Interface.rebindCount, if these values don't match then we need to ask LH
+	// for a punch from the remote end of this tunnel. The goal being to prime their conntrack for our traffic just like
+	// with a handshake
+	lastRebindCount int8
+
 	// lastHandshakeTime records the time the remote side told us about at the stage when the handshake was completed locally
 	// Stage 1 packet will contain it if I am a responder, stage 2 packet if I am an initiator
 	// This is used to avoid an attack where a handshake packet is replayed after some time
@@ -274,27 +266,25 @@ type HostInfo struct {
 	lastRoam       time.Time
 	lastRoamRemote netip.AddrPort

+	// Used to track other hostinfos for this vpn ip since only 1 can be primary
+	// Synchronised via hostmap lock and not the hostinfo lock.
+	next, prev *HostInfo
+
+	//TODO: in, out, and others might benefit from being an atomic.Int32. We could collapse connectionManager pendingDeletion, relayUsed, and in/out into this 1 thing
+	in, out, pendingDeletion atomic.Bool
+
 	// lastUsed tracks the last time ConnectionManager checked the tunnel and it was in use.
 	// This value will be behind against actual tunnel utilization in the hot path.
 	// This should only be used by the ConnectionManagers ticker routine.
 	lastUsed time.Time
-
-	// lanes holds this tunnel's multiport lane sessions. Allocated when the
-	// handshake completes if both sides advertised multiport, nil otherwise.
-	// Immutable once the hostinfo is published to the data plane.
-	lanes *laneSet
 }

 type ViaSender struct {
 	UdpAddr   netip.AddrPort
 	relayHI   *HostInfo // relayHI is the host info object of the relay
+	remoteIdx uint32    // remoteIdx is the index included in the header of the received packet
 	relay     *Relay    // relay contains the rest of the relay information, including the PeerIP of the host trying to communicate with us.
 	IsRelayed bool      // IsRelayed is true if the packet was sent through a relay
-
-	// SockIdx is the local socket (Interface.writers index) the packet
-	// arrived on. Replies that must originate from the same 4-tuple egress
-	// f.writers[SockIdx].
-	SockIdx int
 }

 func (v ViaSender) String() string {
@@ -344,7 +334,6 @@ func newHostMap(l *slog.Logger) *HostMap {
 		Relays:        map[uint32]*HostInfo{},
 		RemoteIndexes: map[uint32]*HostInfo{},
 		Hosts:         map[netip.Addr]*HostInfo{},
-		moreHosts:     map[netip.Addr][]*HostInfo{},
 		l:             l,
 	}
 }
@@ -393,55 +382,13 @@ func (hm *HostMap) EmitStats() {
 	metrics.GetOrRegisterGauge("hostmap.main.relayIndexes", nil).Update(int64(relaysLen))
 }

-// unlockedSetHostsForAddr stores the per-address hostinfo list (list[0] is the primary). An empty
-// list removes the address. This is the one place Hosts and moreHosts are written together, keep
-// it that way. Callers must hold the write lock.
-func (hm *HostMap) unlockedSetHostsForAddr(addr netip.Addr, list []*HostInfo) {
-	if len(list) == 0 {
-		delete(hm.Hosts, addr)
-		delete(hm.moreHosts, addr)
-		return
-	}
-	hm.Hosts[addr] = list[0]
-	if len(list) > 1 {
-		hm.moreHosts[addr] = list
-	} else {
-		delete(hm.moreHosts, addr)
-	}
-}
-
-// unlockedGetHostList returns every hostinfo holding addr, primary first, or nil if we have no
-// tunnel for addr. The common single-hostinfo case builds a fresh one element list, so keep this
-// off the packet hot path; the primary is a direct Hosts read. Callers must hold the lock (read
-// or write).
-func (hm *HostMap) unlockedGetHostList(addr netip.Addr) []*HostInfo {
-	if list, ok := hm.moreHosts[addr]; ok {
-		return list
-	}
-	if h, ok := hm.Hosts[addr]; ok {
-		return []*HostInfo{h}
-	}
-	return nil
-}
-
-// removeHostInfo returns list with hi removed (order preserved), or list unchanged if hi is
-// absent. It deletes in place: every mutator holds the hostmap write lock and no reader ever
-// retains a slice across a mutation (readers iterate under RLock), so there is no snapshot to
-// invalidate.
-func removeHostInfo(list []*HostInfo, hi *HostInfo) []*HostInfo {
-	idx := slices.Index(list, hi)
-	if idx < 0 {
-		return list
-	}
-	return slices.Delete(list, idx, idx+1)
-}
-
-// DeleteHostInfo will fully unlink the hostinfo and return true if no other hostinfo still holds
-// any of its vpn addrs, meaning we no longer have a tunnel to the peer
+// DeleteHostInfo will fully unlink the hostinfo and return true if it was the final hostinfo for this vpn ip
 func (hm *HostMap) DeleteHostInfo(hostinfo *HostInfo) bool {
 	// Delete the host itself, ensuring it's not modified anymore
 	hm.Lock()
-	final := hm.unlockedDeleteHostInfo(hostinfo)
+	// If we have a previous or next hostinfo then we are not the last one for this vpn ip
+	final := (hostinfo.next == nil && hostinfo.prev == nil)
+	hm.unlockedDeleteHostInfo(hostinfo)
 	hm.Unlock()

 	return final
@@ -453,69 +400,85 @@ func (hm *HostMap) MakePrimary(hostinfo *HostInfo) {
 	hm.unlockedMakePrimary(hostinfo)
 }

-// unlockedMakePrimary reports whether hostinfo is (now) the primary for each of its addresses,
-// false only when it is no longer in the hostmap at all.
-func (hm *HostMap) unlockedMakePrimary(hostinfo *HostInfo) bool {
-	// A hostinfo that is no longer in the hostmap must not be re-inserted here. Callers can race
-	// tunnel teardown, deciding to promote under the read lock and only taking the write lock
-	// after a delete fully unlinked the hostinfo (connection manager swapPrimary, AddRelay). Every
-	// live hostinfo is registered in Indexes by unlockedAddHostInfo, so this is a membership test.
-	if hm.Indexes[hostinfo.localIndexId] != hostinfo {
-		return false
+func (hm *HostMap) unlockedMakePrimary(hostinfo *HostInfo) {
+	// Get the current primary, if it exists
+	oldHostinfo := hm.Hosts[hostinfo.vpnAddrs[0]]
+
+	// Every address in the hostinfo gets elevated to primary
+	for _, vpnAddr := range hostinfo.vpnAddrs {
+		//NOTE: It is possible that we leave a dangling hostinfo here but connection manager works on
+		// indexes so it should be fine.
+		hm.Hosts[vpnAddr] = hostinfo
 	}

-	// Move hostinfo to the front (primary) of each of its address lists. The lists are
-	// independent per address, so this can never leave a dangling entry the way promoting
-	// against a single shared chain could.
-	for _, addr := range hostinfo.vpnAddrs {
-		if hm.Hosts[addr] == hostinfo {
-			// Already primary for this address, the list is already in the right order
-			continue
-		}
-		list := removeHostInfo(hm.unlockedGetHostList(addr), hostinfo)
-		list = append([]*HostInfo{hostinfo}, list...)
-		hm.unlockedSetHostsForAddr(addr, list)
+	// If we are already primary then we won't bother re-linking
+	if oldHostinfo == hostinfo {
+		return
 	}
-	return true
+
+	// Unlink this hostinfo
+	if hostinfo.prev != nil {
+		hostinfo.prev.next = hostinfo.next
+	}
+	if hostinfo.next != nil {
+		hostinfo.next.prev = hostinfo.prev
+	}
+
+	// If there wasn't a previous primary then clear out any links
+	if oldHostinfo == nil {
+		hostinfo.next = nil
+		hostinfo.prev = nil
+		return
+	}
+
+	// Relink the hostinfo as primary
+	hostinfo.next = oldHostinfo
+	oldHostinfo.prev = hostinfo
+	hostinfo.prev = nil
 }

-// unlockedDeleteHostInfo removes hostinfo from every one of its address lists and from the index
-// maps. It returns true if this was the last hostinfo for all of its addresses (we no longer have
-// any tunnel to the peer), which the caller uses to decide whether to clear learned lighthouse
-// state and disestablish relays.
-func (hm *HostMap) unlockedDeleteHostInfo(hostinfo *HostInfo) bool {
-	// Lane sessions hang off this hostinfo, so deleting it takes them with it
-	// and there is nothing extra to unwind here.
-
-	// Remove this hostinfo from each of its address lists. The lists are independent, so a
-	// sibling is never promoted to an address it does not own and no other list is touched.
-	final := true
+func (hm *HostMap) unlockedDeleteHostInfo(hostinfo *HostInfo) {
 	for _, addr := range hostinfo.vpnAddrs {
-		if list, ok := hm.moreHosts[addr]; ok {
-			list = removeHostInfo(list, hostinfo)
-			hm.unlockedSetHostsForAddr(addr, list)
-			if len(list) > 0 {
-				final = false
-			}
-		} else if existing, ok := hm.Hosts[addr]; ok {
-			if existing == hostinfo {
-				// Common case, the only hostinfo for this address. moreHosts has no entry to clean up.
-				delete(hm.Hosts, addr)
-			} else {
-				// We don't hold this address but another hostinfo does, we still have a tunnel to the peer
-				final = false
+		h := hm.Hosts[addr]
+		for h != nil {
+			if h == hostinfo {
+				hm.unlockedInnerDeleteHostInfo(h, addr)
 			}
+			h = h.next
+		}
+	}
+}
+
+func (hm *HostMap) unlockedInnerDeleteHostInfo(hostinfo *HostInfo, addr netip.Addr) {
+	primary, ok := hm.Hosts[addr]
+	isLastHostinfo := hostinfo.next == nil && hostinfo.prev == nil
+	if ok && primary == hostinfo {
+		// The vpn addr pointer points to the same hostinfo as the local index id, we can remove it
+		delete(hm.Hosts, addr)
+		if len(hm.Hosts) == 0 {
+			hm.Hosts = map[netip.Addr]*HostInfo{}
+		}
+
+		if hostinfo.next != nil {
+			// We had more than 1 hostinfo at this vpn addr, promote the next in the list to primary
+			hm.Hosts[addr] = hostinfo.next
+			// It is primary, there is no previous hostinfo now
+			hostinfo.next.prev = nil
+		}
+
+	} else {
+		// Relink if we were in the middle of multiple hostinfos for this vpn addr
+		if hostinfo.prev != nil {
+			hostinfo.prev.next = hostinfo.next
+		}
+
+		if hostinfo.next != nil {
+			hostinfo.next.prev = hostinfo.prev
 		}
 	}

-	// Go maps never shrink their buckets, replace fully drained maps so a node that churned
-	// through a large peer count gives the memory back. Same idiom as the index maps below.
-	if len(hm.Hosts) == 0 {
-		hm.Hosts = map[netip.Addr]*HostInfo{}
-	}
-	if len(hm.moreHosts) == 0 {
-		hm.moreHosts = map[netip.Addr][]*HostInfo{}
-	}
+	hostinfo.next = nil
+	hostinfo.prev = nil

 	// The remote index uses index ids outside our control so lets make sure we are only removing
 	// the remote index pointer here if it points to the hostinfo we are deleting
@@ -539,7 +502,7 @@ func (hm *HostMap) unlockedDeleteHostInfo(hostinfo *HostInfo) bool {
 		)
 	}

-	if final {
+	if isLastHostinfo {
 		// I have lost connectivity to my peers. My relay tunnel is likely broken. Mark the next
 		// hops as 'Requested' so that new relay tunnels are created in the future.
 		hm.unlockedDisestablishVpnAddrRelayFor(hostinfo)
@@ -548,19 +511,6 @@ func (hm *HostMap) unlockedDeleteHostInfo(hostinfo *HostInfo) bool {
 	for _, localRelayIdx := range hostinfo.relayState.CopyRelayForIdxs() {
 		delete(hm.Relays, localRelayIdx)
 	}
-
-	return final
-}
-
-func (hm *HostMap) QueryIndexCached(index uint32, cache map[uint32]*HostInfo) *HostInfo {
-	if out, ok := cache[index]; ok {
-		return out
-	}
-	out := hm.QueryIndex(index)
-	if out != nil {
-		cache[index] = out
-	}
-	return out
 }

 func (hm *HostMap) QueryIndex(index uint32) *HostInfo {
@@ -604,30 +554,19 @@ func (hm *HostMap) QueryVpnAddrsRelayFor(targetIps []netip.Addr, relayHostIp net
 	hm.RLock()
 	defer hm.RUnlock()

-	// This runs per relayed packet, so check the primary with a single map probe and only consult
-	// moreHosts when the primary can't relay for us.
 	h, ok := hm.Hosts[relayHostIp]
 	if !ok {
 		return nil, nil, errors.New("unable to find host")
 	}

-	for _, targetIp := range targetIps {
-		r, ok := h.relayState.QueryRelayForByIp(targetIp)
-		if ok && r.State == Established {
-			return h, r, nil
-		}
-	}
-
-	if list, ok := hm.moreHosts[relayHostIp]; ok {
-		// list[0] is the primary we already checked
-		for _, h := range list[1:] {
-			for _, targetIp := range targetIps {
-				r, ok := h.relayState.QueryRelayForByIp(targetIp)
-				if ok && r.State == Established {
-					return h, r, nil
-				}
+	for h != nil {
+		for _, targetIp := range targetIps {
+			r, ok := h.relayState.QueryRelayForByIp(targetIp)
+			if ok && r.State == Established {
+				return h, r, nil
 			}
 		}
+		h = h.next
 	}

 	return nil, nil, errors.New("unable to find host with relay")
@@ -635,14 +574,20 @@ func (hm *HostMap) QueryVpnAddrsRelayFor(targetIps []netip.Addr, relayHostIp net

 func (hm *HostMap) unlockedDisestablishVpnAddrRelayFor(hi *HostInfo) {
 	for _, relayHostIp := range hi.relayState.CopyRelayIps() {
-		for _, h := range hm.unlockedGetHostList(relayHostIp) {
-			h.relayState.UpdateRelayForByIpState(hi.vpnAddrs[0], Disestablished)
+		if h, ok := hm.Hosts[relayHostIp]; ok {
+			for h != nil {
+				h.relayState.UpdateRelayForByIpState(hi.vpnAddrs[0], Disestablished)
+				h = h.next
+			}
 		}
 	}
 	for _, rs := range hi.relayState.CopyAllRelayFor() {
 		if rs.Type == ForwardingType {
-			for _, h := range hm.unlockedGetHostList(rs.PeerAddr) {
-				h.relayState.UpdateRelayForByIpState(hi.vpnAddrs[0], Disestablished)
+			if h, ok := hm.Hosts[rs.PeerAddr]; ok {
+				for h != nil {
+					h.relayState.UpdateRelayForByIpState(hi.vpnAddrs[0], Disestablished)
+					h = h.next
+				}
 			}
 		}
 	}
@@ -678,11 +623,6 @@ func (hm *HostMap) unlockedAddHostInfo(hostinfo *HostInfo, f *Interface) {
 	hm.Indexes[hostinfo.localIndexId] = hostinfo
 	hm.RemoteIndexes[hostinfo.remoteIndexId] = hostinfo

-	hostinfo.markOut(f.rebindEpoch.Load())
-	if f.connectionManager != nil { // f.connectionManager is only nil in some unit tests
-		f.connectionManager.trafficTimer.Add(hostinfo.localIndexId, f.connectionManager.checkInterval)
-	}
-
 	if hm.l.Enabled(context.Background(), slog.LevelDebug) {
 		hm.l.Debug("Hostmap vpnIp added",
 			"hostMap", m{"vpnAddrs": hostinfo.vpnAddrs, "mapTotalSize": len(hm.Hosts),
@@ -692,27 +632,22 @@ func (hm *HostMap) unlockedAddHostInfo(hostinfo *HostInfo, f *Interface) {
 }

 func (hm *HostMap) unlockedInnerAddHostInfo(vpnAddr netip.Addr, hostinfo *HostInfo, f *Interface) {
-	existing, ok := hm.Hosts[vpnAddr]
-	if !ok {
-		// Common case, the first hostinfo for this address. moreHosts stays empty.
-		hm.Hosts[vpnAddr] = hostinfo
-		return
+	existing := hm.Hosts[vpnAddr]
+	hm.Hosts[vpnAddr] = hostinfo
+
+	if existing != nil && existing != hostinfo {
+		hostinfo.next = existing
+		existing.prev = hostinfo
 	}

-	// The new hostinfo becomes the primary for this address. Remove any stale copy of it first so
-	// we never hold a duplicate, then prepend.
-	list, ok := hm.moreHosts[vpnAddr]
-	if !ok {
-		list = []*HostInfo{existing}
-	}
-	list = removeHostInfo(list, hostinfo)
-	list = append([]*HostInfo{hostinfo}, list...)
-	hm.unlockedSetHostsForAddr(vpnAddr, list)
-
-	// Enforce the per-address cap by fully retiring the oldest hostinfo once we exceed it.
-	// Deleting it removes it from all of its addresses and the index maps, matching prior behavior.
-	if len(list) > MaxHostInfosPerVpnIp {
-		hm.unlockedDeleteHostInfo(list[len(list)-1])
+	i := 1
+	check := hostinfo
+	for check != nil {
+		if i > MaxHostInfosPerVpnIp {
+			hm.unlockedDeleteHostInfo(check)
+		}
+		check = check.next
+		i++
 	}
 }

@@ -744,7 +679,7 @@ func (hm *HostMap) ForEachIndex(f controlEach) {
 func (i *HostInfo) TryPromoteBest(preferredRanges []netip.Prefix, ifce *Interface) {
 	c := i.promoteCounter.Add(1)
 	if c%ifce.tryPromoteEvery.Load() == 0 {
-		remote := i.GetRemote()
+		remote := i.remote

 		// return early if we are already on a preferred remote
 		if remote.IsValid() {
@@ -779,64 +714,6 @@ func (i *HostInfo) TryPromoteBest(preferredRanges []netip.Prefix, ifce *Interfac
 	}
 }

-// Bits within HostInfo.state, everything above stateEpochShift is the epoch
-const (
-	stateIn uint32 = 1 << iota
-	stateOut
-	statePendingDeletion
-
-	stateFlags = stateIn | stateOut | statePendingDeletion
-	// The epoch is the top 29 bits, it would take 2^29 rebinds to wrap and we will never get there
-	stateEpochShift = 3
-)
-
-// markIn records inbound traffic
-func (i *HostInfo) markIn() {
-	if i.state.Load()&stateIn == 0 {
-		i.state.Or(stateIn)
-	}
-}
-
-// markOut records a send and reports whether the epoch moved, meaning we want a punch from the far side
-func (i *HostInfo) markOut(epoch uint32) bool {
-	e := epoch << stateEpochShift
-	for {
-		old := i.state.Load()
-		if old&stateOut != 0 && old&^stateFlags == e {
-			return false
-		}
-
-		if i.state.CompareAndSwap(old, old&stateFlags|stateOut|e) {
-			return old&^stateFlags != e
-		}
-	}
-}
-
-// markOutOnly records a send without consuming the rebind epoch, for paths that cannot act on a requery
-func (i *HostInfo) markOutOnly() {
-	if i.state.Load()&stateOut == 0 {
-		i.state.Or(stateOut)
-	}
-}
-
-// takeTraffic clears both traffic bits, leaving the epoch alone, and reports what they were
-func (i *HostInfo) takeTraffic() (in bool, out bool) {
-	old := i.state.And(^(stateIn | stateOut))
-	return old&stateIn != 0, old&stateOut != 0
-}
-
-func (i *HostInfo) setPendingDeletion(v bool) {
-	if v {
-		i.state.Or(statePendingDeletion)
-	} else {
-		i.state.And(^statePendingDeletion)
-	}
-}
-
-func (i *HostInfo) isPendingDeletion() bool {
-	return i.state.Load()&statePendingDeletion != 0
-}
-
 func (i *HostInfo) GetCert() *cert.CachedCertificate {
 	if i.ConnectionState != nil {
 		return i.ConnectionState.peerCert
@@ -844,18 +721,11 @@ func (i *HostInfo) GetCert() *cert.CachedCertificate {
 	return nil
 }

-func (i *HostInfo) GetRemote() netip.AddrPort {
-	if p := i.remote.Load(); p != nil {
-		return *p
-	}
-	return netip.AddrPort{}
-}
-
 // TODO: Maybe use ViaSender here?
 func (i *HostInfo) SetRemote(remote netip.AddrPort) {
 	// We copy here because we likely got this remote from a source that reuses the object
-	if i.GetRemote() != remote {
-		i.remote.Store(&remote)
+	if i.remote != remote {
+		i.remote = remote
 		i.remotes.LearnRemote(i.vpnAddrs[0], remote)
 	}
 }
@@ -867,7 +737,7 @@ func (i *HostInfo) SetRemoteIfPreferred(hm *HostMap, via ViaSender) bool {
 		return false
 	}

-	currentRemote := i.GetRemote()
+	currentRemote := i.remote
 	if !currentRemote.IsValid() {
 		i.SetRemote(via.UdpAddr)
 		return true
@@ -2,7 +2,6 @@ package nebula

 import (
 	"net/netip"
-	"slices"
 	"testing"

 	"github.com/slackhq/nebula/config"
@@ -11,84 +10,78 @@ import (
 	"github.com/stretchr/testify/require"
 )

-// chainIds returns the localIndexIds of the hostinfos holding addr, primary (index 0) first. It
-// also validates the Hosts/moreHosts sync contract on every call so a mutation that broke it
-// fails fast.
-func chainIds(t *testing.T, hm *HostMap, addr netip.Addr) []uint32 {
-	t.Helper()
-	assertHostMapInvariants(t, hm)
-	list := hm.unlockedGetHostList(addr)
-	ids := make([]uint32, len(list))
-	for i, h := range list {
-		ids[i] = h.localIndexId
-	}
-	return ids
-}
-
-// assertHostMapInvariants checks the Hosts/moreHosts contract: moreHosts only holds addresses
-// with 2 or more hostinfos, its first entry is always the primary in Hosts, lists never hold
-// duplicates, every hostinfo in a list owns the address and is registered in Indexes, and every
-// indexed hostinfo is reachable through each of its addresses.
-func assertHostMapInvariants(t *testing.T, hm *HostMap) {
-	t.Helper()
-	for addr, list := range hm.moreHosts {
-		require.GreaterOrEqualf(t, len(list), 2, "moreHosts[%s] must hold at least 2 hostinfos", addr)
-		require.Samef(t, hm.Hosts[addr], list[0], "moreHosts[%s][0] must match the primary in Hosts", addr)
-		seen := map[*HostInfo]bool{}
-		for _, h := range list {
-			require.NotNilf(t, h, "moreHosts[%s] must never hold a nil hostinfo", addr)
-			require.Falsef(t, seen[h], "moreHosts[%s] holds hostinfo %d twice", addr, h.localIndexId)
-			seen[h] = true
-			require.Samef(t, hm.Indexes[h.localIndexId], h, "moreHosts[%s] member %d is not registered in Indexes", addr, h.localIndexId)
-			require.Truef(t, slices.Contains(h.vpnAddrs, addr), "moreHosts[%s] member %d does not own the address", addr, h.localIndexId)
-		}
-	}
-	for addr, h := range hm.Hosts {
-		require.NotNilf(t, h, "Hosts[%s] must never be nil", addr)
-		require.Samef(t, hm.Indexes[h.localIndexId], h, "Hosts[%s] primary %d is not registered in Indexes", addr, h.localIndexId)
-		require.Truef(t, slices.Contains(h.vpnAddrs, addr), "Hosts[%s] primary (index %d) does not own the address", addr, h.localIndexId)
-	}
-	for idx, h := range hm.Indexes {
-		require.Equalf(t, idx, h.localIndexId, "Indexes[%d] holds hostinfo with localIndexId %d", idx, h.localIndexId)
-		for _, va := range h.vpnAddrs {
-			require.Truef(t, slices.Contains(hm.unlockedGetHostList(va), h), "indexed hostinfo %d is missing from the list for %s", idx, va)
-		}
-	}
-}
-
 func TestHostMap_MakePrimary(t *testing.T) {
 	l := test.NewLogger()
 	hm := newHostMap(l)

 	f := &Interface{}
-	a := netip.MustParseAddr("0.0.0.1")

-	h1 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 1}
-	h2 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 2}
-	h3 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 3}
-	h4 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 4}
+	h1 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 1}
+	h2 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 2}
+	h3 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 3}
+	h4 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 4}

 	hm.unlockedAddHostInfo(h4, f)
 	hm.unlockedAddHostInfo(h3, f)
 	hm.unlockedAddHostInfo(h2, f)
 	hm.unlockedAddHostInfo(h1, f)

-	// Most-recently-added is primary: h1, h2, h3, h4
-	assert.Equal(t, []uint32{1, 2, 3, 4}, chainIds(t, hm, a))
-	assert.Equal(t, h1, hm.QueryVpnAddr(a))
+	// Make sure we go h1 -> h2 -> h3 -> h4
+	prim := hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h1.localIndexId, prim.localIndexId)
+	assert.Equal(t, h2.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h1.localIndexId, h2.prev.localIndexId)
+	assert.Equal(t, h3.localIndexId, h2.next.localIndexId)
+	assert.Equal(t, h2.localIndexId, h3.prev.localIndexId)
+	assert.Equal(t, h4.localIndexId, h3.next.localIndexId)
+	assert.Equal(t, h3.localIndexId, h4.prev.localIndexId)
+	assert.Nil(t, h4.next)

-	// Swap the middle to primary: h3, h1, h2, h4
+	// Swap h3/middle to primary
 	hm.MakePrimary(h3)
-	assert.Equal(t, []uint32{3, 1, 2, 4}, chainIds(t, hm, a))
-	assert.Equal(t, h3, hm.QueryVpnAddr(a))

-	// Swap the tail to primary: h4, h3, h1, h2
-	hm.MakePrimary(h4)
-	assert.Equal(t, []uint32{4, 3, 1, 2}, chainIds(t, hm, a))
+	// Make sure we go h3 -> h1 -> h2 -> h4
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h3.localIndexId, prim.localIndexId)
+	assert.Equal(t, h1.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h2.localIndexId, h1.next.localIndexId)
+	assert.Equal(t, h3.localIndexId, h1.prev.localIndexId)
+	assert.Equal(t, h4.localIndexId, h2.next.localIndexId)
+	assert.Equal(t, h1.localIndexId, h2.prev.localIndexId)
+	assert.Equal(t, h2.localIndexId, h4.prev.localIndexId)
+	assert.Nil(t, h4.next)

