document new config options

.github/workflows/release.yml

@@ -209,11 +209,10 @@ jobs:
         id: create_release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REF_NAME: ${{ github.ref_name }}
         run: |
           cd artifacts
           gh release create \
             --verify-tag \
-            --title "Release ${GITHUB_REF_NAME}" \
-            "${GITHUB_REF_NAME}" \
+            --title "Release ${{ github.ref_name }}" \
+            "${{ github.ref_name }}" \
             SHASUM256.txt *-latest/*.zip *-latest/*.tar.gz

.github/workflows/smoke-extra.yml

@@ -18,8 +18,6 @@ jobs:
     if: github.ref == 'refs/heads/master' || contains(github.event.pull_request.labels.*.name, 'smoke-test-extra')
     name: Run extra smoke tests
     runs-on: ubuntu-latest
-    env:
-      VAGRANT_DEFAULT_PROVIDER: libvirt
     steps:
 
     - uses: actions/checkout@v6
@@ -32,13 +30,11 @@ jobs:
     - name: add hashicorp source
       run: wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg && echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
 
-    - name: install vagrant and libvirt
-      run: |
-        sudo apt-get update && sudo apt-get install -y vagrant libvirt-daemon-system libvirt-dev
-        sudo chmod 666 /dev/kvm
-        sudo usermod -aG libvirt $(whoami)
-        sudo chmod 666 /var/run/libvirt/libvirt-sock
-        vagrant plugin install vagrant-libvirt
+    - name: workaround AMD-V issue  # https://github.com/cri-o/packaging/pull/306
+      run: sudo rmmod kvm_amd
+
+    - name: install vagrant
+      run: sudo apt-get update && sudo apt-get install -y vagrant virtualbox
 
     - name: freebsd-amd64
       run: make smoke-vagrant/freebsd-amd64
@@ -49,19 +45,10 @@ jobs:
     - name: netbsd-amd64
       run: make smoke-vagrant/netbsd-amd64
 
+    - name: linux-386
+      run: make smoke-vagrant/linux-386
+
     - name: linux-amd64-ipv6disable
       run: make smoke-vagrant/linux-amd64-ipv6disable
 
-    # linux-386 runs last because it requires disabling KVM to use VirtualBox,
-    # which prevents libvirt (used by the other tests) from working after this point.
-    - name: install virtualbox for i386 test
-      run: |
-        sudo apt-get install -y virtualbox
-        sudo rmmod kvm_amd kvm_intel kvm 2>/dev/null || true
-
-    - name: linux-386
-      env:
-        VAGRANT_DEFAULT_PROVIDER: virtualbox
-      run: make smoke-vagrant/linux-386
-
     timeout-minutes: 30

.github/workflows/smoke/build-relay.sh

@@ -16,10 +16,8 @@ relay:
   am_relay: true
 EOF
 
-    # TEST-NET-3 placeholder IPs; smoke-relay.sh seds them to real container IPs.
-    # Mapping: .2 lighthouse1, .3 host2, .4 host3, .5 host4.
-    export LIGHTHOUSES="192.168.100.1 203.0.113.2:4242"
-    export REMOTE_ALLOW_LIST='{"203.0.113.4/32": false, "203.0.113.5/32": false}'
+    export LIGHTHOUSES="192.168.100.1 172.17.0.2:4242"
+    export REMOTE_ALLOW_LIST='{"172.17.0.4/32": false, "172.17.0.5/32": false}'
 
     HOST="host2" ../genconfig.sh >host2.yml <<EOF
 relay:
@@ -27,7 +25,7 @@ relay:
     - 192.168.100.1
 EOF
 
-    export REMOTE_ALLOW_LIST='{"203.0.113.3/32": false}'
+    export REMOTE_ALLOW_LIST='{"172.17.0.3/32": false}'
 
     HOST="host3" ../genconfig.sh >host3.yml
 

.github/workflows/smoke/build.sh

@@ -5,15 +5,9 @@ set -e -x
 rm -rf ./build
 mkdir ./build
 
-# Smoke containers run on a dedicated docker network whose subnet is allocated
-# at smoke time, not known at build time. Configs are written with TEST-NET-3
-# placeholder IPs (RFC 5737) and smoke.sh / smoke-vagrant.sh / smoke-relay.sh
-# sed the real container IPs in before starting nebula.
-#
-# Placeholder mapping (last octet == fixed container slot):
-#   203.0.113.2 -> lighthouse1, 203.0.113.3 -> host2,
-#   203.0.113.4 -> host3,       203.0.113.5 -> host4.
-LIGHTHOUSE_IP="203.0.113.2"
+# TODO: Assumes your docker bridge network is a /24, and the first container that launches will be .1
+# - We could make this better by launching the lighthouse first and then fetching what IP it is.
+NET="$(docker network inspect bridge -f '{{ range .IPAM.Config }}{{ .Subnet }}{{ end }}' | cut -d. -f1-3)"
 
 (
     cd build
@@ -31,16 +25,16 @@ LIGHTHOUSE_IP="203.0.113.2"
         ../genconfig.sh >lighthouse1.yml
 
     HOST="host2" \
-        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $NET.2:4242" \
         ../genconfig.sh >host2.yml
 
     HOST="host3" \
-        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $NET.2:4242" \
         INBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
         ../genconfig.sh >host3.yml
 
     HOST="host4" \
-        LIGHTHOUSES="192.168.100.1 $LIGHTHOUSE_IP:4242" \
+        LIGHTHOUSES="192.168.100.1 $NET.2:4242" \
         OUTBOUND='[{"port": "any", "proto": "icmp", "group": "lighthouse"}]' \
         ../genconfig.sh >host4.yml
 

.github/workflows/smoke/smoke-relay.sh

@@ -6,8 +6,6 @@ set -o pipefail
 
 mkdir -p logs
 
-NETWORK="nebula-smoke-relay"
-
 cleanup() {
     echo
     echo " *** cleanup"
@@ -18,53 +16,22 @@ cleanup() {
     then
         docker kill lighthouse1 host2 host3 host4
     fi
-    docker network rm "$NETWORK" >/dev/null 2>&1
 }
 
 trap cleanup EXIT
 
-# Create a dedicated smoke network with an explicit subnet (required for --ip
-# below). Probe a short list of candidates so a locally-used range doesn't
-# fail the whole test — we only need one to be free.
-docker network rm "$NETWORK" >/dev/null 2>&1 || true
-for candidate in 172.30.0.0/24 172.31.0.0/24 10.98.0.0/24 10.99.0.0/24 192.168.230.0/24; do
-    if docker network create --subnet "$candidate" "$NETWORK" >/dev/null 2>&1; then
-        break
-    fi
-done
-if ! docker network inspect "$NETWORK" >/dev/null 2>&1; then
-    echo "failed to create $NETWORK: every candidate subnet is in use" >&2
-    exit 1
-fi
-
-# Derive container IPs from the network's assigned subnet. Slots: .2 lighthouse1,
-# .3 host2, .4 host3, .5 host4 — matches the placeholders in build-relay.sh.
-SUBNET="$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' "$NETWORK")"
-PREFIX="${SUBNET%/*}"
-PREFIX="${PREFIX%.*}"
-LIGHTHOUSE_IP="$PREFIX.2"
-HOST2_IP="$PREFIX.3"
-HOST3_IP="$PREFIX.4"
-HOST4_IP="$PREFIX.5"
-
-# Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
-for f in build/host2.yml build/host3.yml build/host4.yml; do
-    sed "s|203\.0\.113\.|$PREFIX.|g" "$f" >"$f.tmp"
-    mv "$f.tmp" "$f"
-done
-
 docker run --name lighthouse1 --rm nebula:smoke-relay -config lighthouse1.yml -test
-docker run --name host2 --rm -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" nebula:smoke-relay -config host2.yml -test
-docker run --name host3 --rm -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" nebula:smoke-relay -config host3.yml -test
-docker run --name host4 --rm -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" nebula:smoke-relay -config host4.yml -test
+docker run --name host2 --rm nebula:smoke-relay -config host2.yml -test
+docker run --name host3 --rm nebula:smoke-relay -config host3.yml -test
+docker run --name host4 --rm nebula:smoke-relay -config host4.yml -test
 
-docker run --name lighthouse1 --network "$NETWORK" --ip "$LIGHTHOUSE_IP" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
+docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
 sleep 1
-docker run --name host2 --network "$NETWORK" --ip "$HOST2_IP" -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
+docker run --name host2 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
 sleep 1
-docker run --name host3 --network "$NETWORK" --ip "$HOST3_IP" -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
+docker run --name host3 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
 sleep 1
-docker run --name host4 --network "$NETWORK" --ip "$HOST4_IP" -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
+docker run --name host4 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke-relay -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
 sleep 1
 
 set +x
@@ -109,13 +76,7 @@ docker exec host4 sh -c 'kill 1'
 docker exec host3 sh -c 'kill 1'
 docker exec host2 sh -c 'kill 1'
 docker exec lighthouse1 sh -c 'kill 1'
-
-# Wait up to 30s for all backgrounded jobs to exit rather than relying on a
-# fixed sleep.
-for _ in $(seq 1 30); do
-    [ -z "$(jobs -r)" ] && break
-    sleep 1
-done
+sleep 5
 
 if [ "$(jobs -r)" ]
 then

.github/workflows/smoke/smoke-vagrant.sh

@@ -8,8 +8,6 @@ export VAGRANT_CWD="$PWD/vagrant-$1"
 
 mkdir -p logs
 
-NETWORK="nebula-smoke"
-
 cleanup() {
     echo
     echo " *** cleanup"
@@ -21,51 +19,21 @@ cleanup() {
         docker kill lighthouse1 host2
     fi
     vagrant destroy -f
-    docker network rm "$NETWORK" >/dev/null 2>&1
 }
 
 trap cleanup EXIT
 
-# Create a dedicated smoke network with an explicit subnet (required for --ip
-# below). Probe a short list of candidates so a locally-used range doesn't
-# fail the whole test — we only need one to be free.
-docker network rm "$NETWORK" >/dev/null 2>&1 || true
-for candidate in 172.30.0.0/24 172.31.0.0/24 10.98.0.0/24 10.99.0.0/24 192.168.230.0/24; do
-    if docker network create --subnet "$candidate" "$NETWORK" >/dev/null 2>&1; then
-        break
-    fi
-done
-if ! docker network inspect "$NETWORK" >/dev/null 2>&1; then
-    echo "failed to create $NETWORK: every candidate subnet is in use" >&2
-    exit 1
-fi
-
-# Derive container IPs from the network's assigned subnet. Slots: .2 lighthouse1,
-# .3 host2 — matches the placeholders in build.sh.
-SUBNET="$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' "$NETWORK")"
-PREFIX="${SUBNET%/*}"
-PREFIX="${PREFIX%.*}"
-LIGHTHOUSE_IP="$PREFIX.2"
-HOST2_IP="$PREFIX.3"
-
-# Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
-# This must happen before `vagrant up` rsyncs build/ into the VM for host3.
-for f in build/host2.yml build/host3.yml; do
-    sed "s|203\.0\.113\.|$PREFIX.|g" "$f" >"$f.tmp"
-    mv "$f.tmp" "$f"
-done
-
 CONTAINER="nebula:${NAME:-smoke}"
 
 docker run --name lighthouse1 --rm "$CONTAINER" -config lighthouse1.yml -test
-docker run --name host2 --rm -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" "$CONTAINER" -config host2.yml -test
+docker run --name host2 --rm "$CONTAINER" -config host2.yml -test
 
 vagrant up
 vagrant ssh -c "cd /nebula && /nebula/$1-nebula -config host3.yml -test" -- -T
 
-docker run --name lighthouse1 --network "$NETWORK" --ip "$LIGHTHOUSE_IP" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
+docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
 sleep 1
-docker run --name host2 --network "$NETWORK" --ip "$HOST2_IP" -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
+docker run --name host2 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
 sleep 1
 vagrant ssh -c "cd /nebula && sudo sh -c 'echo \$\$ >/nebula/pid && exec /nebula/$1-nebula -config host3.yml'" 2>&1 -- -T | tee logs/host3 | sed -u 's/^/  [host3]  /' &
 sleep 15
@@ -128,14 +96,7 @@ vagrant ssh -c "ping -c1 192.168.100.2" -- -T
 vagrant ssh -c "sudo xargs kill </nebula/pid" -- -T
 docker exec host2 sh -c 'kill 1'
 docker exec lighthouse1 sh -c 'kill 1'
-
-# Wait up to 30s for all backgrounded jobs to exit. vagrant ssh in particular
-# takes a beat to tear down after nebula exits on the VM, so a fixed sleep is
-# racy.
-for _ in $(seq 1 30); do
-    [ -z "$(jobs -r)" ] && break
-    sleep 1
-done
+sleep 1
 
 if [ "$(jobs -r)" ]
 then

.github/workflows/smoke/smoke.sh

@@ -6,8 +6,6 @@ set -o pipefail
 
 mkdir -p logs
 
-NETWORK="nebula-smoke"
-
 cleanup() {
     echo
     echo " *** cleanup"
@@ -18,56 +16,24 @@ cleanup() {
     then
         docker kill lighthouse1 host2 host3 host4
     fi
-    docker network rm "$NETWORK" >/dev/null 2>&1
 }
 
 trap cleanup EXIT
 
-# Create a dedicated smoke network with an explicit subnet (required for --ip
-# below). Probe a short list of candidates so a locally-used range doesn't
-# fail the whole test — we only need one to be free.
-docker network rm "$NETWORK" >/dev/null 2>&1 || true
-for candidate in 172.30.0.0/24 172.31.0.0/24 10.98.0.0/24 10.99.0.0/24 192.168.230.0/24; do
-    if docker network create --subnet "$candidate" "$NETWORK" >/dev/null 2>&1; then
-        break
-    fi
-done
-if ! docker network inspect "$NETWORK" >/dev/null 2>&1; then
-    echo "failed to create $NETWORK: every candidate subnet is in use" >&2
-    exit 1
-fi
-
-# Derive container IPs from the network's assigned subnet. Slots: .2 lighthouse1,
-# .3 host2, .4 host3, .5 host4 — matches the placeholders in build.sh.
-SUBNET="$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' "$NETWORK")"
-PREFIX="${SUBNET%/*}"
-PREFIX="${PREFIX%.*}"
-LIGHTHOUSE_IP="$PREFIX.2"
-HOST2_IP="$PREFIX.3"
-HOST3_IP="$PREFIX.4"
-HOST4_IP="$PREFIX.5"
-
-# Sed the placeholder TEST-NET-3 IPs in the host configs to the real ones.
-# build/lighthouse1.yml has no IPs to rewrite so it's skipped.
-for f in build/host2.yml build/host3.yml build/host4.yml; do
-    sed "s|203\.0\.113\.|$PREFIX.|g" "$f" >"$f.tmp"
-    mv "$f.tmp" "$f"
-done
-
 CONTAINER="nebula:${NAME:-smoke}"
 
 docker run --name lighthouse1 --rm "$CONTAINER" -config lighthouse1.yml -test
-docker run --name host2 --rm -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" "$CONTAINER" -config host2.yml -test
-docker run --name host3 --rm -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" "$CONTAINER" -config host3.yml -test
-docker run --name host4 --rm -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" "$CONTAINER" -config host4.yml -test
+docker run --name host2 --rm "$CONTAINER" -config host2.yml -test
+docker run --name host3 --rm "$CONTAINER" -config host3.yml -test
+docker run --name host4 --rm "$CONTAINER" -config host4.yml -test
 