-	// Swapping the current primary again is a no-op
+	// Swap h4/tail to primary
 	hm.MakePrimary(h4)
-	assert.Equal(t, []uint32{4, 3, 1, 2}, chainIds(t, hm, a))
+
+	// Make sure we go h4 -> h3 -> h1 -> h2
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h4.localIndexId, prim.localIndexId)
+	assert.Equal(t, h3.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h1.localIndexId, h3.next.localIndexId)
+	assert.Equal(t, h4.localIndexId, h3.prev.localIndexId)
+	assert.Equal(t, h2.localIndexId, h1.next.localIndexId)
+	assert.Equal(t, h3.localIndexId, h1.prev.localIndexId)
+	assert.Equal(t, h1.localIndexId, h2.prev.localIndexId)
+	assert.Nil(t, h2.next)
+
+	// Swap h4 again should be no-op
+	hm.MakePrimary(h4)
+
+	// Make sure we go h4 -> h3 -> h1 -> h2
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h4.localIndexId, prim.localIndexId)
+	assert.Equal(t, h3.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h1.localIndexId, h3.next.localIndexId)
+	assert.Equal(t, h4.localIndexId, h3.prev.localIndexId)
+	assert.Equal(t, h2.localIndexId, h1.next.localIndexId)
+	assert.Equal(t, h3.localIndexId, h1.prev.localIndexId)
+	assert.Equal(t, h1.localIndexId, h2.prev.localIndexId)
+	assert.Nil(t, h2.next)
 }

 func TestHostMap_DeleteHostInfo(t *testing.T) {
@@ -96,14 +89,13 @@ func TestHostMap_DeleteHostInfo(t *testing.T) {
 	hm := newHostMap(l)

 	f := &Interface{}
-	a := netip.MustParseAddr("0.0.0.1")

-	h1 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 1}
-	h2 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 2}
-	h3 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 3}
-	h4 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 4}
-	h5 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 5}
-	h6 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 6}
+	h1 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 1}
+	h2 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 2}
+	h3 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 3}
+	h4 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 4}
+	h5 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 5}
+	h6 := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("0.0.0.1")}, localIndexId: 6}

 	hm.unlockedAddHostInfo(h6, f)
 	hm.unlockedAddHostInfo(h5, f)
@@ -112,243 +104,94 @@ func TestHostMap_DeleteHostInfo(t *testing.T) {
 	hm.unlockedAddHostInfo(h2, f)
 	hm.unlockedAddHostInfo(h1, f)

-	// h6 is evicted by the MaxHostInfosPerVpnIp cap; the rest are newest-first.
-	assert.Nil(t, hm.QueryIndex(h6.localIndexId))
-	assert.Equal(t, []uint32{1, 2, 3, 4, 5}, chainIds(t, hm, a))
+	// h6 should be deleted
+	assert.Nil(t, h6.next)
+	assert.Nil(t, h6.prev)
+	h := hm.QueryIndex(h6.localIndexId)
+	assert.Nil(t, h)

-	// Delete primary; not final since siblings remain.
-	assert.False(t, hm.DeleteHostInfo(h1))
-	assert.Equal(t, []uint32{2, 3, 4, 5}, chainIds(t, hm, a))
+	// Make sure we go h1 -> h2 -> h3 -> h4 -> h5
+	prim := hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h1.localIndexId, prim.localIndexId)
+	assert.Equal(t, h2.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h1.localIndexId, h2.prev.localIndexId)
+	assert.Equal(t, h3.localIndexId, h2.next.localIndexId)
+	assert.Equal(t, h2.localIndexId, h3.prev.localIndexId)
+	assert.Equal(t, h4.localIndexId, h3.next.localIndexId)
+	assert.Equal(t, h3.localIndexId, h4.prev.localIndexId)
+	assert.Equal(t, h5.localIndexId, h4.next.localIndexId)
+	assert.Equal(t, h4.localIndexId, h5.prev.localIndexId)
+	assert.Nil(t, h5.next)

-	// Deleting the same hostinfo again must not report final while siblings remain and must not
-	// disturb the list. The old chain code got this wrong: the first delete nil'd next/prev, so a
-	// second delete looked final and wiped lighthouse state out from under the live sibling.
-	assert.False(t, hm.DeleteHostInfo(h1))
-	assert.Equal(t, []uint32{2, 3, 4, 5}, chainIds(t, hm, a))
+	// Delete primary
+	hm.DeleteHostInfo(h1)
+	assert.Nil(t, h1.prev)
+	assert.Nil(t, h1.next)

-	// Delete a middle node.
-	assert.False(t, hm.DeleteHostInfo(h3))
-	assert.Equal(t, []uint32{2, 4, 5}, chainIds(t, hm, a))
+	// Make sure we go h2 -> h3 -> h4 -> h5
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h2.localIndexId, prim.localIndexId)
+	assert.Equal(t, h3.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h3.localIndexId, h2.next.localIndexId)
+	assert.Equal(t, h2.localIndexId, h3.prev.localIndexId)
+	assert.Equal(t, h4.localIndexId, h3.next.localIndexId)
+	assert.Equal(t, h3.localIndexId, h4.prev.localIndexId)
+	assert.Equal(t, h5.localIndexId, h4.next.localIndexId)
+	assert.Equal(t, h4.localIndexId, h5.prev.localIndexId)
+	assert.Nil(t, h5.next)

-	// Delete the tail.
-	assert.False(t, hm.DeleteHostInfo(h5))
-	assert.Equal(t, []uint32{2, 4}, chainIds(t, hm, a))
+	// Delete in the middle
+	hm.DeleteHostInfo(h3)
+	assert.Nil(t, h3.prev)
+	assert.Nil(t, h3.next)

-	// Delete the head; h4 remains and becomes primary.
-	assert.False(t, hm.DeleteHostInfo(h2))
-	assert.Equal(t, []uint32{4}, chainIds(t, hm, a))
-	assert.Equal(t, h4, hm.QueryVpnAddr(a))
+	// Make sure we go h2 -> h4 -> h5
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h2.localIndexId, prim.localIndexId)
+	assert.Equal(t, h4.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h4.localIndexId, h2.next.localIndexId)
+	assert.Equal(t, h2.localIndexId, h4.prev.localIndexId)
+	assert.Equal(t, h5.localIndexId, h4.next.localIndexId)
+	assert.Equal(t, h4.localIndexId, h5.prev.localIndexId)
+	assert.Nil(t, h5.next)

-	// Delete the only remaining item; final is true and the address is gone.
-	assert.True(t, hm.DeleteHostInfo(h4))
-	assert.Empty(t, chainIds(t, hm, a))
-	assert.Nil(t, hm.QueryVpnAddr(a))
+	// Delete the tail
+	hm.DeleteHostInfo(h5)
+	assert.Nil(t, h5.prev)
+	assert.Nil(t, h5.next)

-	// Deleting an already-gone hostinfo is still final; nothing holds the address anymore.
-	assert.True(t, hm.DeleteHostInfo(h4))
-	assert.Empty(t, chainIds(t, hm, a))
-}
+	// Make sure we go h2 -> h4
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h2.localIndexId, prim.localIndexId)
+	assert.Equal(t, h4.localIndexId, prim.next.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Equal(t, h4.localIndexId, h2.next.localIndexId)
+	assert.Equal(t, h2.localIndexId, h4.prev.localIndexId)
+	assert.Nil(t, h4.next)

-// TestHostMap_MakePrimary_DeletedHostInfo covers promoting a hostinfo that lost a race with
-// tunnel teardown: swapPrimary and AddRelay decide to promote while holding a stale pointer and
-// only take the write lock after a delete fully unlinked the hostinfo. MakePrimary must be a
-// no-op, not a resurrection that installs an unmanaged primary.
-func TestHostMap_MakePrimary_DeletedHostInfo(t *testing.T) {
-	l := test.NewLogger()
-	hm := newHostMap(l)
-	f := &Interface{}
-	a := netip.MustParseAddr("0.0.0.1")
+	// Delete the head
+	hm.DeleteHostInfo(h2)
+	assert.Nil(t, h2.prev)
+	assert.Nil(t, h2.next)

-	h1 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 1}
-	h2 := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 2}
-	hm.unlockedAddHostInfo(h1, f)
-	hm.unlockedAddHostInfo(h2, f)
+	// Make sure we only have h4
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Equal(t, h4.localIndexId, prim.localIndexId)
+	assert.Nil(t, prim.prev)
+	assert.Nil(t, prim.next)
+	assert.Nil(t, h4.next)

-	// h1 is fully deleted while another goroutine still holds a pointer to it.
-	assert.False(t, hm.DeleteHostInfo(h1))
-	assert.Equal(t, []uint32{2}, chainIds(t, hm, a))
+	// Delete the only item
+	hm.DeleteHostInfo(h4)
+	assert.Nil(t, h4.prev)
+	assert.Nil(t, h4.next)

-	// The stale promote must not bring it back.
-	hm.MakePrimary(h1)
-	assert.Equal(t, []uint32{2}, chainIds(t, hm, a))
-	assert.Equal(t, h2, hm.QueryVpnAddr(a))
-	assert.Nil(t, hm.QueryIndex(h1.localIndexId))
-}
-
-// TestHostMap_QueryVpnAddrsRelayFor_NonPrimary makes sure a relay established on an older
-// hostinfo is still found after a newer tunnel without relay state takes primary for the same
-// address. The lookup checks the primary first and falls back to the rest of the list.
-func TestHostMap_QueryVpnAddrsRelayFor_NonPrimary(t *testing.T) {
-	l := test.NewLogger()
-	hm := newHostMap(l)
-	f := &Interface{}
-	relayAddr := netip.MustParseAddr("0.0.0.9")
-	target := netip.MustParseAddr("0.0.0.1")
-
-	older := &HostInfo{
-		vpnAddrs:     []netip.Addr{relayAddr},
-		localIndexId: 1,
-		relayState: RelayState{
-			relayForByAddr: map[netip.Addr]*Relay{},
-			relayForByIdx:  map[uint32]*Relay{},
-		},
-	}
-	older.relayState.InsertRelay(target, 100, &Relay{Type: ForwardingType, State: Established, LocalIndex: 100, PeerAddr: target})
-	hm.unlockedAddHostInfo(older, f)
-
-	// The relay is found on the primary.
-	h, r, err := hm.QueryVpnAddrsRelayFor([]netip.Addr{target}, relayAddr)
-	require.NoError(t, err)
-	assert.Equal(t, older, h)
-	assert.Equal(t, uint32(100), r.LocalIndex)
-
-	// A re-handshake with no relay state takes primary; the established relay on the older
-	// hostinfo must still be found through the fallback.
-	newer := &HostInfo{vpnAddrs: []netip.Addr{relayAddr}, localIndexId: 2}
-	hm.unlockedAddHostInfo(newer, f)
-	assert.Equal(t, []uint32{2, 1}, chainIds(t, hm, relayAddr))
-
-	h, r, err = hm.QueryVpnAddrsRelayFor([]netip.Addr{target}, relayAddr)
-	require.NoError(t, err)
-	assert.Equal(t, older, h)
-	assert.Equal(t, uint32(100), r.LocalIndex)
-
-	// No hostinfo at all is a plain miss.
-	_, _, err = hm.QueryVpnAddrsRelayFor([]netip.Addr{target}, netip.MustParseAddr("0.0.0.42"))
-	require.Error(t, err)
-}
-
-// TestHostMap_DeleteHostInfo_MultipleVpnAddrs exercises the case where a hostinfo carries more than one
-// vpnAddr and shares its next/prev chain with a live sibling. Deleting the head must not corrupt the
-// sibling: every address the sibling owns has to keep pointing at it. The pre-fix code unlinked the shared
-// chain once per vpnAddr, so on the first address it nil'd next/prev, and on the second address the node
-// looked already-detached: it dropped the map entry instead of promoting the sibling (and tripped the
-// isLastHostinfo relay teardown). See unlockedDeleteHostInfo.
-func TestHostMap_DeleteHostInfo_MultipleVpnAddrs(t *testing.T) {
-	l := test.NewLogger()
-	hm := newHostMap(l)
-
-	f := &Interface{}
-
-	a := netip.MustParseAddr("0.0.0.1")
-	b := netip.MustParseAddr("0.0.0.2")
-
-	// Two tunnels for the same peer, each reachable at both a and b.
-	other := &HostInfo{vpnAddrs: []netip.Addr{a, b}, localIndexId: 1}
-	head := &HostInfo{vpnAddrs: []netip.Addr{a, b}, localIndexId: 2}
-
-	hm.unlockedAddHostInfo(other, f)
-	hm.unlockedAddHostInfo(head, f)
-
-	// head is primary for both addresses, other is next in each address's list.
-	assert.Equal(t, head, hm.QueryVpnAddr(a))
-	assert.Equal(t, head, hm.QueryVpnAddr(b))
-	assert.Equal(t, []uint32{2, 1}, chainIds(t, hm, a))
-	assert.Equal(t, []uint32{2, 1}, chainIds(t, hm, b))
-
-	// Delete the head. other is still live, so it must become primary for BOTH addresses.
-	assert.False(t, hm.DeleteHostInfo(head))
-	assert.Equal(t, other, hm.QueryVpnAddr(a))
-	assert.Equal(t, other, hm.QueryVpnAddr(b))
-	assert.Equal(t, []uint32{1}, chainIds(t, hm, a))
-	assert.Equal(t, []uint32{1}, chainIds(t, hm, b))
-
-	// head is fully removed from the index map.
-	assert.Nil(t, hm.QueryIndex(head.localIndexId))
-}
-
-// TestHostMap_DeleteHostInfo_DivergentVpnAddrs covers chained hostinfos for the same peer whose
-// vpnAddrs sets differ (a re-handshake cert added a second address). Deleting the superset node
-// must not promote a sibling to an address it does not own.
-func TestHostMap_DeleteHostInfo_DivergentVpnAddrs(t *testing.T) {
-	l := test.NewLogger()
-	hm := newHostMap(l)
-	f := &Interface{}
-	a := netip.MustParseAddr("0.0.0.1")
-	b := netip.MustParseAddr("0.0.0.2")
-
-	// sub owns only a; super (a newer handshake) owns a and b.
-	sub := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 1}
-	super := &HostInfo{vpnAddrs: []netip.Addr{a, b}, localIndexId: 2}
-	hm.unlockedAddHostInfo(sub, f)
-	hm.unlockedAddHostInfo(super, f)
-
-	assert.Equal(t, []uint32{2, 1}, chainIds(t, hm, a))
-	assert.Equal(t, []uint32{2}, chainIds(t, hm, b))
-
-	// Delete super: a promotes to sub (which owns it); b has no remaining owner and must be
-	// removed, not dangled at sub (which does not own b).
-	assert.False(t, hm.DeleteHostInfo(super))
-	assert.Equal(t, []uint32{1}, chainIds(t, hm, a))
-	assert.Empty(t, chainIds(t, hm, b))
-	assert.Equal(t, sub, hm.QueryVpnAddr(a))
-	assert.Nil(t, hm.QueryVpnAddr(b))
-	assert.Nil(t, hm.QueryIndex(super.localIndexId))
-
-	// Deleting sub cleans up fully.
-	assert.True(t, hm.DeleteHostInfo(sub))
-	assert.Nil(t, hm.QueryVpnAddr(a))
-	assertHostMapInvariants(t, hm)
-}
-
-// TestHostMap_AddDivergentOverlap covers a new hostinfo claiming addresses currently owned by two
-// DIFFERENT hostinfos. The old single shared next/prev chain overwrote a pointer and orphaned one
-// of them (in Indexes but unreachable via its address); independent per-address lists cannot.
-func TestHostMap_AddDivergentOverlap(t *testing.T) {
-	l := test.NewLogger()
-	hm := newHostMap(l)
-	f := &Interface{}
-	a := netip.MustParseAddr("0.0.0.1")
-	b := netip.MustParseAddr("0.0.0.2")
-
-	hiA := &HostInfo{vpnAddrs: []netip.Addr{a}, localIndexId: 1}
-	hiP := &HostInfo{vpnAddrs: []netip.Addr{b}, localIndexId: 2}
-	hm.unlockedAddHostInfo(hiA, f)
-	hm.unlockedAddHostInfo(hiP, f)
-
-	hiB := &HostInfo{vpnAddrs: []netip.Addr{a, b}, localIndexId: 3}
-	hm.unlockedAddHostInfo(hiB, f)
-
-	assert.Equal(t, []uint32{3, 1}, chainIds(t, hm, a))
-	assert.Equal(t, []uint32{3, 2}, chainIds(t, hm, b))
-	// hiA is still reachable via its address (not orphaned) and still indexed.
-	assert.Contains(t, chainIds(t, hm, a), hiA.localIndexId)
-	assert.NotNil(t, hm.QueryIndex(hiA.localIndexId))
-}
-
-// TestHostMap_MaxHostInfosPerVpnIp_MultipleVpnAddrs verifies the MaxHostInfosPerVpnIp overflow prune
-// (unlockedInnerAddHostInfo calls unlockedDeleteHostInfo on the oldest node once the chain is too long)
-// still behaves when hostinfos carry more than one vpnAddr. The pruned node is always the tail, so it is
-// primary for none of the addresses, and both address chains must stay consistent afterwards.
-func TestHostMap_MaxHostInfosPerVpnIp_MultipleVpnAddrs(t *testing.T) {
-	l := test.NewLogger()
-	hm := newHostMap(l)
-
-	f := &Interface{}
-
-	a := netip.MustParseAddr("0.0.0.1")
-	b := netip.MustParseAddr("0.0.0.2")
-
-	// Add one more than the cap, newest last so it becomes head. Every hostinfo owns both a and b.
-	hostinfos := make([]*HostInfo, 0, MaxHostInfosPerVpnIp+1)
-	for i := 0; i <= MaxHostInfosPerVpnIp; i++ {
-		hostinfos = append(hostinfos, &HostInfo{vpnAddrs: []netip.Addr{a, b}, localIndexId: uint32(i + 1)})
-	}
-	// Add oldest first (highest index in our slice) so the very first one added is the overflow victim.
-	for i := len(hostinfos) - 1; i >= 0; i-- {
-		hm.unlockedAddHostInfo(hostinfos[i], f)
-	}
-
-	oldest := hostinfos[len(hostinfos)-1]
-
-	// The oldest hostinfo was pruned from both lists and the index map.
-	assert.Nil(t, hm.QueryIndex(oldest.localIndexId))
-
-	// Both addresses hold exactly MaxHostInfosPerVpnIp survivors in the same order; oldest is absent.
-	require.Len(t, chainIds(t, hm, a), MaxHostInfosPerVpnIp)
-	assert.Equal(t, chainIds(t, hm, a), chainIds(t, hm, b), "both addresses must list the same survivors in the same order")
-	assert.NotContains(t, chainIds(t, hm, a), oldest.localIndexId)
-	assert.Equal(t, hm.QueryVpnAddr(a), hm.QueryVpnAddr(b))
+	// Make sure we have nil
+	prim = hm.QueryVpnAddr(netip.MustParseAddr("0.0.0.1"))
+	assert.Nil(t, prim)
 }

 func TestHostMap_reload(t *testing.T) {
@@ -401,49 +244,3 @@ func TestHostMap_RelayState(t *testing.T) {
 	assert.Equal(t, []netip.Addr{}, h1.relayState.relays)

 }
-
-// sentSinceCheck reports whether anything has been sent since the connection manager last looked. Test only:
-// production reads the out bit through takeTraffic on the connection manager tick.
-func (i *HostInfo) sentSinceCheck() bool {
-	return i.state.Load()&stateOut != 0
-}
-
-func TestHostInfo_markOut(t *testing.T) {
-	h := &HostInfo{}
-	h.markOut(5) // stamped when the tunnel was added
-
-	// A tunnel already on the current epoch has nothing to report, which is what keeps a fresh tunnel from
-	// requerying on its first packet
-	assert.False(t, h.markOut(5), "an unchanged epoch should not report a move")
-	assert.True(t, h.sentSinceCheck(), "the send is still recorded as traffic")
-
-	// A rebind is observed exactly once, so we requery once per rebind
-	assert.True(t, h.markOut(6), "a bumped epoch should report a move")
-	assert.False(t, h.markOut(6), "the epoch move should only be reported once")
-
-	// Traffic and pendingDeletion live in the same word and must survive an epoch change
-	h.setPendingDeletion(true)
-	h.markIn()
-	assert.True(t, h.markOut(7))
-	assert.True(t, h.isPendingDeletion(), "pendingDeletion must survive an epoch change")
-	in, out := h.takeTraffic()
-	assert.True(t, in, "inbound traffic must survive an epoch change")
-	assert.True(t, out)
-
-	// Clearing the traffic bits leaves the epoch alone, otherwise an idle tunnel would requery forever
-	assert.False(t, h.markOut(7), "takeTraffic must not disturb the epoch")
-}
-
-// A relayed send records traffic but must leave the rebind epoch for the direct path to consume, otherwise
-// relaying to a host swallows the requery that gets the far side punching at our new address.
-func TestHostInfo_markOutOnly(t *testing.T) {
-	h := &HostInfo{}
-	h.markOut(5)
-
-	h.markOutOnly()
-	assert.True(t, h.sentSinceCheck(), "a relayed send is still outbound traffic")
-	assert.False(t, h.markOut(5), "a relayed send must not disturb the epoch")
-
-	assert.True(t, h.markOut(6), "a relayed send must not consume the epoch edge")
-	assert.False(t, h.markOut(6))
-}
@@ -2,7 +2,6 @@ package nebula

 import (
 	"context"
-	"fmt"
 	"io"
 	"log/slog"
 	"net/netip"
@@ -11,18 +10,12 @@ import (
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/iputil"
 	"github.com/slackhq/nebula/noiseutil"
-	"github.com/slackhq/nebula/overlay/tio"
+	"github.com/slackhq/nebula/overlay/batch"
 	"github.com/slackhq/nebula/routing"
+	"github.com/slackhq/nebula/wire"
 )

-func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.ParsedPacket, nb []byte, tx *txQueue, rejectBuf []byte, q int, localCache firewall.ConntrackCache) {
-	// borrowed: pkt.Bytes is owned by the originating tio.Queue and is
-	// only valid until the next Read on that queue. Every consumer below
-	// (parse, self-forward, handshake cache, sendInsideMessage) reads it
-	// synchronously; do not retain pkt outside this call. If a future
-	// caller needs to keep the packet, use pkt.Clone() to detach it from
-	// the borrow.
-	//
+func (f *Interface) consumeInsidePacket(pkt wire.TunPacket, fwPacket *firewall.Packet, nb []byte, sendBatch *batch.SendBatch, rejectBuf []byte, q int, localCache firewall.ConntrackCache) {
 	// pkt.Bytes is either one IP datagram (GSO zero) or a TSO/USO
 	// superpacket. In both cases the L3+L4 headers at the start describe
 	// the same 5-tuple every segment will share, so a single newPacket /
@@ -52,15 +45,8 @@ func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.Parse
 		// routes packets from the Nebula addr to the Nebula addr through the Nebula
 		// TUN device.
 		if immediatelyForwardToSelf {
-			// Write copies into the kernel queue synchronously, so seg's lifetime ends at return.
-			// A self-forwarded superpacket would be re-handed to the
-			// kernel as one giant blob; segment first so the loopback
-			// path sees one IP datagram per Write.
-			err := tio.SegmentSuperpacket(pkt, func(seg []byte) error {
-				// The kernel may have left the transport checksum for hardware
-				// offload to finish; nothing between here and the tun will.
-				iputil.SetTransportChecksum(seg)
-				_, werr := f.queues[q].Write(seg)
+			err := pkt.PerSegment(func(seg []byte) error {
+				_, werr := f.readers[q].Write(seg)
 				return werr
 			})
 			if err != nil {
@@ -77,11 +63,11 @@ func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.Parse
 		return
 	}

-	hostinfo, ready := f.getOrHandshakeConsiderRouting(&fwPacket.Packet, func(hh *HandshakeHostInfo) {
-		// borrowed: SegmentSuperpacket builds each segment in the kernel-supplied pkt
+	hostinfo, ready := f.getOrHandshakeConsiderRouting(fwPacket, func(hh *HandshakeHostInfo) {
+		// borrowed: PerSegment builds each segment in the kernel-supplied pkt
 		// bytes underneath. cachePacket explicitly copies its argument (handshake_manager.go cachePacket),
 		// so retaining segments past the loop is safe.
-		err := tio.SegmentSuperpacket(pkt, func(seg []byte) error {
+		err := pkt.PerSegment(func(seg []byte) error {
 			hh.cachePacket(f.l, header.Message, 0, seg, f.sendMessageNow, f.cachedPacketMetrics)
 			return nil
 		})
@@ -108,9 +94,9 @@ func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.Parse
 		return
 	}

-	dropReason := f.firewall.Drop(fwPacket.Packet, false, hostinfo, f.pki.GetCAPool(), localCache)
+	dropReason := f.firewall.Drop(*fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason == nil {
-		f.sendInsideMessage(hostinfo, pkt, &fwPacket.Packet, nb, tx)
+		f.sendInsideMessage(hostinfo, pkt, nb, sendBatch)
 	} else {
 		f.rejectInside(packet, rejectBuf, q)
 		if f.l.Enabled(context.Background(), slog.LevelDebug) {
@@ -122,13 +108,14 @@ func (f *Interface) consumeInsidePacket(pkt tio.Packet, fwPacket *firewall.Parse
 	}
 }

-func (f *Interface) sendInsideEncrypt(hostinfo *HostInfo, ci *ConnectionState, lane uint8, seg, scratch, nb []byte) []byte {
+func (f *Interface) sendInsideEncrypt(hostinfo *HostInfo, ci *ConnectionState, seg, scratch, nb []byte) []byte {
 	if noiseutil.EncryptLockNeeded {
 		ci.writeLock.Lock()
 	}
 	c := ci.messageCounter.Add(1)

-	out := header.EncodeLane(scratch, header.Version, header.Message, 0, hostinfo.remoteIndexId, c, lane)
+	out := header.Encode(scratch, header.Version, header.Message, 0, hostinfo.remoteIndexId, c)
+	f.connectionManager.Out(hostinfo)

 	out, encErr := ci.eKey.EncryptDanger(out, out, seg, c, nb)
 	if noiseutil.EncryptLockNeeded {
@@ -137,10 +124,11 @@ func (f *Interface) sendInsideEncrypt(hostinfo *HostInfo, ci *ConnectionState, l
 	if encErr != nil {
 		hostinfo.logger(f.l).Error("Failed to encrypt outgoing packet",
 			"error", encErr,
-			"udpAddr", hostinfo.GetRemote(),
+			"udpAddr", hostinfo.remote,
 			"counter", c,
 		)
-		// Skip this segment; the rest of the superpacket can still go out. TCP will retransmit anything we drop here.
+		// Skip this segment; the rest of the superpacket can still
+		// go out — TCP will retransmit anything we drop here.
 		return nil
 	}

@@ -151,37 +139,29 @@ func (f *Interface) sendInsideEncrypt(hostinfo *HostInfo, ci *ConnectionState, l
 // segment of a TSO/USO superpacket) into the caller's batch slot for
 // later sendmmsg flush. Segmentation is fused with encryption here so the
 // kernel-supplied superpacket bytes never get written into a separate
-// scratch arena: SegmentSuperpacket builds each segment's plaintext in
-// segScratch[:segLen] in turn, and we encrypt directly into a fresh SendBatch slot.
-//
-// When this flow has a usable multiport lane to this peer, the direct path swaps
-// to that lane's session and socket below. Relay and base traffic stays on
-// tx.base (socket 0).
-func (f *Interface) sendInsideMessage(hostinfo *HostInfo, pkt tio.Packet, fwPacket *firewall.Packet, nb []byte, tx *txQueue) {
+// scratch arena: PerSegment builds each segment's plaintext in
+// segScratch[:segLen] in turn, and we encrypt directly into a fresh
+// SendBatch slot.
+func (f *Interface) sendInsideMessage(hostinfo *HostInfo, pkt wire.TunPacket, nb []byte, sendBatch *batch.SendBatch) {
 	ci := hostinfo.ConnectionState
 	if ci.eKey == nil {
 		return
 	}