-docker run --name lighthouse1 --network "$NETWORK" --ip "$LIGHTHOUSE_IP" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
+docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config lighthouse1.yml 2>&1 | tee logs/lighthouse1 | sed -u 's/^/  [lighthouse1]  /' &
 sleep 1
-docker run --name host2 --network "$NETWORK" --ip "$HOST2_IP" -v "$PWD/build/host2.yml:/nebula/host2.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
+docker run --name host2 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host2.yml 2>&1 | tee logs/host2 | sed -u 's/^/  [host2]  /' &
 sleep 1
-docker run --name host3 --network "$NETWORK" --ip "$HOST3_IP" -v "$PWD/build/host3.yml:/nebula/host3.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
+docker run --name host3 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host3.yml 2>&1 | tee logs/host3 | sed -u 's/^/  [host3]  /' &
 sleep 1
-docker run --name host4 --network "$NETWORK" --ip "$HOST4_IP" -v "$PWD/build/host4.yml:/nebula/host4.yml:ro" --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
+docker run --name host4 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm "$CONTAINER" -config host4.yml 2>&1 | tee logs/host4 | sed -u 's/^/  [host4]  /' &
 sleep 1
 
 # grab tcpdump pcaps for debugging
@@ -82,7 +48,7 @@ docker exec host4 tcpdump -i eth0 -q -w - -U 2>logs/host4.outside.log >logs/host
 
 docker exec host2 ncat -nklv 0.0.0.0 2000 &
 docker exec host3 ncat -nklv 0.0.0.0 2000 &
-docker exec host4 ncat -e '/usr/bin/echo helloagainfromhost4' -nkluv 0.0.0.0 4000 &
+docker exec host4 ncat -nkluv 0.0.0.0 4000 &
 docker exec host2 ncat -e '/usr/bin/echo host2' -nkluv 0.0.0.0 3000 &
 docker exec host3 ncat -e '/usr/bin/echo host3' -nkluv 0.0.0.0 3000 &
 
@@ -155,23 +121,16 @@ echo " *** Testing conntrack"
 echo
 set -x
 
-# host4's outbound firewall only allows ICMP to the lighthouse, so host4
-# cannot initiate UDP to host2. Once host2 initiates a flow to host4:4000,
-# conntrack must let host4's listener reply on that flow. If it doesn't,
-# the echo back from host4 never reaches host2.
-docker exec host2 sh -c "(/usr/bin/echo host2; sleep 2) | ncat -nuv 192.168.100.4 4000" | grep -q helloagainfromhost4
+# host2 speaking to host4 on UDP 4000 should allow it to reply, when firewall rules would normally not permit this
+docker exec host2 sh -c "/usr/bin/echo host2 | ncat -nuv 192.168.100.4 4000"
+docker exec host2 ncat -e '/usr/bin/echo helloagainfromhost2' -nkluv 0.0.0.0 4000 &
+docker exec host4 sh -c "/usr/bin/echo host4 | ncat -nuv 192.168.100.2 4000"
 
 docker exec host4 sh -c 'kill 1'
 docker exec host3 sh -c 'kill 1'
 docker exec host2 sh -c 'kill 1'
 docker exec lighthouse1 sh -c 'kill 1'
-
-# Wait up to 30s for all backgrounded jobs to exit rather than relying on a
-# fixed sleep.
-for _ in $(seq 1 30); do
-    [ -z "$(jobs -r)" ] && break
-    sleep 1
-done
+sleep 5
 
 if [ "$(jobs -r)" ]
 then

.github/workflows/smoke/vagrant-linux-amd64-ipv6disable/Vagrantfile

@@ -1,7 +1,7 @@
 # -*- mode: ruby -*-
 # vi: set ft=ruby :
 Vagrant.configure("2") do |config|
-  config.vm.box = "bento/ubuntu-24.04"
+  config.vm.box = "ubuntu/jammy64"
 
   config.vm.synced_folder "../build", "/nebula"
 

.github/workflows/smoke/vagrant-openbsd-amd64/Vagrantfile

@@ -1,7 +1,7 @@
 # -*- mode: ruby -*-
 # vi: set ft=ruby :
 Vagrant.configure("2") do |config|
-  config.vm.box = "DefinedNet/openbsd78"
+  config.vm.box = "generic/openbsd7"
 
   config.vm.synced_folder "../build", "/nebula", type: "rsync"
 end

.golangci.yaml

@@ -2,21 +2,7 @@ version: "2"
 linters:
   default: none
   enable:
-    - sloglint
     - testifylint
-  settings:
-    sloglint:
-      # Enforce key-value pair form for Info/Debug/Warn/Error/Log/With and
-      # the package-level slog equivalents. Use l.Log(ctx, level, ...) for
-      # custom levels instead of LogAttrs when you can.
-      #
-      # LogAttrs is also flagged by this rule because it takes ...slog.Attr;
-      # the few legitimate sites (where attrs is built up as a []slog.Attr)
-      # carry a //nolint:sloglint with rationale.
-      kv-only: true
-      # no-mixed-args is on by default: forbids mixing kv and attrs in one call.
-      # discard-handler is on by default (since Go 1.24): suggests
-      # slog.DiscardHandler over slog.NewTextHandler(io.Discard, nil).
   exclusions:
     generated: lax
     presets:

CODEOWNERS

@@ -1 +0,0 @@
-#ECCN:Open Source

README.md

@@ -57,7 +57,7 @@ Check the [releases](https://github.com/slackhq/nebula/releases/latest) page for
     docker pull nebulaoss/nebula
     ```
 
-#### Mobile ([source code](https://github.com/DefinedNet/mobile_nebula))
+#### Mobile
 
 - [iOS](https://apps.apple.com/us/app/mobile-nebula/id1509587936?itsct=apps_box&itscg=30200)
 - [Android](https://play.google.com/store/apps/details?id=net.defined.mobile_nebula&pcampaignid=pcampaignidMKT-Other-global-all-co-prtnr-py-PartBadge-Mar2515-1)
@@ -76,8 +76,6 @@ Nebula was created to provide a mechanism for groups of hosts to communicate sec
 
 ## Getting started (quickly)
 
-**Don't want to manage your own PKI and lighthouses?** [Managed Nebula](https://www.defined.net/) from Defined Networking handles all of this for you.
-
 To set up a Nebula network, you'll need:
 
 #### 1. The [Nebula binaries](https://github.com/slackhq/nebula/releases) or [Distribution Packages](https://github.com/slackhq/nebula#distribution-packages) for your specific platform. Specifically you'll need `nebula-cert` and the specific nebula binary for each platform you use.

bits.go

@@ -1,10 +1,8 @@
 package nebula
 
 import (
-	"context"
-	"log/slog"
-
 	"github.com/rcrowley/go-metrics"
+	"github.com/sirupsen/logrus"
 )
 
 type Bits struct {
@@ -32,7 +30,7 @@ func NewBits(bits uint64) *Bits {
 	return b
 }
 
-func (b *Bits) Check(l *slog.Logger, i uint64) bool {
+func (b *Bits) Check(l *logrus.Logger, i uint64) bool {
 	// If i is the next number, return true.
 	if i > b.current {
 		return true
@@ -44,16 +42,13 @@ func (b *Bits) Check(l *slog.Logger, i uint64) bool {
 	}
 
 	// Not within the window
-	if l.Enabled(context.Background(), slog.LevelDebug) {
-		l.Debug("rejected a packet (top)",
-			"current", b.current,
-			"incoming", i,
-		)
+	if l.Level >= logrus.DebugLevel {
+		l.Debugf("rejected a packet (top) %d %d\n", b.current, i)
 	}
 	return false
 }
 
-func (b *Bits) Update(l *slog.Logger, i uint64) bool {
+func (b *Bits) Update(l *logrus.Logger, i uint64) bool {
 	// If i is the next number, return true and update current.
 	if i == b.current+1 {
 		// Check if the oldest bit was lost since we are shifting the window by 1 and occupying it with this counter
@@ -92,13 +87,9 @@ func (b *Bits) Update(l *slog.Logger, i uint64) bool {
 	// Check to see if it's a duplicate
 	if i > b.current-b.length || i < b.length && b.current < b.length {
 		if b.current == i || b.bits[i%b.length] == true {
-			if l.Enabled(context.Background(), slog.LevelDebug) {
-				l.Debug("Receive window",
-					"accepted", false,
-					"currentCounter", b.current,
-					"incomingCounter", i,
-					"reason", "duplicate",
-				)
+			if l.Level >= logrus.DebugLevel {
+				l.WithField("receiveWindow", m{"accepted": false, "currentCounter": b.current, "incomingCounter": i, "reason": "duplicate"}).
+					Debug("Receive window")
 			}
 			b.dupeCounter.Inc(1)
 			return false
@@ -110,13 +101,12 @@ func (b *Bits) Update(l *slog.Logger, i uint64) bool {
 
 	// In all other cases, fail and don't change current.
 	b.outOfWindowCounter.Inc(1)
-	if l.Enabled(context.Background(), slog.LevelDebug) {
-		l.Debug("Receive window",
-			"accepted", false,
-			"currentCounter", b.current,
-			"incomingCounter", i,
-			"reason", "nonsense",
-		)
+	if l.Level >= logrus.DebugLevel {
+		l.WithField("accepted", false).
+			WithField("currentCounter", b.current).
+			WithField("incomingCounter", i).
+			WithField("reason", "nonsense").
+			Debug("Receive window")
 	}
 	return false
 }

cert/ca_pool.go

@@ -1,14 +1,11 @@
 package cert
 
 import (
-	"bufio"
-	"bytes"
-	"encoding/pem"
 	"errors"
 	"fmt"
-	"io"
 	"net/netip"
 	"slices"
+	"strings"
 	"time"
 )
 
@@ -32,46 +29,22 @@ func NewCAPool() *CAPool {
 // If the pool contains any expired certificates, an ErrExpired will be
 // returned along with the pool. The caller must handle any such errors.
 func NewCAPoolFromPEM(caPEMs []byte) (*CAPool, error) {
-	return NewCAPoolFromPEMReader(bytes.NewReader(caPEMs))
-}
-
-// NewCAPoolFromPEMReader will create a new CA pool from the provided reader.
-// The reader must contain a PEM-encoded set of nebula certificates.
-func NewCAPoolFromPEMReader(r io.Reader) (*CAPool, error) {
 	pool := NewCAPool()
-
+	var err error
 	var expired bool
-
-	scanner := bufio.NewScanner(r)
-	scanner.Split(SplitPEM)
-
-	for scanner.Scan() {
-		pemBytes := scanner.Bytes()
-
-		block, rest := pem.Decode(pemBytes)
-		if len(bytes.TrimSpace(rest)) > 0 {
-			return nil, ErrInvalidPEMBlock
+	for {
+		caPEMs, err = pool.AddCAFromPEM(caPEMs)
+		if errors.Is(err, ErrExpired) {
+			expired = true
+			err = nil
 		}
-		if block == nil {
-			return nil, ErrInvalidPEMBlock
-		}
-
-		c, err := unmarshalCertificateBlock(block)
 		if err != nil {
 			return nil, err
 		}
-
-		err = pool.AddCA(c)
-		if errors.Is(err, ErrExpired) {
-			expired = true
-			continue
-		} else if err != nil {
-			return nil, err
+		if len(caPEMs) == 0 || strings.TrimSpace(string(caPEMs)) == "" {
+			break
 		}
 	}
-	if err := scanner.Err(); err != nil {
-		return nil, ErrInvalidPEMBlock
-	}
 
 	if expired {
 		return pool, ErrExpired

cert/ca_pool_test.go

@@ -1,10 +1,7 @@
 package cert
 
 import (
-	"bytes"
-	"io"
 	"net/netip"
-	"strings"
 	"testing"
 	"time"
 
@@ -115,60 +112,6 @@ k+coOv04r+zh33ISyhbsafnYduN17p2eD7CmHvHuerguXD9f32gcxo/KsFCKEjMe
 	assert.Len(t, ppppp.CAs, 1)
 }
 
-// oneByteReader wraps a reader to return at most 1 byte per Read call,
-// exercising the streaming accumulation logic in NewCAPoolFromPEMReader.
-type oneByteReader struct {
-	r io.Reader
-}
-
-func (o *oneByteReader) Read(p []byte) (int, error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-	return o.r.Read(p[:1])
-}
-
-func TestNewCAPoolFromPEMReader_EmptyReader(t *testing.T) {
-	pool, err := NewCAPoolFromPEMReader(bytes.NewReader(nil))
-	require.NoError(t, err)
-	assert.Empty(t, pool.CAs)
-
-	pool, err = NewCAPoolFromPEMReader(strings.NewReader("   \n\t\n  "))
-	require.NoError(t, err)
-	assert.Empty(t, pool.CAs)
-}
-
-func TestNewCAPoolFromPEMReader_OneByteReads(t *testing.T) {
-	ca1, _, _, pem1 := NewTestCaCert(Version2, Curve_CURVE25519, time.Now(), time.Now().Add(time.Hour), nil, nil, nil)
-	ca2, _, _, pem2 := NewTestCaCert(Version2, Curve_CURVE25519, time.Now(), time.Now().Add(time.Hour), nil, nil, nil)
-
-	bundle := append(pem1, pem2...)
-	pool, err := NewCAPoolFromPEMReader(&oneByteReader{r: bytes.NewReader(bundle)})
-	require.NoError(t, err)
-	assert.Len(t, pool.CAs, 2)
-
-	fp1, err := ca1.Fingerprint()
-	require.NoError(t, err)
-	fp2, err := ca2.Fingerprint()
-	require.NoError(t, err)
-
-	assert.Contains(t, pool.CAs, fp1)
-	assert.Contains(t, pool.CAs, fp2)
-}
-
-func TestNewCAPoolFromPEMReader_TruncatedPEM(t *testing.T) {
-	_, err := NewCAPoolFromPEMReader(strings.NewReader("-----BEGIN NEBULA CERTIFICATE-----\npartialdata"))
-	assert.ErrorIs(t, err, ErrInvalidPEMBlock)
-}
-
-func TestNewCAPoolFromPEMReader_TrailingGarbage(t *testing.T) {
-	_, _, _, pem1 := NewTestCaCert(Version2, Curve_CURVE25519, time.Now(), time.Now().Add(time.Hour), nil, nil, nil)
-
-	bundle := append(pem1, []byte("some trailing garbage")...)
-	_, err := NewCAPoolFromPEMReader(bytes.NewReader(bundle))
-	assert.ErrorIs(t, err, ErrInvalidPEMBlock)
-}
-
 func TestCertificateV1_Verify(t *testing.T) {
 	ca, _, caKey, _ := NewTestCaCert(Version1, Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, nil)
 	c, _, _, _ := NewTestCert(Version1, Curve_CURVE25519, ca, caKey, "test cert", time.Now(), time.Now().Add(5*time.Minute), nil, nil, nil)

cert/cert_v2.go

@@ -439,11 +439,7 @@ func (c *certificateV2) validate() error {
 				if !hasV6Networks {
 					return NewErrInvalidCertificateProperties("IPv6 unsafe networks require an IPv6 address assignment: %s", network)
 				}
-			} else if network.Addr().Is4() {
-				if !hasV4Networks {
-					return NewErrInvalidCertificateProperties("IPv4 unsafe networks require an IPv4 address assignment: %s", network)
-				}
-			}
+			} // as long as we have any IP address, IPv4 UnsafeNetworks are allowed
 		}
 	}
 

cert/p256/p256.go

@@ -44,12 +44,7 @@ func swap(r, s []byte) ([]byte, []byte, error) {
 	}
 	sNormalized := nMod.Nat().Sub(bigS, nMod)
 
-	result := sNormalized.Bytes(nMod)
-	for len(result) > 1 && result[0] == 0 {
-		result = result[1:]
-	}
-
-	return r, result, nil
+	return r, sNormalized.Bytes(nMod), nil
 }
 
 func Normalize(sig []byte) ([]byte, error) {

cert/pem.go

@@ -1,66 +1,12 @@
 package cert
 
 import (
-	"bytes"
 	"encoding/pem"
-	"errors"
 	"fmt"
 
 	"golang.org/x/crypto/ed25519"
 )
 
-var ErrTruncatedPEMBlock = errors.New("truncated PEM block")
-
-// SplitPEM is a split function for bufio.Scanner that returns each PEM block.
-func SplitPEM(data []byte, atEOF bool) (advance int, token []byte, err error) {
-	// Look for the start of a PEM block
-	start := bytes.Index(data, []byte("-----BEGIN "))
-	if start == -1 {
-		if atEOF && len(bytes.TrimSpace(data)) > 0 {
-			// Non-whitespace content with no PEM block
-			return 0, nil, ErrTruncatedPEMBlock
-		}
-		if atEOF {
-			return len(data), nil, nil
-		}
-		// Request more data
-		return 0, nil, nil
-	}
-
-	// Look for the end marker
-	endMarkerStart := bytes.Index(data[start:], []byte("-----END "))
-	if endMarkerStart == -1 {
-		if atEOF {
-			// Incomplete PEM block at EOF
-			return 0, nil, ErrTruncatedPEMBlock
-		}
-		// Need more data to find the end
-		return 0, nil, nil
-	}
-
-	// Find the actual end of the END line (after the newline)
-	endMarkerStart += start
-	endLineEnd := bytes.IndexByte(data[endMarkerStart:], '\n')
-	var end int
-	if endLineEnd == -1 {
-		if atEOF {
-			// END marker without newline at EOF - take it anyway
-			end = len(data)
-		} else {
-			// Need more data
-			return 0, nil, nil
-		}
-	} else {
-		end = endMarkerStart + endLineEnd + 1
-	}
-
-	// Extract the PEM block
-	pemBlock := data[start:end]
-
-	// Return the valid PEM block
-	return end, pemBlock, nil
-}
-
 const ( //cert banners
 	CertificateBanner   = "NEBULA CERTIFICATE"
 	CertificateV2Banner = "NEBULA CERTIFICATE V2"
@@ -91,7 +37,19 @@ func UnmarshalCertificateFromPEM(b []byte) (Certificate, []byte, error) {
 		return nil, r, ErrInvalidPEMBlock
 	}
 
-	c, err := unmarshalCertificateBlock(p)
+	var c Certificate
+	var err error
+
+	switch p.Type {
+	// Implementations must validate the resulting certificate contains valid information
+	case CertificateBanner:
+		c, err = unmarshalCertificateV1(p.Bytes, nil)
+	case CertificateV2Banner:
+		c, err = unmarshalCertificateV2(p.Bytes, nil, Curve_CURVE25519)
+	default:
+		return nil, r, ErrInvalidPEMCertificateBanner
+	}
+
 	if err != nil {
 		return nil, r, err
 	}
@@ -100,20 +58,6 @@ func UnmarshalCertificateFromPEM(b []byte) (Certificate, []byte, error) {
 
 }
 
-// unmarshalCertificateBlock decodes a single PEM block into a certificate.
-// It expects a Nebula certificate banner and returns ErrInvalidPEMCertificateBanner otherwise.
-func unmarshalCertificateBlock(block *pem.Block) (Certificate, error) {
-	switch block.Type {
-	// Implementations must validate the resulting certificate contains valid information
-	case CertificateBanner:
-		return unmarshalCertificateV1(block.Bytes, nil)
-	case CertificateV2Banner:
-		return unmarshalCertificateV2(block.Bytes, nil, Curve_CURVE25519)
-	default:
-		return nil, ErrInvalidPEMCertificateBanner
-	}
-}
-
 func marshalCertPublicKeyToPEM(c Certificate) []byte {
 	if c.IsCA() {
 		return MarshalSigningPublicKeyToPEM(c.Curve(), c.PublicKey())

cert/pem_test.go

@@ -1,88 +1,12 @@
 package cert
 
 import (
-	"bufio"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func scanAll(t *testing.T, input string) ([]string, error) {
-	t.Helper()
-	scanner := bufio.NewScanner(strings.NewReader(input))
-	scanner.Split(SplitPEM)
-	var blocks []string
-	for scanner.Scan() {
-		blocks = append(blocks, scanner.Text())
-	}
-	return blocks, scanner.Err()
-}
-
-func TestSplitPEM_Single(t *testing.T) {
-	input := "-----BEGIN TEST-----\ndata\n-----END TEST-----\n"
-	blocks, err := scanAll(t, input)
-	require.NoError(t, err)
-	require.Len(t, blocks, 1)
-	require.Equal(t, input, blocks[0])
-}
-
-func TestSplitPEM_Multiple(t *testing.T) {
-	block1 := "-----BEGIN TEST-----\naaa\n-----END TEST-----\n"
-	block2 := "-----BEGIN TEST-----\nbbb\n-----END TEST-----\n"
-	blocks, err := scanAll(t, block1+block2)
-	require.NoError(t, err)
-	require.Len(t, blocks, 2)
-	require.Equal(t, block1, blocks[0])
-	require.Equal(t, block2, blocks[1])
-}
-
-func TestSplitPEM_CommentsAndWhitespaceBetweenBlocks(t *testing.T) {
-	input := "# comment\n\n-----BEGIN TEST-----\naaa\n-----END TEST-----\n\n# another comment\n\n-----BEGIN TEST-----\nbbb\n-----END TEST-----\n"
-	blocks, err := scanAll(t, input)
-	require.NoError(t, err)
-	require.Len(t, blocks, 2)
-}
-
-func TestSplitPEM_Empty(t *testing.T) {
-	blocks, err := scanAll(t, "")
-	require.NoError(t, err)
-	require.Empty(t, blocks)
-}
-
-func TestSplitPEM_WhitespaceOnly(t *testing.T) {
-	blocks, err := scanAll(t, "  \n\t\n  ")
-	require.NoError(t, err)
-	require.Empty(t, blocks)
-}
-
-func TestSplitPEM_TrailingGarbage(t *testing.T) {
-	input := "-----BEGIN TEST-----\ndata\n-----END TEST-----\ngarbage"
-	blocks, err := scanAll(t, input)
-	require.ErrorIs(t, err, ErrTruncatedPEMBlock)
-	require.Len(t, blocks, 1)
-}
-
-func TestSplitPEM_TruncatedBlock(t *testing.T) {
-	input := "-----BEGIN TEST-----\npartial data with no end"
-	_, err := scanAll(t, input)
-	require.ErrorIs(t, err, ErrTruncatedPEMBlock)
-}
-
-func TestSplitPEM_NoEndNewline(t *testing.T) {
-	input := "-----BEGIN TEST-----\ndata\n-----END TEST-----"
-	blocks, err := scanAll(t, input)
-	require.NoError(t, err)
-	require.Len(t, blocks, 1)
-	require.Equal(t, input, blocks[0])
-}
-
-func TestSplitPEM_GarbageOnly(t *testing.T) {
-	_, err := scanAll(t, "this is not PEM data")
-	require.ErrorIs(t, err, ErrTruncatedPEMBlock)
-}
-
 func TestUnmarshalCertificateFromPEM(t *testing.T) {
 	goodCert := []byte(`
 # A good cert

cert_test/cert.go

@@ -163,55 +163,3 @@ func P256Keypair() ([]byte, []byte) {
 	pubkey := privkey.PublicKey()
 	return pubkey.Bytes(), privkey.Bytes()
 }
-
-// DummyCert is a minimal cert.Certificate implementation for testing error paths.
-type DummyCert struct {
-	Version_        cert.Version
-	Curve_          cert.Curve
-	Groups_         []string
-	IsCA_           bool
-	Issuer_         string
-	Name_           string
-	Networks_       []netip.Prefix
-	NotAfter_       time.Time
-	NotBefore_      time.Time
-	PublicKey_      []byte
-	Signature_      []byte
-	UnsafeNetworks_ []netip.Prefix
-}
-
-func (d *DummyCert) Version() cert.Version                         { return d.Version_ }
-func (d *DummyCert) Curve() cert.Curve                             { return d.Curve_ }
-func (d *DummyCert) Groups() []string                              { return d.Groups_ }
-func (d *DummyCert) IsCA() bool                                    { return d.IsCA_ }
-func (d *DummyCert) Issuer() string                                { return d.Issuer_ }
-func (d *DummyCert) Name() string                                  { return d.Name_ }
-func (d *DummyCert) Networks() []netip.Prefix                      { return d.Networks_ }
-func (d *DummyCert) NotAfter() time.Time                           { return d.NotAfter_ }
-func (d *DummyCert) NotBefore() time.Time                          { return d.NotBefore_ }
-func (d *DummyCert) PublicKey() []byte                             { return d.PublicKey_ }
-func (d *DummyCert) Signature() []byte                             { return d.Signature_ }
-func (d *DummyCert) UnsafeNetworks() []netip.Prefix                { return d.UnsafeNetworks_ }
-func (d *DummyCert) Fingerprint() (string, error)                  { return "", nil }
-func (d *DummyCert) CheckSignature(key []byte) bool                { return false }
-func (d *DummyCert) MarshalForHandshakes() ([]byte, error)         { return nil, nil }
-func (d *DummyCert) MarshalPEM() ([]byte, error)                   { return nil, nil }
-func (d *DummyCert) MarshalJSON() ([]byte, error)                  { return nil, nil }
-func (d *DummyCert) Marshal() ([]byte, error)                      { return nil, nil }
-func (d *DummyCert) String() string                                { return "dummy" }
-func (d *DummyCert) Copy() cert.Certificate                        { return d }
-func (d *DummyCert) VerifyPrivateKey(c cert.Curve, k []byte) error { return nil }
-func (d *DummyCert) Expired(time.Time) bool                        { return false }
-func (d *DummyCert) MarshalPublicKeyPEM() []byte                   { return nil }
-func (d *DummyCert) PublicKeyPEM() []byte                          { return nil }
-
-// NewTestCAPool creates a CAPool from the given CA certificates, panicking on error.
-func NewTestCAPool(cas ...cert.Certificate) *cert.CAPool {
-	pool := cert.NewCAPool()
-	for _, ca := range cas {
-		if err := pool.AddCA(ca); err != nil {
-			panic(err)
-		}
-	}
-	return pool
-}

cmd/nebula-cert/verify.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/slackhq/nebula/cert"
@@ -39,15 +40,21 @@ func verify(args []string, out io.Writer, errOut io.Writer) error {
 		return err
 	}
 
-	caFile, err := os.Open(*vf.caPath)
+	rawCACert, err := os.ReadFile(*vf.caPath)
 	if err != nil {
 		return fmt.Errorf("error while reading ca: %w", err)
 	}
-	defer caFile.Close()
 
-	caPool, err := cert.NewCAPoolFromPEMReader(caFile)
-	if err != nil && !errors.Is(err, cert.ErrExpired) {
-		return fmt.Errorf("error while adding ca cert to pool: %w", err)
+	caPool := cert.NewCAPool()
+	for {
+		rawCACert, err = caPool.AddCAFromPEM(rawCACert)
+		if err != nil {
+			return fmt.Errorf("error while adding ca cert to pool: %w", err)
+		}
+
+		if rawCACert == nil || len(rawCACert) == 0 || strings.TrimSpace(string(rawCACert)) == "" {
+			break
+		}
 	}
 
 	rawCert, err := os.ReadFile(*vf.certPath)

cmd/nebula-cert/verify_test.go

@@ -64,7 +64,7 @@ func Test_verify(t *testing.T) {
 	err = verify([]string{"-ca", caFile.Name(), "-crt", "does_not_exist"}, ob, eb)
 	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
-	require.ErrorIs(t, err, cert.ErrInvalidPEMBlock)
+	require.EqualError(t, err, "error while adding ca cert to pool: input did not contain a valid PEM encoded block")
 
 	// make a ca for later
 	caPub, caPriv, _ := ed25519.GenerateKey(rand.Reader)

cmd/nebula-service/logs_generic.go

@@ -3,15 +3,8 @@
 
 package main
 
-import (
-	"log/slog"
-	"os"
+import "github.com/sirupsen/logrus"
 
-	"github.com/slackhq/nebula/logging"
-)
-
-// newPlatformLogger returns a *slog.Logger that writes to stdout. Non-Windows
-// platforms have no special sink to integrate with.
-func newPlatformLogger() *slog.Logger {
-	return logging.NewLogger(os.Stdout)
+func HookLogger(l *logrus.Logger) {
+	// Do nothing, let the logs flow to stdout/stderr
 }

cmd/nebula-service/logs_windows.go

@@ -1,86 +1,54 @@
 package main
 
 import (
-	"context"
-	"log/slog"
-	"strings"
-	"sync"
+	"fmt"
+	"io/ioutil"
+	"os"
 
-	"github.com/slackhq/nebula/logging"
+	"github.com/kardianos/service"
+	"github.com/sirupsen/logrus"
 )
 
-// newPlatformLogger returns a *slog.Logger that routes every log record
-// through the Windows service logger so records end up in the Windows
-// Event Log. All the heavy lifting (level management, format swap,
-// timestamp toggle, WithAttrs/WithGroup) comes from logging.NewHandler;
-// this file only contributes:
-//
-//   - an io.Writer that forwards each formatted line to the service
-//     logger at the current record's Event Log severity, and
-//   - a thin severityTag that embeds *logging.Handler and overrides
-//     only Handle / WithAttrs / WithGroup, so Event Viewer's severity
-//     column and severity-based filters keep working the way they did
-//     before the slog migration.
-//
-// Format (text vs json) is carried by the embedded *logging.Handler, so
-// logging.format: json in config still produces JSON lines in Event
-// Viewer, same as the pre-slog logrus setup.
-func newPlatformLogger() *slog.Logger {
-	w := &eventLogWriter{}
-	return slog.New(&severityTag{Handler: logging.NewHandler(w), w: w})
+// HookLogger routes the logrus logs through the service logger so that they end up in the Windows Event Viewer
+// logrus output will be discarded
+func HookLogger(l *logrus.Logger) {
+	l.AddHook(newLogHook(logger))
+	l.SetOutput(ioutil.Discard)
 }
 
-// eventLogWriter forwards slog-formatted lines to the Windows service
-// logger at the severity most recently stashed by severityTag.Handle.
-// The mutex serializes the stash + inner.Handle + Write cycle per record
-// across all concurrent goroutines; slog's builtin text/json handlers
-// each hold their own mutex around Write, but that only protects the
-// Write call itself, not our stash-then-handle sequence.
-type eventLogWriter struct {
-	mu    sync.Mutex
-	level slog.Level
+type logHook struct {
+	sl service.Logger
 }
 
-func (w *eventLogWriter) Write(p []byte) (int, error) {
-	line := strings.TrimRight(string(p), "\n")
-	switch {
-	case w.level >= slog.LevelError:
-		return len(p), logger.Error(line)
-	case w.level >= slog.LevelWarn:
-		return len(p), logger.Warning(line)
+func newLogHook(sl service.Logger) *logHook {
+	return &logHook{sl: sl}
+}
+
+func (h *logHook) Fire(entry *logrus.Entry) error {
+	line, err := entry.String()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Unable to read entry, %v", err)
+		return err
+	}
+
+	switch entry.Level {
+	case logrus.PanicLevel:
+		return h.sl.Error(line)
+	case logrus.FatalLevel:
+		return h.sl.Error(line)
+	case logrus.ErrorLevel:
+		return h.sl.Error(line)
+	case logrus.WarnLevel:
+		return h.sl.Warning(line)
+	case logrus.InfoLevel:
+		return h.sl.Info(line)
+	case logrus.DebugLevel:
+		return h.sl.Info(line)
 	default:
-		return len(p), logger.Info(line)
+		return nil
 	}
 }
 