-	// Base and relay traffic stays on socket 0; the direct path may swap to tx.lane below.
-	sendBatch := tx.base
-
-	// One traffic-out mark covers every segment of the superpacket; doing it
-	// per segment in sendInsideEncrypt paid an atomic store up to ~45 extra
-	// times per TSO packet, inside writeLock under boring crypto.
-	//
-	// We rebound since this tunnel last sent, ask the lighthouse to get the far side punching at us again
-	if f.connectionManager.Out(hostinfo) {
+	ecnEnabled := f.ecnEnabled.Load()
+	if hostinfo.lastRebindCount != f.rebindCount {
+		//NOTE: there is an update hole if a tunnel isn't used and exactly 256 rebinds occur before the tunnel is
+		// finally used again. This tunnel would eventually be torn down and recreated if this action didn't help.
 		f.lightHouse.QueryServer(hostinfo.vpnAddrs[0])
+		hostinfo.lastRebindCount = f.rebindCount
 		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(f.l).Debug("Lighthouse update triggered for punch due to rebind epoch",
+			hostinfo.logger(f.l).Debug("Lighthouse update triggered for punch due to rebind counter",
 				"vpnAddrs", hostinfo.vpnAddrs,
 			)
 		}
 	}

-	remote := hostinfo.GetRemote()
-	if !remote.IsValid() { //the relay path
+	if !hostinfo.remote.IsValid() { //the relay path
 		//first, find our relay hostinfo:
 		var relayHostInfo *HostInfo
 		var relay *Relay
@@ -203,11 +183,11 @@ func (f *Interface) sendInsideMessage(hostinfo *HostInfo, pkt tio.Packet, fwPack
 			return
 		}

-		err = tio.SegmentSuperpacket(pkt, func(seg []byte) error {
+		err = pkt.PerSegment(func(seg []byte) error {
 			//relay header + header + plaintext + AEAD tag (16 bytes for both AES-GCM and ChaCha20-Poly1305) + relay tag
 			scratch := sendBatch.Reserve(header.Len + header.Len + len(seg) + 16 + 16)

-			innerPacket := f.sendInsideEncrypt(hostinfo, ci, 0, seg, scratch[header.Len:], nb)
+			innerPacket := f.sendInsideEncrypt(hostinfo, ci, seg, scratch[header.Len:], nb)
 			if innerPacket == nil {
 				return nil
 			}
@@ -219,7 +199,11 @@ func (f *Interface) sendInsideMessage(hostinfo *HostInfo, pkt tio.Packet, fwPack
 				return nil
 			}

-			sendBatch.Commit(toSend, relayHostInfo.GetRemote())
+			var ecn byte
+			if ecnEnabled {
+				ecn = innerECN(seg)
+			}
+			sendBatch.Commit(toSend, relayHostInfo.remote, ecn)
 			return nil
 		})
 		if err != nil {
@@ -228,42 +212,47 @@ func (f *Interface) sendInsideMessage(hostinfo *HostInfo, pkt tio.Packet, fwPack
 		return
 	}

-	// Direct path: prefer this flow's multiport lane once it is proven usable.
-	// txLaneForFlow hands back the lane's session and destination together, so
-	// there is no window where one is set and the other is not, and a demotion
-	// drops us back onto the base tunnel on the very next packet.
-	//
-	// A miss is also how a lane gets re-probed after a demotion: txLane raises
-	// demand, which the connection manager's next tick on this tunnel picks up.
-	// Until the lane is up the traffic rides the base tunnel, the same fallback
-	// a demoted lane uses.
-	lane := uint8(0)
-	if s, lci, laneRemote := hostinfo.lanes.txLaneForFlow(fwPacket); lci != nil {
-		lane = uint8(s)
-		ci = lci
-		remote = laneRemote
-		sendBatch = tx.laneBatch(f, s)
-	}
-
-	err := tio.SegmentSuperpacket(pkt, func(seg []byte) error {
+	err := pkt.PerSegment(func(seg []byte) error {
 		// header + plaintext + AEAD tag (16 bytes for both AES-GCM and ChaCha20-Poly1305)
 		scratch := sendBatch.Reserve(header.Len + len(seg) + 16)

-		out := f.sendInsideEncrypt(hostinfo, ci, lane, seg, scratch, nb)
+		out := f.sendInsideEncrypt(hostinfo, ci, seg, scratch, nb)
 		if out == nil {
 			return nil
 		}

-		sendBatch.Commit(out, remote)
+		var ecn byte
+		if ecnEnabled {
+			ecn = innerECN(seg)
+		}
+		sendBatch.Commit(out, hostinfo.remote, ecn)
 		return nil
 	})
 	if err != nil {
-		hostinfo.logger(f.l).Error("Failed to segment superpacket for send", "error", err)
+		hostinfo.logger(f.l).Error("Failed to segment superpacket for send",
+			"error", err,
+		)
 	}
 }

+// innerECN returns the 2-bit IP-level ECN codepoint of an inner IPv4 or IPv6
+// packet, or 0 if pkt is too short or its IP version is unrecognized. Used at
+// encap to copy the inner codepoint onto the outer carrier per RFC 6040.
+func innerECN(pkt []byte) byte {
+	if len(pkt) < 2 {
+		return 0
+	}
+	switch pkt[0] >> 4 {
+	case 4:
+		return pkt[1] & 0x03
+	case 6:
+		return (pkt[1] >> 4) & 0x03
+	}
+	return 0
+}
+
 func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
-	if !f.firewall.OutboundSendReject {
+	if !f.firewall.InSendReject {
 		return
 	}

@@ -272,36 +261,33 @@ func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
 		return
 	}

-	_, err := f.queues[q].Write(out)
+	_, err := f.readers[q].Write(out)
 	if err != nil {
 		f.l.Error("Failed to write to tun", "error", err)
 	}
 }

-func (f *Interface) rejectOutside(packet []byte, ci *ConnectionState, hostinfo *HostInfo, nb, rejectBuf []byte, q int) {
-	if !f.firewall.InboundSendReject {
+func (f *Interface) rejectOutside(packet []byte, ci *ConnectionState, hostinfo *HostInfo, nb, out []byte, q int) {
+	if !f.firewall.OutSendReject {
 		return
 	}

-	// split rejectBuf to make sure we have room to write the plaintext rejection, then encrypt it, without trampling anything
-	// we can't re-use packet, if we need to send an icmp reject, it won't be long enough.
-	half := len(rejectBuf) / 2
-	encryptBuf := rejectBuf[0:0:half] //the first half of rejectBuf's capacity, len set to 0
-	buildBuf := rejectBuf[half:]
-
-	out := iputil.CreateRejectPacket(packet, buildBuf)
+	out = iputil.CreateRejectPacket(packet, out)
 	if len(out) == 0 {
 		return
 	}

 	if len(out) > iputil.MaxRejectPacketSize {
 		if f.l.Enabled(context.Background(), slog.LevelInfo) {
-			f.l.Info("rejectOutside: packet too big, not sending", "packet", packet, "outPacket", out)
+			f.l.Info("rejectOutside: packet too big, not sending",
+				"packet", packet,
+				"outPacket", out,
+			)
 		}
 		return
 	}

-	f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, out, nb, encryptBuf, q)
+	f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, out, nb, packet, q)
 }

 // Handshake will attempt to initiate a tunnel with the provided vpn address. This is a no-op if the tunnel is already established or being established
@@ -395,7 +381,7 @@ func (f *Interface) getOrHandshakeConsiderRouting(fwPacket *firewall.Packet, cac
 }

 func (f *Interface) sendMessageNow(t header.MessageType, st header.MessageSubType, hostinfo *HostInfo, p, nb, out []byte) {
-	fp := &firewall.ParsedPacket{}
+	fp := &firewall.Packet{}
 	err := newPacket(p, false, fp)
 	if err != nil {
 		f.l.Warn("error while parsing outgoing packet for firewall check", "error", err)
@@ -403,7 +389,7 @@ func (f *Interface) sendMessageNow(t header.MessageType, st header.MessageSubTyp
 	}

 	// check if packet is in outbound fw rules
-	dropReason := f.firewall.Drop(fp.Packet, false, hostinfo, f.pki.GetCAPool(), nil)
+	dropReason := f.firewall.Drop(*fp, false, hostinfo, f.pki.GetCAPool(), nil)
 	if dropReason != nil {
 		if f.l.Enabled(context.Background(), slog.LevelDebug) {
 			f.l.Debug("dropping cached packet",
@@ -454,14 +440,6 @@ func (f *Interface) sendTo(t header.MessageType, st header.MessageSubType, ci *C
 	f.sendNoMetrics(t, st, ci, hostinfo, remote, p, nb, out, 0)
 }

-// dropExhausted records an exhaustion drop and logs once, on the crossing send, for a spent tunnel.
-func (f *Interface) dropExhausted(hostinfo *HostInfo, c uint64, msg string) {
-	f.messageMetrics.TxExhausted(1)
-	if c == RejectAfterMessages {
-		hostinfo.logger(f.l).Error(msg)
-	}
-}
-
 func (f *Interface) prepareSendVia(via *HostInfo,
 	relay *Relay,
 	ad,
@@ -473,17 +451,10 @@ func (f *Interface) prepareSendVia(via *HostInfo,
 		// NOTE: for goboring AESGCMTLS we need to lock because of the nonce check
 		via.ConnectionState.writeLock.Lock()
 	}
-	c, ok := via.ConnectionState.NextMessageCounter()
-	if !ok {
-		if noiseutil.EncryptLockNeeded {
-			via.ConnectionState.writeLock.Unlock()
-		}
-		f.dropExhausted(via, c, "Dropping outbound relay packets, tunnel message counter is exhausted")
-		return nil, fmt.Errorf("tunnel message counter is exhausted")
-	}
+	c := via.ConnectionState.messageCounter.Add(1)

 	out = header.Encode(out, header.Version, header.Message, header.MessageRelay, relay.RemoteIndex, c)
-	f.connectionManager.OutNoRebind(via)
+	f.connectionManager.Out(via)

 	// Authenticate the header and payload, but do not encrypt for this message type.
 	// The payload consists of the inner, unencrypted Nebula header, as well as the end-to-end encrypted payload.
@@ -529,60 +500,32 @@ func (f *Interface) prepareSendVia(via *HostInfo,
 // via is the HostInfo through which the message is relayed.
 // ad is the plaintext data to authenticate, but not encrypt
 // nb is a buffer used to store the nonce value, re-used for performance reasons.
-// out is a buffer used to store the result of the Encrypt operation
-// q indicates which writer to use to send the packet.
-func (f *Interface) SendVia(via *HostInfo, relay *Relay, ad, nb, out []byte, nocopy bool, q int) {
+// out is a buffer used to store the result of the Encrypt operation.
+// The write goes through writers[0] — SendVia is called from contexts
+// without a per-queue index (handshake, async control paths).
+func (f *Interface) SendVia(via *HostInfo,
+	relay *Relay,
+	ad,
+	nb,
+	out []byte,
+	nocopy bool,
+) {
 	toSend, err := f.prepareSendVia(via, relay, ad, nb, out, nocopy)
 	if err != nil {
-		// already logged by prepareSendVia
+		via.logger(f.l).Info("Failed to prepareSendVia", "error", err)
 		return
 	}
-
-	err = f.writers[f.egressSock(q)].WriteTo(toSend, via.GetRemote())
+	err = f.writers[0].WriteTo(toSend, via.remote)
 	if err != nil {
 		via.logger(f.l).Info("Failed to WriteTo in sendVia", "error", err)
 	}
 }

-// egressSock picks the socket a tunnel packet leaves from.
-//
-// Everything that is not lane data plane leaves from the base port: handshakes, keepalives, close packets, rejects and
-// relay carriers all belong to the base tunnel's 4-tuple, which is the only one a peer's spoof/roam checks and a
-// vanilla peer's expectations know about. Lane data goes through laneSock instead and never comes here.
-//
-// Which socket on the base port doesn't matter — they share an address, so they produce identical packets — so keep to
-// this routine's own share of the group and leave the rest of it uncontended. Without multiport that is q itself, since
-// every socket is on the base port.
-func (f *Interface) egressSock(q int) int {
-	return f.laneSock(q, 0)
-}
-
-// laneSock returns the index in writers of a socket bound to lane s's port, for a
-// routine that reads queue q.
-//
-// Under multiport the sockets are laid out port-major — writers[s*routinesPerPort
-// + r] is the r'th socket on port listen.port+s — so every routine has a sibling
-// socket on every port and the arithmetic is a lane index away. Routines pick the
-// sibling matching their own position in their group, which spreads the writers
-// for one port over that port's whole group rather than funnelling them onto its
-// first socket. It is a pure function of (q, s), so a flow always leaves from the
-// same socket and cannot reorder itself across two of them.
-//
-// Without multiport there is one port and every socket is on it, so any lane
-// resolves to q's own socket.
-func (f *Interface) laneSock(q, s int) int {
-	if !f.multiport {
-		return q
-	}
-	return s*f.routinesPerPort + q%f.routinesPerPort
-}
-
 func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType, ci *ConnectionState, hostinfo *HostInfo, remote netip.AddrPort, p, nb, out []byte, q int) {
 	if ci.eKey == nil {
 		return
 	}
-	q = f.egressSock(q)
-	useRelay := !remote.IsValid() && !hostinfo.GetRemote().IsValid()
+	useRelay := !remote.IsValid() && !hostinfo.remote.IsValid()
 	fullOut := out

 	if useRelay {
@@ -599,24 +542,21 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 		// NOTE: for goboring AESGCMTLS we need to lock because of the nonce check
 		ci.writeLock.Lock()
 	}
-	c, ok := ci.NextMessageCounter()
-	if !ok {
-		if noiseutil.EncryptLockNeeded {
-			ci.writeLock.Unlock()
-		}
-		f.dropExhausted(hostinfo, c, "Dropping outbound packets, tunnel message counter is exhausted")
-		return
-	}
+	c := ci.messageCounter.Add(1)

 	//l.WithField("trace", string(debug.Stack())).Error("out Header ", &Header{Version, t, st, 0, hostinfo.remoteIndexId, c}, p)
 	out = header.Encode(out, header.Version, t, st, hostinfo.remoteIndexId, c)
-	// A closing tunnel is torn down right after this, so skip the connection manager entirely: no point recording
-	// traffic or asking the lighthouse for a punch. Otherwise, if we rebound since this tunnel last sent, ask the
-	// lighthouse to get the far side punching at us again.
-	if t != header.CloseTunnel && f.connectionManager.Out(hostinfo) {
+	f.connectionManager.Out(hostinfo)
+
+	// Query our LH if we haven't since the last time we've been rebound, this will cause the remote to punch against
+	// all our addrs and enable a faster roaming.
+	if t != header.CloseTunnel && hostinfo.lastRebindCount != f.rebindCount {
+		//NOTE: there is an update hole if a tunnel isn't used and exactly 256 rebinds occur before the tunnel is
+		// finally used again. This tunnel would eventually be torn down and recreated if this action didn't help.
 		f.lightHouse.QueryServer(hostinfo.vpnAddrs[0])
+		hostinfo.lastRebindCount = f.rebindCount
 		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			f.l.Debug("Lighthouse update triggered for punch due to rebind epoch",
+			f.l.Debug("Lighthouse update triggered for punch due to rebind counter",
 				"vpnAddrs", hostinfo.vpnAddrs,
 			)
 		}
@@ -632,6 +572,7 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 			"error", err,
 			"udpAddr", remote,
 			"counter", c,
+			"attemptedCounter", c,
 		)
 		return
 	}
@@ -644,12 +585,12 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 				"udpAddr", remote,
 			)
 		}
-	} else if hr := hostinfo.GetRemote(); hr.IsValid() {
-		err = f.writers[q].WriteTo(out, hr)
+	} else if hostinfo.remote.IsValid() {
+		err = f.writers[q].WriteTo(out, hostinfo.remote)
 		if err != nil {
 			hostinfo.logger(f.l).Error("Failed to write outgoing packet",
 				"error", err,
-				"udpAddr", hr,
+				"udpAddr", remote,
 			)
 		}
 	} else {
@@ -664,7 +605,7 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 				)
 				continue
 			}
-			f.SendVia(relayHostInfo, relay, out, nb, fullOut[:header.Len+len(out)], true, q)
+			f.SendVia(relayHostInfo, relay, out, nb, fullOut[:header.Len+len(out)], true)
 			break
 		}
 	}
@@ -1,265 +0,0 @@
-package nebula
-
-import (
-	"encoding/binary"
-	"io"
-	"net/netip"
-	"testing"
-
-	"github.com/gaissmai/bart"
-	"github.com/slackhq/nebula/firewall"
-	"github.com/slackhq/nebula/iputil"
-	"github.com/slackhq/nebula/overlay/tio"
-	"github.com/slackhq/nebula/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const (
-	ipv4HeaderLen = 20
-	ipv6HeaderLen = 40
-)
-
-// capturingTun is a tio.Queue that records what is written to it. A queue that
-// discards writes is indistinguishable from a packet that was never forwarded.
-type capturingTun struct {
-	writes [][]byte
-}
-
-func (c *capturingTun) Read() ([]tio.Packet, error) { return nil, io.EOF }
-func (c *capturingTun) Close() error                { return nil }
-
-func (c *capturingTun) Write(b []byte) (int, error) {
-	c.writes = append(c.writes, append([]byte(nil), b...))
-	return len(b), nil
-}
-
-func newSelfForwardInterface(myAddrs ...netip.Addr) (*Interface, *capturingTun) {
-	vpnAddrs := &bart.Lite{}
-	for _, a := range myAddrs {
-		vpnAddrs.Insert(netip.PrefixFrom(a, a.BitLen()))
-	}
-
-	tun := &capturingTun{}
-	return &Interface{
-		l:                     test.NewLogger(),
-		myVpnAddrsTable:       vpnAddrs,
-		myBroadcastAddrsTable: &bart.Lite{},
-		queues:                []tio.Queue{tun},
-	}, tun
-}
-
-func consumeInside(f *Interface, packet []byte) {
-	f.consumeInsidePacket(tio.Packet{Bytes: packet}, &firewall.ParsedPacket{}, make([]byte, 12), nil, make([]byte, mtu), 0, nil)
-}
-
-// l4Proto describes one upper-layer header for these tests: its IP next-header
-// value, where its checksum field sits within the header, and how to build a
-// minimal instance of it.
-type l4Proto struct {
-	name    string
-	nextHdr uint8
-	cksumAt int
-	build   func() []byte
-}
-
-var (
-	tcpSyn = l4Proto{"tcp", iputil.IPProtocolTCP, 16, func() []byte {
-		h := make([]byte, 20)
-		binary.BigEndian.PutUint16(h[0:2], 49152)
-		binary.BigEndian.PutUint16(h[2:4], 443)
-		binary.BigEndian.PutUint32(h[4:8], 0x11223344) // sequence
-		h[12] = 5 << 4                                 // data offset, no options
-		h[13] = 0x02                                   // SYN
-		binary.BigEndian.PutUint16(h[14:16], 65535)    // window
-		return h
-	}}
-
-	udpDatagram = l4Proto{"udp", iputil.IPProtocolUDP, 6, func() []byte {
-		h := make([]byte, 8+4)
-		binary.BigEndian.PutUint16(h[0:2], 49152)
-		binary.BigEndian.PutUint16(h[2:4], 53)
-		binary.BigEndian.PutUint16(h[4:6], uint16(len(h)))
-		copy(h[8:], "ping")
-		return h
-	}}
-
-	icmpEcho   = l4Proto{"icmp", iputil.IPProtocolICMP, 2, func() []byte { return echoRequest(8) }}
-	icmpv6Echo = l4Proto{"icmpv6", iputil.IPProtocolICMPv6, 2, func() []byte { return echoRequest(128) }}
-)
-
-// echoRequest builds an echo request body. The type differs between ICMP and
-// ICMPv6, the rest of the header does not.
-func echoRequest(typ uint8) []byte {
-	h := make([]byte, 8)
-	h[0] = typ
-	binary.BigEndian.PutUint16(h[4:6], 0xbeef) // identifier
-	binary.BigEndian.PutUint16(h[6:8], 1)      // sequence
-	return h
-}
-
-func buildIPv6(src, dst netip.Addr, p l4Proto) []byte {
-	l4 := p.build()
-	pkt := make([]byte, ipv6HeaderLen+len(l4))
-	pkt[0] = 0x60
-	binary.BigEndian.PutUint16(pkt[4:6], uint16(len(l4)))
-	pkt[6] = p.nextHdr
-	pkt[7] = 64
-	copy(pkt[8:24], src.AsSlice())
-	copy(pkt[24:40], dst.AsSlice())
-	copy(pkt[ipv6HeaderLen:], l4)
-	if l4 := pkt[ipv6HeaderLen:]; p.nextHdr == iputil.IPProtocolTCP || p.nextHdr == iputil.IPProtocolUDP {
-		sum := ipv6PseudoheaderSum(src, dst, uint32(p.nextHdr), uint32(len(l4)))
-		binary.BigEndian.PutUint16(l4[p.cksumAt:], ^fold(sumBytes(l4, sum)))
-	}
-	return pkt
-}
-
-func buildIPv4(src, dst netip.Addr, p l4Proto) []byte {
-	l4 := p.build()
-	pkt := make([]byte, ipv4HeaderLen+len(l4))
-	pkt[0] = 0x45
-	binary.BigEndian.PutUint16(pkt[2:4], uint16(len(pkt)))
-	pkt[8] = 64
-	pkt[9] = p.nextHdr
-	copy(pkt[12:16], src.AsSlice())
-	copy(pkt[16:20], dst.AsSlice())
-	copy(pkt[ipv4HeaderLen:], l4)
-	if l4 := pkt[ipv4HeaderLen:]; p.nextHdr == iputil.IPProtocolTCP || p.nextHdr == iputil.IPProtocolUDP {
-		sum := sumBytes(pkt[12:20], uint32(p.nextHdr)+uint32(len(l4)))
-		binary.BigEndian.PutUint16(l4[p.cksumAt:], ^fold(sumBytes(l4, sum)))
-	}
-	return pkt
-}
-
-// ipv6PseudoheaderSum is the RFC 2460 section 8.1 pseudo-header sum: source,
-// destination, a 32 bit upper-layer packet length and a 32 bit zero-padded next
-// header. Kept local to the test so these assertions do not check nebula's
-// checksum code against itself.
-func ipv6PseudoheaderSum(src, dst netip.Addr, nextHeader, length uint32) uint32 {
-	var csum uint32
-	s, d := src.AsSlice(), dst.AsSlice()
-	for i := 0; i < 16; i += 2 {
-		csum += uint32(s[i])<<8 | uint32(s[i+1])
-		csum += uint32(d[i])<<8 | uint32(d[i+1])
-	}
-	return csum + length + nextHeader
-}
-
-func sumBytes(b []byte, csum uint32) uint32 {
-	for i := 0; i+1 < len(b); i += 2 {
-		csum += uint32(b[i])<<8 | uint32(b[i+1])
-	}
-	if len(b)%2 == 1 {
-		csum += uint32(b[len(b)-1]) << 8
-	}
-	return csum
-}
-
-func fold(csum uint32) uint16 {
-	for csum > 0xffff {
-		csum = (csum >> 16) + (csum & 0xffff)
-	}
-	return uint16(csum)
-}
-
-// l4ChecksumValid6 verifies an IPv6 upper-layer checksum the way a receiver
-// does: the pseudo-header plus the whole upper-layer segment, checksum field
-// included, folds to 0xffff. The next header field is the upper-layer protocol
-// only while there are no extension headers, which is all this file builds.
-func l4ChecksumValid6(pkt []byte) bool {
-	src, _ := netip.AddrFromSlice(pkt[8:24])
-	dst, _ := netip.AddrFromSlice(pkt[24:40])
-	l4 := pkt[ipv6HeaderLen:]
-	return fold(sumBytes(l4, ipv6PseudoheaderSum(src, dst, uint32(pkt[6]), uint32(len(l4))))) == 0xffff
-}
-
-// l4ChecksumValid4 is the IPv4 counterpart: the RFC 793/768 pseudo-header is
-// source, destination, a zero byte, the protocol and the upper-layer length.
-func l4ChecksumValid4(pkt []byte) bool {
-	ihl := int(pkt[0]&0x0f) << 2
-	l4 := pkt[ihl:]
-	return fold(sumBytes(l4, sumBytes(pkt[12:20], uint32(pkt[9])+uint32(len(l4))))) == 0xffff
-}
-
-// TestConsumeInsidePacketSelfTraffic covers the self-addressed branch of
-// consumeInsidePacket, taken where immediatelyForwardToSelf is set (see
-// inside_bsd.go): the packet goes straight back to the tun, ahead of the
-// firewall and the handshake.
-func TestConsumeInsidePacketSelfTraffic(t *testing.T) {
-	v4 := netip.MustParseAddr("100.100.1.42")
-	v6 := netip.MustParseAddr("fd00::42")
-
-	tests := []struct {
-		name string
-		addr netip.Addr
-		pkt  []byte
-	}{
-		{"ipv4/tcp", v4, buildIPv4(v4, v4, tcpSyn)},
-		{"ipv4/udp", v4, buildIPv4(v4, v4, udpDatagram)},
-		{"ipv4/icmp", v4, buildIPv4(v4, v4, icmpEcho)},
-		{"ipv6/tcp", v6, buildIPv6(v6, v6, tcpSyn)},
-		{"ipv6/udp", v6, buildIPv6(v6, v6, udpDatagram)},
-		{"ipv6/icmpv6", v6, buildIPv6(v6, v6, icmpv6Echo)},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			f, tun := newSelfForwardInterface(tt.addr)
-			// consumeInsidePacket writes through the slice it is handed, so a
-			// packet that arrived with a valid checksum must come back out of
-			// bytes taken before the call, unchanged.
-			want := append([]byte(nil), tt.pkt...)
-			consumeInside(f, tt.pkt)
-
-			if immediatelyForwardToSelf {
-				require.Len(t, tun.writes, 1)
-				assert.Equal(t, want, tun.writes[0])
-			} else {
-				assert.Empty(t, tun.writes, "self traffic reaches the tun over loopback here and must be dropped")
-			}
-		})
-	}
-}
-
-// TestConsumeInsidePacketSelfTrafficChecksum shows that the self-forward
-// returns the bytes it was handed, so a packet that arrived with a wrong
-// upper-layer checksum is written back with that same wrong checksum and the
-// kernel drops it on re-entry.
-//
-// This is how a macOS host loses TCP and UDP to its own IPv6 overlay address:
-// the kernel writes only the pseudo-header sum into the checksum field and
-// defers completion to hardware offload, state that does not survive the
-// crossing into userspace. Which kernels do this, for which protocols and IP
-// versions, is a property of the kernel and belongs to a test against a live
-// one; here the checksum is simply wrong, and the forward must make it right.
-func TestConsumeInsidePacketSelfTrafficChecksum(t *testing.T) {
-	if !immediatelyForwardToSelf {
-		t.Skip("self traffic never reaches the tun on this platform")
-	}
-	versions := []struct {
-		name  string
-		addr  netip.Addr
-		build func(src, dst netip.Addr, p l4Proto) []byte
-		l4At  int
-		valid func(pkt []byte) bool
-	}{
-		{"v4", netip.MustParseAddr("100.100.1.42"), buildIPv4, ipv4HeaderLen, l4ChecksumValid4},
-		{"v6", netip.MustParseAddr("fd00::42"), buildIPv6, ipv6HeaderLen, l4ChecksumValid6},
-	}
-	for _, v := range versions {
-		for _, p := range []l4Proto{tcpSyn, udpDatagram} {
-			t.Run(v.name+"/"+p.name, func(t *testing.T) {
-				pkt := v.build(v.addr, v.addr, p)
-				binary.BigEndian.PutUint16(pkt[v.l4At+p.cksumAt:], 0x1234)
-				require.False(t, v.valid(pkt), "the packet under test must start with a wrong checksum")
-				f, tun := newSelfForwardInterface(v.addr)
-				consumeInside(f, pkt)
-				require.Len(t, tun.writes, 1)
-				assert.True(t, v.valid(tun.writes[0]),
-					"a forwarded %s packet must carry a valid checksum, got 0x%04x",
-					p.name, binary.BigEndian.Uint16(tun.writes[0][v.l4At+p.cksumAt:]))
-			})
-		}
-	}
-}
@@ -2,13 +2,11 @@ package nebula

 import (
 	"context"
-	"crypto/fips140"
 	"errors"
 	"fmt"
 	"log/slog"
 	"net/netip"
 	"runtime"
-	"slices"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -16,8 +14,8 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/rcrowley/go-metrics"
 	"github.com/slackhq/nebula/util"
+	"github.com/slackhq/nebula/wire"