-// severityTag embeds *logging.Handler to pick up everything it does for
-// free (Enabled, SetLevel, GetLevel, SetFormat, GetFormat,
-// SetDisableTimestamp) and overrides only Handle / WithAttrs / WithGroup
-// so each record's slog.Level is stashed on the writer before formatting
-// and so derived handlers stay wrapped as severityTag rather than
-// downgrading to bare *logging.Handler.
-type severityTag struct {
-	*logging.Handler
-	w *eventLogWriter
-}
-
-func (s *severityTag) Handle(ctx context.Context, r slog.Record) error {
-	s.w.mu.Lock()
-	defer s.w.mu.Unlock()
-	s.w.level = r.Level
-	return s.Handler.Handle(ctx, r)
-}
-
-func (s *severityTag) WithAttrs(attrs []slog.Attr) slog.Handler {
-	if len(attrs) == 0 {
-		return s
-	}
-	return &severityTag{Handler: s.Handler.WithAttrs(attrs).(*logging.Handler), w: s.w}
-}
-
-func (s *severityTag) WithGroup(name string) slog.Handler {
-	if name == "" {
-		return s
-	}
-	return &severityTag{Handler: s.Handler.WithGroup(name).(*logging.Handler), w: s.w}
+func (h *logHook) Levels() []logrus.Level {
+	return logrus.AllLevels
 }

cmd/nebula-service/main.go

@@ -7,9 +7,9 @@ import (
 	"runtime/debug"
 	"strings"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/logging"
 	"github.com/slackhq/nebula/util"
 )
 
@@ -50,14 +50,9 @@ func main() {
 		os.Exit(0)
 	}
 
-	l := logging.NewLogger(os.Stdout)
-
 	if *serviceFlag != "" {
-		if err := doService(configPath, configTest, Build, serviceFlag); err != nil {
-			l.Error("Service command failed", "error", err)
-			os.Exit(1)
-		}
-		return
+		doService(configPath, configTest, Build, serviceFlag)
+		os.Exit(1)
 	}
 
 	if *configPath == "" {
@@ -66,6 +61,9 @@ func main() {
 		os.Exit(1)
 	}
 
+	l := logrus.New()
+	l.Out = os.Stdout
+
 	c := config.NewC(l)
 	err := c.Load(*configPath)
 	if err != nil {
@@ -73,16 +71,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err := logging.ApplyConfig(l, c); err != nil {
-		fmt.Printf("failed to apply logging config: %s", err)
-		os.Exit(1)
-	}
-	c.RegisterReloadCallback(func(c *config.C) {
-		if err := logging.ApplyConfig(l, c); err != nil {
-			l.Error("Failed to reconfigure logger on reload", "error", err)
-		}
-	})
-
 	ctrl, err := nebula.Main(c, *configTest, Build, l, nil)
 	if err != nil {
 		util.LogWithContextIfNeeded("Failed to start", err, l)
@@ -90,20 +78,8 @@ func main() {
 	}
 
 	if !*configTest {
-		wait, err := ctrl.Start()
-		if err != nil {
-			util.LogWithContextIfNeeded("Error while running", err, l)
-			os.Exit(1)
-		}
-
-		go ctrl.ShutdownBlock()
-
-		if err := wait(); err != nil {
-			l.Error("Nebula stopped due to fatal error", "error", err)
-			os.Exit(2)
-		}
-
-		l.Info("Goodbye")
+		ctrl.Start()
+		ctrl.ShutdownBlock()
 	}
 
 	os.Exit(0)

cmd/nebula-service/service.go

@@ -7,9 +7,9 @@ import (
 	"path/filepath"
 
 	"github.com/kardianos/service"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/logging"
 )
 
 var logger service.Logger
@@ -25,7 +25,8 @@ func (p *program) Start(s service.Service) error {
 	// Start should not block.
 	logger.Info("Nebula service starting.")
 
-	l := newPlatformLogger()
+	l := logrus.New()
+	HookLogger(l)
 
 	c := config.NewC(l)
 	err := c.Load(*p.configPath)
@@ -33,15 +34,6 @@ func (p *program) Start(s service.Service) error {
 		return fmt.Errorf("failed to load config: %s", err)
 	}
 
-	if err := logging.ApplyConfig(l, c); err != nil {
-		return fmt.Errorf("failed to apply logging config: %s", err)
-	}
-	c.RegisterReloadCallback(func(c *config.C) {
-		if err := logging.ApplyConfig(l, c); err != nil {
-			l.Error("Failed to reconfigure logger on reload", "error", err)
-		}
-	})
-
 	p.control, err = nebula.Main(c, *p.configTest, Build, l, nil)
 	if err != nil {
 		return err
@@ -65,11 +57,11 @@ func fileExists(filename string) bool {
 	return true
 }
 
-func doService(configPath *string, configTest *bool, build string, serviceFlag *string) error {
+func doService(configPath *string, configTest *bool, build string, serviceFlag *string) {
 	if *configPath == "" {
 		ex, err := os.Executable()
 		if err != nil {
-			return err
+			panic(err)
 		}
 		*configPath = filepath.Dir(ex) + "/config.yaml"
 		if !fileExists(*configPath) {
@@ -93,16 +85,16 @@ func doService(configPath *string, configTest *bool, build string, serviceFlag *
 	// Here are what the different loggers are doing:
 	// - `log` is the standard go log utility, meant to be used while the process is still attached to stdout/stderr
 	// - `logger` is the service log utility that may be attached to a special place depending on OS (Windows will have it attached to the event log)
-	// - in program.Start we build a *slog.Logger via newPlatformLogger; on non-Windows that is a stdout-backed slog logger, on Windows it routes records through the service logger
+	// - above, in `Run` we create a `logrus.Logger` which is what nebula expects to use
 	s, err := service.New(prg, svcConfig)
 	if err != nil {
-		return err
+		log.Fatal(err)
 	}
 
 	errs := make(chan error, 5)
 	logger, err = s.Logger(errs)
 	if err != nil {
-		return err
+		log.Fatal(err)
 	}
 
 	go func() {
@@ -117,16 +109,18 @@ func doService(configPath *string, configTest *bool, build string, serviceFlag *
 
 	switch *serviceFlag {
 	case "run":
-		if err := s.Run(); err != nil {
+		err = s.Run()
+		if err != nil {
 			// Route any errors to the system logger
 			logger.Error(err)
 		}
 	default:
-		if err := service.Control(s, *serviceFlag); err != nil {
+		err := service.Control(s, *serviceFlag)
+		if err != nil {
 			log.Printf("Valid actions: %q\n", service.ControlAction)
-			return err
+			log.Fatal(err)
 		}
+		return
 	}
 
-	return nil
 }

cmd/nebula/main.go

@@ -7,9 +7,9 @@ import (
 	"runtime/debug"
 	"strings"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/logging"
 	"github.com/slackhq/nebula/util"
 )
 
@@ -55,7 +55,8 @@ func main() {
 		os.Exit(1)
 	}
 
-	l := logging.NewLogger(os.Stdout)
+	l := logrus.New()
+	l.Out = os.Stdout
 
 	c := config.NewC(l)
 	err := c.Load(*configPath)
@@ -64,16 +65,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err := logging.ApplyConfig(l, c); err != nil {
-		fmt.Printf("failed to apply logging config: %s", err)
-		os.Exit(1)
-	}
-	c.RegisterReloadCallback(func(c *config.C) {
-		if err := logging.ApplyConfig(l, c); err != nil {
-			l.Error("Failed to reconfigure logger on reload", "error", err)
-		}
-	})
-
 	ctrl, err := nebula.Main(c, *configTest, Build, l, nil)
 	if err != nil {
 		util.LogWithContextIfNeeded("Failed to start", err, l)
@@ -81,21 +72,9 @@ func main() {
 	}
 
 	if !*configTest {
-		wait, err := ctrl.Start()
-		if err != nil {
-			util.LogWithContextIfNeeded("Error while running", err, l)
-			os.Exit(1)
-		}
-
-		go ctrl.ShutdownBlock()
+		ctrl.Start()
 		notifyReady(l)
-
-		if err := wait(); err != nil {
-			l.Error("Nebula stopped due to fatal error", "error", err)
-			os.Exit(2)
-		}
-
-		l.Info("Goodbye")
+		ctrl.ShutdownBlock()
 	}
 
 	os.Exit(0)

cmd/nebula/notify_linux.go

@@ -1,10 +1,11 @@
 package main
 
 import (
-	"log/slog"
 	"net"
 	"os"
 	"time"
+
+	"github.com/sirupsen/logrus"
 )
 
 // SdNotifyReady tells systemd the service is ready and dependent services can now be started
@@ -12,30 +13,30 @@ import (
 // https://www.freedesktop.org/software/systemd/man/systemd.service.html
 const SdNotifyReady = "READY=1"
 
-func notifyReady(l *slog.Logger) {
+func notifyReady(l *logrus.Logger) {
 	sockName := os.Getenv("NOTIFY_SOCKET")
 	if sockName == "" {
-		l.Debug("NOTIFY_SOCKET systemd env var not set, not sending ready signal")
+		l.Debugln("NOTIFY_SOCKET systemd env var not set, not sending ready signal")
 		return
 	}
 
 	conn, err := net.DialTimeout("unixgram", sockName, time.Second)
 	if err != nil {
-		l.Error("failed to connect to systemd notification socket", "error", err)
+		l.WithError(err).Error("failed to connect to systemd notification socket")
 		return
 	}
 	defer conn.Close()
 
 	err = conn.SetWriteDeadline(time.Now().Add(time.Second))
 	if err != nil {
-		l.Error("failed to set the write deadline for the systemd notification socket", "error", err)
+		l.WithError(err).Error("failed to set the write deadline for the systemd notification socket")
 		return
 	}
 
 	if _, err = conn.Write([]byte(SdNotifyReady)); err != nil {
-		l.Error("failed to signal the systemd notification socket", "error", err)
+		l.WithError(err).Error("failed to signal the systemd notification socket")
 		return
 	}
 
-	l.Debug("notified systemd the service is ready")
+	l.Debugln("notified systemd the service is ready")
 }

cmd/nebula/notify_notlinux.go

@@ -3,8 +3,8 @@
 
 package main
 
-import "log/slog"
+import "github.com/sirupsen/logrus"
 
-func notifyReady(_ *slog.Logger) {
+func notifyReady(_ *logrus.Logger) {
 	// No init service to notify
 }

config/config.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
 	"math"
 	"os"
 	"os/signal"
@@ -17,6 +16,7 @@ import (
 	"time"
 
 	"dario.cat/mergo"
+	"github.com/sirupsen/logrus"
 	"go.yaml.in/yaml/v3"
 )
 
@@ -26,11 +26,11 @@ type C struct {
 	Settings    map[string]any
 	oldSettings map[string]any
 	callbacks   []func(*C)
-	l           *slog.Logger
+	l           *logrus.Logger
 	reloadLock  sync.Mutex
 }
 
-func NewC(l *slog.Logger) *C {
+func NewC(l *logrus.Logger) *C {
 	return &C{
 		Settings: make(map[string]any),
 		l:        l,
@@ -107,18 +107,12 @@ func (c *C) HasChanged(k string) bool {
 
 	newVals, err := yaml.Marshal(nv)
 	if err != nil {
-		c.l.Error("Error while marshaling new config",
-			"config_path", k,
-			"error", err,
-		)
+		c.l.WithField("config_path", k).WithError(err).Error("Error while marshaling new config")
 	}
 
 	oldVals, err := yaml.Marshal(ov)
 	if err != nil {
-		c.l.Error("Error while marshaling old config",
-			"config_path", k,
-			"error", err,
-		)
+		c.l.WithField("config_path", k).WithError(err).Error("Error while marshaling old config")
 	}
 
 	return string(newVals) != string(oldVals)
@@ -160,10 +154,7 @@ func (c *C) ReloadConfig() {
 
 	err := c.Load(c.path)
 	if err != nil {
-		c.l.Error("Error occurred while reloading config",
-			"config_path", c.path,
-			"error", err,
-		)
+		c.l.WithField("config_path", c.path).WithError(err).Error("Error occurred while reloading config")
 		return
 	}
 

connection_manager.go

@@ -5,13 +5,13 @@ import (
 	"context"
 	"encoding/binary"
 	"fmt"
-	"log/slog"
 	"net/netip"
 	"sync"
 	"sync/atomic"
 	"time"
 
 	"github.com/rcrowley/go-metrics"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/header"
@@ -47,10 +47,10 @@ type connectionManager struct {
 
 	metricsTxPunchy metrics.Counter
 
-	l *slog.Logger
+	l *logrus.Logger
 }
 
-func newConnectionManagerFromConfig(l *slog.Logger, c *config.C, hm *HostMap, p *Punchy) *connectionManager {
+func newConnectionManagerFromConfig(l *logrus.Logger, c *config.C, hm *HostMap, p *Punchy) *connectionManager {
 	cm := &connectionManager{
 		hostMap:         hm,
 		l:               l,
@@ -85,10 +85,9 @@ func (cm *connectionManager) reload(c *config.C, initial bool) {
 		old := cm.getInactivityTimeout()
 		cm.inactivityTimeout.Store((int64)(c.GetDuration("tunnels.inactivity_timeout", 10*time.Minute)))
 		if !initial {
-			cm.l.Info("Inactivity timeout has changed",
-				"oldDuration", old,
-				"newDuration", cm.getInactivityTimeout(),
-			)
+			cm.l.WithField("oldDuration", old).
+				WithField("newDuration", cm.getInactivityTimeout()).
+				Info("Inactivity timeout has changed")
 		}
 	}
 
@@ -96,10 +95,9 @@ func (cm *connectionManager) reload(c *config.C, initial bool) {
 		old := cm.dropInactive.Load()
 		cm.dropInactive.Store(c.GetBool("tunnels.drop_inactive", false))
 		if !initial {
-			cm.l.Info("Drop inactive setting has changed",
-				"oldBool", old,
-				"newBool", cm.dropInactive.Load(),
-			)
+			cm.l.WithField("oldBool", old).
+				WithField("newBool", cm.dropInactive.Load()).
+				Info("Drop inactive setting has changed")
 		}
 	}
 }
@@ -145,7 +143,6 @@ func (cm *connectionManager) getAndResetTrafficCheck(h *HostInfo, now time.Time)
 func (cm *connectionManager) AddTrafficWatch(h *HostInfo) {
 	if h.out.Swap(true) == false {
 		cm.trafficTimer.Add(h.localIndexId, cm.checkInterval)
-		cm.intf.pmtudManager.OnTunnelUp(h)
 	}
 }
 
@@ -181,7 +178,6 @@ func (cm *connectionManager) doTrafficCheck(localIndex uint32, p, nb, out []byte
 
 	switch decision {
 	case deleteTunnel:
-		cm.intf.pmtudManager.OnTunnelDown(hostinfo)
 		if cm.hostMap.DeleteHostInfo(hostinfo) {
 			// Only clearing the lighthouse cache if this is the last hostinfo for this vpn ip in the hostmap
 			cm.intf.lightHouse.DeleteVpnAddrs(hostinfo.vpnAddrs)
@@ -201,14 +197,7 @@ func (cm *connectionManager) doTrafficCheck(localIndex uint32, p, nb, out []byte
 		cm.tryRehandshake(hostinfo)
 
 	case sendTestPacket:
-		// Defer to pmtud if it has a confirmed PMTU > floor for this peer:
-		// the probe at the confirmed size verifies both liveness AND that
-		// the discovered PMTU still fits, so we don't burn a separate test
-		// packet on top of it. If pmtud declines (disabled, peer unsupported,
-		// or no confirmed size yet) we fall back to the regular test.
-		if !cm.intf.pmtudManager.MaybeProbeAsTest(hostinfo) {
-			cm.intf.SendMessageToHostInfo(header.Test, header.TestRequest, hostinfo, p, nb, out)
-		}
+		cm.intf.SendMessageToHostInfo(header.Test, header.TestRequest, hostinfo, p, nb, out)
 	}
 
 	cm.resetRelayTrafficCheck(hostinfo)
@@ -267,7 +256,7 @@ func (cm *connectionManager) migrateRelayUsed(oldhostinfo, newhostinfo *HostInfo
 			var err error
 			index, err = AddRelay(cm.l, newhostinfo, cm.hostMap, r.PeerAddr, nil, r.Type, Requested)
 			if err != nil {
-				cm.l.Error("failed to migrate relay to new hostinfo", "error", err)
+				cm.l.WithError(err).Error("failed to migrate relay to new hostinfo")
 				continue
 			}
 			switch r.Type {
@@ -315,16 +304,16 @@ func (cm *connectionManager) migrateRelayUsed(oldhostinfo, newhostinfo *HostInfo
 
 		msg, err := req.Marshal()
 		if err != nil {
-			cm.l.Error("failed to marshal Control message to migrate relay", "error", err)
+			cm.l.WithError(err).Error("failed to marshal Control message to migrate relay")
 		} else {
 			cm.intf.SendMessageToHostInfo(header.Control, 0, newhostinfo, msg, make([]byte, 12), make([]byte, mtu))
-			cm.l.Info("send CreateRelayRequest",
-				"relayFrom", req.RelayFromAddr,
-				"relayTo", req.RelayToAddr,
-				"initiatorRelayIndex", req.InitiatorRelayIndex,
-				"responderRelayIndex", req.ResponderRelayIndex,
-				"vpnAddrs", newhostinfo.vpnAddrs,
-			)
+			cm.l.WithFields(logrus.Fields{
+				"relayFrom":           req.RelayFromAddr,
+				"relayTo":             req.RelayToAddr,
+				"initiatorRelayIndex": req.InitiatorRelayIndex,
+				"responderRelayIndex": req.ResponderRelayIndex,
+				"vpnAddrs":            newhostinfo.vpnAddrs}).
+				Info("send CreateRelayRequest")
 		}
 	}
 }
@@ -336,7 +325,7 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 
 	hostinfo := cm.hostMap.Indexes[localIndex]
 	if hostinfo == nil {
-		cm.l.Debug("Not found in hostmap", "localIndex", localIndex)
+		cm.l.WithField("localIndex", localIndex).Debugln("Not found in hostmap")
 		return doNothing, nil, nil
 	}
 
@@ -356,10 +345,10 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 	// A hostinfo is determined alive if there is incoming traffic
 	if inTraffic {
 		decision := doNothing
-		if cm.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(cm.l).Debug("Tunnel status",
-				"tunnelCheck", m{"state": "alive", "method": "passive"},
-			)
+		if cm.l.Level >= logrus.DebugLevel {
+			hostinfo.logger(cm.l).
+				WithField("tunnelCheck", m{"state": "alive", "method": "passive"}).
+				Debug("Tunnel status")
 		}
 		hostinfo.pendingDeletion.Store(false)
 
@@ -386,9 +375,9 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 
 	if hostinfo.pendingDeletion.Load() {
 		// We have already sent a test packet and nothing was returned, this hostinfo is dead
-		hostinfo.logger(cm.l).Info("Tunnel status",
-			"tunnelCheck", m{"state": "dead", "method": "active"},
-		)
+		hostinfo.logger(cm.l).
+			WithField("tunnelCheck", m{"state": "dead", "method": "active"}).
+			Info("Tunnel status")
 
 		return deleteTunnel, hostinfo, nil
 	}
@@ -399,10 +388,10 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 			inactiveFor, isInactive := cm.isInactive(hostinfo, now)
 			if isInactive {
 				// Tunnel is inactive, tear it down
-				hostinfo.logger(cm.l).Info("Dropping tunnel due to inactivity",
-					"inactiveDuration", inactiveFor,
-					"primary", mainHostInfo,
-				)
+				hostinfo.logger(cm.l).
+					WithField("inactiveDuration", inactiveFor).
+					WithField("primary", mainHostInfo).
+					Info("Dropping tunnel due to inactivity")
 
 				return closeTunnel, hostinfo, primary
 			}
@@ -421,18 +410,18 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 			cm.sendPunch(hostinfo)
 		}
 
-		if cm.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(cm.l).Debug("Tunnel status",
-				"tunnelCheck", m{"state": "testing", "method": "active"},
-			)
+		if cm.l.Level >= logrus.DebugLevel {
+			hostinfo.logger(cm.l).
+				WithField("tunnelCheck", m{"state": "testing", "method": "active"}).
+				Debug("Tunnel status")
 		}
 
 		// Send a test packet to trigger an authenticated tunnel test, this should suss out any lingering tunnel issues
 		decision = sendTestPacket
 
 	} else {
-		if cm.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(cm.l).Debug("Hostinfo sadness")
+		if cm.l.Level >= logrus.DebugLevel {
+			hostinfo.logger(cm.l).Debugf("Hostinfo sadness")
 		}
 	}
 
@@ -504,16 +493,14 @@ func (cm *connectionManager) isInvalidCertificate(now time.Time, hostinfo *HostI
 		return false //cert is still valid! yay!
 	} else if err == cert.ErrBlockListed { //avoiding errors.Is for speed
 		// Block listed certificates should always be disconnected
-		hostinfo.logger(cm.l).Info("Remote certificate is blocked, tearing down the tunnel",
-			"error", err,
-			"fingerprint", remoteCert.Fingerprint,
-		)
+		hostinfo.logger(cm.l).WithError(err).
+			WithField("fingerprint", remoteCert.Fingerprint).
+			Info("Remote certificate is blocked, tearing down the tunnel")
 		return true
 	} else if cm.intf.disconnectInvalid.Load() {
-		hostinfo.logger(cm.l).Info("Remote certificate is no longer valid, tearing down the tunnel",
-			"error", err,
-			"fingerprint", remoteCert.Fingerprint,
-		)
+		hostinfo.logger(cm.l).WithError(err).
+			WithField("fingerprint", remoteCert.Fingerprint).
+			Info("Remote certificate is no longer valid, tearing down the tunnel")
 		return true
 	} else {
 		//if we reach here, the cert is no longer valid, but we're configured to keep tunnels from now-invalid certs open
@@ -552,11 +539,10 @@ func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 	curCrtVersion := curCrt.Version()
 	myCrt := cs.getCertificate(curCrtVersion)
 	if myCrt == nil {
-		cm.l.Info("Re-handshaking with remote",
-			"vpnAddrs", hostinfo.vpnAddrs,
-			"version", curCrtVersion,
-			"reason", "local certificate removed",
-		)
+		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
+			WithField("version", curCrtVersion).
+			WithField("reason", "local certificate removed").
+			Info("Re-handshaking with remote")
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}
@@ -564,12 +550,11 @@ func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 	if peerCrt != nil && curCrtVersion < peerCrt.Certificate.Version() {
 		// if our certificate version is less than theirs, and we have a matching version available, rehandshake?
 		if cs.getCertificate(peerCrt.Certificate.Version()) != nil {
-			cm.l.Info("Re-handshaking with remote",
-				"vpnAddrs", hostinfo.vpnAddrs,
-				"version", curCrtVersion,
-				"peerVersion", peerCrt.Certificate.Version(),
-				"reason", "local certificate version lower than peer, attempting to correct",
-			)
+			cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
+				WithField("version", curCrtVersion).
+				WithField("peerVersion", peerCrt.Certificate.Version()).
+				WithField("reason", "local certificate version lower than peer, attempting to correct").
+				Info("Re-handshaking with remote")
 			cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], func(hh *HandshakeHostInfo) {
 				hh.initiatingVersionOverride = peerCrt.Certificate.Version()
 			})
@@ -577,19 +562,17 @@ func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 		}
 	}
 	if !bytes.Equal(curCrt.Signature(), myCrt.Signature()) {
-		cm.l.Info("Re-handshaking with remote",
-			"vpnAddrs", hostinfo.vpnAddrs,
-			"reason", "local certificate is not current",
-		)
+		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
+			WithField("reason", "local certificate is not current").
+			Info("Re-handshaking with remote")
 
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}
 	if curCrtVersion < cs.initiatingVersion {
-		cm.l.Info("Re-handshaking with remote",
-			"vpnAddrs", hostinfo.vpnAddrs,
-			"reason", "current cert version < pki.initiatingVersion",
-		)
+		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
+			WithField("reason", "current cert version < pki.initiatingVersion").
+			Info("Re-handshaking with remote")
 
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return

connection_manager_test.go

@@ -7,9 +7,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/flynn/noise"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/overlaytest"
 	"github.com/slackhq/nebula/test"
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
@@ -46,13 +46,13 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
+		v1HandshakeBytes:  []byte{},
 	}
 
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -63,12 +63,10 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 	ifce.pki.cs.Store(cs)
 
 	// Create manager
-	conf := config.NewC(test.NewLogger())
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	conf := config.NewC(l)
+	punchy := NewPunchyFromConfig(l, conf)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	nc.intf = ifce
-	ifce.pmtudManager = newPMTUDManagerFromConfig(test.NewLogger(), conf, ifce.inside)
-	ifce.pmtudManager.intf = ifce
 	p := []byte("")
 	nb := make([]byte, 12, 12)
 	out := make([]byte, mtu)
@@ -81,6 +79,7 @@ func Test_NewConnectionManagerTest(t *testing.T) {
 	}
 	hostinfo.ConnectionState = &ConnectionState{
 		myCert: &dummyCert{version: cert.Version1},
+		H:      &noise.HandshakeState{},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
 
@@ -130,13 +129,13 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
+		v1HandshakeBytes:  []byte{},
 	}
 
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -147,12 +146,10 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 	ifce.pki.cs.Store(cs)
 
 	// Create manager
-	conf := config.NewC(test.NewLogger())
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	conf := config.NewC(l)
+	punchy := NewPunchyFromConfig(l, conf)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	nc.intf = ifce
-	ifce.pmtudManager = newPMTUDManagerFromConfig(test.NewLogger(), conf, ifce.inside)
-	ifce.pmtudManager.intf = ifce
 	p := []byte("")
 	nb := make([]byte, 12, 12)
 	out := make([]byte, mtu)
@@ -165,6 +162,7 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 	}
 	hostinfo.ConnectionState = &ConnectionState{
 		myCert: &dummyCert{version: cert.Version1},
+		H:      &noise.HandshakeState{},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
 
@@ -216,13 +214,13 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
+		v1HandshakeBytes:  []byte{},
 	}
 
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -233,12 +231,12 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	ifce.pki.cs.Store(cs)
 
 	// Create manager
-	conf := config.NewC(test.NewLogger())
+	conf := config.NewC(l)
 	conf.Settings["tunnels"] = map[string]any{
 		"drop_inactive": true,
 	}
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	punchy := NewPunchyFromConfig(l, conf)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	assert.True(t, nc.dropInactive.Load())
 	nc.intf = ifce
 
@@ -250,6 +248,7 @@ func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	}
 	hostinfo.ConnectionState = &ConnectionState{
 		myCert: &dummyCert{version: cert.Version1},
+		H:      &noise.HandshakeState{},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
 
@@ -340,15 +339,15 @@ func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
 	cachedPeerCert, err := ncp.VerifyCertificate(now.Add(time.Second), peerCert)
 
 	cs := &CertState{
-		privateKey:   []byte{},
-		v1Cert:       &dummyCert{},
-		v1Credential: nil,
+		privateKey:       []byte{},
+		v1Cert:           &dummyCert{},
+		v1HandshakeBytes: []byte{},
 	}
 
 	lh := newTestLighthouse()
 	ifce := &Interface{
 		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
+		inside:           &test.NoopTun{},
 		outside:          &udp.NoopConn{},
 		firewall:         &Firewall{},
 		lightHouse:       lh,
@@ -361,12 +360,10 @@ func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
 	ifce.disconnectInvalid.Store(true)
 
 	// Create manager
-	conf := config.NewC(test.NewLogger())
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
+	conf := config.NewC(l)
+	punchy := NewPunchyFromConfig(l, conf)
+	nc := newConnectionManagerFromConfig(l, conf, hostMap, punchy)
 	nc.intf = ifce
-	ifce.pmtudManager = newPMTUDManagerFromConfig(test.NewLogger(), conf, ifce.inside)
-	ifce.pmtudManager.intf = ifce
 	ifce.connectionManager = nc
 
 	hostinfo := &HostInfo{
@@ -374,6 +371,7 @@ func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
 		ConnectionState: &ConnectionState{
 			myCert:   &dummyCert{},
 			peerCert: cachedPeerCert,
+			H:        &noise.HandshakeState{},
 		},
 	}
 	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)

connection_state.go

@@ -1,12 +1,16 @@
 package nebula
 
 import (
+	"crypto/rand"
 	"encoding/json"
+	"fmt"
 	"sync"
 	"sync/atomic"
 
+	"github.com/flynn/noise"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/handshake"
+	"github.com/slackhq/nebula/noiseutil"
 )
 
 const ReplayWindow = 1024
@@ -14,6 +18,7 @@ const ReplayWindow = 1024
 type ConnectionState struct {
 	eKey           *NebulaCipherState
 	dKey           *NebulaCipherState
+	H              *noise.HandshakeState
 	myCert         cert.Certificate
 	peerCert       *cert.CachedCertificate
 	initiator      bool
@@ -22,24 +27,55 @@ type ConnectionState struct {
 	writeLock      sync.Mutex
 }
 
-// newConnectionStateFromResult builds a fully-populated ConnectionState from a
-// completed handshake.Result. It seeds messageCounter and the replay window so
-// that the post-handshake message indices already used on the wire don't count
-// as missed traffic in the data plane.
-func newConnectionStateFromResult(r *handshake.Result) *ConnectionState {
+func NewConnectionState(l *logrus.Logger, cs *CertState, crt cert.Certificate, initiator bool, pattern noise.HandshakePattern) (*ConnectionState, error) {
+	var dhFunc noise.DHFunc
+	switch crt.Curve() {
+	case cert.Curve_CURVE25519:
+		dhFunc = noise.DH25519
+	case cert.Curve_P256:
+		if cs.pkcs11Backed {
+			dhFunc = noiseutil.DHP256PKCS11
+		} else {
+			dhFunc = noiseutil.DHP256
+		}
+	default:
+		return nil, fmt.Errorf("invalid curve: %s", crt.Curve())
+	}
+
+	var ncs noise.CipherSuite
+	if cs.cipher == "chachapoly" {
+		ncs = noise.NewCipherSuite(dhFunc, noise.CipherChaChaPoly, noise.HashSHA256)
+	} else {
+		ncs = noise.NewCipherSuite(dhFunc, noiseutil.CipherAESGCM, noise.HashSHA256)
+	}
+
+	static := noise.DHKey{Private: cs.privateKey, Public: crt.PublicKey()}
+	hs, err := noise.NewHandshakeState(noise.Config{
+		CipherSuite:   ncs,
+		Random:        rand.Reader,
+		Pattern:       pattern,
+		Initiator:     initiator,
+		StaticKeypair: static,
+		//NOTE: These should come from CertState (pki.go) when we finally implement it
+		PresharedKey:          []byte{},
+		PresharedKeyPlacement: 0,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("NewConnectionState: %s", err)
+	}
+
+	// The queue and ready params prevent a counter race that would happen when
+	// sending stored packets and simultaneously accepting new traffic.
 	ci := &ConnectionState{
-		myCert:    r.MyCert,
-		initiator: r.Initiator,
-		peerCert:  r.RemoteCert,
-		eKey:      NewNebulaCipherState(r.EKey),
-		dKey:      NewNebulaCipherState(r.DKey),
+		H:         hs,
+		initiator: initiator,
 		window:    NewBits(ReplayWindow),
+		myCert:    crt,
 	}
-	ci.messageCounter.Add(r.MessageIndex)
-	for i := uint64(1); i <= r.MessageIndex; i++ {
-		ci.window.Update(nil, i)
-	}
-	return ci
+	// always start the counter from 2, as packet 1 and packet 2 are handshake packets.
+	ci.messageCounter.Add(2)
+
+	return ci, nil
 }
 