-	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
@@ -43,22 +41,11 @@ type InterfaceConfig struct {
 	DropLocalBroadcast bool
 	DropMulticast      bool
 	routines           int
-	// Multiport means the sockets are spread over a range of ports
-	// (listen.port+slot) rather than all sharing listen.port, and that lane
-	// tunnels are negotiated with capable peers.
-	Multiport bool
-	// RoutinesPerPort is how many sockets share each port under multiport, and so
-	// the stride between port slots in writers: writers[s*RoutinesPerPort+r] is
-	// the r'th socket bound to listen.port+s. It is `routines` as configured,
-	// while routines above is that times the number of ports.
-	RoutinesPerPort int
-	// LaneCount is the number of lanes counting the base tunnel as lane 0
-	// (multiport.lanes, clamped to the number of ports bound).
-	LaneCount      int
-	MessageMetrics *MessageMetrics
-	version        string
-	relayManager   *relayManager
-	punchy         *Punchy
+	batchSize          int
+	MessageMetrics     *MessageMetrics
+	version            string
+	relayManager       *relayManager
+	punchy             *Punchy

 	tryPromoteEvery uint32
 	reQueryEvery    uint32
@@ -69,13 +56,8 @@ type InterfaceConfig struct {
 	// CpuAffinity, when non-empty, names the CPUs each TUN reader goroutine
 	// should pin to. Queue i pins to CpuAffinity[i % len(CpuAffinity)] —
 	// shorter lists than `routines` cycle. Empty list keeps the default
-	// pin-to-(i % NumCPU) behavior. Only consulted when PinThreads is true.
+	// pin-to-(i % NumCPU) behavior.
 	CpuAffinity []int
-	// PinThreads controls whether each TUN reader OS thread is pinned to a
-	// single CPU (via tun.pin_threads, default true). Pinning keeps each
-	// goroutine's sendmmsg on one XPS-selected NIC TX ring so per-flow
-	// packets stay ordered on the wire.
-	PinThreads bool

 	l *slog.Logger
 }
@@ -99,20 +81,18 @@ type Interface struct {
 	dropLocalBroadcast    bool
 	dropMulticast         bool
 	routines              int
-	multiport             bool
-	routinesPerPort       int
-	laneCount             int
+	batchSize             int
 	disconnectInvalid     atomic.Bool
 	closed                atomic.Bool
 	// cpuAffinity, when non-empty, names the CPUs each TUN reader goroutine
 	// should pin to. Queue i pins to cpuAffinity[i % len(cpuAffinity)].
-	// Empty falls back to the default pin-to-(allowed CPU) behavior.
-	// Only consulted when pinThreads is true.
+	// Empty falls back to the default pin-to-(i % NumCPU) behavior.
 	cpuAffinity []int
-	// pinThreads controls whether listenIn pins each TUN reader OS thread to
-	// a CPU at all (tun.pin_threads, default true). When false, threads are
-	// left free to migrate as on stock nebula.
-	pinThreads   bool
+	// ecnEnabled gates RFC 6040 underlay ECN propagation. When true,
+	// inside.go copies the inner ECN onto the outer carrier on encap and
+	// decryptToTun folds outer CE into the inner header on decap. Toggle
+	// via tunnels.ecn (default true).
+	ecnEnabled   atomic.Bool
 	relayManager *relayManager

 	tryPromoteEvery atomic.Uint32
@@ -122,21 +102,19 @@ type Interface struct {
 	sendRecvErrorConfig   recvErrorConfig
 	acceptRecvErrorConfig recvErrorConfig

-	// Bumped on every udp rebind, tunnels compare it to decide they need a punch from the far side
-	rebindEpoch atomic.Uint32
+	// rebindCount is used to decide if an active tunnel should trigger a punch notification through a lighthouse
+	rebindCount int8
 	version     string

 	conntrackCacheTimeout time.Duration

 	ctx     context.Context
 	writers []udp.Conn
-	queues  []tio.Queue
-	// batchers is one per tun queue, wrapping queues[i]. readOutsidePackets
-	// commits plaintext into the batcher; the plaintext is decrypted
-	// in place inside the UDP receive buffers, so listenOut must call Flush
-	// at the end of each UDP recvmmsg batch, before those buffers are
-	// reused (every udp.Conn ListenOut guarantees that ordering).
-	batchers []*batch.MultiCoalescer
+	readers []tio.Queue
+	// batchers is one per tun queue, wrapping readers[i].
+	// decryptToTun sends plaintext into the batch.RxBatcher;
+	// listenOut calls its Flush at the end of each UDP recvmmsg batch.
+	batchers []batch.RxBatcher
 	wg       sync.WaitGroup

 	// fatalErr holds the first unexpected reader error that caused shutdown.
@@ -148,13 +126,18 @@ type Interface struct {
 	metricHandshakes    metrics.Histogram
 	messageMetrics      *MessageMetrics
 	cachedPacketMetrics *cachedPacketMetrics
-	metricTxDropped     metrics.Counter

 	l *slog.Logger
 }

 type EncWriter interface {
-	SendVia(via *HostInfo, relay *Relay, ad, nb, out []byte, nocopy bool, q int)
+	SendVia(via *HostInfo,
+		relay *Relay,
+		ad,
+		nb,
+		out []byte,
+		nocopy bool,
+	)
 	SendMessageToVpnAddr(t header.MessageType, st header.MessageSubType, vpnAddr netip.Addr, p, nb, out []byte)
 	SendMessageToHostInfo(t header.MessageType, st header.MessageSubType, hostinfo *HostInfo, p, nb, out []byte)
 	Handshake(vpnAddr netip.Addr)
@@ -213,10 +196,6 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		return nil, errors.New("no connection manager")
 	}

-	if c.routines <= 1 {
-		c.PinThreads = false //pinning is not useful unless there's more than one tun reader
-	}
-
 	cs := c.pki.getCertState()
 	ifce := &Interface{
 		ctx:                   ctx,
@@ -232,12 +211,11 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		dropLocalBroadcast:    c.DropLocalBroadcast,
 		dropMulticast:         c.DropMulticast,
 		routines:              c.routines,
-		multiport:             c.Multiport,
-		routinesPerPort:       max(c.RoutinesPerPort, 1),
-		laneCount:             c.LaneCount,
+		batchSize:             c.batchSize,
 		version:               c.version,
 		writers:               make([]udp.Conn, c.routines),
-		batchers:              make([]*batch.MultiCoalescer, c.routines),
+		readers:               make([]tio.Queue, c.routines),
+		batchers:              make([]batch.RxBatcher, c.routines),
 		myVpnNetworks:         cs.myVpnNetworks,
 		myVpnNetworksTable:    cs.myVpnNetworksTable,
 		myVpnAddrs:            cs.myVpnAddrs,
@@ -247,10 +225,8 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		connectionManager:     c.connectionManager,
 		conntrackCacheTimeout: c.ConntrackCacheTimeout,
 		cpuAffinity:           c.CpuAffinity,
-		pinThreads:            c.PinThreads,

 		metricHandshakes: metrics.GetOrRegisterHistogram("handshakes", nil, metrics.NewExpDecaySample(1028, 0.015)),
-		metricTxDropped:  metrics.GetOrRegisterCounter("udp.tx.dropped", nil),
 		messageMetrics:   c.MessageMetrics,
 		cachedPacketMetrics: &cachedPacketMetrics{
 			sent:    metrics.GetOrRegisterCounter("hostinfo.cached_packets.sent", nil),
@@ -266,9 +242,6 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {

 	ifce.connectionManager.intf = ifce

-	// Held until Close so waiting on the interface blocks until the resources are actually released
-	ifce.wg.Add(1)
-
 	return ifce, nil
 }

@@ -289,61 +262,52 @@ func (f *Interface) activate() error {
 		"build", f.version,
 		"udpAddr", addr,
 		"boringcrypto", boringEnabled(),
-		"fips140Version", fips140.Version(),
-		"fips140Enabled", fips140.Enabled(),
-		"fips140Enforced", fips140.Enforced(),
 	)

-	// Under multiport each socket has exactly one reader on its own port, so
-	// the shared-port multi-reader capability is irrelevant (and main.go
-	// already hard-errored on unsupported platforms).
-	if f.routines > 1 && !f.multiport && !f.outside.SupportsMultipleReaders() {
-		f.routines = 1
-		f.l.Warn("multiple udp readers are not supported on this platform, falling back to a single routine")
-	}
-
-	// Prepare the tun queues. A device that can't open that many hands back
-	// fewer (a single queue on platforms without multiqueue support) and we
-	// size the reader routines to what we actually got.
-	queues, err := f.inside.Queues(f.routines)
-	if err != nil {
-		return err
-	}
-	if len(queues) < f.routines {
-		if f.multiport {
-			// The lane sockets are already bound one-per-routine; shrinking
-			// the routine count would leave bound ports with no reader.
-			return fmt.Errorf("multiport requires %d tun queues, device provided %d", f.routines, len(queues))
+	if f.routines > 1 {
+		if !f.inside.SupportsMultiqueue() || !f.outside.SupportsMultipleReaders() {
+			f.routines = 1
+			f.l.Warn("routines is not supported on this platform, falling back to a single routine")
 		}
-		// TODO: this clamp is only safe because it is unreachable when the
-		// udp side has multiple readers (linux Queues opens exactly n or
-		// errors; every other platform already clamped routines to 1 above).
-		// If a platform ever returns fewer queues than routines with
-		// SO_REUSEPORT sockets already bound, the surplus sockets get no
-		// listenOut and the kernel blackholes every flow it hashes to them —
-		// fail loudly or close the extra sockets instead.
-		f.l.Warn("tun multiqueue is not supported on this platform, falling back to fewer routines",
-			"requested", f.routines, "opened", len(queues))
-		f.routines = len(queues)
 	}
-	f.queues = queues

 	metrics.GetOrRegisterGauge("routines", nil).Update(int64(f.routines))

-	for i := range f.queues {
-		f.batchers[i] = batch.NewMultiCoalescer(f.queues[i], f.l)
+	// Prepare n tun queues
+	for i := 0; i < f.routines; i++ {
+		if i > 0 {
+			if err = f.inside.NewMultiQueueReader(); err != nil {
+				return err
+			}
+		}
+	}
+	f.readers = f.inside.Readers()
+	for i := range f.readers {
+		caps := f.readers[i].Capabilities()
+		if caps.TSO || caps.USO {
+			// Multi-lane: TCP gets coalesced when TSO is on, UDP when USO
+			// is on, everything else (and either lane disabled) falls
+			// through to passthrough so non-IP / non-TCP-UDP traffic still
+			// reaches the TUN.
+			arena := util.NewArena(max(f.batchSize, 1) * 65535)
+			f.batchers[i] = batch.NewMultiCoalescer(f.readers[i], f.l, arena, caps.TSO, caps.USO)
+		} else {
+			arena := util.NewArena(max(f.batchSize, 1) * udp.MTU)
+			f.batchers[i] = batch.NewPassthrough(f.readers[i], f.batchSize, arena)
+		}
 	}

-	// On error the caller owns the cleanup, Control.Start cancels the service context
-	// before releasing our resources so a waiter never observes a live context
+	f.wg.Add(1) // for us to wait on Close() to return
 	if err = f.inside.Activate(); err != nil {
+		f.wg.Done()
+		f.inside.Close()
 		return err
 	}

 	return nil
 }

-func (f *Interface) run() {
+func (f *Interface) run() (func() error, error) {
 	// Launch n queues to read packets from udp
 	for i := 0; i < f.routines; i++ {
 		f.wg.Go(func() {
@@ -354,18 +318,17 @@ func (f *Interface) run() {
 	// Launch n queues to read packets from tun dev
 	for i := 0; i < f.routines; i++ {
 		f.wg.Go(func() {
-			f.listenIn(f.queues[i], i)
+			f.listenIn(f.readers[i], i)
 		})
 	}

-}
-
-func (f *Interface) wait() error {
-	f.wg.Wait()
-	if e := f.fatalErr.Load(); e != nil {
-		return *e
-	}
-	return nil
+	return func() error {
+		f.wg.Wait()
+		if e := f.fatalErr.Load(); e != nil {
+			return *e
+		}
+		return nil
+	}, nil
 }

 // onFatal stores the first fatal reader error, and calls triggerShutdown if it was the first one
@@ -379,31 +342,6 @@ func (f *Interface) onFatal(err error) {
 	}
 }

-type rxContext struct {
-	q       int
-	scratch []byte
-	// nb is a re-usable nonce buffer for decrypt calls to use
-	nb           []byte
-	h            *header.H
-	fwPacket     *firewall.ParsedPacket
-	hostmapCache map[uint32]*HostInfo
-	lhh          *LightHouseHandler
-	ctCache      *firewall.ConntrackCacheTicker
-}
-
-func newRxContext(f *Interface, q int) *rxContext {
-	return &rxContext{
-		q:            q,
-		scratch:      make([]byte, mtu),
-		nb:           make([]byte, 12, 12),
-		h:            &header.H{},
-		fwPacket:     &firewall.ParsedPacket{},
-		hostmapCache: map[uint32]*HostInfo{},
-		lhh:          f.lightHouse.NewRequestHandler(),
-		ctCache:      firewall.NewConntrackCacheTicker(f.ctx, f.l, f.conntrackCacheTimeout),
-	}
-}
-
 func (f *Interface) listenOut(i int) {
 	var li udp.Conn
 	if i > 0 {
@@ -412,25 +350,25 @@ func (f *Interface) listenOut(i int) {
 		li = f.outside
 	}

-	rxc := newRxContext(f, i)
+	ctCache := firewall.NewConntrackCacheTicker(f.ctx, f.l, f.conntrackCacheTimeout)
+	lhh := f.lightHouse.NewRequestHandler()
+	h := &header.H{}
+	fwPacket := &firewall.Packet{}
+	nb := make([]byte, 12, 12)

-	listener := func(fromUdpAddr netip.AddrPort, payload []byte) {
-		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr, SockIdx: i}, payload, rxc)
+	listener := func(fromUdpAddr netip.AddrPort, payload []byte, meta udp.RxMeta) {
+		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr}, payload, h, fwPacket, lhh, nb, i, ctCache.Get(), meta)
 	}

 	flusher := func() {
 		if err := f.batchers[i].Flush(); err != nil {
 			f.l.Error("Failed to flush tun coalescer", "error", err)
 		}
-		clear(rxc.hostmapCache)
 	}

 	err := li.ListenOut(listener, flusher)

-	// An error after teardown began is shutdown noise, the closed flag covers resources
-	// Close releases itself and the cancelled ctx covers ones torn down by their owners
-	// reacting to it, like the user device pipes
-	if err != nil && !f.closed.Load() && f.ctx.Err() == nil {
+	if err != nil && !f.closed.Load() {
 		f.l.Error("Error while reading inbound packet, closing", "error", err)
 		f.onFatal(err)
 	}
@@ -438,185 +376,57 @@ func (f *Interface) listenOut(i int) {
 	f.l.Debug("underlay reader is done", "reader", i)
 }

-func (f *Interface) pinThisThread(i int) {
-	var cpu int
+func (f *Interface) listenIn(reader tio.Queue, q int) {
+	// Pinning this thread (and goroutine) to a single CPU keeps every sendmmsg from this goroutine going through the
+	// same TX ring on the nic, so the wire sees per-flow order.
+	cpu := q % runtime.NumCPU()
 	if n := len(f.cpuAffinity); n > 0 {
-		// Explicit tun.cpu_affinity list wins; parseCpuAffinity already
-		// validated the entries against the allowed CPU set.
-		cpu = f.cpuAffinity[i%n]
-	} else if allowed, err := util.AllowedCPUs(); err == nil && len(allowed) > 0 {
-		// Default: spread queues across the CPUs we're actually allowed to
-		// run on. Under a cpuset/taskset mask these aren't 0..NumCPU-1, so
-		// i % NumCPU would pick unrunnable IDs and every pin would fail.
-		cpu = allowed[i%len(allowed)]
-	} else {
-		cpu = i % runtime.NumCPU()
+		cpu = f.cpuAffinity[q%n]
 	}
 	if err := util.PinThreadToCPU(cpu); err != nil {
-		f.l.Warn("failed to pin tun reader to CPU", "queue", i, "cpu", cpu, "err", err)
+		f.l.Warn("failed to pin tun reader to CPU", "queue", q, "cpu", cpu, "err", err)
 	}
-}

-// txQueue is the per-routine TX state owned by one listenIn goroutine.
-//
-// base carries base-session data, relay carriers, and everything on a tunnel
-// without lanes. It goes out a socket on the base port — egressSock's pick — since
-// base traffic must keep the base source port or a vanilla peer would see it move
-// and roam-thrash. lane[s] goes out a socket on listen.port+s and carries traffic
-// encrypted with lane s's session; lane[0] is base, and the rest are built on the
-// first packet that picks them, since a routine that never sends on a lane should
-// not hold a batch for it. Both come from laneSock, so a routine writes to its own
-// share of each port's socket group.
-//
-// Which lane a packet rides comes from its own flow hash, not from this
-// routine's index. That is deliberate. Which routine reads a flow is the
-// kernel's decision: it hashes the flow to a tun queue, but it also *learns*
-// the queue we write that flow's inbound packets to, and prefers what it
-// learned. So if the lane followed the routine, a peer whose lanes were still
-// down — every peer, for the first moments of a tunnel — would write all of its
-// inbound traffic to queue 0, teaching both kernels to steer every flow to
-// queue 0, and every tunnel would collapse onto lane 0 and stay there for as
-// long as its flows kept busy. Hashing here makes lane spread independent of
-// tun steering entirely.
-//
-// Every batch borrows arena, so a routine holding a batch per lane still costs
-// one slab. The arena is reset by flush once every batch over it is drained.
-//
-// Several routines can still write to one socket — the sockets on a port are
-// shared by the routines whose lane arithmetic lands on them — which the underlay
-// serializes (see batchWriter). Per-flow wire order still holds: a flow is hashed
-// onto one lane and read by one routine, so nothing else is writing it.
-type txQueue struct {
-	// q is the queue this state belongs to, which laneSock needs to resolve a lane
-	// to one of its port's sockets.
-	q     int
-	base  *batch.SendBatch
-	lane  []*batch.SendBatch
-	arena *batch.Arena
-
-	// live is every batch built so far, in build order, so base is first: see
-	// flush. Kept as its own slice because lane is mostly nil holes and both
-	// full and flush walk this per read batch.
-	live []txBatch
-}
-
-// txBatch is a live batch and the index in writers of the socket it flushes to.
-type txBatch struct {
-	sb   *batch.SendBatch
-	sock int
-}
-
-func (f *Interface) newTxQueue(q int) *txQueue {
-	baseSock := f.egressSock(q)
-	arena := batch.NewArena(batch.SendBatchCap * (udp.MTU + 32))
-	base := batch.NewSendBatchSharedArena(f.writers[baseSock], batch.SendBatchCap, arena)
-
-	tx := &txQueue{
-		q:     q,
-		base:  base,
-		arena: arena,
-		live:  []txBatch{{sb: base, sock: baseSock}},
-	}
-	if f.multiport && f.laneCount > 1 {
-		tx.lane = make([]*batch.SendBatch, f.laneCount)
-		tx.lane[0] = base
-	}
-	return tx
-}
-
-// laneBatch returns the batch for lane s, building it the first time this
-// routine sends on that lane. Lanes this queue doesn't cover fall back to base,
-// which is also lane 0's batch.
-func (tx *txQueue) laneBatch(f *Interface, s int) *batch.SendBatch {
-	if s <= 0 || s >= len(tx.lane) {
-		return tx.base
-	}
-	sb := tx.lane[s]
-	if sb == nil {
-		sock := f.laneSock(tx.q, s)
-		sb = batch.NewSendBatchSharedArena(f.writers[sock], batch.SendBatchCap, tx.arena)
-		tx.lane[s] = sb
-		tx.live = append(tx.live, txBatch{sb: sb, sock: sock})
-	}
-	return sb
-}
-
-// full reports a full sendmmsg worth of work queued across every lane, rather
-// than on any one of them: the arena is shared, so it is the total that bounds
-// how much is outstanding.
-func (tx *txQueue) full() bool {
-	n := 0
-	for _, b := range tx.live {
-		n += b.sb.Len()
-	}
-	return n >= batch.SendBatchCap
-}
-
-// flush drains base before the lanes so that when a flow moves from the base
-// session onto a freshly promoted lane mid-window, its packets still leave this
-// host in encryption order. Resetting the shared arena is this queue's job,
-// since no single batch's Flush can know the others are done with it.
-func (tx *txQueue) flush(f *Interface) {
-	for _, b := range tx.live {
-		if b.sb.Len() > 0 {
-			f.flushSendBatch(b.sb, b.sock)
-		}
-	}
-	tx.arena.Reset()
-}
-
-func (f *Interface) listenIn(queue tio.Queue, i int) {
-	// Pinning this thread (and goroutine) to a single CPU keeps every sendmmsg from this goroutine going through the
-	// same TX ring on the nic, so the wire sees per-flow order. Skip entirely when tun.pin_threads is false.
-	if f.pinThreads {
-		f.pinThisThread(i)
+	const bonusInfo = 16
+	bufferScale := udp.MTU + bonusInfo
+	numTunPackets := 1
+	caps := reader.Capabilities()
+	if caps.TSO || caps.USO {
+		bufferScale = 65535 + bonusInfo
+		numTunPackets = f.batchSize
 	}

 	rejectBuf := make([]byte, mtu)
-	tx := f.newTxQueue(i)
-	fwPacket := &firewall.ParsedPacket{}
+	tunPackets := make([]wire.TunPacket, numTunPackets)
+	packetMem := make([]byte, bufferScale*numTunPackets)
+
+	arenaSize := batch.SendBatchCap * (udp.MTU + 32)
+	sb := batch.NewSendBatch(f.writers[q], batch.SendBatchCap, util.NewArena(arenaSize))
+	fwPacket := &firewall.Packet{}
 	nb := make([]byte, 12, 12)

 	conntrackCache := firewall.NewConntrackCacheTicker(f.ctx, f.l, f.conntrackCacheTimeout)

 	for {
-		pkts, err := queue.Read()
+		n, err := reader.Read(tunPackets, packetMem)
 		if err != nil {
-			// Same shutdown noise handling as listenOut
-			if !f.closed.Load() && f.ctx.Err() == nil {
-				f.l.Error("Error while reading outbound packet, closing", "error", err, "reader", i)
+			if !f.closed.Load() {
+				f.l.Error("Error while reading outbound packet, closing", "error", err, "reader", q)
 				f.onFatal(err)
 			}
 			break
 		}

-		for _, pkt := range pkts {
-			f.consumeInsidePacket(pkt, fwPacket, nb, tx, rejectBuf, i, conntrackCache.Get())
-			// Flush incrementally once a full sendmmsg batch has
-			// accumulated so the first packets of a deep read drain
-			// hit the wire while the rest are still being encrypted.
-			if tx.full() {
-				tx.flush(f)
-			}
+		ctCache := conntrackCache.Get()
+		for i := range n {
+			f.consumeInsidePacket(tunPackets[i], fwPacket, nb, sb, rejectBuf, q, ctCache)
+		}
+		if err := sb.Flush(); err != nil {
+			f.l.Error("Failed to write outgoing batch", "error", err, "writer", q)
 		}
-		tx.flush(f)
 	}

-	f.l.Debug("overlay reader is done", "reader", i)
-}
-
-// flushSendBatch drains sb to the underlay and accounts for anything it could not deliver. A shortfall means
-// specific destinations were undeliverable (a stale remote, a reject rule), which the backend logs per peer at
-// debug; here it is only a counter, so one unreachable peer cannot spam a log line per batch.
-func (f *Interface) flushSendBatch(sb *batch.SendBatch, q int) {
-	queued := sb.Len()
-	written, err := sb.Flush()
-	if err != nil {
-		f.l.Error("Failed to write outgoing batch", "error", err, "writer", q)
-	}
-	if dropped := queued - written; dropped > 0 {
-		f.metricTxDropped.Inc(int64(dropped))
-	}
+	f.l.Debug("overlay reader is done", "reader", q)
 }

 func (f *Interface) RegisterConfigChangeCallbacks(c *config.C) {
@@ -625,6 +435,7 @@ func (f *Interface) RegisterConfigChangeCallbacks(c *config.C) {
 	c.RegisterReloadCallback(f.reloadAcceptRecvError)
 	c.RegisterReloadCallback(f.reloadDisconnectInvalid)
 	c.RegisterReloadCallback(f.reloadMisc)
+	c.RegisterReloadCallback(f.reloadEcn)

 	for _, udpConn := range f.writers {
 		c.RegisterReloadCallback(udpConn.ReloadConfig)
@@ -642,22 +453,13 @@ func (f *Interface) reloadDisconnectInvalid(c *config.C) {
 }

 func (f *Interface) reloadFirewall(c *config.C) {
-	cs := f.pki.getCertState()
-	curCert := cs.getCertificate(cert.Version2)
-	if curCert == nil {
-		curCert = cs.getCertificate(cert.Version1)
-	}
-
-	// The firewall builds its routableNetworks set from the certificate's UnsafeNetworks at construction.
-	// Check to see if that set has changed, and if so, rebuild the firewall.
-	certUnsafeChanged := curCert != nil && !slices.Equal(curCert.UnsafeNetworks(), f.firewall.unsafeNetworks)
-
-	if !c.HasChanged("firewall") && !certUnsafeChanged {
+	//TODO: need to trigger/detect if the certificate changed too
+	if c.HasChanged("firewall") == false {
 		f.l.Debug("No firewall config change detected")
 		return
 	}

-	fw, err := NewFirewallFromConfig(f.l, cs, c)
+	fw, err := NewFirewallFromConfig(f.l, f.pki.getCertState(), c)
 	if err != nil {
 		f.l.Error("Error while creating firewall during reload", "error", err)
 		return
@@ -757,6 +559,20 @@ func (f *Interface) reloadMisc(c *config.C) {
 	}
 }