 func (cs *ConnectionState) MarshalJSON() ([]byte, error) {

connection_state_test.go

@@ -1,114 +0,0 @@
-package nebula
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/flynn/noise"
-	"github.com/slackhq/nebula/cert"
-	ct "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/handshake"
-	"github.com/slackhq/nebula/header"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// runTestHandshake runs a complete IX handshake between two freshly-built
-// peers and returns the initiator and responder Results. Used to produce
-// real cipher states for tests that need to exercise post-handshake glue.
-func runTestHandshake(t *testing.T) (initR, respR *handshake.Result) {
-	t.Helper()
-
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-
-	makeCreds := func(name string, networks []netip.Prefix) handshake.GetCredentialFunc {
-		c, _, rawKey, _ := ct.NewTestCert(
-			cert.Version2, cert.Curve_CURVE25519, ca, caKey,
-			name, ca.NotBefore(), ca.NotAfter(), networks, nil, nil,
-		)
-		priv, _, _, err := cert.UnmarshalPrivateKeyFromPEM(rawKey)
-		require.NoError(t, err)
-		hsBytes, err := c.MarshalForHandshakes()
-		require.NoError(t, err)
-		ncs := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
-		cred := handshake.NewCredential(c, hsBytes, priv, ncs)
-		return func(v cert.Version) *handshake.Credential {
-			if v == cert.Version2 {
-				return cred
-			}
-			return nil
-		}
-	}
-
-	verifier := func(c cert.Certificate) (*cert.CachedCertificate, error) {
-		return caPool.VerifyCertificate(time.Now(), c)
-	}
-
-	initCreds := makeCreds("initiator", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	respCreds := makeCreds("responder", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-
-	initM, err := handshake.NewMachine(
-		cert.Version2, initCreds, verifier,
-		func() (uint32, error) { return 1000, nil },
-		true, header.HandshakeIXPSK0,
-	)
-	require.NoError(t, err)
-
-	respM, err := handshake.NewMachine(
-		cert.Version2, respCreds, verifier,
-		func() (uint32, error) { return 2000, nil },
-		false, header.HandshakeIXPSK0,
-	)
-	require.NoError(t, err)
-
-	msg1, err := initM.Initiate(nil)
-	require.NoError(t, err)
-
-	resp, respR, err := respM.ProcessPacket(nil, msg1)
-	require.NoError(t, err)
-	require.NotNil(t, respR)
-
-	_, initR, err = initM.ProcessPacket(nil, resp)
-	require.NoError(t, err)
-	require.NotNil(t, initR)
-
-	return initR, respR
-}
-
-func TestNewConnectionStateFromResult(t *testing.T) {
-	initR, respR := runTestHandshake(t)
-
-	t.Run("initiator", func(t *testing.T) {
-		ci := newConnectionStateFromResult(initR)
-		assert.True(t, ci.initiator)
-		assert.Equal(t, initR.MyCert, ci.myCert)
-		assert.Equal(t, initR.RemoteCert, ci.peerCert)
-		assert.NotNil(t, ci.eKey)
-		assert.NotNil(t, ci.dKey)
-
-		// IX has 2 handshake messages; the next data-plane send is counter=3.
-		assert.Equal(t, uint64(2), ci.messageCounter.Load(),
-			"messageCounter must equal Result.MessageIndex so the next send is N+1")
-
-		// Both handshake counters must be marked seen so they don't appear lost.
-		// Check returns false if an index has already been recorded.
-		assert.False(t, ci.window.Check(nil, 1), "counter 1 must already be seen")
-		assert.False(t, ci.window.Check(nil, 2), "counter 2 must already be seen")
-		// Counter 3 is the next data-plane message and must NOT be pre-marked.
-		assert.True(t, ci.window.Check(nil, 3), "counter 3 must not be pre-seeded")
-	})
-
-	t.Run("responder", func(t *testing.T) {
-		ci := newConnectionStateFromResult(respR)
-		assert.False(t, ci.initiator)
-		assert.Equal(t, respR.MyCert, ci.myCert)
-		assert.Equal(t, respR.RemoteCert, ci.peerCert)
-		assert.NotNil(t, ci.eKey)
-		assert.NotNil(t, ci.dKey)
-		assert.Equal(t, uint64(2), ci.messageCounter.Load())
-	})
-}

control.go

@@ -2,33 +2,17 @@ package nebula
 
 import (
 	"context"
-	"errors"
-	"log/slog"
 	"net/netip"
 	"os"
 	"os/signal"
-	"sync"
 	"syscall"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/overlay"
 )
 
-type RunState int
-
-const (
-	StateUnknown RunState = iota
-	StateReady
-	StateStarted
-	StateStopping
-	StateStopped
-)
-
-var ErrAlreadyStarted = errors.New("nebula is already started")
-var ErrAlreadyStopped = errors.New("nebula cannot be restarted")
-var ErrUnknownState = errors.New("nebula state is invalid")
-
 // Every interaction here needs to take extra care to copy memory and not return or use arguments "as is" when touching
 // core. This means copying IP objects, slices, de-referencing pointers and taking the actual value, etc
 
@@ -42,11 +26,8 @@ type controlHostLister interface {
 }
 
 type Control struct {
-	stateLock sync.Mutex
-	state     RunState
-
 	f                      *Interface
-	l                      *slog.Logger
+	l                      *logrus.Logger
 	ctx                    context.Context
 	cancel                 context.CancelFunc
 	sshStart               func()
@@ -54,7 +35,6 @@ type Control struct {
 	dnsStart               func()
 	lighthouseStart        func()
 	connectionManagerStart func(context.Context)
-	pmtudManagerStart      func(context.Context)
 }
 
 type ControlHostInfo struct {
@@ -69,31 +49,10 @@ type ControlHostInfo struct {
 	CurrentRelaysThroughMe []netip.Addr     `json:"currentRelaysThroughMe"`
 }
 
-// Start actually runs nebula, this is a nonblocking call.
-// The returned function blocks until nebula has fully stopped and returns the
-// first fatal reader error (if any). A nil error means nebula shut down
-// gracefully; a non-nil error means a reader hit an unexpected failure that
-// triggered the shutdown.
-func (c *Control) Start() (func() error, error) {
-	c.stateLock.Lock()
-	defer c.stateLock.Unlock()
-	switch c.state {
-	case StateReady:
-		//yay!
-	case StateStopped, StateStopping:
-		return nil, ErrAlreadyStopped
-	case StateStarted:
-		return nil, ErrAlreadyStarted
-	default:
-		return nil, ErrUnknownState
-	}
-
+// Start actually runs nebula, this is a nonblocking call. To block use Control.ShutdownBlock()
+func (c *Control) Start() {
 	// Activate the interface
-	err := c.f.activate()
-	if err != nil {
-		c.state = StateStopped
-		return nil, err
-	}
+	c.f.activate()
 
 	// Call all the delayed funcs that waited patiently for the interface to be created.
 	if c.sshStart != nil {
@@ -108,58 +67,29 @@ func (c *Control) Start() (func() error, error) {
 	if c.connectionManagerStart != nil {
 		go c.connectionManagerStart(c.ctx)
 	}
-	if c.pmtudManagerStart != nil {
-		go c.pmtudManagerStart(c.ctx)
-	}
 	if c.lighthouseStart != nil {
 		c.lighthouseStart()
 	}
 
-	c.f.triggerShutdown = c.Stop
-
 	// Start reading packets.
-	out, err := c.f.run()
-	if err != nil {
-		c.state = StateStopped
-		return nil, err
-	}
-	c.state = StateStarted
-	return out, nil
-}
-
-func (c *Control) State() RunState {
-	c.stateLock.Lock()
-	defer c.stateLock.Unlock()
-	return c.state
+	c.f.run()
 }
 
 func (c *Control) Context() context.Context {
 	return c.ctx
 }
 
-// Stop is a non-blocking call that signals nebula to close all tunnels and shut down
+// Stop signals nebula to shutdown and close all tunnels, returns after the shutdown is complete
 func (c *Control) Stop() {
-	c.stateLock.Lock()
-	if c.state != StateStarted {
-		c.stateLock.Unlock()
-		// We are stopping or stopped already
-		return
-	}
-
-	c.state = StateStopping
-	c.stateLock.Unlock()
-
 	// Stop the handshakeManager (and other services), to prevent new tunnels from
 	// being created while we're shutting them all down.
 	c.cancel()
 
 	c.CloseAllTunnels(false)
 	if err := c.f.Close(); err != nil {
-		c.l.Error("Close interface failed", "error", err)
+		c.l.WithError(err).Error("Close interface failed")
 	}
-	c.stateLock.Lock()
-	c.state = StateStopped
-	c.stateLock.Unlock()
+	c.l.Info("Goodbye")
 }
 
 // ShutdownBlock will listen for and block on term and interrupt signals, calling Control.Stop() once signalled
@@ -170,7 +100,7 @@ func (c *Control) ShutdownBlock() {
 
 	rawSig := <-sigChan
 	sig := rawSig.String()
-	c.l.Info("Caught signal, shutting down", "signal", sig)
+	c.l.WithField("signal", sig).Info("Caught signal, shutting down")
 	c.Stop()
 }
 
@@ -307,10 +237,8 @@ func (c *Control) CloseAllTunnels(excludeLighthouses bool) (closed int) {
 		c.f.send(header.CloseTunnel, 0, h.ConnectionState, h, []byte{}, make([]byte, 12, 12), make([]byte, mtu))
 		c.f.closeTunnel(h)
 
-		c.l.Debug("Sending close tunnel message",
-			"vpnAddrs", h.vpnAddrs,
-			"udpAddr", h.remote,
-		)
+		c.l.WithField("vpnAddrs", h.vpnAddrs).WithField("udpAddr", h.remote).
+			Debug("Sending close tunnel message")
 		closed++
 	}
 

control_test.go

@@ -6,6 +6,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
@@ -78,11 +79,10 @@ func TestControl_GetHostInfoByVpnIp(t *testing.T) {
 	}, &Interface{})
 
 	c := Control{
-		state: StateReady,
 		f: &Interface{
 			hostMap: hm,
 		},
-		l: test.NewLogger(),
+		l: logrus.New(),
 	}
 
 	thi := c.GetHostInfoByVpnAddr(vpnIp, false)

dist/wireshark/nebula.lua

@@ -84,24 +84,30 @@ end
 
 function nebula.prefs_changed()
     if default_settings.all_ports == nebula.prefs.all_ports and default_settings.port == nebula.prefs.port then
+        -- Nothing changed, bail
         return
     end
 
-    -- Remove all existing registrations
+    -- Remove our old dissector
     DissectorTable.get("udp.port"):remove_all(nebula)
 
-    if nebula.prefs.all_ports then
-        -- Register on every port for hole punch capture
+    if nebula.prefs.all_ports and default_settings.all_ports ~= nebula.prefs.all_ports then
+        default_settings.all_port = nebula.prefs.all_ports
+
         for i=0, 65535 do
             DissectorTable.get("udp.port"):add(i, nebula)
         end
-    else
-        -- Register on the configured port only
-        DissectorTable.get("udp.port"):add(nebula.prefs.port, nebula)
+
+        -- no need to establish again on specific ports
+        return
     end
 
-    default_settings.all_ports = nebula.prefs.all_ports
-    default_settings.port = nebula.prefs.port
+
+    if default_settings.all_ports ~= nebula.prefs.all_ports then
+        -- Add our new port dissector
+        default_settings.port = nebula.prefs.port
+        DissectorTable.get("udp.port"):add(default_settings.port, nebula)
+    end
 end
 
 DissectorTable.get("udp.port"):add(default_settings.port, nebula)

dns_server.go

@@ -1,249 +1,63 @@
 package nebula
 
 import (
-	"context"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/netip"
 	"strconv"
 	"strings"
 	"sync"
-	"sync/atomic"
 
 	"github.com/gaissmai/bart"
 	"github.com/miekg/dns"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 )
 
-type dnsServer struct {
+// This whole thing should be rewritten to use context
+
+var dnsR *dnsRecords
+var dnsServer *dns.Server
+var dnsAddr string
+
+type dnsRecords struct {
 	sync.RWMutex
-	l               *slog.Logger
-	ctx             context.Context
+	l               *logrus.Logger
 	dnsMap4         map[string]netip.Addr
 	dnsMap6         map[string]netip.Addr
 	hostMap         *HostMap
 	myVpnAddrsTable *bart.Lite
-
-	mux *dns.ServeMux
-
-	// enabled mirrors `lighthouse.serve_dns && lighthouse.am_lighthouse`.
-	// Start, Add, and reload consult it so callers don't need to know the
-	// gating rules. When it toggles off via reload, accumulated records are
-	// cleared so a later re-enable starts with a fresh map populated from
-	// new handshakes.
-	enabled atomic.Bool
-
-	serverMu sync.Mutex
-	server   *dns.Server
-	// started is closed once `server` has finished binding (or after
-	// ListenAndServe returns on a bind failure). Stop waits on it before
-	// calling Shutdown to avoid the miekg/dns "server not started" race
-	// where a Shutdown that arrives before bind completes is silently
-	// ignored, leaving the listener running forever.
-	started chan struct{}
-	addr    string
 }
 
-// newDnsServerFromConfig builds a dnsServer, applies the initial config, and
-// registers a reload callback. The reload callback is registered before the
-// initial config is applied, so a SIGHUP can later enable, fix, or disable
-// DNS even if the initial application failed.
-//
-// The dnsServer internally gates on `lighthouse.serve_dns &&
-// lighthouse.am_lighthouse`. Start and Add are safe to call unconditionally,
-// they no-op when DNS isn't enabled. Each Start invocation owns a ctx-cancel
-// watcher that tears the listener down on nebula shutdown. The returned
-// pointer is always non-nil, even on error.
-func newDnsServerFromConfig(ctx context.Context, l *slog.Logger, cs *CertState, hostMap *HostMap, c *config.C) (*dnsServer, error) {
-	ds := &dnsServer{
+func newDnsRecords(l *logrus.Logger, cs *CertState, hostMap *HostMap) *dnsRecords {
+	return &dnsRecords{
 		l:               l,
-		ctx:             ctx,
 		dnsMap4:         make(map[string]netip.Addr),
 		dnsMap6:         make(map[string]netip.Addr),
 		hostMap:         hostMap,
 		myVpnAddrsTable: cs.myVpnAddrsTable,
 	}
-	ds.mux = dns.NewServeMux()
-	ds.mux.HandleFunc(".", ds.handleDnsRequest)
-
-	c.RegisterReloadCallback(func(c *config.C) {
-		if err := ds.reload(c, false); err != nil {
-			ds.l.Error("Failed to reload DNS responder from config", "error", err)
-		}
-	})
-
-	if err := ds.reload(c, true); err != nil {
-		return ds, err
-	}
-	return ds, nil
 }
 
-// reload applies the latest config and reconciles the running state with it:
-//   - enabled toggled on  -> spawn a runner
-//   - enabled toggled off -> stop the runner
-//   - listen address changed (while running) -> restart on the new address
-//   - everything else     -> no-op
-//
-// On the initial call it only records configuration; Control.Start is what
-// launches the first runner via dnsStart.
-func (d *dnsServer) reload(c *config.C, initial bool) error {
-	wantsDns := c.GetBool("lighthouse.serve_dns", false)
-	amLighthouse := c.GetBool("lighthouse.am_lighthouse", false)
-	enabled := wantsDns && amLighthouse
-	newAddr := getDnsServerAddr(c)
-
-	d.serverMu.Lock()
-	running := d.server
-	runningStarted := d.started
-	sameAddr := d.addr == newAddr
-	d.addr = newAddr
-	d.enabled.Store(enabled)
-	d.serverMu.Unlock()
-
-	if initial {
-		if wantsDns && !amLighthouse {
-			d.l.Warn("DNS server refusing to run because this host is not a lighthouse.")
-		}
-		return nil
-	}
-
-	if !enabled {
-		if running != nil {
-			d.Stop()
-		}
-		// Drop any records that accumulated while enabled; a later re-enable
-		// will repopulate from fresh handshakes.
-		d.clearRecords()
-		return nil
-	}
-
-	if running == nil {
-		// Was disabled (or never started); bring it up now.
-		go d.Start()
-		return nil
-	}
-
-	if sameAddr {
-		return nil
-	}
-
-	d.shutdownServer(running, runningStarted, "reload")
-	// Old Start goroutine has now exited; bring up a fresh listener on the
-	// new address.
-	go d.Start()
-	return nil
-}
-
-// shutdownServer waits for the server to finish binding (so Shutdown actually
-// stops it rather than no-oping) and then shuts it down.
-func (d *dnsServer) shutdownServer(srv *dns.Server, started chan struct{}, reason string) {
-	if srv == nil {
-		return
-	}
-	if started != nil {
-		<-started
-	}
-	if err := srv.Shutdown(); err != nil {
-		d.l.Warn("Failed to shut down the DNS responder", "reason", reason, "error", err)
-	}
-}
-
-// Start binds and serves the DNS responder. Blocks until Stop is called or
-// the listener errors. Safe to call when DNS is disabled (returns
-// immediately). This is what Control.dnsStart points at.
-//
-// Must be invoked after the tun device is active so that lighthouse.dns.host
-// may bind to a nebula IP.
-func (d *dnsServer) Start() {
-	if !d.enabled.Load() {
-		return
-	}
-
-	started := make(chan struct{})
-	d.serverMu.Lock()
-	if d.ctx.Err() != nil {
-		d.serverMu.Unlock()
-		return
-	}
-	addr := d.addr
-	server := &dns.Server{
-		Addr:              addr,
-		Net:               "udp",
-		Handler:           d.mux,
-		NotifyStartedFunc: func() { close(started) },
-	}
-	d.server = server
-	d.started = started
-	d.serverMu.Unlock()
-
-	// Per-invocation ctx watcher. Exits when Start does, so we don't leak a
-	// watcher per reload-driven restart.
-	done := make(chan struct{})
-	go func() {
-		select {
-		case <-d.ctx.Done():
-			d.shutdownServer(server, started, "shutdown")
-		case <-done:
-		}
-	}()
-
-	d.l.Info("Starting DNS responder", "dnsListener", addr)
-	err := server.ListenAndServe()
-	close(done)
-
-	// If the listener never bound (bind error) NotifyStartedFunc never fires,
-	// so close started here to release any Stop caller waiting on it.
-	select {
-	case <-started:
-	default:
-		close(started)
-	}
-
-	if err != nil {
-		d.l.Warn("Failed to run the DNS responder", "error", err)
-	}
-}
-
-// Stop shuts down the active server, if any. Idempotent.
-func (d *dnsServer) Stop() {
-	d.serverMu.Lock()
-	srv := d.server
-	started := d.started
-	d.server = nil
-	d.started = nil
-	d.serverMu.Unlock()
-	d.shutdownServer(srv, started, "stop")
-}
-
-// Query returns the address for the given name and query type. The second
-// return value reports whether the name is known at all (in either A or AAAA),
-// which lets callers distinguish NODATA from NXDOMAIN.
-func (d *dnsServer) Query(q uint16, data string) (netip.Addr, bool) {
+func (d *dnsRecords) Query(q uint16, data string) netip.Addr {
 	data = strings.ToLower(data)
 	d.RLock()
 	defer d.RUnlock()
-	addr4, haveV4 := d.dnsMap4[data]
-	addr6, haveV6 := d.dnsMap6[data]
-	nameExists := haveV4 || haveV6
 	switch q {
 	case dns.TypeA:
-		if haveV4 {
-			return addr4, nameExists
+		if r, ok := d.dnsMap4[data]; ok {
+			return r
 		}
 	case dns.TypeAAAA:
-		if haveV6 {
-			return addr6, nameExists
+		if r, ok := d.dnsMap6[data]; ok {
+			return r
 		}
 	}
 
-	return netip.Addr{}, nameExists
+	return netip.Addr{}
 }
 
-func (d *dnsServer) QueryCert(data string) string {
-	if len(data) < 2 {
-		return ""
-	}
+func (d *dnsRecords) QueryCert(data string) string {
 	ip, err := netip.ParseAddr(data[:len(data)-1])
 	if err != nil {
 		return ""
@@ -266,19 +80,8 @@ func (d *dnsServer) QueryCert(data string) string {
 	return string(b)
 }
 
-// clearRecords drops all DNS records.
-func (d *dnsServer) clearRecords() {
-	d.Lock()
-	defer d.Unlock()
-	clear(d.dnsMap4)
-	clear(d.dnsMap6)
-}
-
 // Add adds the first IPv4 and IPv6 address that appears in `addresses` as the record for `host`
-func (d *dnsServer) Add(host string, addresses []netip.Addr) {
-	if !d.enabled.Load() {
-		return
-	}
+func (d *dnsRecords) Add(host string, addresses []netip.Addr) {
 	host = strings.ToLower(host)
 	d.Lock()
 	defer d.Unlock()
@@ -298,7 +101,7 @@ func (d *dnsServer) Add(host string, addresses []netip.Addr) {
 	}
 }
 
-func (d *dnsServer) isSelfNebulaOrLocalhost(addr string) bool {
+func (d *dnsRecords) isSelfNebulaOrLocalhost(addr string) bool {
 	a, _, _ := net.SplitHostPort(addr)
 	b, err := netip.ParseAddr(a)
 	if err != nil {
@@ -313,24 +116,13 @@ func (d *dnsServer) isSelfNebulaOrLocalhost(addr string) bool {
 	return d.myVpnAddrsTable.Contains(b)
 }
 
-func (d *dnsServer) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
-	debugEnabled := d.l.Enabled(context.Background(), slog.LevelDebug)
-	// Per RFC 2308 §2.2, a name that exists but has no record of the requested
-	// type must be answered with NOERROR and an empty answer section (NODATA),
-	// not NXDOMAIN (RFC 2308 §2.1), which is reserved for names that do not
-	// exist at all.
-	anyNameExists := false
+func (d *dnsRecords) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 	for _, q := range m.Question {
 		switch q.Qtype {
 		case dns.TypeA, dns.TypeAAAA:
 			qType := dns.TypeToString[q.Qtype]
-			if debugEnabled {
-				d.l.Debug("DNS query", "type", qType, "name", q.Name)
-			}
-			ip, nameExists := d.Query(q.Qtype, q.Name)
-			if nameExists {
-				anyNameExists = true
-			}
+			d.l.Debugf("Query for %s %s", qType, q.Name)
+			ip := d.Query(q.Qtype, q.Name)
 			if ip.IsValid() {
 				rr, err := dns.NewRR(fmt.Sprintf("%s %s %s", q.Name, qType, ip))
 				if err == nil {
@@ -342,9 +134,7 @@ func (d *dnsServer) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 			if !d.isSelfNebulaOrLocalhost(w.RemoteAddr().String()) {
 				return
 			}
-			if debugEnabled {
-				d.l.Debug("DNS query", "type", "TXT", "name", q.Name)
-			}
+			d.l.Debugf("Query for TXT %s", q.Name)
 			ip := d.QueryCert(q.Name)
 			if ip != "" {
 				rr, err := dns.NewRR(fmt.Sprintf("%s TXT %s", q.Name, ip))
@@ -355,12 +145,12 @@ func (d *dnsServer) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 		}
 	}
 
-	if len(m.Answer) == 0 && !anyNameExists {
+	if len(m.Answer) == 0 {
 		m.Rcode = dns.RcodeNameError
 	}
 }
 
-func (d *dnsServer) handleDnsRequest(w dns.ResponseWriter, r *dns.Msg) {
+func (d *dnsRecords) handleDnsRequest(w dns.ResponseWriter, r *dns.Msg) {
 	m := new(dns.Msg)
 	m.SetReply(r)
 	m.Compress = false
@@ -373,6 +163,21 @@ func (d *dnsServer) handleDnsRequest(w dns.ResponseWriter, r *dns.Msg) {
 	w.WriteMsg(m)
 }
 
+func dnsMain(l *logrus.Logger, cs *CertState, hostMap *HostMap, c *config.C) func() {
+	dnsR = newDnsRecords(l, cs, hostMap)
+
+	// attach request handler func
+	dns.HandleFunc(".", dnsR.handleDnsRequest)
+
+	c.RegisterReloadCallback(func(c *config.C) {
+		reloadDns(l, c)
+	})
+
+	return func() {
+		startDns(l, c)
+	}
+}
+
 func getDnsServerAddr(c *config.C) string {
 	dnsHost := strings.TrimSpace(c.GetString("lighthouse.dns.host", ""))
 	// Old guidance was to provide the literal `[::]` in `lighthouse.dns.host` but that won't resolve.
@@ -381,3 +186,25 @@ func getDnsServerAddr(c *config.C) string {
 	}
 	return net.JoinHostPort(dnsHost, strconv.Itoa(c.GetInt("lighthouse.dns.port", 53)))
 }
+
+func startDns(l *logrus.Logger, c *config.C) {
+	dnsAddr = getDnsServerAddr(c)
+	dnsServer = &dns.Server{Addr: dnsAddr, Net: "udp"}
+	l.WithField("dnsListener", dnsAddr).Info("Starting DNS responder")
+	err := dnsServer.ListenAndServe()
+	defer dnsServer.Shutdown()
+	if err != nil {
+		l.Errorf("Failed to start server: %s\n ", err.Error())
+	}
+}
+
+func reloadDns(l *logrus.Logger, c *config.C) {
+	if dnsAddr == getDnsServerAddr(c) {
+		l.Debug("No DNS server config change detected")
+		return
+	}
+
+	l.Debug("Restarting DNS server")
+	dnsServer.Shutdown()
+	go startDns(l, c)
+}

dns_server_test.go

@@ -1,43 +1,19 @@
 package nebula
 
 import (
-	"context"
-	"log/slog"
-	"net"
 	"net/netip"
-	"strconv"
 	"testing"
-	"time"
 
 	"github.com/miekg/dns"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
-type stubDNSWriter struct{}
-
-func (stubDNSWriter) LocalAddr() net.Addr { return &net.UDPAddr{} }
-func (stubDNSWriter) RemoteAddr() net.Addr {
-	return &net.UDPAddr{IP: net.ParseIP("127.0.0.1"), Port: 5353}
-}
-func (stubDNSWriter) Write([]byte) (int, error) { return 0, nil }
-func (stubDNSWriter) WriteMsg(*dns.Msg) error   { return nil }
-func (stubDNSWriter) Close() error              { return nil }
-func (stubDNSWriter) TsigStatus() error         { return nil }
-func (stubDNSWriter) TsigTimersOnly(bool)       {}
-func (stubDNSWriter) Hijack()                   {}
-
 func TestParsequery(t *testing.T) {
-	l := slog.New(slog.DiscardHandler)
+	l := logrus.New()
 	hostMap := &HostMap{}
-	ds := &dnsServer{
-		l:       l,
-		dnsMap4: make(map[string]netip.Addr),
-		dnsMap6: make(map[string]netip.Addr),
-		hostMap: hostMap,
-	}
-	ds.enabled.Store(true)
+	ds := newDnsRecords(l, &CertState{}, hostMap)
 	addrs := []netip.Addr{
 		netip.MustParseAddr("1.2.3.4"),
 		netip.MustParseAddr("1.2.3.5"),
@@ -45,56 +21,18 @@ func TestParsequery(t *testing.T) {
 		netip.MustParseAddr("fd01::25"),
 	}
 	ds.Add("test.com.com", addrs)
-	ds.Add("v4only.com.com", []netip.Addr{netip.MustParseAddr("1.2.3.6")})
-	ds.Add("v6only.com.com", []netip.Addr{netip.MustParseAddr("fd01::26")})
 
 	m := &dns.Msg{}
 	m.SetQuestion("test.com.com", dns.TypeA)
 	ds.parseQuery(m, nil)
 	assert.NotNil(t, m.Answer)
 	assert.Equal(t, "1.2.3.4", m.Answer[0].(*dns.A).A.String())
-	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
 
 	m = &dns.Msg{}
 	m.SetQuestion("test.com.com", dns.TypeAAAA)
 	ds.parseQuery(m, nil)
 	assert.NotNil(t, m.Answer)
 	assert.Equal(t, "fd01::24", m.Answer[0].(*dns.AAAA).AAAA.String())
-	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
-
-	// A known name with no record of the requested type should return NODATA
-	// (NOERROR with empty answer), not NXDOMAIN.
-	m = &dns.Msg{}
-	m.SetQuestion("v4only.com.com", dns.TypeAAAA)
-	ds.parseQuery(m, nil)
-	assert.Empty(t, m.Answer)
-	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
-
-	m = &dns.Msg{}
-	m.SetQuestion("v6only.com.com", dns.TypeA)
-	ds.parseQuery(m, nil)
-	assert.Empty(t, m.Answer)
-	assert.Equal(t, dns.RcodeSuccess, m.Rcode)
-
-	// An unknown name should still return NXDOMAIN.
-	m = &dns.Msg{}
-	m.SetQuestion("unknown.com.com", dns.TypeA)
-	ds.parseQuery(m, nil)
-	assert.Empty(t, m.Answer)
-	assert.Equal(t, dns.RcodeNameError, m.Rcode)
-
-	// short lookups should not fail
-	m = &dns.Msg{}
-	m.Question = []dns.Question{{Name: "", Qtype: dns.TypeTXT, Qclass: dns.ClassINET}}
-	ds.parseQuery(m, stubDNSWriter{})
-	assert.Empty(t, m.Answer)
-	assert.Equal(t, dns.RcodeNameError, m.Rcode)
-
-	m = &dns.Msg{}
-	m.Question = []dns.Question{{Name: ".", Qtype: dns.TypeTXT, Qclass: dns.ClassINET}}
-	ds.parseQuery(m, stubDNSWriter{})
-	assert.Empty(t, m.Answer)
-	assert.Equal(t, dns.RcodeNameError, m.Rcode)
 }
 