+// reloadEcn syncs Interface.ecnEnabled with the tunnels.ecn config knob.
+// Default is enabled (RFC 6040 normal mode); set false on the rare path
+// where an underlay middlebox rewrites or drops ECN bits unpredictably.
+func (f *Interface) reloadEcn(c *config.C) {
+	initial := c.InitialLoad()
+	if initial || c.HasChanged("tunnels.ecn") {
+		v := c.GetBool("tunnels.ecn", true)
+		f.ecnEnabled.Store(v)
+		if !initial {
+			f.l.Info("tunnels.ecn changed", "enabled", v)
+		}
+	}
+}
+
 func (f *Interface) emitStats(ctx context.Context, i time.Duration) {
 	ticker := time.NewTicker(i)
 	defer ticker.Stop()
@@ -767,46 +583,26 @@ func (f *Interface) emitStats(ctx context.Context, i time.Duration) {
 	certInitiatingVersion := metrics.GetOrRegisterGauge("certificate.initiating_version", nil)
 	certMaxVersion := metrics.GetOrRegisterGauge("certificate.max_version", nil)

-	// Registered only when we run multiport, so these don't sit at zero on a node
-	// that was never going to have a lane and read as a broken feature.
-	var lanesUpGauge, laneTunnelsGauge metrics.Gauge
-	if f.multiport && f.laneCount > 1 {
-		lanesUpGauge = metrics.GetOrRegisterGauge("multiport.lanes.up", nil)
-		laneTunnelsGauge = metrics.GetOrRegisterGauge("multiport.lanes.tunnels", nil)
-	}
-
-	emit := func() {
-		f.firewall.EmitStats()
-		f.handshakeManager.EmitStats()
-		udpStats()
-
-		if lanesUpGauge != nil {
-			f.emitLaneStats(lanesUpGauge, laneTunnelsGauge)
-		}
-
-		certState := f.pki.getCertState()
-		defaultCrt := certState.GetDefaultCertificate()
-		certExpirationGauge.Update(int64(defaultCrt.NotAfter().Sub(time.Now()) / time.Second))
-		certInitiatingVersion.Update(int64(defaultCrt.Version()))
-
-		// Report the max certificate version we are capable of using
-		if certState.v2Cert != nil {
-			certMaxVersion.Update(int64(certState.v2Cert.Version()))
-		} else {
-			certMaxVersion.Update(int64(certState.v1Cert.Version()))
-		}
-	}
-
-	// Prime gauges so a Prometheus scrape that lands before the first tick
-	// sees real values instead of the zero defaults (issue #907).
-	emit()
-
 	for {
 		select {
 		case <-ctx.Done():
 			return
 		case <-ticker.C:
-			emit()
+			f.firewall.EmitStats()
+			f.handshakeManager.EmitStats()
+			udpStats()
+
+			certState := f.pki.getCertState()
+			defaultCrt := certState.GetDefaultCertificate()
+			certExpirationGauge.Update(int64(defaultCrt.NotAfter().Sub(time.Now()) / time.Second))
+			certInitiatingVersion.Update(int64(defaultCrt.Version()))
+
+			// Report the max certificate version we are capable of using
+			if certState.v2Cert != nil {
+				certMaxVersion.Update(int64(certState.v2Cert.Version()))
+			} else {
+				certMaxVersion.Update(int64(certState.v1Cert.Version()))
+			}
 		}
 	}
 }
@@ -819,15 +615,9 @@ func (f *Interface) GetCertState() *CertState {
 	return f.pki.getCertState()
 }

-// Close releases the interface's resources: the udp sockets and the tun device.
-// It is idempotent and safe to call at any point in the lifecycle, including on an interface that never activated,
-// calls after the first return nil without doing anything.
 func (f *Interface) Close() error {
-	if !f.closed.CompareAndSwap(false, true) {
-		return nil
-	}
-
 	var errs []error
+	f.closed.Store(true)

 	// Release the udp readers
 	for i, u := range f.writers {
@@ -843,8 +633,6 @@ func (f *Interface) Close() error {
 	if closeErr != nil {
 		errs = append(errs, closeErr)
 	}
-
-	// Release the construction token so waiters know the resources are gone
 	f.wg.Done()
 	return errors.Join(errs...)
 }
@@ -1,73 +0,0 @@
-//go:build linux || darwin
-
-package nebula
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/rcrowley/go-metrics"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/firewall"
-	"github.com/slackhq/nebula/overlay/overlaytest"
-	"github.com/slackhq/nebula/test"
-	"github.com/slackhq/nebula/udp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// Test_emitStats_primesGauges covers issue #907: a Prometheus scrape that
-// landed before the first ticker fire used to read 0 for the cert gauges.
-// emitStats now primes the gauges before entering the ticker loop. We assert
-// the gauge is zero before the first call and non-zero after.
-func Test_emitStats_primesGauges(t *testing.T) {
-	defer metrics.DefaultRegistry.UnregisterAll()
-
-	l := test.NewLogger()
-	hostMap := newHostMap(l)
-	preferredRanges := []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}
-	hostMap.preferredRanges.Store(&preferredRanges)
-
-	notAfter := time.Now().Add(time.Hour)
-	cs := &CertState{
-		initiatingVersion: cert.Version1,
-		privateKey:        []byte{},
-		v1Cert:            &dummyCert{version: cert.Version1, notAfter: notAfter},
-		v1Credential:      nil,
-	}
-
-	lh := newTestLighthouse()
-	ifce := &Interface{
-		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
-		outside:          &udp.NoopConn{},
-		firewall:         &Firewall{Conntrack: &FirewallConntrack{Conns: map[firewall.Packet]*conn{}}},
-		lightHouse:       lh,
-		pki:              &PKI{},
-		handshakeManager: NewHandshakeManager(l, hostMap, lh, &udp.NoopConn{}, defaultHandshakeConfig),
-		l:                l,
-		// On linux, udp.NewUDPStatsEmitter indexes writers[0] and asserts to
-		// *udp.StdConn. A zero value works: getMemInfo sees a nil rawConn,
-		// returns an error, and the emitter falls through to a no-op.
-		writers: []udp.Conn{&udp.StdConn{}},
-	}
-	ifce.pki.cs.Store(cs)
-
-	ttlGauge := metrics.GetOrRegisterGauge("certificate.ttl_seconds", nil)
-	require.Zero(t, ttlGauge.Value(), "gauge should be zero before emitStats runs")
-
-	// Pre-cancel the context so emitStats returns after priming the gauges
-	// without ever reading from ticker.C. The one hour interval is just a
-	// belt-and-suspenders, the test does not expect the ticker to fire.
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	ifce.emitStats(ctx, time.Hour)
-
-	ttl := ttlGauge.Value()
-	assert.Positive(t, ttl, "ttl gauge should be primed by emitStats before its first tick")
-	assert.LessOrEqual(t, ttl, int64(3600))
-	assert.Equal(t, int64(cert.Version1), metrics.GetOrRegisterGauge("certificate.initiating_version", nil).Value())
-	assert.Equal(t, int64(cert.Version1), metrics.GetOrRegisterGauge("certificate.max_version", nil).Value())
-}
@@ -1,120 +0,0 @@
-package nebula
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/test"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestReloadFirewall_CertUnsafeNetworksChanged verifies that reloadFirewall
-// rebuilds the firewall when only the certificate's UnsafeNetworks have changed,
-// even if the firewall section of the YAML has not.
-func TestReloadFirewall_CertUnsafeNetworksChanged(t *testing.T) {
-	l := test.NewLogger()
-
-	vpnNet := netip.MustParsePrefix("10.0.0.1/24")
-	initialUnsafe := []netip.Prefix{netip.MustParsePrefix("198.51.100.0/24")}
-
-	// dummyCert avoids dragging the real signing pipeline into a unit test.
-	c1 := &dummyCert{
-		version:        cert.Version2,
-		networks:       []netip.Prefix{vpnNet},
-		unsafeNetworks: initialUnsafe,
-	}
-	pki := &PKI{}
-	pki.cs.Store(&CertState{v2Cert: c1, initiatingVersion: cert.Version2})
-
-	rawYAML := `firewall:
-  outbound:
-    - port: any
-      proto: any
-      host: any
-  inbound:
-    - port: any
-      proto: any
-      host: any
-`
-	cfg := config.NewC(l)
-	require.NoError(t, cfg.LoadString(rawYAML))
-
-	fw, err := NewFirewallFromConfig(l, pki.getCertState(), cfg)
-	require.NoError(t, err)
-	require.Equal(t, initialUnsafe, fw.unsafeNetworks)
-
-	f := &Interface{
-		pki:      pki,
-		firewall: fw,
-		l:        l,
-	}
-
-	// Swap the cert with a different UnsafeNetworks set.
-	newUnsafe := []netip.Prefix{
-		netip.MustParsePrefix("198.51.100.0/24"),
-		netip.MustParsePrefix("203.0.113.0/24"),
-	}
-	c2 := &dummyCert{
-		version:        cert.Version2,
-		networks:       []netip.Prefix{vpnNet},
-		unsafeNetworks: newUnsafe,
-	}
-	pki.cs.Store(&CertState{v2Cert: c2, initiatingVersion: cert.Version2})
-
-	// Reload with the same YAML so HasChanged("firewall") reports false.
-	require.NoError(t, cfg.ReloadConfigString(rawYAML))
-	require.False(t, cfg.HasChanged("firewall"))
-
-	f.reloadFirewall(cfg)
-
-	assert.NotSame(t, fw, f.firewall, "firewall pointer should have been replaced")
-	assert.Equal(t, newUnsafe, f.firewall.unsafeNetworks)
-	assert.True(t, f.firewall.routableNetworks.Contains(netip.MustParseAddr("203.0.113.5")))
-}
-
-// TestReloadFirewall_NoChange verifies that reloadFirewall is a no-op when
-// neither the firewall config nor the cert's UnsafeNetworks have changed.
-func TestReloadFirewall_NoChange(t *testing.T) {
-	l := test.NewLogger()
-
-	vpnNet := netip.MustParsePrefix("10.0.0.1/24")
-	unsafe := []netip.Prefix{netip.MustParsePrefix("198.51.100.0/24")}
-
-	c1 := &dummyCert{
-		version:        cert.Version2,
-		networks:       []netip.Prefix{vpnNet},
-		unsafeNetworks: unsafe,
-	}
-	pki := &PKI{}
-	pki.cs.Store(&CertState{v2Cert: c1, initiatingVersion: cert.Version2})
-
-	rawYAML := `firewall:
-  outbound:
-    - port: any
-      proto: any
-      host: any
-  inbound:
-    - port: any
-      proto: any
-      host: any
-`
-	cfg := config.NewC(l)
-	require.NoError(t, cfg.LoadString(rawYAML))
-
-	fw, err := NewFirewallFromConfig(l, pki.getCertState(), cfg)
-	require.NoError(t, err)
-
-	f := &Interface{
-		pki:      pki,
-		firewall: fw,
-		l:        l,
-	}
-
-	require.NoError(t, cfg.ReloadConfigString(rawYAML))
-	f.reloadFirewall(cfg)
-
-	assert.Same(t, fw, f.firewall, "firewall should not have been replaced")
-}
@@ -1,146 +0,0 @@
-package iputil
-
-import (
-	"encoding/binary"
-
-	"github.com/slackhq/nebula/overlay/checksum"
-	"golang.org/x/net/ipv4"
-	"golang.org/x/net/ipv6"
-)
-
-const udpHeaderLen = 8
-
-// SetTransportChecksum recomputes the TCP or UDP checksum of an IPv4 or IPv6
-// packet in place.
-//
-// A kernel that offloads checksums to the NIC hands a packet to a tun with the
-// transport checksum unfinished: only the pseudo-header sum is in the field and
-// the rest is left for hardware that a tun does not have. A packet written
-// straight back to that tun is dropped on re-entry unless the checksum is
-// completed first. ICMP is left alone; it arrived complete on the kernels this
-// was measured against.
-//
-// So is any packet whose transport header cannot be located: fragments, unknown
-// extension headers and truncated packets. An IPv6 fragment header is declined
-// even when it carries the whole datagram (RFC 6946 atomic fragment), because
-// the walk reports only that a fragment header was present.
-func SetTransportChecksum(packet []byte) {
-	if len(packet) < 1 {
-		return
-	}
-	switch int(packet[0] >> 4) {
-	case ipv4.Version:
-		setTransportChecksum4(packet)
-	case ipv6.Version:
-		setTransportChecksum6(packet)
-	}
-}
-
-func setTransportChecksum4(packet []byte) {
-	if len(packet) < ipv4.HeaderLen {
-		return
-	}
-	ihl := int(packet[0]&0x0f) << 2
-	end := int(binary.BigEndian.Uint16(packet[2:4]))
-	if ihl < ipv4.HeaderLen || end < ihl || end > len(packet) {
-		return
-	}
-	// The checksum covers the whole datagram, which a fragment (MF set or a
-	// non-zero offset) does not carry.
-	if binary.BigEndian.Uint16(packet[6:8])&0x3fff != 0 {
-		return
-	}
-
-	transport, ok := transportExtent(packet[ihl:end], packet[9])
-	if !ok {
-		return
-	}
-	csum := ipv4PseudoheaderChecksum(packet[12:16], packet[16:20], uint32(packet[9]), uint32(len(transport)))
-	writeTransportChecksum(transport, packet[9], csum)
-}
-
-func setTransportChecksum6(packet []byte) {
-	if len(packet) < ipv6.HeaderLen {
-		return
-	}
-	end := ipv6.HeaderLen + int(binary.BigEndian.Uint16(packet[4:6]))
-	if end > len(packet) {
-		return
-	}
-
-	// The checksum covers the whole datagram, which a fragment does not carry.
-	// An unknown extension header hides where the transport header starts. A
-	// chain longer than the walk's budget ends it early, at an offset that was
-	// never checked against the packet.
-	proto, offset, _, anyFragment, err := IPv6FindUpperProtocol(packet[:end])
-	if err != nil || anyFragment || offset >= end {
-		return
-	}
-
-	transport, ok := transportExtent(packet[offset:end], proto)
-	if !ok {
-		return
-	}
-	csum := ipv6PseudoheaderChecksum(packet[8:24], packet[24:40], uint32(proto), uint32(len(transport)))
-	writeTransportChecksum(transport, proto, csum)
-}
-
-// transportExtent narrows a segment to the length its own header declares. UDP
-// carries a Length field, and RFC 768 and RFC 8200 section 8.1 both make that
-// field, not the IP payload extent, the length the pseudo-header counts and the
-// checksum covers; a datagram padded out to a link's minimum frame is the usual
-// way the two differ. TCP has no such field, so its segment runs to the end of
-// the IP payload. A Length that overruns the bytes IP delivered describes a
-// datagram that is not there.
-func transportExtent(transport []byte, proto uint8) ([]byte, bool) {
-	if proto != IPProtocolUDP {
-		return transport, true
-	}
-	if len(transport) < udpHeaderLen {
-		return nil, false
-	}
-	ulen := int(binary.BigEndian.Uint16(transport[4:6]))
-	if ulen < udpHeaderLen || ulen > len(transport) {
-		return nil, false
-	}
-	return transport[:ulen], true
-}
-
-// writeTransportChecksum stores the checksum of transport, taken over the
-// pseudo-header sum csum, in the header's checksum field. A UDP checksum that
-// computes to zero goes on the wire as 0xffff: zero means no checksum was
-// computed (RFC 768), and over IPv6 the checksum is mandatory (RFC 8200
-// section 8.1).
-func writeTransportChecksum(transport []byte, proto uint8, csum uint32) {
-	var at, minLen int
-	switch proto {
-	case IPProtocolTCP:
-		at, minLen = 16, 20
-	case IPProtocolUDP:
-		at, minLen = 6, udpHeaderLen
-	default:
-		return
-	}
-	if len(transport) < minLen {
-		return
-	}
-
-	transport[at], transport[at+1] = 0, 0
-	sum := ^checksum.Checksum(transport, fold(csum))
-	if sum == 0 && proto == IPProtocolUDP {
-		sum = 0xffff
-	}
-	binary.BigEndian.PutUint16(transport[at:], sum)
-}
-
-// fold reduces a pseudo-header sum to the 16 bit seed Checksum takes. Carrying
-// the high half back into the low half is what keeps the reduction lossless, so
-// the seed sums exactly as the wider value would; 0xffff is its fixed point.
-// Every term of that sum comes from a 16 bit field, so it stays far below the
-// width at which the accumulator would wrap.
-func fold(csum uint32) uint16 {
-	for csum > 0xffff {
-		csum = (csum >> 16) + (csum & 0xffff)
-	}
-	return uint16(csum)
-}
@@ -1,242 +0,0 @@
-package iputil
-
-import (
-	"encoding/binary"
-	"net"
-	"testing"
-
-	"github.com/google/gopacket"
-	"github.com/google/gopacket/layers"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/net/ipv6"
-)
-
-// serialize builds a packet with gopacket, whose checksums are computed
-// independently of this package.
-func serialize(t *testing.T, ls ...gopacket.SerializableLayer) []byte {
-	buf := gopacket.NewSerializeBuffer()
-	require.NoError(t, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true, ComputeChecksums: true}, ls...))
-	return append([]byte(nil), buf.Bytes()...)
-}
-
-// withExtensionHeader inserts an 8 byte IPv6 extension header of the given
-// type between the IPv6 header and its payload. The transport checksum does not
-// change: the pseudo-header counts only upper-layer bytes.
-func withExtensionHeader(pkt []byte, typ layers.IPProtocol, hdr [8]byte) []byte {
-	hdr[0] = pkt[6]
-	out := make([]byte, 0, len(pkt)+8)
-	out = append(out, pkt[:40]...)
-	out = append(out, hdr[:]...)
-	out = append(out, pkt[40:]...)
-	out[6] = byte(typ)
-	binary.BigEndian.PutUint16(out[4:6], binary.BigEndian.Uint16(pkt[4:6])+8)
-	return out
-}
-
-// truncate copies the first n bytes into a buffer of exactly that capacity, so
-// a read past the length panics instead of quietly succeeding.
-func truncate(pkt []byte, n int) []byte {
-	out := make([]byte, n)
-	copy(out, pkt)
-	return out
-}
-
-// extChain builds an IPv6 packet fronted by n Destination Options headers. Each
-// points at another one, so the walk spends its whole budget without reaching a
-// transport header. lastExtLen inflates the final header's declared length,
-// which is how the walk ends up past the end of the packet.
-func extChain(n int, lastExtLen byte) []byte {
-	pkt := make([]byte, ipv6.HeaderLen)
-	pkt[0], pkt[6], pkt[7] = 0x60, 60, 64
-	for i := range n {
-		h := make([]byte, 8)
-		h[0] = 60
-		if i == n-1 {
-			h[1] = lastExtLen
-		}
-		pkt = append(pkt, h...)
-	}
-	pkt = append(pkt, make([]byte, 20)...)
-	binary.BigEndian.PutUint16(pkt[4:6], uint16(len(pkt)-ipv6.HeaderLen))
-	return pkt
-}
-
-func TestSetTransportChecksum(t *testing.T) {
-	// Source and destination differ so that a pseudo-header built from the wrong
-	// one, or from the two swapped, does not land on the same checksum anyway.
-	v4 := func(proto layers.IPProtocol) *layers.IPv4 {
-		return &layers.IPv4{Version: 4, TTL: 64, Id: 0x1234, Protocol: proto, SrcIP: net.IPv4(192, 0, 2, 1).To4(), DstIP: net.IPv4(198, 51, 100, 2).To4()}
-	}
-	v6 := func(proto layers.IPProtocol) *layers.IPv6 {
-		return &layers.IPv6{Version: 6, HopLimit: 64, NextHeader: proto, SrcIP: net.ParseIP("2001:db8::1"), DstIP: net.ParseIP("2001:db8:1::2")}
-	}
-	tcp := func(ip gopacket.NetworkLayer) *layers.TCP {
-		l := &layers.TCP{SrcPort: 49152, DstPort: 443, SYN: true, Window: 65535}
-		require.NoError(t, l.SetNetworkLayerForChecksum(ip))
-		return l
-	}
-	udp := func(ip gopacket.NetworkLayer) *layers.UDP {
-		l := &layers.UDP{SrcPort: 49152, DstPort: 53}
-		require.NoError(t, l.SetNetworkLayerForChecksum(ip))
-		return l
-	}
-	payload := gopacket.Payload("self")
-	nop := layers.IPv4Option{OptionType: 1, OptionLength: 1}
-
-	ip4tcp := v4(layers.IPProtocolTCP)
-	ip4opts := v4(layers.IPProtocolTCP)
-	ip4opts.Options = []layers.IPv4Option{nop, nop, nop, nop}
-	ip4udp := v4(layers.IPProtocolUDP)
-	ip6tcp := v6(layers.IPProtocolTCP)
-	ip6udp := v6(layers.IPProtocolUDP)
-	hopByHop := [8]byte{0, 0, 1, 4} // next header, length 0, PadN of 4
-
-	// Bytes past the length the IP header declares are not part of the
-	// datagram and must not be summed.
-	trailing4 := append(serialize(t, ip4tcp, tcp(ip4tcp), payload), []byte("trailing")...)
-	trailing6 := append(serialize(t, ip6tcp, tcp(ip6tcp), payload), []byte("trailing")...)
-
-	// A datagram padded out past the length UDP declares: the pseudo-header
-	// counts the UDP Length field, so the checksum is the unpadded one.
-	padded4 := append(serialize(t, ip4udp, udp(ip4udp), payload), []byte("pad!")...)
-	binary.BigEndian.PutUint16(padded4[2:4], uint16(len(padded4)))
-	padded6 := append(serialize(t, ip6udp, udp(ip6udp), payload), []byte("pad!")...)
-	binary.BigEndian.PutUint16(padded6[4:6], uint16(len(padded6)-ipv6.HeaderLen))
-
-	// Corrupting the checksum and asking for it back must yield gopacket's
-	// packet, byte for byte.
-	recomputed := []struct {
-		name  string
-		pkt   []byte
-		cksum int
-	}{
-		{"v4 tcp", serialize(t, ip4tcp, tcp(ip4tcp), payload), 20 + 16},
-		{"v4 tcp with ip options", serialize(t, ip4opts, tcp(ip4opts), payload), 24 + 16},
-		{"v4 udp", serialize(t, ip4udp, udp(ip4udp), payload), 20 + 6},
-		{"v4 tcp header only", serialize(t, ip4tcp, tcp(ip4tcp)), 20 + 16},
-		{"v4 udp header only", serialize(t, ip4udp, udp(ip4udp)), 20 + 6},
-		{"v6 tcp", serialize(t, ip6tcp, tcp(ip6tcp), payload), 40 + 16},
-		{"v6 udp", serialize(t, ip6udp, udp(ip6udp), payload), 40 + 6},
-		{"v6 udp header only", serialize(t, ip6udp, udp(ip6udp)), 40 + 6},
-		{"v6 tcp behind hop-by-hop", withExtensionHeader(serialize(t, ip6tcp, tcp(ip6tcp), payload), layers.IPProtocolIPv6HopByHop, hopByHop), 48 + 16},
-		{"v4 tcp with bytes past the total length", trailing4, 20 + 16},
-		{"v6 tcp with bytes past the payload length", trailing6, 40 + 16},
-		{"v4 udp padded past its declared length", padded4, 20 + 6},
-		{"v6 udp padded past its declared length", padded6, 40 + 6},
-	}
-	for _, tt := range recomputed {
-		t.Run(tt.name, func(t *testing.T) {
-			got := append([]byte(nil), tt.pkt...)
-			binary.BigEndian.PutUint16(got[tt.cksum:], 0x1234)
-			require.NotEqual(t, tt.pkt, got)
-			SetTransportChecksum(got)
-			assert.Equal(t, tt.pkt, got)
-		})
-	}
-
-	ip4frag := v4(layers.IPProtocolTCP)
-	ip4frag.Flags = layers.IPv4MoreFragments
-	ip4later := v4(layers.IPProtocolTCP)
-	ip4later.FragOffset = 1
-	ip4icmp := v4(layers.IPProtocolICMPv4)
-
-	badIHL := serialize(t, ip4tcp, tcp(ip4tcp), payload)
-	badIHL[0] = 0x44 // header length 16, shorter than an ipv4 header
-	shortTotalLen := serialize(t, ip4tcp, tcp(ip4tcp), payload)
-	binary.BigEndian.PutUint16(shortTotalLen[2:4], 10) // shorter than the header it introduces
-	cutTCP := serialize(t, ip4tcp, tcp(ip4tcp), payload)
-	binary.BigEndian.PutUint16(cutTCP[2:4], 20+19) // one byte short of a tcp header
-	cutTCP = truncate(cutTCP, 20+19)
-	cutUDP := serialize(t, ip4udp, udp(ip4udp), payload)
-	binary.BigEndian.PutUint16(cutUDP[2:4], 20+7) // one byte short of a udp header
-	cutUDP = truncate(cutUDP, 20+7)
-	// Two bytes short, so a transport header survives whole and the minimum
-	// length check cannot stand in for the bounds check.
-	cutV6 := truncate(serialize(t, ip6tcp, tcp(ip6tcp), payload), 62)
-	fragment := [8]byte{0, 0, 0, 1, 0, 0, 0, 1} // next header, reserved, offset 0 with M set, id
-	overrun4 := serialize(t, ip4udp, udp(ip4udp), payload)
-	binary.BigEndian.PutUint16(overrun4[24:26], uint16(len(overrun4)-20+1)) // one byte past what ip delivered
-	overrun6 := serialize(t, ip6udp, udp(ip6udp), payload)
-	binary.BigEndian.PutUint16(overrun6[44:46], uint16(len(overrun6)-ipv6.HeaderLen+1))
-	shortUDPLen := serialize(t, ip4udp, udp(ip4udp), payload)
-	binary.BigEndian.PutUint16(shortUDPLen[24:26], 7) // shorter than the header it counts
-
-	// Where the checksum cannot be completed the packet is left as it came.
-	untouched := []struct {
-		name  string
-		pkt   []byte
-		cksum int
-	}{
-		{"v4 first fragment", serialize(t, ip4frag, tcp(ip4frag), payload), 20 + 16},
-		{"v4 later fragment", serialize(t, ip4later, tcp(ip4later), payload), 20 + 16},
-		{"v4 icmp", serialize(t, ip4icmp, &layers.ICMPv4{TypeCode: layers.CreateICMPv4TypeCode(8, 0), Id: 1, Seq: 1}, payload), 20 + 2},
-		{"v4 header length below the minimum", badIHL, 20 + 16},
-		{"v4 total length below the header length", shortTotalLen, 20 + 16},
-		{"v4 truncated below its total length", truncate(serialize(t, ip4tcp, tcp(ip4tcp), payload), 30), -1},
-		{"v4 tcp header cut short", cutTCP, 20 + 16},
-		{"v4 udp header cut short", cutUDP, -1},
-		{"v6 fragment", withExtensionHeader(serialize(t, ip6tcp, tcp(ip6tcp), payload), layers.IPProtocolIPv6Fragment, fragment), 48 + 16},
-		{"v6 truncated below its payload length", truncate(serialize(t, ip6tcp, tcp(ip6tcp), payload), 50), -1},
-		{"v6 truncated with a whole transport header still present", cutV6, 40 + 16},
-		{"v6 extension header chain longer than the walk", extChain(9, 0), 112 + 16},
-		{"v6 extension header chain running past the packet", extChain(8, 255), 104 + 16},
-		{"v4 udp length past the end of the datagram", overrun4, 20 + 6},
-		{"v6 udp length past the end of the datagram", overrun6, 40 + 6},
-		{"v4 udp length below a udp header", shortUDPLen, 20 + 6},
-	}
-	for _, tt := range untouched {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.cksum >= 0 {
-				binary.BigEndian.PutUint16(tt.pkt[tt.cksum:], 0x1234)
-			}
-			want := append([]byte(nil), tt.pkt...)
-			SetTransportChecksum(tt.pkt)
-			assert.Equal(t, want, tt.pkt)
-		})
-	}
-
-	t.Run("too short to carry a header", func(t *testing.T) {
-		for _, pkt := range [][]byte{nil, {}, {0x45}, {0x60}} {
-			assert.NotPanics(t, func() { SetTransportChecksum(pkt) })
-		}
-	})
-
-	t.Run("tcp checksum of zero goes out as zero", func(t *testing.T) {
-		pkt := serialize(t, ip4tcp, tcp(ip4tcp), gopacket.Payload{0, 0})
-		c := binary.BigEndian.Uint16(pkt[36:38])
-		require.NotZero(t, c)
-		// Only udp reserves zero to mean "not computed", so tcp keeps it.
-		binary.BigEndian.PutUint16(pkt[40:42], c)
-		SetTransportChecksum(pkt)
-		assert.Zero(t, binary.BigEndian.Uint16(pkt[36:38]))
-	})
-
-	t.Run("udp checksum of zero goes out as 0xffff", func(t *testing.T) {
-		pkt := serialize(t, ip4udp, udp(ip4udp), gopacket.Payload{0, 0})
-		c := binary.BigEndian.Uint16(pkt[26:28])
-		require.NotZero(t, c)
-		// The one's complement sum is now 0xffff - c; adding c to the payload
-		// makes it 0xffff, whose complement is zero.
-		binary.BigEndian.PutUint16(pkt[28:30], c)
-		SetTransportChecksum(pkt)
-		assert.Equal(t, uint16(0xffff), binary.BigEndian.Uint16(pkt[26:28]))
-	})
-}
-
-func TestFold(t *testing.T) {
-	// 0xffff is the fold's fixed point, so a loop bound one notch tight never
-	// terminates on it.
-	for _, tt := range []struct {
-		in   uint32
-		want uint16
-	}{
-		{0, 0},
-		{0xffff, 0xffff},
-		{0x10000, 1},
-		{0x1fffe, 0xffff},
-		{0xffffffff, 0xffff},
-	} {
-		assert.Equal(t, tt.want, fold(tt.in))
-	}
-}
@@ -2,68 +2,28 @@ package iputil

 import (
 	"encoding/binary"
-	"errors"

 	"golang.org/x/net/ipv4"
-	"golang.org/x/net/ipv6"
 )

-// ErrIPv6CouldNotFindPayload is returned when the ipv6 extension header chain is truncated before a terminal
-// upper layer protocol is reached.
-var ErrIPv6CouldNotFindPayload = errors.New("could not find payload in ipv6 packet")
-
 const (
-	// MaxIPv4RejectPacketSize is the largest IPv4 reject packet:
+	// Need 96 bytes for the largest reject packet:
 	// - 20 byte ipv4 header
 	// - 8 byte icmpv4 header
 	// - 68 byte body (60 byte max orig ipv4 header + 8 byte orig icmpv4 header)
-	maxIPv4RejectPacketSize = ipv4.HeaderLen + 8 + 60 + 8
-
-	// MaxRejectPacketSize is sized for the largest possible reject packet (IPv6):
-	// - 40 byte ipv6 header
-	// - 8 byte icmpv6 header
-	// - up to 1000 byte body (original packet, possibly truncated. We want to stay
-	//   under the MTU with Nebula overhead included)
-	maxIPv6RejectPacketSize = ipv6.HeaderLen + 8 + 1000
-
-	MaxRejectPacketSize = maxIPv6RejectPacketSize
-
-	IPProtocolICMP        = 1
-	IPProtocolICMPv6      = 58
-	IPProtocolTCP         = 6
-	IPProtocolUDP         = 17
-	ICMPv6TypeEchoRequest = 128
-	ICMPv6TypeEchoReply   = 129
+	MaxRejectPacketSize = ipv4.HeaderLen + 8 + 60 + 8
 )

 func CreateRejectPacket(packet []byte, out []byte) []byte {
-	if len(packet) < 1 {
+	if len(packet) < ipv4.HeaderLen || int(packet[0]>>4) != ipv4.Version {
 		return nil
 	}

-	version := int(packet[0] >> 4)
-	switch version {
-	case ipv4.Version:
-		if len(packet) < ipv4.HeaderLen {
-			return nil
-		}
-		// Do not send reject packets for non-first fragments
-		if packet[6]&0x1f != 0 || packet[7] != 0 {
-			return nil
-		}
-		switch packet[9] {
-		case 6: // tcp
-			return ipv4CreateRejectTCPPacket(packet, out)
-		default:
-			return ipv4CreateRejectICMPPacket(packet, out)
-		}
-	case ipv6.Version:
-		if len(packet) < ipv6.HeaderLen {
-			return nil
-		}
-		return ipv6CreateRejectPacket(packet, out)
+	switch packet[9] {
+	case 6: // tcp
+		return ipv4CreateRejectTCPPacket(packet, out)
 	default:
-		return nil
+		return ipv4CreateRejectICMPPacket(packet, out)
 	}
 }

@@ -75,16 +35,11 @@ func ipv4CreateRejectICMPPacket(packet []byte, out []byte) []byte {
 		return nil
 	}

-	// Do not generate ICMP errors in response to ICMP error packets
-	if packet[9] == 1 && len(packet) > ihl {
-		icmpType := packet[ihl]
-		if icmpType == 3 || icmpType == 4 || icmpType == 5 || icmpType == 11 || icmpType == 12 {
-			return nil
-		}
-	}
-
 	// ICMP reply includes original header and first 8 bytes of the packet
-	packetLen := min(len(packet), ihl+8)
+	packetLen := len(packet)
+	if packetLen > ihl+8 {
+		packetLen = ihl + 8
+	}

 	outLen := ipv4.HeaderLen + 8 + packetLen
 	if outLen > cap(out) {
@@ -116,14 +71,14 @@ func ipv4CreateRejectICMPPacket(packet []byte, out []byte) []byte {

 	// ICMP Destination Unreachable
 	icmpOut := out[ipv4.HeaderLen:]
-	icmpOut[0] = 3  // type (Destination unreachable)
-	icmpOut[1] = 13 // code (Communication administratively prohibited)
-	icmpOut[2] = 0  // checksum
-	icmpOut[3] = 0  //  .
-	icmpOut[4] = 0  // unused
-	icmpOut[5] = 0  //  .
-	icmpOut[6] = 0  //  .
-	icmpOut[7] = 0  //  .
+	icmpOut[0] = 3 // type (Destination unreachable)
+	icmpOut[1] = 3 // code (Port unreachable error)
+	icmpOut[2] = 0 // checksum
+	icmpOut[3] = 0 //  .
+	icmpOut[4] = 0 // unused
+	icmpOut[5] = 0 //  .
+	icmpOut[6] = 0 //  .
+	icmpOut[7] = 0 //  .

 	// Copy original IP header and first 8 bytes as body
 	copy(icmpOut[8:], packet[:packetLen])
@@ -210,213 +165,7 @@ func ipv4CreateRejectTCPPacket(packet []byte, out []byte) []byte {
 	return out
 }

-func ipv6CreateRejectPacket(packet []byte, out []byte) []byte {
-	proto, offset, isFragment, _, err := IPv6FindUpperProtocol(packet)
-	if err != nil || isFragment {
-		return nil
-	}
-	switch proto {
-	case 6: // tcp
-		return ipv6CreateRejectTCPPacket(packet, out, offset)
-	default:
-		return ipv6CreateRejectICMPPacket(packet, out, proto, offset)
-	}
-}
-
-func ipv6CreateRejectICMPPacket(packet []byte, out []byte, proto uint8, offset int) []byte {
-	// Do not generate ICMPv6 errors in response to ICMPv6 error packets
-	if proto == 58 && len(packet) > offset {
-		icmpType := packet[offset]
-		if icmpType >= 1 && icmpType <= 4 {
-			return nil
-		}
-	}
-
-	// Include as much of the original packet as possible, up to 1000 bytes,
-	// so the response fits comfortably within any tunnel MTU.
-	packetLen := min(len(packet), 1000)
-
-	outLen := ipv6.HeaderLen + 8 + packetLen
-	if outLen > cap(out) {
-		return nil
-	}
-
-	out = out[:outLen]
-
-	// IPv6 header
-	ipHdr := out[0:ipv6.HeaderLen]
-	ipHdr[0] = ipv6.Version << 4 // version, traffic class (high bits)
-	ipHdr[1] = 0                 // traffic class (low bits), flow label (high bits)
-	ipHdr[2] = 0                 // flow label
-	ipHdr[3] = 0                 // flow label
-
-	payloadLen := uint16(outLen - ipv6.HeaderLen)
-	binary.BigEndian.PutUint16(ipHdr[4:], payloadLen) // payload length
-	ipHdr[6] = 58                                     // next header (ICMPv6)
-	ipHdr[7] = 64                                     // hop limit
-
-	// Swap dest / src IPs (each 16 bytes, src at 8, dst at 24)
-	copy(ipHdr[8:24], packet[24:40])
-	copy(ipHdr[24:40], packet[8:24])
-
-	// ICMPv6 Destination Unreachable
-	icmpOut := out[ipv6.HeaderLen:]
-	icmpOut[0] = 1 // type (Destination Unreachable)
-	icmpOut[1] = 1 // code (Communication with destination administratively prohibited)
-	icmpOut[2] = 0 // checksum
-	icmpOut[3] = 0 //  .
-	icmpOut[4] = 0 // unused
-	icmpOut[5] = 0 //  .
-	icmpOut[6] = 0 //  .
-	icmpOut[7] = 0 //  .
-
-	copy(icmpOut[8:], packet[:packetLen])
-
-	// ICMPv6 checksum uses a pseudo-header
-	csum := ipv6PseudoheaderChecksum(ipHdr[8:24], ipHdr[24:40], 58, uint32(payloadLen))
-	binary.BigEndian.PutUint16(icmpOut[2:], tcpipChecksum(icmpOut, csum))
-
-	return out
-}
-
-func ipv6CreateRejectTCPPacket(packet []byte, out []byte, offset int) []byte {
-	const tcpLen = 20
-
-	if len(packet) < offset+tcpLen {
-		return nil
-	}
-
-	outLen := ipv6.HeaderLen + tcpLen
-	if outLen > cap(out) {
-		return nil
-	}
-
-	out = out[:outLen]
-
-	// IPv6 header
-	ipHdr := out[0:ipv6.HeaderLen]
-	ipHdr[0] = ipv6.Version << 4 // version, traffic class (high bits)
-	ipHdr[1] = 0                 // traffic class (low bits), flow label (high bits)
-	ipHdr[2] = 0                 // flow label
-	ipHdr[3] = 0                 // flow label
-
-	binary.BigEndian.PutUint16(ipHdr[4:], tcpLen) // payload length
-	ipHdr[6] = 6                                  // next header (TCP)
-	ipHdr[7] = 64                                 // hop limit
-
-	// Swap dest / src IPs
-	copy(ipHdr[8:24], packet[24:40])
-	copy(ipHdr[24:40], packet[8:24])
-
-	// TCP RST
-	tcpIn := packet[offset:]
-	var ackSeq, seq uint32
-	outFlags := byte(0b00000100) // RST
-
-	inAck := tcpIn[13]&0b00010000 != 0
-	if inAck {
-		seq = binary.BigEndian.Uint32(tcpIn[8:])
-	} else {
-		inSyn := uint32((tcpIn[13] & 0b00000010) >> 1)
-		inFin := uint32(tcpIn[13] & 0b00000001)
-		ackSeq = binary.BigEndian.Uint32(tcpIn[4:]) + inSyn + inFin + uint32(len(tcpIn)) - uint32(tcpIn[12]>>4)<<2
-		outFlags |= 0b00010000 // ACK
-	}
-
-	tcpOut := out[ipv6.HeaderLen:]
-	// Swap dest / src ports
-	copy(tcpOut[0:2], tcpIn[2:4])
-	copy(tcpOut[2:4], tcpIn[0:2])
-	binary.BigEndian.PutUint32(tcpOut[4:], seq)
-	binary.BigEndian.PutUint32(tcpOut[8:], ackSeq)
-	tcpOut[12] = (tcpLen >> 2) << 4 // data offset, reserved, NS
-	tcpOut[13] = outFlags           // CWR, ECE, URG, ACK, PSH, RST, SYN, FIN
-	tcpOut[14] = 0                  // window size
-	tcpOut[15] = 0                  //  .
-	tcpOut[16] = 0                  // checksum
-	tcpOut[17] = 0                  //  .
-	tcpOut[18] = 0                  // URG Pointer
-	tcpOut[19] = 0                  //  .
-
-	// Calculate checksum with IPv6 pseudo-header
-	csum := ipv6PseudoheaderChecksum(ipHdr[8:24], ipHdr[24:40], 6, tcpLen)
-	binary.BigEndian.PutUint16(tcpOut[16:], tcpipChecksum(tcpOut, csum))
-
-	return out
-}
-
-// IPv6FindUpperProtocol walks the ipv6 extension header chain and returns the upper layer protocol, the
-// offset it begins at, and whether the packet is a non-first fragment. Only the RFC 8200 and IANA extension
-// headers below are walked. Everything else, including Mobility (135), HIP (139), Shim6 (140), experimental
-// 253/254, and real upper layer protocols like SCTP or GRE, is terminal. Walking those as extension headers
-// is a firewall bypass, so they fail closed. For a non-first fragment the returned protocol is the fragmented
-// protocol and offset points at the fragment header, there is no transport header to locate. Returns
-// ErrIPv6CouldNotFindPayload if packet is smaller than an ipv6 header or the chain is truncated before a
-// terminal protocol is reached.
-func IPv6FindUpperProtocol(packet []byte) (nextHeader uint8, offset int, isFragment bool, anyFragment bool, err error) {
-	const maxIPv6ExtHeaders = 8
-	if len(packet) < ipv6.HeaderLen {
-		return 0, 0, false, false, ErrIPv6CouldNotFindPayload
-	}
-	nextHeader = packet[6]
-	offset = ipv6.HeaderLen
-
-	for range maxIPv6ExtHeaders {
-		switch nextHeader {
-		case 0, 43, 60: // Hop-by-Hop, Routing, Destination
-			if len(packet) < offset+2 {
-				return nextHeader, offset, isFragment, anyFragment, ErrIPv6CouldNotFindPayload
-			}
-			nextHeader = packet[offset]
-			offset += (int(packet[offset+1]) + 1) << 3
-
-		case 44: // Fragment
-			if len(packet) < offset+8 {
-				return nextHeader, offset, isFragment, anyFragment, ErrIPv6CouldNotFindPayload
-			}
-			anyFragment = true
-			// Non-first fragments carry no transport header, report the fragmented protocol and stop
-			if packet[offset+2] != 0 || packet[offset+3]&0xf8 != 0 {
-				return packet[offset], offset, true, anyFragment, nil
-			}
-			nextHeader = packet[offset]
-			offset += 8
-
-		case 51: // AH
-			if len(packet) < offset+2 {
-				return nextHeader, offset, isFragment, anyFragment, ErrIPv6CouldNotFindPayload
-			}
-			nextHeader = packet[offset]
-			offset += (int(packet[offset+1]) + 2) << 2
-
-		default:
-			// A prior extension header can declare a length that advances offset past the packet. The terminal
-			// protocol's header isn't actually here, so treat the chain as truncated rather than classifying it.
-			if offset > len(packet) {
-				return nextHeader, offset, isFragment, anyFragment, ErrIPv6CouldNotFindPayload
-			}
-			return nextHeader, offset, isFragment, anyFragment, nil
-		}
-	}
-	return nextHeader, offset, isFragment, anyFragment, nil
-}
-
 func CreateICMPEchoResponse(packet, out []byte) []byte {
-	if len(packet) < 1 {
-		return nil
-	}
-
-	switch packet[0] >> 4 {
-	case 4:
-		return createICMPv4EchoResponse(packet, out)
-	case 6:
-		return createICMPv6EchoResponse(packet, out)
-	default:
-		return nil
-	}
-}
-
-func createICMPv4EchoResponse(packet, out []byte) []byte {
 	// Return early if this is not a simple ICMP Echo Request
 	//TODO: make constants out of these
 	if !(len(packet) >= 28 && len(packet) <= 9001 && packet[0] == 0x45 && packet[9] == 0x01 && packet[20] == 0x08) {
@@ -450,43 +199,6 @@ func createICMPv4EchoResponse(packet, out []byte) []byte {
 	return out
 }

-func createICMPv6EchoResponse(packet, out []byte) []byte {
-	// IPv6 header (40 bytes) + ICMPv6 header (8 bytes minimum)
-	if len(packet) < ipv6.HeaderLen+8 || len(packet) > 9001 {
-		return nil
-	}
-
-	// Next Header must be ICMPv6 (58)
-	if packet[6] != 58 {
-		return nil
-	}
-
-	// ICMPv6 type must be Echo Request (128)
-	if packet[ipv6.HeaderLen] != 128 {
-		return nil
-	}
-
-	out = out[:len(packet)]
-	copy(out, packet)
-
-	// Swap src/dst addresses (bytes 8-23 and 24-39)
-	copy(out[8:24], packet[24:40])
-	copy(out[24:40], packet[8:24])
-
-	// Change ICMPv6 type to Echo Reply (129)
-	icmp := out[ipv6.HeaderLen:]
-	icmp[0] = 129
-	icmp[2] = 0
-	icmp[3] = 0
-
-	// ICMPv6 checksum uses a pseudo-header with src, dst, length, and next header
-	payloadLen := uint32(len(icmp))
-	csum := ipv6PseudoheaderChecksum(out[8:24], out[24:40], 58, payloadLen)
-	binary.BigEndian.PutUint16(icmp[2:], tcpipChecksum(icmp, csum))
-
-	return out
-}
-
 // calculates the TCP/IP checksum defined in rfc1071. The passed-in
 // csum is any initial checksum data that's already been computed.
 //
@@ -524,18 +236,3 @@ func ipv4PseudoheaderChecksum(src, dst []byte, proto, length uint32) (csum uint3
 	csum += length >> 16
 	return csum
 }
-
-// based on:
-// - https://github.com/google/gopacket/blob/v1.1.19/layers/tcpip.go#L37-L48
-func ipv6PseudoheaderChecksum(src, dst []byte, proto, length uint32) (csum uint32) {
-	for i := 0; i < 16; i += 2 {
-		csum += uint32(src[i]) << 8
-		csum += uint32(src[i+1])
-		csum += uint32(dst[i]) << 8
-		csum += uint32(dst[i+1])
-	}
-	csum += proto
-	csum += length & 0xffff
-	csum += length >> 16
-	return csum
-}
@@ -1,15 +1,11 @@
 package iputil

 import (
-	"bytes"
-	"encoding/binary"
 	"net"
 	"testing"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/ipv4"
-	"golang.org/x/net/ipv6"
 )

 func Test_CreateRejectPacket(t *testing.T) {
@@ -47,7 +43,7 @@ func Test_CreateRejectPacket(t *testing.T) {
 	}
 	b = append(b, []byte{0, 3, 0, 4, 0, 0, 0, 0}...)

-	expectedLen = maxIPv4RejectPacketSize
+	expectedLen = MaxRejectPacketSize
 	out = make([]byte, MaxRejectPacketSize)
 	rejectPacket = CreateRejectPacket(b, out)
 	assert.NotNil(t, rejectPacket)
@@ -75,504 +71,3 @@ func Test_CreateRejectPacket(t *testing.T) {
 	assert.NotNil(t, rejectPacket)
 	assert.Len(t, rejectPacket, expectedLen)
 }
-
-func Test_CreateRejectPacket_NoFragment(t *testing.T) {
-	out := make([]byte, MaxRejectPacketSize)
-
-	// IPv4: non-zero fragment offset should not generate reject packet
-	h := ipv4.Header{
-		Len:      20,
-		Src:      net.IPv4(10, 0, 0, 1),
-		Dst:      net.IPv4(10, 0, 0, 2),
-		Protocol: 17, // UDP
-	}
-	b, err := h.Marshal()
-	if err != nil {
-		t.Fatalf("h.Marshal: %v", err)
-	}
-	b = append(b, make([]byte, 8)...)
-	// Set fragment offset to non-zero (byte 6-7, offset in 8-byte units)
-	b[6] = 0x00
-	b[7] = 0x01
-	assert.Nil(t, CreateRejectPacket(b, out))
-
-	// MF flag with zero offset (first fragment) should still generate reject
-	b[6] = 0x20 // MF flag set
-	b[7] = 0x00
-	assert.NotNil(t, CreateRejectPacket(b, out))
-
-	// Non-fragment should still generate reject packet
-	b[6] = 0x00
-	b[7] = 0x00
-	assert.NotNil(t, CreateRejectPacket(b, out))
-
-	// DF flag only (not a fragment) should still generate reject packet
-	b[6] = 0x40
-	b[7] = 0x00
-	assert.NotNil(t, CreateRejectPacket(b, out))
-}
-
-func Test_CreateRejectPacketIPv6_NoFragment(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-	out := make([]byte, MaxRejectPacketSize)
-
-	// IPv6 with Fragment header and non-zero offset should not generate reject
-	fragHeader := []byte{
-		17,   // next header: UDP
-		0,    // reserved
-		0, 9, // fragment offset=1 (shifted left 3), M=1
-		0, 0, 0, 1, // identification
-	}
-	udpPayload := make([]byte, 8)
-	payload := append(fragHeader, udpPayload...)
-	packet := makeIPv6Packet(src, dst, 44, payload) // next header 44 = Fragment
-	assert.Nil(t, CreateRejectPacket(packet, out))
-
-	// Fragment header with zero offset (first fragment) should still generate reject
-	fragHeader[2] = 0
-	fragHeader[3] = 1 // offset=0, M=1
-	payload = append(fragHeader, udpPayload...)
-	packet = makeIPv6Packet(src, dst, 44, payload)
-	assert.NotNil(t, CreateRejectPacket(packet, out))
-}
-
-func Test_CreateRejectPacket_NoICMPError(t *testing.T) {
-	out := make([]byte, MaxRejectPacketSize)
-
-	// ICMP error types should not generate reject packets
-	icmpErrorTypes := []byte{3, 4, 5, 11, 12}
-	for _, icmpType := range icmpErrorTypes {
-		h := ipv4.Header{
-			Len:      20,
-			Src:      net.IPv4(10, 0, 0, 1),
-			Dst:      net.IPv4(10, 0, 0, 2),
-			Protocol: 1, // ICMP
-		}
-
-		b, err := h.Marshal()
-		if err != nil {
-			t.Fatalf("h.Marshal: %v", err)
-		}
-		b = append(b, icmpType, 0, 0, 0, 0, 0, 0, 0)
-
-		rejectPacket := CreateRejectPacket(b, out)
-		assert.Nil(t, rejectPacket, "ICMP type %d should not generate a reject packet", icmpType)
-	}
-
-	// ICMP non-error types should still generate reject packets
-	icmpNonErrorTypes := []byte{0, 8, 13, 14}
-	for _, icmpType := range icmpNonErrorTypes {
-		h := ipv4.Header{
-			Len:      20,
-			Src:      net.IPv4(10, 0, 0, 1),
-			Dst:      net.IPv4(10, 0, 0, 2),
-			Protocol: 1, // ICMP
-		}
-
-		b, err := h.Marshal()
-		if err != nil {
-			t.Fatalf("h.Marshal: %v", err)
-		}
-		b = append(b, icmpType, 0, 0, 0, 0, 0, 0, 0)
-
-		rejectPacket := CreateRejectPacket(b, out)
-		assert.NotNil(t, rejectPacket, "ICMP type %d should generate a reject packet", icmpType)
-	}
-}
-
-// Test_CreateRejectPacket_RespectsCap ensures it is impossible for
-// an oversized ICMPv6 reject to overwrite the neighbor segment's bytes.
-func Test_CreateRejectPacket_RespectsCap(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-
-	// Inner IPv6 UDP packet. An ICMPv6 reject copies the whole inner packet
-	// plus a 48-byte header (40 IPv6 + 8 ICMPv6), so it needs 48 more bytes
-	// than the inner packet length.
-	inner := makeIPv6Packet(src, dst, 17, make([]byte, 20))
-
-	// The ciphertext scratch reused as the reject buffer is the received
-	// datagram: 16-byte Nebula header + inner + 16-byte AEAD tag. That is only
-	// 32 bytes of slack, so a full ICMPv6 reject overruns it by 16 bytes.
-	const nebulaOverhead = 32
-	segLen := len(inner) + nebulaOverhead
-
-	// Shared backing row laid out as [segment][neighbor's 16-byte Nebula header].
-	const neighborHdr = 16
-	sentinel := bytes.Repeat([]byte{0xAB}, neighborHdr)
-
-	// Uncapped: the slice's capacity reaches into the neighbor, reproducing
-	// the overrun that silently drops the neighbor packet.
-	backing := make([]byte, segLen+neighborHdr)
-	copy(backing[segLen:], sentinel)
-	reject := CreateRejectPacket(inner, backing[:segLen])
-	assert.NotNil(t, reject, "uncapped buffer reaches into the neighbor, so the reject is built")
-	assert.NotEqual(t, sentinel, backing[segLen:segLen+neighborHdr],
-		"without the cap the oversized reject overruns into the neighbor segment")
-
-	// Capped (the fix): cap==len, so the builder cannot exceed the segment. The
-	// reject does not fit, so it is refused rather than corrupting the neighbor.
-	backing = make([]byte, segLen+neighborHdr)
-	copy(backing[segLen:], sentinel)
-	reject = CreateRejectPacket(inner, backing[:segLen:segLen])
-	assert.Nil(t, reject, "capped segment is 16 bytes too small for a full ICMPv6 reject, so it is refused")
-	assert.Equal(t, sentinel, backing[segLen:segLen+neighborHdr],
-		"capped segment must leave the neighbor untouched")
-}
-
-func makeIPv6Packet(src, dst net.IP, nextHeader uint8, payload []byte) []byte {
-	b := make([]byte, ipv6.HeaderLen+len(payload))
-	b[0] = ipv6.Version << 4
-	binary.BigEndian.PutUint16(b[4:], uint16(len(payload)))
-	b[6] = nextHeader
-	b[7] = 64
-	copy(b[8:24], src.To16())
-	copy(b[24:40], dst.To16())
-	copy(b[ipv6.HeaderLen:], payload)
-	return b
-}
-
-func Test_CreateRejectPacketIPv6_ICMP(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-
-	// Small UDP packet: entire original included in body
-	udpPayload := make([]byte, 20)
-	udpPayload[0] = 0x00 // src port high
-	udpPayload[1] = 0x50 // src port low (80)
-	udpPayload[2] = 0x01 // dst port high
-	udpPayload[3] = 0xBB // dst port low (443)
-	packet := makeIPv6Packet(src, dst, 17, udpPayload)
-
-	out := make([]byte, MaxRejectPacketSize)
-	rejectPacket := CreateRejectPacket(packet, out)
-	assert.NotNil(t, rejectPacket)
-
-	// Small packet fits entirely: 40 (ipv6 hdr) + 8 (icmpv6 hdr) + 60 (original)
-	expectedLen := ipv6.HeaderLen + 8 + len(packet)
-	assert.Len(t, rejectPacket, expectedLen)
-
-	// Verify version
-	assert.Equal(t, byte(ipv6.Version<<4), rejectPacket[0]&0xf0)
-	// Verify next header is ICMPv6 (58)
-	assert.Equal(t, byte(58), rejectPacket[6])
-	// Verify src/dst are swapped
-	assert.Equal(t, dst.To16(), net.IP(rejectPacket[8:24]))
-	assert.Equal(t, src.To16(), net.IP(rejectPacket[24:40]))
-	// Verify ICMPv6 type=1 (Dest Unreachable), code=1 (Administratively prohibited)
-	assert.Equal(t, byte(1), rejectPacket[ipv6.HeaderLen])
-	assert.Equal(t, byte(1), rejectPacket[ipv6.HeaderLen+1])
-	// Verify entire original packet is included in body
-	assert.Equal(t, packet, rejectPacket[ipv6.HeaderLen+8:])
-
-	// Large packet: body is truncated to 1000 bytes
-	largePkt := makeIPv6Packet(src, dst, 17, make([]byte, 1200))
-	rejectPacket = CreateRejectPacket(largePkt, out)
-	assert.NotNil(t, rejectPacket)
-	assert.Len(t, rejectPacket, ipv6.HeaderLen+8+1000)
-	assert.Equal(t, largePkt[:1000], rejectPacket[ipv6.HeaderLen+8:])
-}
-
-func Test_CreateRejectPacketIPv6_TCP(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-
-	// TCP SYN packet (next header 6)
-	tcpPayload := make([]byte, 20)
-	tcpPayload[0] = 0x00                             // src port high
-	tcpPayload[1] = 0x50                             // src port low (80)
-	tcpPayload[2] = 0x01                             // dst port high
-	tcpPayload[3] = 0xBB                             // dst port low (443)
-	binary.BigEndian.PutUint32(tcpPayload[4:], 1000) // seq
-	binary.BigEndian.PutUint32(tcpPayload[8:], 0)    // ack seq
-	tcpPayload[12] = (20 >> 2) << 4                  // data offset
-	tcpPayload[13] = 0b00000010                      // SYN flag
-
-	packet := makeIPv6Packet(src, dst, 6, tcpPayload)
-
-	out := make([]byte, MaxRejectPacketSize)
-	rejectPacket := CreateRejectPacket(packet, out)
-	assert.NotNil(t, rejectPacket)
-
-	// Expected: 40 (ipv6 hdr) + 20 (tcp RST)
-	expectedLen := ipv6.HeaderLen + 20
-	assert.Len(t, rejectPacket, expectedLen)
-
-	// Verify version
-	assert.Equal(t, byte(ipv6.Version<<4), rejectPacket[0]&0xf0)
-	// Verify next header is TCP (6)
-	assert.Equal(t, byte(6), rejectPacket[6])
-	// Verify src/dst are swapped
-	assert.Equal(t, dst.To16(), net.IP(rejectPacket[8:24]))
-	assert.Equal(t, src.To16(), net.IP(rejectPacket[24:40]))
-	// Verify ports are swapped
-	tcpOut := rejectPacket[ipv6.HeaderLen:]
-	assert.Equal(t, uint16(443), binary.BigEndian.Uint16(tcpOut[0:2]))
-	assert.Equal(t, uint16(80), binary.BigEndian.Uint16(tcpOut[2:4]))
-	// RST+ACK flags (since input was SYN without ACK)
-	assert.Equal(t, byte(0b00010100), tcpOut[13])
-	// ack_seq = original seq (1000) + SYN (1) + FIN (0) + segment data (0)
-	assert.Equal(t, uint32(1001), binary.BigEndian.Uint32(tcpOut[8:]))
-}
-
-func Test_CreateRejectPacketIPv6_TCPWithACK(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-
-	// TCP packet with ACK set
-	tcpPayload := make([]byte, 20)
-	tcpPayload[0] = 0x00
-	tcpPayload[1] = 0x50
-	tcpPayload[2] = 0x01
-	tcpPayload[3] = 0xBB
-	binary.BigEndian.PutUint32(tcpPayload[4:], 1000) // seq
-	binary.BigEndian.PutUint32(tcpPayload[8:], 2000) // ack seq
-	tcpPayload[12] = (20 >> 2) << 4                  // data offset
-	tcpPayload[13] = 0b00010000                      // ACK flag
-
-	packet := makeIPv6Packet(src, dst, 6, tcpPayload)
-
-	out := make([]byte, MaxRejectPacketSize)
-	rejectPacket := CreateRejectPacket(packet, out)
-	assert.NotNil(t, rejectPacket)
-
-	tcpOut := rejectPacket[ipv6.HeaderLen:]
-	// RST only (no ACK) since input had ACK
-	assert.Equal(t, byte(0b00000100), tcpOut[13])
-	// seq = original ack_seq
-	assert.Equal(t, uint32(2000), binary.BigEndian.Uint32(tcpOut[4:]))
-}
-
-func Test_CreateRejectPacketIPv6_NoICMPError(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-	out := make([]byte, MaxRejectPacketSize)
-
-	// ICMPv6 error types (1-4) should not generate reject packets
-	for icmpType := byte(1); icmpType <= 4; icmpType++ {
-		payload := make([]byte, 8)
-		payload[0] = icmpType
-		packet := makeIPv6Packet(src, dst, 58, payload)
-
-		rejectPacket := CreateRejectPacket(packet, out)
-		assert.Nil(t, rejectPacket, "ICMPv6 type %d should not generate a reject packet", icmpType)
-	}
-
-	// ICMPv6 non-error types should still generate reject packets
-	nonErrorTypes := []byte{128, 129, 133, 134}
-	for _, icmpType := range nonErrorTypes {
-		payload := make([]byte, 8)
-		payload[0] = icmpType
-		packet := makeIPv6Packet(src, dst, 58, payload)
-
-		rejectPacket := CreateRejectPacket(packet, out)
-		assert.NotNil(t, rejectPacket, "ICMPv6 type %d should generate a reject packet", icmpType)
-	}
-}
-
-func Test_CreateRejectPacketIPv6_TooShort(t *testing.T) {
-	// Packet too short to be valid IPv6
-	out := make([]byte, MaxRejectPacketSize)
-	assert.Nil(t, CreateRejectPacket([]byte{0x60}, out))
-	assert.Nil(t, CreateRejectPacket(make([]byte, 39), out))
-}
-
-func Test_CreateRejectPacketIPv6_ExtensionHeaders(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-
-	// IPv6 + Hop-by-Hop extension header + TCP
-	hopByHop := []byte{
-		6,    // next header: TCP
-		0,    // length (8 bytes total)
-		0, 0, // padding
-		0, 0, 0, 0,
-	}
-	tcpPayload := make([]byte, 20)
-	tcpPayload[0] = 0x00
-	tcpPayload[1] = 0x50
-	tcpPayload[2] = 0x01
-	tcpPayload[3] = 0xBB
-	binary.BigEndian.PutUint32(tcpPayload[4:], 1000)
-	binary.BigEndian.PutUint32(tcpPayload[8:], 2000)
-	tcpPayload[12] = (20 >> 2) << 4
-	tcpPayload[13] = 0b00010000 // ACK
-
-	payload := append(hopByHop, tcpPayload...)
-	packet := makeIPv6Packet(src, dst, 0, payload) // next header 0 = Hop-by-Hop
-
-	out := make([]byte, MaxRejectPacketSize)
-	rejectPacket := CreateRejectPacket(packet, out)
-	assert.NotNil(t, rejectPacket)
-
-	// Should produce TCP RST
-	expectedLen := ipv6.HeaderLen + 20
-	assert.Len(t, rejectPacket, expectedLen)
-	assert.Equal(t, byte(6), rejectPacket[6]) // next header is TCP
-	tcpOut := rejectPacket[ipv6.HeaderLen:]
-	assert.Equal(t, byte(0b00000100), tcpOut[13]) // RST only
-}
-
-func TestCreateICMPEchoResponse_IPv4(t *testing.T) {
-	// Build a simple IPv4 ICMP Echo Request
-	packet := make([]byte, 28)
-	packet[0] = 0x45                                   // version 4, IHL 5
-	binary.BigEndian.PutUint16(packet[2:], uint16(28)) // total length
-	packet[8] = 64                                     // TTL
-	packet[9] = 1                                      // protocol ICMP
-	copy(packet[12:16], net.IPv4(10, 0, 0, 1).To4())   // src
-	copy(packet[16:20], net.IPv4(10, 0, 0, 2).To4())   // dst
-	packet[20] = 8                                     // ICMP Echo Request
-
-	out := make([]byte, len(packet))
-	result := CreateICMPEchoResponse(packet, out)
-	assert.NotNil(t, result)
-	assert.Equal(t, byte(0x45), result[0])
-	// src/dst swapped
-	assert.Equal(t, net.IPv4(10, 0, 0, 2).To4(), net.IP(result[12:16]))
-	assert.Equal(t, net.IPv4(10, 0, 0, 1).To4(), net.IP(result[16:20]))
-	// ICMP Echo Reply
-	assert.Equal(t, byte(0), result[20])
-}
-
-func TestCreateICMPEchoResponse_IPv6(t *testing.T) {
-	src := net.ParseIP("fd00::1").To16()
-	dst := net.ParseIP("fd00::2").To16()
-
-	// Build an IPv6 ICMPv6 Echo Request packet
-	// IPv6 header (40 bytes) + ICMPv6 (8 bytes)
-	packet := make([]byte, 48)
-	packet[0] = 0x60        // version 6
-	payloadLen := uint16(8) // ICMPv6 header only
-	binary.BigEndian.PutUint16(packet[4:], payloadLen)
-	packet[6] = 58           // Next Header: ICMPv6
-	packet[7] = 64           // Hop Limit
-	copy(packet[8:24], src)  // src address
-	copy(packet[24:40], dst) // dst address
-
-	// ICMPv6 Echo Request
-	icmp := packet[40:]
-	icmp[0] = 128                           // type: Echo Request
-	icmp[1] = 0                             // code
-	binary.BigEndian.PutUint16(icmp[4:], 1) // identifier
-	binary.BigEndian.PutUint16(icmp[6:], 1) // sequence number
-
-	// Compute correct checksum for the request
-	csum := ipv6PseudoheaderChecksum(src, dst, 58, uint32(payloadLen))
-	binary.BigEndian.PutUint16(icmp[2:], tcpipChecksum(icmp, csum))
-
-	out := make([]byte, len(packet))
-	result := CreateICMPEchoResponse(packet, out)
-	assert.NotNil(t, result)
-
-	// Version should still be 6
-	assert.Equal(t, byte(6), result[0]>>4)
-	// src/dst swapped
-	assert.Equal(t, dst, net.IP(result[8:24]))
-	assert.Equal(t, src, net.IP(result[24:40]))
-	// ICMPv6 Echo Reply type
-	assert.Equal(t, byte(129), result[40])
-
-	// Verify checksum is valid (tcpipChecksum returns 0 when data+checksum is correct)
-	respIcmp := result[40:]
-	verifyCsum := ipv6PseudoheaderChecksum(result[8:24], result[24:40], 58, uint32(payloadLen))
-	assert.Equal(t, uint16(0), tcpipChecksum(respIcmp, verifyCsum))
-}
-
-func TestCreateICMPEchoResponse_IPv6_NotEchoRequest(t *testing.T) {
-	src := net.ParseIP("fd00::1").To16()
-	dst := net.ParseIP("fd00::2").To16()
-
-	packet := make([]byte, 48)
-	packet[0] = 0x60
-	binary.BigEndian.PutUint16(packet[4:], 8)
-	packet[6] = 58
-	packet[7] = 64
-	copy(packet[8:24], src)
-	copy(packet[24:40], dst)
-
-	// ICMPv6 type 1 (Destination Unreachable) - not Echo Request
-	packet[40] = 1
-
-	out := make([]byte, len(packet))
-	result := CreateICMPEchoResponse(packet, out)
-	assert.Nil(t, result)
-}
-
-func TestCreateICMPEchoResponse_IPv6_NotICMPv6(t *testing.T) {
-	src := net.ParseIP("fd00::1").To16()
-	dst := net.ParseIP("fd00::2").To16()
-
-	packet := make([]byte, 48)
-	packet[0] = 0x60
-	binary.BigEndian.PutUint16(packet[4:], 8)
-	packet[6] = 6 // TCP, not ICMPv6
-	packet[7] = 64
-	copy(packet[8:24], src)
-	copy(packet[24:40], dst)
-
-	out := make([]byte, len(packet))
-	result := CreateICMPEchoResponse(packet, out)
-	assert.Nil(t, result)
-}
-
-func Test_IPv6FindUpperProtocol(t *testing.T) {
-	src := net.ParseIP("fd00::1")
-	dst := net.ParseIP("fd00::2")
-
-	// 8 byte extension/transport stand-ins, first byte is the next header, second is the length field
-	extToTCP := []byte{6, 0, 0, 0, 0, 0, 0, 0}        // len 0 -> 8 bytes, next = TCP
-	extToUDP := []byte{17, 0, 0, 0, 0, 0, 0, 0}       // len 0 -> 8 bytes, next = UDP
-	extToRouting := []byte{43, 0, 0, 0, 0, 0, 0, 0}   // len 0 -> 8 bytes, next = Routing
-	ahToUDP := []byte{17, 0, 0, 0, 0, 0, 0, 0}        // AH len 0 -> (0+2)<<2 = 8 bytes, next = UDP
-	firstFragToUDP := []byte{17, 0, 0, 1, 0, 0, 0, 1} // frag offset 0, M=1, next = UDP
-	nonFirstFrag := []byte{17, 0, 0, 9, 0, 0, 0, 1}   // frag offset non-zero, next = UDP
-	transport := []byte{0, 80, 1, 187, 0, 0, 0, 0}    // stand-in bytes, IPv6FindUpperProtocol never reads ports
-
-	tests := []struct {
-		name         string
-		nextHeader   uint8
-		payload      []byte
-		wantProto    uint8
-		wantOffset   int
-		wantFragment bool
-		wantAnyFrag  bool
-		wantErr      error
-	}{
-		{"plain udp", 17, transport, 17, ipv6.HeaderLen, false, false, nil},
-		{"hop-by-hop then tcp", 0, append(extToTCP, transport...), 6, ipv6.HeaderLen + 8, false, false, nil},
-		{"routing then tcp", 43, append(extToTCP, transport...), 6, ipv6.HeaderLen + 8, false, false, nil},
-		{"destination then udp", 60, append(extToUDP, transport...), 17, ipv6.HeaderLen + 8, false, false, nil},
-		{"hop-by-hop, routing, then tcp", 0, append(append(extToRouting, extToTCP...), transport...), 6, ipv6.HeaderLen + 16, false, false, nil},
-		{"ah then udp", 51, append(ahToUDP, transport...), 17, ipv6.HeaderLen + 8, false, false, nil},
-		{"first fragment walks to transport", 44, append(firstFragToUDP, transport...), 17, ipv6.HeaderLen + 8, false, true, nil},
-		{"non-first fragment stops", 44, append(nonFirstFrag, transport...), 17, ipv6.HeaderLen, true, true, nil},
-		{"unknown protocol is terminal", 132, transport, 132, ipv6.HeaderLen, false, false, nil}, // SCTP
-		{"truncated extension header", 0, nil, 0, ipv6.HeaderLen, false, false, ErrIPv6CouldNotFindPayload},
-		// Destination Options with a declared length (255+1)*8 = 2048 that runs past the 48 byte buffer, next = SCTP
-		{"extension length past buffer", 60, []byte{132, 255, 0, 0, 0, 0, 0, 0}, 132, ipv6.HeaderLen + 2048, false, false, ErrIPv6CouldNotFindPayload},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			packet := makeIPv6Packet(src, dst, tt.nextHeader, tt.payload)
-			proto, offset, isFragment, anyFragment, err := IPv6FindUpperProtocol(packet)
-			if tt.wantErr != nil {
-				assert.ErrorIs(t, err, tt.wantErr)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tt.wantProto, proto)
-			assert.Equal(t, tt.wantOffset, offset)
-			assert.Equal(t, tt.wantFragment, isFragment)
-			assert.Equal(t, tt.wantAnyFrag, anyFragment)
-		})
-	}
-
-	// A packet smaller than an ipv6 header must error rather than panic reading byte 6
-	t.Run("shorter than ipv6 header", func(t *testing.T) {
-		_, _, _, _, err := IPv6FindUpperProtocol(make([]byte, 6))
-		assert.ErrorIs(t, err, ErrIPv6CouldNotFindPayload)
-	})
-}
@@ -1,713 +0,0 @@
-package nebula
-
-import (
-	"context"
-	"hash/fnv"
-	"log/slog"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/flynn/noise"
-	"github.com/rcrowley/go-metrics"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/firewall"
-	"github.com/slackhq/nebula/handshake"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/noiseutil"
-)
-
-// Multiport lanes give one tunnel several underlay 5-tuples, so its traffic
-// spreads over ECMP paths, NIC receive queues and per-flow policers instead of
-// funnelling through a single flow. Each inside flow picks a lane by hashing its
-// own 5-tuple, so the spread doesn't depend on how a kernel steers tun queues
-// (see txQueue).
-//
-// A lane is not a second tunnel: it is an extra session on the same HostInfo.
-// Noise leaves us with A.eKey == B.dKey, so both sides expand the same two keys
-// with the same per-lane label and land on a matched pair without exchanging
-// anything. A lane therefore costs no handshake, has no half-established state,
-// and dies exactly when its base tunnel does. Which lane a packet belongs to
-// travels in the nebula header, inside the AEAD's associated data.
-//
-// Lane 0 is the base tunnel itself: HostInfo.ConnectionState, the base port, and
-// the peer's real remote address, and it carries its share of flows like any
-// other. Lane s > 0 egresses a socket on listen.port+s (see laneSock) toward the
-// peer's advertised port range. Receiving on a lane
-// needs no permission — the keys are derivable the moment the base handshake
-// completes — but sending on one needs proof the new 5-tuple actually works,
-// since nothing else would notice a middlebox quietly dropping it. So a lane
-// stays down until a probe on it is acked, and falls back to the base tunnel the
-// moment it stops being acked.
-//
-// Both directions are pay-per-use. A lane session is derived on the first packet
-// that needs it, because how many lanes exist is partly the peer's call: it
-// advertises how many it sends on, and we have to be able to receive all of
-// them. Deriving them all up front would let a peer advertising the maximum cost
-// us a replay window and two cipher states per lane, per tunnel, for lanes it
-// may never send on.
-
-const (
-	// laneKeyInfo is the HKDF label prefix for lane key expansion. Changing it
-	// means older builds derive different keys and drop our lane traffic; the
-	// base tunnel would keep working, so the failure would be a silent loss of
-	// lanes rather than of connectivity.
-	laneKeyInfo = "nebula multiport lane v1"
-
-	// laneRetryBase and laneRetryMax bound the backoff between probes of a lane
-	// that will not come up, so a peer whose lane ports are firewalled costs one
-	// packet a minute rather than one per traffic tick.
-	laneRetryBase = 5 * time.Second
-	laneRetryMax  = 60 * time.Second
-
-	// laneMaxFails caps the failure counter; the backoff saturates well before.
-	laneMaxFails = 8
-
-	// laneProbeTimeout is how long a probe may go unacked before it counts as a
-	// failure. It is shorter than the connection manager's check interval on
-	// purpose: an outstanding probe is judged on the next tick either way, and a
-	// longer timeout would only delay that by a whole tick.
-	laneProbeTimeout = 2 * time.Second
-
-	// laneKeepalive is how often a lane that is up re-proves its path. Traffic
-	// on a lane is not evidence the lane works — that is the whole reason lanes
-	// need probing — so a lane that silently breaks is only caught here.
-	laneKeepalive = 30 * time.Second
-)
-
-// laneSet holds a peer's lane sessions and the state deciding which lanes may
-// carry traffic. It is built when the base handshake completes and never
-// resized, so the slices and their lengths are immutable; mu guards the fields
-// under it, and sessions/txAddr/demand are atomics read by the data plane
-// without it.
-type laneSet struct {
-	// sessions[s] holds lane s's session once something has needed it, and nil
-	// until then. sessions[0] is never populated: lane 0 is the base tunnel's own
-	// ConnectionState. The length is immutable, so the data plane bounds-checks
-	// and loads with no locking.
-	sessions []atomic.Pointer[ConnectionState]
-
-	// material is what a lane session is derived from, kept because sessions are
-	// derived lazily and the handshake result is long gone by then.
-	material laneMaterial
-
-	// txAddr[s] holds lane s's remote address while the lane is proven usable
-	// and nil otherwise. This single atomic is both the TX gate and the
-	// destination, so a routine that loads non-nil has everything it needs.
-	// Sized txLanes: lanes above that never send.
-	txAddr []atomic.Pointer[netip.AddrPort]
-
-	// demand[s] is raised at creation, and again by the TX path whenever a flow
-	// hashes onto lane s while it is down. Probing is demand-driven, so a peer we
-	// never send to costs nothing beyond its base tunnel no matter how many lanes
-	// are configured, and a lane that keeps failing is only retried while
-	// something still wants it. Sized txLanes.
-	demand []atomic.Bool
-
-	// txLanes is how many lanes we may send on — our lane count clamped to the
-	// ports the peer bound — and so the modulus a flow's hash is reduced by.
-	// Lanes from txLanes up can only receive, which is how a peer with more
-	// routines than us still spreads its own traffic.
-	// Immutable, and the length of every TX-side slice here.
-	txLanes int
-
-	mu sync.Mutex
-
-	// peerPortCount and peerBasePort are the peer's advertised port range and
-	// portOffset is this pair's rotation within it: lane s targets
-	// peerBasePort + ((s + portOffset) % peerPortCount).
-	peerPortCount uint16
-	peerBasePort  uint16
-	portOffset    uint16
-
-	// laneBias rotates the flow hash before it picks a lane, so the two sides of
-	// a flow land on lanes that are each other's partner rather than at
-	// independent points in the range. See newLaneSet.
-	laneBias uint16
-
-	// peerAddr is the address the current lane targets were built from. The
-	// peer's lane ports have no derivable relationship to a new NAT mapping, so
-	// a roam invalidates every lane rather than moving it.
-	peerAddr netip.Addr
-
-	// probe[s] is lane s's probe and backoff state. Sized txLanes.
-	probe []laneProbeState
-}
-
-// laneMaterial is everything a lane session is derived from. The two base keys
-// are the same secret the base tunnel's own cipher states already hold — the
-// noiseutil.CipherState interface just doesn't hand them back, so a lane set
-// keeps its own copy rather than a reference to the session.
-type laneMaterial struct {
-	eKey, dKey [32]byte
-	cipher     noise.CipherFunc
-	myCert     cert.Certificate
-	peerCert   *cert.CachedCertificate
-	initiator  bool
-}
-
-type laneProbeState struct {
-	// gen is the generation of the last probe sent, echoed in the ack so a late
-	// ack cannot promote a lane on the strength of a superseded probe.
-	gen uint8
-
-	// fails is the consecutive failure count driving retryAt.
-	fails uint8
-
-	// sentAt is when the outstanding probe went out, zero when none is pending.
-	sentAt time.Time
-
-	// target is where the outstanding probe went, promoted to txAddr on ack. It
-	// outlives the probe, which is what lets a demotion log the address that
-	// stopped answering.
-	target netip.AddrPort
-
-	// lastAck is when the lane was last confirmed usable, driving the keepalive.
-	lastAck time.Time
-
-	// retryAt is the earliest we may probe this lane again.
-	retryAt time.Time
-}
-
-// newLaneSet sets up the lanes for a freshly completed base handshake. It
-// returns nil when the pair has no lane beyond the base tunnel, which is the
-// normal answer for a peer running without multiport. No session is derived
-// here; each is derived on the first packet that needs it.
-func newLaneSet(r *handshake.Result, myLanes int, myAddr, peerAddr netip.Addr) *laneSet {
-	// PeerPortCount and PeerBasePort are already bounded to uint16 by the
-	// handshake payload parser. A zero port count is a peer that did not
-	// advertise multiport at all, so there is no lane to be had in either
-	// direction.
-	peerPorts := uint16(r.PeerPortCount)
-	if peerPorts == 0 {
-		return nil
-	}
-
-	// Sessions have to cover both directions: we send on our lanes and receive
-	// on the peer's, and one derived session serves both ends of a lane index.
-	// Only the session table is sized by the peer's advertised count; the TX-side
-	// state is sized by what we will actually send on.
-	n := min(max(myLanes, int(r.PeerTxLanes)), header.MaxLane+1)
-	if n < 2 {
-		return nil
-	}
-	txLanes := min(myLanes, int(peerPorts), n)
-
-	offset := lanePortOffset(myAddr, peerAddr, peerPorts)
-
-	// A flow picks its lane from a hash both sides compute identically, so with
-	// the ranges lined up the two directions of a flow would pick the same lane
-	// index — and lane s targets the peer's lane (s + portOffset), not lane s. The
-	// high-addressed side rotates its choice by the low side's offset, which is
-	// its own negated, so the two directions land on partner lanes and their
-	// 4-tuples are exact reverses: each side's traffic then arrives through the
-	// conntrack entry the other's probe opened. With mismatched ranges there are
-	// no partner lanes to find, so don't pretend: hash straight.
-	bias := uint16(0)
-	if txLanes == int(peerPorts) && peerAddr.Less(myAddr) {
-		bias = (peerPorts - offset) % peerPorts
-	}
-
-	ls := &laneSet{
-		sessions: make([]atomic.Pointer[ConnectionState], n),
-		material: laneMaterial{
-			eKey:      r.EKey.UnsafeKey(),
-			dKey:      r.DKey.UnsafeKey(),
-			cipher:    r.Cipher,
-			myCert:    r.MyCert,
-			peerCert:  r.RemoteCert,
-			initiator: r.Initiator,
-		},
-		txAddr:        make([]atomic.Pointer[netip.AddrPort], txLanes),
-		demand:        make([]atomic.Bool, txLanes),
-		probe:         make([]laneProbeState, txLanes),
-		txLanes:       txLanes,
-		peerPortCount: peerPorts,
-		peerBasePort:  uint16(r.PeerBasePort),
-		portOffset:    offset,
-		laneBias:      bias,
-	}
-
-	// Every lane starts out demanded, so the first traffic tick on this tunnel
-	// probes all of them at once instead of waiting for a flow to hash onto each.
-	// Lanes have to be up *before* the flows are, not after: the peer writes a
-	// flow's inbound packets to the tun queue matching the socket they arrived on,
-	// and the kernel remembers that for as long as the flow stays busy. A flow that
-	// starts while the lanes are still down therefore gets pinned to queue 0 on
-	// both hosts for its whole life. This costs one probe per lane on any tunnel
-	// with traffic; an idle tunnel is never ticked, so it still costs nothing.
-	for s := 1; s < txLanes; s++ {
-		ls.demand[s].Store(true)
-	}
-	return ls
-}
-
-// laneLogAttr summarizes what a tunnel negotiated, for the handshake log lines.
-// It is an empty attr, which slog drops, on a node not running multiport. A peer
-// that negotiated no lanes still logs, with zeros: "we offered and got nothing"
-// is exactly what you want to see when you expected lanes and have none.
-func laneLogAttr(myLanes int, ls *laneSet) slog.Attr {
-	if myLanes == 0 {
-		return slog.Attr{}
-	}
-	if ls == nil {
-		return slog.Any("lanes", m{"tx": 0, "sessions": 0})
-	}
-	// Every field read here is immutable once the set is built.
-	return slog.Any("lanes", m{
-		"tx":           ls.txLanes,
-		"sessions":     len(ls.sessions),
-		"peerBasePort": ls.peerBasePort,
-		"peerPorts":    ls.peerPortCount,
-		"portOffset":   ls.portOffset,
-	})
-}
-
-// emitLaneStats reports how many lanes are carrying traffic and how many tunnels
-// have any. Both are counted by walking the hostmap, because a counter kept at
-// promotion and demotion would drift upward forever: a tunnel torn down while its
-// lanes are up never demotes them. Only a node running multiport pays for the
-// walk.
-func (f *Interface) emitLaneStats(up, tunnels metrics.Gauge) {
-	var nUp, nTunnels int64
-	f.hostMap.ForEachIndex(func(hostinfo *HostInfo) {
-		ls := hostinfo.lanes
-		if ls == nil {
-			return
-		}
-		nTunnels++
-		for s := 1; s < ls.txLanes; s++ {
-			if ls.txAddr[s].Load() != nil {
-				nUp++
-			}
-		}
-	})
-	up.Update(nUp)
-	tunnels.Update(nTunnels)
-}
-
-// lanePortOffset returns the rotation applied to this pair's lane target ports,
-// in [0, peerPortCount). Without it every low-routine peer would aim its few
-// lanes at a big peer's first few ports, concentrating the big peer's receive
-// work on a couple of sockets; the hash spreads pairs across the whole range.
-//
-// Both sides hash the same sorted vpn-address pair and the higher address
-// negates the result, so when port counts match the two sides' rotations
-// cancel: our lane s's 4-tuple stays the reverse of the peer's lane s, and each
-// side's probe opens the conntrack entry the other's arrives through. (The one
-// lane a nonzero rotation lands on the peer's base port has no partner lane, so
-// behind a port-restricted NAT it is the one lane that may never come up.)
-func lanePortOffset(myAddr, peerAddr netip.Addr, peerPortCount uint16) uint16 {
-	if peerPortCount == 0 {
-		return 0
-	}
-	lo, hi := myAddr, peerAddr
-	if hi.Less(lo) {
-		lo, hi = hi, lo
-	}
-	h := fnv.New32a()
-	b := lo.As16()
-	h.Write(b[:])
-	b = hi.As16()
-	h.Write(b[:])
-	o := uint16(h.Sum32() % uint32(peerPortCount))
-	if myAddr == hi {
-		o = (peerPortCount - o) % peerPortCount
-	}
-	return o
-}
-
-// laneSession returns the session to decrypt a lane s packet with, deriving one
-// if this is the first packet to claim that lane. A nil session with no error
-// means this tunnel has no lane s at all.
-//
-// cached reports whether the session was already in the table. A fresh one is
-// deliberately left out of it: anyone who can spoof this tunnel's local index
-// can name any lane, and installing on sight would let them make us hold a
-// replay window and two cipher states per lane without authenticating anything.
-// The caller must install with installSession once the packet decrypts, which is
-// the first moment the lane is known to be real.
-func (i *HostInfo) laneSession(s uint8) (ci *ConnectionState, cached bool, err error) {
-	ls := i.lanes
-	if ls == nil || s == 0 || int(s) >= len(ls.sessions) {
-		return nil, false, nil
-	}
-
-	if cs := ls.sessions[s].Load(); cs != nil {
-		return cs, true, nil
-	}
-
-	cs, err := newLaneConnectionState(&ls.material, s)
-	if err != nil {
-		return nil, false, err
-	}
-	return cs, false, nil
-}
-
-// installSession publishes a session derived by laneSession, so the next packet
-// on the lane doesn't have to derive it again. cs must have already decrypted the
-// packet at messageCounter.
-//
-// Two routines can race on a lane's first packet and derive a session each. The
-// loser's is dropped, and with it the replay-window entry for the packet it just
-// accepted, so hand that counter to the session that survives — the keys are
-// identical, so it is the same window in every respect that matters.
-func (ls *laneSet) installSession(l *slog.Logger, s uint8, cs *ConnectionState, messageCounter uint64) {
-	if ls.sessions[s].CompareAndSwap(nil, cs) {
-		return
-	}
-	ls.sessions[s].Load().noteSeen(l, messageCounter)
-}
-
-// session returns lane s's session for our own use, deriving and installing it
-// if it doesn't exist yet. Unlike the RX path this needs no proof the lane is
-// real: we only ask for lanes we chose to send on. s must be a lane this set
-// covers.
-func (ls *laneSet) session(s int) (*ConnectionState, error) {
-	if cs := ls.sessions[s].Load(); cs != nil {
-		return cs, nil
-	}
-
-	cs, err := newLaneConnectionState(&ls.material, uint8(s))
-	if err != nil {
-		return nil, err
-	}
-
-	if !ls.sessions[s].CompareAndSwap(nil, cs) {
-		return ls.sessions[s].Load(), nil
-	}
-	return cs, nil
-}
-
-// maxMessageCounter returns the highest counter across the base session and
-// every lane session. Data rides the lanes, so the base counter alone would
-// never reach the rehandshake or exhaustion thresholds and the lane keys would
-// be used past their data-volume margin. Rolling the base tunnel replaces the
-// lane keys with it, since lanes are derived from it.
-func (i *HostInfo) maxMessageCounter() uint64 {
-	if i.ConnectionState == nil {
-		return 0
-	}
-	c := i.ConnectionState.messageCounter.Load()
-	if ls := i.lanes; ls != nil {
-		for s := range ls.sessions {
-			cs := ls.sessions[s].Load()
-			if cs == nil {
-				// Never derived, so it has never sent anything either.
-				continue
-			}
-			if lc := cs.messageCounter.Load(); lc > c {
-				c = lc
-			}
-		}
-	}
-	return c
-}
-
-// txLane returns the session and destination for lane s, or a nil session when
-// the lane is down and the caller must use the base tunnel. A miss raises
-// demand, which is what gets a down lane probed again, so we pay for a lane
-// exactly where real traffic wanted one. Callers on the data plane come through
-// txLaneForFlow.
-func (ls *laneSet) txLane(s int) (*ConnectionState, netip.AddrPort) {
-	if ls == nil || s <= 0 || s >= ls.txLanes {
-		return nil, netip.AddrPort{}
-	}
-
-	if addr := ls.txAddr[s].Load(); addr != nil {
-		// The lane is only up because a probe was acked on it, and that probe
-		// derived the session, so this load cannot miss. Fall back rather than
-		// derive here anyway: this is the hot path and a nil is not worth an HKDF.
-		if cs := ls.sessions[s].Load(); cs != nil {
-			return cs, *addr
-		}
-		return nil, netip.AddrPort{}
-	}
-
-	// Load-guarded so the common case of a lane that will not come up is a
-	// plain read and cannot ping-pong the cache line these flags share.
-	if !ls.demand[s].Load() {
-		ls.demand[s].Store(true)
-	}
-	return nil, netip.AddrPort{}
-}
-
-// txLaneForFlow picks the lane a flow rides and returns it with its session and
-// destination, or lane 0 and a nil session when the flow belongs on the base
-// tunnel — either because the hash landed on lane 0 or because the lane it
-// landed on is down.
-//
-// The lane comes from the flow rather than from the sending routine so that lane
-// use doesn't depend on how the kernel steers tun queues; see txQueue. It is a
-// pure function of the 5-tuple, so a flow stays on one lane for its life: no
-// per-packet reordering, and one lane's replay window sees one set of flows.
-func (ls *laneSet) txLaneForFlow(p *firewall.Packet) (int, *ConnectionState, netip.AddrPort) {
-	if ls == nil || ls.txLanes < 2 {
-		return 0, nil, netip.AddrPort{}
-	}
-
-	s := int((laneFlowHash(p) + uint32(ls.laneBias)) % uint32(ls.txLanes))
-	if s == 0 {
-		// Lane 0 is the base tunnel, and a full share of flows belongs on it.
-		return 0, nil, netip.AddrPort{}
-	}
-
-	cs, addr := ls.txLane(s)
-	return s, cs, addr
-}
-
-// laneFlowHash hashes a 5-tuple to the same value from either end of the flow,
-// which is what lets both peers pick partner lanes for it (see laneBias). FNV-1a
-// by hand rather than through hash/fnv: this runs per packet, and the interface
-// there would escape the addresses to the heap.
-func laneFlowHash(p *firewall.Packet) uint32 {
-	// Order the two endpoints so the direction of travel cannot change the hash.
-	aAddr, aPort := p.LocalAddr, p.LocalPort
-	bAddr, bPort := p.RemoteAddr, p.RemotePort
-	if bAddr.Less(aAddr) || (aAddr == bAddr && bPort < aPort) {
-		aAddr, aPort, bAddr, bPort = bAddr, bPort, aAddr, aPort
-	}
-
-	const prime = 16777619
-	h := uint32(2166136261)
-	x, y := aAddr.As16(), bAddr.As16()
-	for i := range x {
-		h = (h ^ uint32(x[i])) * prime
-		h = (h ^ uint32(y[i])) * prime
-	}
-	for _, b := range [5]byte{byte(aPort >> 8), byte(aPort), byte(bPort >> 8), byte(bPort), p.Protocol} {
-		h = (h ^ uint32(b)) * prime
-	}
-	return h
-}
-
-// laneTargetPortLocked returns the peer port lane s aims at. Only meaningful
-// when peerPortCount is nonzero, which txLanes > 0 guarantees.
-func (ls *laneSet) laneTargetPortLocked(s int) uint16 {
-	return ls.peerBasePort + uint16((s+int(ls.portOffset))%int(ls.peerPortCount))
-}
-
-// laneTargetLocked returns where lane s's probes go: the peer port this lane is
-// paired with, on the peer's current direct address.
-//
-// A lane only ever aims at its own port. There is no fallback to the peer's base
-// port when the lane port doesn't answer — a lane sharing the base port's
-// destination gains only a source port of its own, while costing the peer the
-// receive spread that is the whole point, so a lane that can't reach its port
-// stays down and its traffic rides the base tunnel.
-func (ls *laneSet) laneTargetLocked(s int, addr netip.Addr) netip.AddrPort {
-	return netip.AddrPortFrom(addr, ls.laneTargetPortLocked(s))
-}
-
-// laneRetryDelay is the backoff after fails consecutive probe failures.
-func laneRetryDelay(fails uint8) time.Duration {
-	d := laneRetryBase << min(fails, 4)
-	if d > laneRetryMax {
-		d = laneRetryMax
-	}
-	return d
-}
-
-// noteAck records an acked probe for lane s, promoting the lane if it was down.
-// gen must match the outstanding probe. Reports the target the lane came up on,
-// and whether this ack is what promoted it.
-func (ls *laneSet) noteAck(s int, gen uint8, now time.Time) (netip.AddrPort, bool) {
-	if s <= 0 || s >= len(ls.probe) {
-		return netip.AddrPort{}, false
-	}
-
-	ls.mu.Lock()
-	defer ls.mu.Unlock()
-
-	p := &ls.probe[s]
-	if p.sentAt.IsZero() || p.gen != gen {
-		// No probe outstanding, or an ack for a probe we have already given up
-		// on. Either way it says nothing about the lane's current path.
-		return netip.AddrPort{}, false
-	}
-
-	p.sentAt = time.Time{}
-	p.lastAck = now
-	p.fails = 0
-	p.retryAt = time.Time{}
-
-	target := p.target
-	if ls.txAddr[s].Load() != nil {
-		// Keepalive for a lane already up.
-		return target, false
-	}
-
-	ls.txAddr[s].Store(&target)
-	return target, true
-}
-
-// probeLanes runs one lane maintenance pass for a peer: it demotes lanes whose
-// probe went unanswered, re-proves lanes that have been up a while without one,
-// and probes down lanes the data plane asked for. Driven by the connection
-// manager's per-tunnel traffic tick, which only fires for a live tunnel — the
-// same condition that produces lane demand in the first place.
-func (f *Interface) probeLanes(hostinfo *HostInfo, now time.Time, nb, out []byte) {
-	ls := hostinfo.lanes
-	if ls == nil || ls.txLanes < 2 {
-		return
-	}
-
-	remote := hostinfo.GetRemote()
-
-	ls.mu.Lock()
-	defer ls.mu.Unlock()
-
-	if !remote.IsValid() {
-		// Relayed, or otherwise without a direct path. Lanes are direct-only,
-		// so drop them all; a later tick rebuilds if a direct path returns.
-		ls.resetLocked()
-		return
-	}
-
-	if ls.peerAddr != remote.Addr() {
-		if ls.peerAddr.IsValid() {
-			// A roam is a new path, not a failure: forget the lanes built on
-			// the old one and let demand re-probe from a clean backoff. On the
-			// first pass there is nothing built yet, so just record the address.
-			ls.resetLocked()
-		}
-		ls.peerAddr = remote.Addr()
-	}
-
-	for s := 1; s < ls.txLanes; s++ {
-		p := &ls.probe[s]
-		up := ls.txAddr[s].Load() != nil
-
-		if !p.sentAt.IsZero() {
-			if now.Sub(p.sentAt) < laneProbeTimeout {
-				continue
-			}
-
-			// An aged-out probe is a failure whether it was bringing the lane
-			// up or keeping it up.
-			p.sentAt = time.Time{}
-			p.fails = min(p.fails+1, laneMaxFails)
-			p.retryAt = now.Add(laneRetryDelay(p.fails))
-			if up {
-				ls.txAddr[s].Store(nil)
-				hostinfo.logger(f.l).Info("Multiport lane demoted, probe unanswered", "lane", s, "udpAddr", p.target)
-			}
-			continue
-		}
-
-		if up {
-			if now.Sub(p.lastAck) < laneKeepalive {
-				continue
-			}
-		} else if now.Before(p.retryAt) || !ls.demand[s].Swap(false) {
-			continue
-		}
-
-		p.gen++
-		p.target = ls.laneTargetLocked(s, remote.Addr())
-		if f.sendLaneProbe(hostinfo, s, p.gen, p.target, nb, out) {
-			p.sentAt = now
-		} else {
-			p.fails = min(p.fails+1, laneMaxFails)
-			p.retryAt = now.Add(laneRetryDelay(p.fails))
-		}
-	}
-}
-
-// resetLocked takes every lane down and clears its probe state, without
-// counting it as a failure.
-//
-// Demand is deliberately left standing: it records that a routine has real
-// traffic for this peer, which a roam or a relay detour does not change. Keeping
-// it re-probes the lanes that were actually carrying data as soon as a path
-// exists again, while a lane whose routine has gone quiet stays down.
-func (ls *laneSet) resetLocked() {
-	for s := 1; s < len(ls.probe); s++ {
-		ls.txAddr[s].Store(nil)
-		ls.probe[s] = laneProbeState{}
-	}
-}
-
-// sendLaneProbe sends a probe on lane s to addr from a socket on lane s's port.
-// The probe is an ordinary Test packet encrypted with the lane's session, so an
-// ack proves the whole lane: our source port reached the peer, its reply reached
-// us, and the keys we derived for this lane match the ones it derived. Reports
-// whether the probe made it onto the wire.
-//
-// It goes out the first socket on the port, since the connection manager runs
-// this and has no queue of its own; every socket on the port has the same address,
-// so the probe proves the path for whichever one the data plane picks.
-func (f *Interface) sendLaneProbe(hostinfo *HostInfo, s int, gen uint8, addr netip.AddrPort, nb, out []byte) bool {
-	// The first probe on a lane is what derives its session.
-	ci, err := hostinfo.lanes.session(s)
-	if err != nil {
-		hostinfo.logger(f.l).Error("Failed to derive multiport lane session", "error", err, "lane", s)
-		return false
-	}
-	if ci == nil || ci.eKey == nil {
-		return false
-	}
-
-	if noiseutil.EncryptLockNeeded {
-		ci.writeLock.Lock()
-	}
-	c, ok := ci.NextMessageCounter()
-	if !ok {
-		if noiseutil.EncryptLockNeeded {
-			ci.writeLock.Unlock()
-		}
-		f.dropExhausted(hostinfo, c, "Dropping multiport lane probe, lane message counter is exhausted")
-		return false
-	}
-
-	b := header.EncodeLane(out[:0], header.Version, header.Test, header.LaneProbe, hostinfo.remoteIndexId, c, uint8(s))
-	b, err = ci.eKey.EncryptDanger(b, b, []byte{uint8(s), gen}, c, nb)
-	if noiseutil.EncryptLockNeeded {
-		ci.writeLock.Unlock()
-	}
-	if err != nil {
-		hostinfo.logger(f.l).Error("Failed to encrypt multiport lane probe", "error", err, "lane", s)
-		return false
-	}
-
-	f.messageMetrics.Tx(header.Test, header.LaneProbe, 1)
-	if err := f.writers[f.laneSock(0, s)].WriteTo(b, addr); err != nil {
-		hostinfo.logger(f.l).Error("Failed to send multiport lane probe", "error", err, "lane", s, "udpAddr", addr)
-		return false
-	}
-
-	if f.l.Enabled(context.Background(), slog.LevelDebug) {
-		hostinfo.logger(f.l).Debug("Multiport lane probe sent", "lane", s, "gen", gen, "udpAddr", addr)
-	}
-	return true
-}
-
-// handleLaneProbe answers a peer's lane probe. The ack rides the base tunnel on
-// purpose: a probe proves the peer's lane s works in its send direction, and
-// answering on our own lane s would make the result depend on a second path
-// that may be broken independently.
-func (f *Interface) handleLaneProbe(hostinfo *HostInfo, lane uint8, payload []byte, rxc *rxContext) {
-	if lane == 0 || len(payload) < 2 {
-		return
-	}
-
-	// Echo the header's lane rather than the payload's, so a peer cannot get us
-	// to vouch for a lane it did not actually probe.
-	f.send(header.Test, header.LaneProbeAck, hostinfo.ConnectionState, hostinfo,
-		[]byte{lane, payload[1]}, rxc.nb, rxc.scratch[:0])
-}
-
-// handleLaneProbeAck promotes the lane a peer just acked.
-func (f *Interface) handleLaneProbeAck(hostinfo *HostInfo, payload []byte) {
-	ls := hostinfo.lanes
-	if ls == nil || len(payload) < 2 {
-		return
-	}
-
-	// The target is worth logging next to the demotion that names the same
-	// address, so a flapping lane can be read off the logs.
-	if target, promoted := ls.noteAck(int(payload[0]), payload[1], time.Now()); promoted {
-		hostinfo.logger(f.l).Info("Multiport lane up", "lane", payload[0], "udpAddr", target)
-	}
-}
@@ -36,10 +36,6 @@ type LightHouse struct {
 	myVpnNetworksTable *bart.Lite
 	punchy             *Punchy

-	// localAddrsFn enumerates the underlay addresses we advertise. It is a field so tests can supply simulated
-	// addresses rather than whatever this machine's NICs happen to be. Set it before Start.
-	localAddrsFn func(*LocalAllowList) []netip.Addr
-
 	// Local cache of answers from light houses
 	// map of vpn addr to answers
 	addrMap map[netip.Addr]*RemoteList
@@ -111,10 +107,6 @@ func NewLightHouseFromConfig(ctx context.Context, l *slog.Logger, c *config.C, c
 		queryChan:          make(chan netip.Addr, c.GetUint32("handshakes.query_buffer", 64)),
 		l:                  l,
 	}
-	h.localAddrsFn = func(al *LocalAllowList) []netip.Addr {
-		return localAddrs(h.l, al)
-	}
-
 	lighthouses := make([]netip.Addr, 0)
 	h.lighthouses.Store(&lighthouses)
 	staticList := make(map[netip.Addr]struct{})
@@ -280,18 +272,16 @@ func (lh *LightHouse) reload(c *config.C, initial bool) error {
 	//NOTE: many things will get much simpler when we combine static_host_map and lighthouse.hosts in config
 	if initial || c.HasChanged("static_host_map") || c.HasChanged("static_map.cadence") || c.HasChanged("static_map.network") || c.HasChanged("static_map.lookup_timeout") {
 		// Clean up. Entries still in the static_host_map will be re-built.
-		ourselves := lh.myVpnNetworks[0].Addr()
-		oldStaticList := lh.staticList.Load()
-		if oldStaticList != nil {
+		// Entries no longer present must have their (possible) background DNS goroutines stopped.
+		if existingStaticList := lh.staticList.Load(); existingStaticList != nil {
 			lh.RLock()
-			for staticVpnAddr := range *oldStaticList {
+			for staticVpnAddr := range *existingStaticList {
 				if am, ok := lh.addrMap[staticVpnAddr]; ok && am != nil {
-					am.ResetForOwner(ourselves)
+					am.hr.Cancel()
 				}
 			}
 			lh.RUnlock()
 		}
-
 		// Build a new list based on current config.
 		staticList := make(map[netip.Addr]struct{})
 		err := lh.loadStaticMap(c, staticList)
@@ -299,21 +289,6 @@ func (lh *LightHouse) reload(c *config.C, initial bool) error {
 			return err
 		}

-		// For entries removed from static_host_map, stop the DNS goroutine and drop the cached addrs.
-		// All addrs must come from the lighthouses now that it's no longer a static host.
-		if oldStaticList != nil {
-			lh.RLock()
-			for staticVpnAddr := range *oldStaticList {
-				if _, stillStatic := staticList[staticVpnAddr]; stillStatic {
-					continue
-				}
-				if am, ok := lh.addrMap[staticVpnAddr]; ok && am != nil {
-					am.ClearHostnameResults()
-				}
-			}
-			lh.RUnlock()
-		}
-
 		lh.staticList.Store(&staticList)
 		if !initial {
 			if c.HasChanged("static_host_map") {
@@ -926,7 +901,7 @@ func (lh *LightHouse) SendUpdate() {
 	}

 	lal := lh.GetLocalAllowList()
-	for _, e := range lh.localAddrsFn(lal) {
+	for _, e := range localAddrs(lh.l, lal) {
 		if lh.myVpnNetworksTable.Contains(e) {
 			continue
 		}
@@ -1426,9 +1401,6 @@ func (lhh *LightHouseHandler) handleHostPunchNotification(n *NebulaMeta, fromVpn

 	remoteAllowList := lhh.lh.GetRemoteAllowList()
 	for _, a := range n.Details.V4AddrPorts {
-		if a == nil {
-			continue
-		}
 		b := protoV4AddrPortToNetAddrPort(a)
 		if remoteAllowList.Allow(detailsVpnAddr, b.Addr()) {
 			lhh.lh.punchy.Schedule(b, detailsVpnAddr)
@@ -1436,9 +1408,6 @@ func (lhh *LightHouseHandler) handleHostPunchNotification(n *NebulaMeta, fromVpn
 	}

 	for _, a := range n.Details.V6AddrPorts {
-		if a == nil {
-			continue
-		}
 		b := protoV6AddrPortToNetAddrPort(a)
 		if remoteAllowList.Allow(detailsVpnAddr, b.Addr()) {
 			lhh.lh.punchy.Schedule(b, detailsVpnAddr)
@@ -1468,7 +1437,7 @@ func protoV6AddrPortToNetAddrPort(ap *V6AddrPort) netip.AddrPort {
 	b := [16]byte{}
 	binary.BigEndian.PutUint64(b[:8], ap.Hi)
 	binary.BigEndian.PutUint64(b[8:], ap.Lo)
-	return netip.AddrPortFrom(netip.AddrFrom16(b).Unmap(), uint16(ap.Port))
+	return netip.AddrPortFrom(netip.AddrFrom16(b), uint16(ap.Port))
 }

 func netAddrToProtoAddr(addr netip.Addr) *Addr {
@@ -1508,9 +1477,7 @@ func (d *NebulaMetaDetails) GetRelays() []netip.Addr {

 	if len(d.RelayVpnAddrs) > 0 {
 		for _, r := range d.RelayVpnAddrs {
-			if r != nil {
-				relays = append(relays, protoAddrToNetAddr(r))
-			}
+			relays = append(relays, protoAddrToNetAddr(r))
 		}
 	}
 	return relays
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
JackDoan	c610b712af	it works	2026-05-22 08:52:37 -05:00
JackDoan	aff46ce762	gottem	2026-05-14 16:06:00 -05:00
JackDoan	8051de88d7	no	2026-05-14 15:56:39 -05:00
JackDoan	d50c3028a2	broken checkpt	2026-05-14 15:56:34 -05:00
JackDoan	d429dab5dd	tweaks	2026-05-14 14:43:57 -05:00
JackDoan	c4deb5fc1c	checkpt	2026-05-14 14:42:17 -05:00
JackDoan	697294a676	size arena to match batch size	2026-05-14 14:39:02 -05:00
JackDoan	13ebc1b343	batched tun interface	2026-05-14 14:37:35 -05:00
JackDoan	0d87e57de3	fixes	2026-05-14 14:31:04 -05:00
JackDoan	2841aea86c	fixes	2026-05-14 14:31:04 -05:00
JackDoan	5eb0b1cfd3	snip	2026-05-14 14:31:04 -05:00
JackDoan	7d61303e81	snip	2026-05-14 14:31:04 -05:00
JackDoan	d1a24540e6	snip	2026-05-14 14:31:04 -05:00
JackDoan	3b1e658bef	change Queue.Read signature	2026-05-14 14:31:02 -05:00
JackDoan	3192e47ff4	flatten tio.Capabilities	2026-05-14 14:28:07 -05:00
JackDoan	37208b1d8f	speed	2026-05-14 14:28:06 -05:00
JackDoan	7bb5cd477e	new tun interface	2026-05-14 14:27:17 -05:00
JackDoan	c08ed7d626	udp setsockopt correctness fixes	2026-05-12 11:41:42 -05:00
JackDoan	c256f2cfbb	use less ram pls	2026-05-11 17:30:56 -05:00
JackDoan	3be637bade	clean up a comment a bit	2026-05-11 17:10:33 -05:00
JackDoan	0ff28504d7	drop in a logger	2026-05-11 17:10:05 -05:00
JackDoan	2a47b47853	go mod tidy	2026-05-11 14:56:26 -05:00
JackDoan	681f5ef5a6	lint	2026-05-11 14:04:23 -05:00
JackDoan	6b6dcda486	fix	2026-05-11 11:32:57 -05:00
JackDoan	ed4d17d768	faster grr heap usage!	2026-05-11 11:32:57 -05:00
JackDoan	67af1edadb	no	2026-05-11 11:32:57 -05:00
JackDoan	7924cf0aa8	use clear()	2026-05-11 11:32:57 -05:00
JackDoan	b0f139b578	remove udp-level RX reorder buf	2026-05-11 11:32:57 -05:00
JackDoan	1972c73940	make relays take the fast path maybe	2026-05-11 11:32:57 -05:00
JackDoan	5138321491	scoot pinning around	2026-05-11 11:32:57 -05:00
JackDoan	49535ceb6c	scoot stuff around for e2e	2026-05-11 11:32:57 -05:00
JackDoan	e3e8622b98	disable sort-on-RX, CPU pinning seems to work for now	2026-05-11 11:32:57 -05:00
JackDoan	924268cc1f	switch to ASM vector checksum	2026-05-11 11:32:57 -05:00
JackDoan	6a46a2913a	GSO/GRO offloads, with TCP+ECN and UDP support	2026-05-11 11:32:57 -05:00
JackDoan	4b4331ba42	better and batched tun interface	2026-05-11 11:32:57 -05:00