 func Test_getDnsServerAddr(t *testing.T) {
@@ -133,208 +71,3 @@ func Test_getDnsServerAddr(t *testing.T) {
 	}
 	assert.Equal(t, "[::]:1", getDnsServerAddr(c))
 }
-
-func newTestDnsServer(t *testing.T) (*dnsServer, *config.C) {
-	t.Helper()
-	sl := slog.New(slog.DiscardHandler)
-	ds := &dnsServer{
-		l:       sl,
-		ctx:     context.Background(),
-		dnsMap4: make(map[string]netip.Addr),
-		dnsMap6: make(map[string]netip.Addr),
-		hostMap: &HostMap{},
-	}
-	ds.mux = dns.NewServeMux()
-	ds.mux.HandleFunc(".", ds.handleDnsRequest)
-	return ds, config.NewC(nil)
-}
-
-func setDnsConfig(c *config.C, host string, port string, amLighthouse, serveDns bool) {
-	c.Settings["lighthouse"] = map[string]any{
-		"am_lighthouse": amLighthouse,
-		"serve_dns":     serveDns,
-		"dns": map[string]any{
-			"host": host,
-			"port": port,
-		},
-	}
-}
-
-func TestDnsServer_reload_initial_disabled(t *testing.T) {
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", "0", true, false)
-
-	require.NoError(t, ds.reload(c, true))
-	assert.False(t, ds.enabled.Load())
-	assert.Equal(t, "127.0.0.1:0", ds.addr)
-	assert.Nil(t, ds.server)
-}
-
-func TestDnsServer_reload_initial_enabled(t *testing.T) {
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", "0", true, true)
-
-	require.NoError(t, ds.reload(c, true))
-	assert.True(t, ds.enabled.Load())
-	assert.Equal(t, "127.0.0.1:0", ds.addr)
-	// initial never starts a runner; that's Control.Start's job
-	assert.Nil(t, ds.server)
-}
-
-func TestDnsServer_reload_initial_serveDnsWithoutLighthouse(t *testing.T) {
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", "0", false, true)
-
-	require.NoError(t, ds.reload(c, true))
-	// Wants DNS but isn't a lighthouse: gated off, no runner.
-	assert.False(t, ds.enabled.Load())
-}
-
-func TestDnsServer_reload_sameAddr_noOp(t *testing.T) {
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", "0", true, true)
-
-	require.NoError(t, ds.reload(c, true))
-	// No server running yet, no addr change. Reload should not spawn anything.
-	require.NoError(t, ds.reload(c, false))
-	assert.True(t, ds.enabled.Load())
-	assert.Nil(t, ds.server)
-}
-
-func TestDnsServer_StartStop_lifecycle(t *testing.T) {
-	// Bind to a real (random) UDP port so we exercise the actual
-	// ListenAndServe + Shutdown plumbing including the started-chan race fix.
-	port := freeUDPPort(t)
-
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", port, true, true)
-	require.NoError(t, ds.reload(c, true))
-
-	done := make(chan struct{})
-	go func() {
-		ds.Start()
-		close(done)
-	}()
-
-	waitFor(t, func() bool {
-		ds.serverMu.Lock()
-		started := ds.started
-		ds.serverMu.Unlock()
-		if started == nil {
-			return false
-		}
-		select {
-		case <-started:
-			return true
-		default:
-			return false
-		}
-	})
-
-	ds.Stop()
-	select {
-	case <-done:
-	case <-time.After(5 * time.Second):
-		t.Fatal("Start did not return after Stop")
-	}
-}
-
-func TestDnsServer_Stop_beforeBind_doesNotHang(t *testing.T) {
-	// Stop called immediately after Start should not deadlock even if bind
-	// hasn't completed yet. This exercises the started-chan close-on-bind-fail
-	// path: by binding to an obviously bad port (privileged) we get a fast
-	// bind error before NotifyStartedFunc fires.
-	ds, c := newTestDnsServer(t)
-	// Use a port that should fail to bind (negative would be invalid, use a
-	// host that won't resolve to ensure listenUDP fails quickly).
-	setDnsConfig(c, "256.256.256.256", "53", true, true)
-	require.NoError(t, ds.reload(c, true))
-
-	done := make(chan struct{})
-	go func() {
-		ds.Start()
-		close(done)
-	}()
-
-	// Give Start a moment to attempt the bind and fail.
-	select {
-	case <-done:
-		// Bind failed and Start returned; Stop should be a no-op.
-	case <-time.After(time.Second):
-		t.Fatal("Start did not return after a bad bind")
-	}
-
-	stopped := make(chan struct{})
-	go func() {
-		ds.Stop()
-		close(stopped)
-	}()
-	select {
-	case <-stopped:
-	case <-time.After(time.Second):
-		t.Fatal("Stop hung after a failed bind")
-	}
-}
-
-func TestDnsServer_reload_disable_stopsRunningServer(t *testing.T) {
-	port := freeUDPPort(t)
-	ds, c := newTestDnsServer(t)
-	setDnsConfig(c, "127.0.0.1", port, true, true)
-	require.NoError(t, ds.reload(c, true))
-
-	startReturned := make(chan struct{})
-	go func() {
-		ds.Start()
-		close(startReturned)
-	}()
-	waitForBind(t, ds)
-
-	// Toggle serve_dns off; reload should shut the running server down.
-	setDnsConfig(c, "127.0.0.1", port, true, false)
-	require.NoError(t, ds.reload(c, false))
-	select {
-	case <-startReturned:
-	case <-time.After(5 * time.Second):
-		t.Fatal("Start did not return after reload disabled DNS")
-	}
-	assert.False(t, ds.enabled.Load())
-}
-
-func freeUDPPort(t *testing.T) string {
-	t.Helper()
-	conn, err := net.ListenPacket("udp", "127.0.0.1:0")
-	require.NoError(t, err)
-	port := conn.LocalAddr().(*net.UDPAddr).Port
-	require.NoError(t, conn.Close())
-	return strconv.Itoa(port)
-}
-
-func waitForBind(t *testing.T, ds *dnsServer) {
-	t.Helper()
-	waitFor(t, func() bool {
-		ds.serverMu.Lock()
-		started := ds.started
-		ds.serverMu.Unlock()
-		if started == nil {
-			return false
-		}
-		select {
-		case <-started:
-			return true
-		default:
-			return false
-		}
-	})
-}
-
-func waitFor(t *testing.T, cond func() bool) {
-	t.Helper()
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		if cond() {
-			return
-		}
-		time.Sleep(5 * time.Millisecond)
-	}
-	t.Fatal("timed out waiting for condition")
-}

e2e/handshake_manager_test.go

@@ -1,577 +0,0 @@
-//go:build e2e_testing
-// +build e2e_testing
-
-package e2e
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/udp"
-	"github.com/stretchr/testify/assert"
-)
-
-// makeHandshakePacket creates a handshake packet with the given parameters.
-func makeHandshakePacket(from, to netip.AddrPort, subtype header.MessageSubType, remoteIndex uint32, counter uint64) *udp.Packet {
-	data := make([]byte, 200)
-	header.Encode(data, header.Version, header.Handshake, subtype, remoteIndex, counter)
-	for i := header.Len; i < len(data); i++ {
-		data[i] = byte(i)
-	}
-	return &udp.Packet{To: to, From: from, Data: data}
-}
-
-func TestHandshakeRetransmitDuplicate(t *testing.T) {
-	t.Parallel()
-	// Verify the responder correctly handles receiving the same msg1 multiple times
-	// (retransmission). The duplicate goes through CheckAndComplete -> ErrAlreadySeen
-	// and the cached response is resent.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Trigger handshake from me to them")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-
-	t.Log("Grab my msg1")
-	msg1 := myControl.GetFromUDP(true)
-
-	t.Log("Inject msg1 into them, first time")
-	theirControl.InjectUDPPacket(msg1)
-	_ = theirControl.GetFromUDP(true)
-
-	t.Log("Inject the SAME msg1 again, tests ErrAlreadySeen path")
-	theirControl.InjectUDPPacket(msg1)
-	resp2 := theirControl.GetFromUDP(true)
-	assert.NotNil(t, resp2, "should get cached response on duplicate msg1")
-
-	t.Log("Complete handshake with cached response")
-	myControl.InjectUDPPacket(resp2)
-	myControl.WaitForType(1, 0, theirControl)
-
-	t.Log("Drain cached packet and verify tunnel works")
-	cachedPacket := theirControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi"), cachedPacket, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Verify only one tunnel exists on each side")
-	assert.Len(t, myControl.ListHostmapHosts(false), 1)
-	assert.Len(t, theirControl.ListHostmapHosts(false), 1)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeTruncatedPacketRecovery(t *testing.T) {
-	t.Parallel()
-	// Verify that a truncated handshake packet is ignored and the real
-	// packet can still complete the handshake.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Trigger handshake")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-
-	t.Log("Get msg1 and deliver to responder")
-	msg1 := myControl.GetFromUDP(true)
-	theirControl.InjectUDPPacket(msg1)
-
-	t.Log("Get the real response")
-	realResp := theirControl.GetFromUDP(true)
-
-	t.Log("Truncate the response and inject, should be ignored")
-	truncResp := realResp.Copy()
-	truncResp.Data = truncResp.Data[:header.Len]
-	myControl.InjectUDPPacket(truncResp)
-
-	t.Log("Verify pending handshake survived the truncated packet")
-	assert.NotEmpty(t, myControl.ListHostmapHosts(true), "pending handshake should still exist")
-
-	t.Log("Inject real response, should complete handshake")
-	myControl.InjectUDPPacket(realResp)
-	myControl.WaitForType(1, 0, theirControl)
-
-	t.Log("Drain and verify tunnel")
-	cachedPacket := theirControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi"), cachedPacket, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeOrphanedMsg2Dropped(t *testing.T) {
-	t.Parallel()
-	// A msg2 arriving with no matching pending index should be silently dropped
-	// with no response sent and no state changes.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Complete a normal handshake")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	r.RouteForAllUntilTxTun(theirControl)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Record hostmap state")
-	myIndexes := len(myControl.ListHostmapIndexes(false))
-
-	t.Log("Inject a fake msg2 with unknown RemoteIndex")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0xDEADBEEF, 2))
-
-	t.Log("Verify no new indexes created")
-	assert.Equal(t, myIndexes, len(myControl.ListHostmapIndexes(false)))
-
-	t.Log("Verify no UDP response was sent")
-	time.Sleep(100 * time.Millisecond)
-	assert.Nil(t, myControl.GetFromUDP(false), "should not send a response to orphaned msg2")
-
-	t.Log("Verify existing tunnel still works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeUnknownMessageCounter(t *testing.T) {
-	t.Parallel()
-	// A handshake packet with an unexpected message counter should be silently
-	// dropped with no side effects and no UDP response.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, _, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Inject handshake with MessageCounter=3")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0, 3))
-
-	t.Log("Inject handshake with MessageCounter=99")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0, 99))
-
-	t.Log("Verify no tunnels or pending handshakes")
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	t.Log("Verify no UDP response was sent")
-	time.Sleep(100 * time.Millisecond)
-	assert.Nil(t, myControl.GetFromUDP(false))
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeUnknownSubtype(t *testing.T) {
-	t.Parallel()
-	// A handshake packet with an unknown subtype should be silently dropped.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, _, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, _, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Inject handshake with unknown subtype 99")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.MessageSubType(99), 0, 1))
-
-	t.Log("Verify no tunnels or pending handshakes")
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	t.Log("Verify no UDP response was sent")
-	time.Sleep(100 * time.Millisecond)
-	assert.Nil(t, myControl.GetFromUDP(false))
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeLateResponse(t *testing.T) {
-	t.Parallel()
-	// After a handshake times out, a late response should be silently ignored
-	// with no new tunnels created.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{
-		"handshakes": m{
-			"try_interval": "200ms",
-			"retries":      2,
-		},
-	})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Trigger handshake from me")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-
-	t.Log("Grab msg1 but don't deliver")
-	msg1 := myControl.GetFromUDP(true)
-
-	t.Log("Wait for handshake to time out")
-	for i := 0; i < 5; i++ {
-		time.Sleep(300 * time.Millisecond)
-		myControl.GetFromUDP(false)
-	}
-
-	t.Log("Confirm no pending handshakes remain")
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	t.Log("Deliver old msg1 to them, they create a tunnel")
-	theirControl.InjectUDPPacket(msg1)
-	resp := theirControl.GetFromUDP(true)
-	assert.NotNil(t, resp)
-
-	t.Log("Inject late response into me, should be ignored")
-	myControl.InjectUDPPacket(resp)
-
-	t.Log("No tunnel should exist on my side")
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeSelfConnectionRejected(t *testing.T) {
-	t.Parallel()
-	// Verify that a node rejects a handshake containing its own VPN IP in the
-	// peer cert. We do this by sending the initiator's own msg1 back to itself.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-
-	// Need a lighthouse entry to trigger a handshake
-	myControl.InjectLightHouseAddr(netip.MustParseAddr("10.128.0.2"), netip.MustParseAddrPort("10.0.0.2:4242"))
-
-	myControl.Start()
-
-	t.Log("Trigger handshake from me")
-	myControl.InjectTunUDPPacket(netip.MustParseAddr("10.128.0.2"), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	msg1 := myControl.GetFromUDP(true)
-
-	t.Log("Drain any handshake retransmits before injecting")
-	time.Sleep(100 * time.Millisecond)
-	for myControl.GetFromUDP(false) != nil {
-	}
-
-	t.Log("Feed my own msg1 back to me as if it came from someone else")
-	selfMsg := msg1.Copy()
-	selfMsg.From = netip.MustParseAddrPort("10.0.0.99:4242")
-	selfMsg.To = myUdpAddr
-	myControl.InjectUDPPacket(selfMsg)
-
-	t.Log("Verify no response was sent (self-connection rejected)")
-	time.Sleep(100 * time.Millisecond)
-	// Drain any further retransmits from the original handshake, then check
-	// that none of them are a handshake response (MessageCounter=2)
-	h := &header.H{}
-	for {
-		p := myControl.GetFromUDP(false)
-		if p == nil {
-			break
-		}
-		_ = h.Parse(p.Data)
-		assert.NotEqual(t, uint64(2), h.MessageCounter,
-			"should not send a stage 2 response to self-connection")
-	}
-
-	t.Log("Verify no tunnel to myself was created")
-	assert.Nil(t, myControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false))
-
-	myControl.Stop()
-}
-
-func TestHandshakeMessageCounter0Dropped(t *testing.T) {
-	t.Parallel()
-	// MessageCounter=0 is not a valid handshake message and should be dropped.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, _, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	_, _, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.Start()
-
-	t.Log("Inject handshake with MessageCounter=0")
-	myControl.InjectUDPPacket(makeHandshakePacket(theirUdpAddr, myUdpAddr, header.HandshakeIXPSK0, 0, 0))
-
-	time.Sleep(100 * time.Millisecond)
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-	assert.Nil(t, myControl.GetFromUDP(false))
-
-	myControl.Stop()
-}
-
-func TestHandshakeRemoteAllowList(t *testing.T) {
-	t.Parallel()
-	// Verify that a handshake from a blocked underlay IP is dropped with no
-	// response and no state changes. Then verify the same packet from an
-	// allowed IP succeeds.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{
-		"lighthouse": m{
-			"remote_allow_list": m{
-				"10.0.0.0/8": true,
-				"0.0.0.0/0":  false,
-			},
-		},
-	})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Trigger handshake from them")
-	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	msg1 := theirControl.GetFromUDP(true)
-
-	t.Log("Rewrite the source to a blocked IP and inject")
-	blockedMsg := msg1.Copy()
-	blockedMsg.From = netip.MustParseAddrPort("192.168.1.1:4242")
-	myControl.InjectUDPPacket(blockedMsg)
-
-	t.Log("Verify no tunnel, no pending, no response from blocked source")
-	time.Sleep(100 * time.Millisecond)
-	assert.Empty(t, myControl.ListHostmapHosts(false))
-	assert.Empty(t, myControl.ListHostmapHosts(true))
-	assert.Nil(t, myControl.GetFromUDP(false), "should not respond to blocked source")
-
-	t.Log("Now inject the real packet from the allowed source")
-	myControl.InjectUDPPacket(msg1)
-
-	t.Log("Verify handshake completes from allowed source")
-	resp := myControl.GetFromUDP(true)
-	assert.NotNil(t, resp)
-	theirControl.InjectUDPPacket(resp)
-	theirControl.WaitForType(1, 0, myControl)
-
-	t.Log("Drain cached packet and verify tunnel works")
-	cachedPacket := myControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi"), cachedPacket, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), 80, 80)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeAlreadySeenPreferredRemote(t *testing.T) {
-	t.Parallel()
-	// When a duplicate msg1 arrives via ErrAlreadySeen, verify the tunnel
-	// remains functional and hostmap index count is stable.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	t.Log("Complete a normal handshake via the router")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi"))
-	r.RouteForAllUntilTxTun(theirControl)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Record hostmap state")
-	theirIndexes := len(theirControl.ListHostmapIndexes(false))
-	hi := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, hi)
-	originalRemote := hi.CurrentRemote
-
-	t.Log("Re-trigger traffic to cause a new handshake attempt (ErrAlreadySeen)")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("roam"))
-	r.RouteForAllUntilTxTun(theirControl)
-
-	t.Log("Verify tunnel still works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Verify remote is still valid and index count is stable")
-	hi2 := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, hi2)
-	assert.Equal(t, originalRemote, hi2.CurrentRemote)
-	assert.Equal(t, theirIndexes, len(theirControl.ListHostmapIndexes(false)),
-		"no extra indexes should be created from ErrAlreadySeen")
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestHandshakeWrongResponderPacketStore(t *testing.T) {
-	t.Parallel()
-	// Verify that when the wrong host responds, the cached packets are
-	// transferred to the new handshake, the evil tunnel is closed, evil's
-	// address is blocked, and the correct tunnel is eventually established.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.100/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.99/24", nil)
-	evilControl, evilVpnIpNet, evilUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "evil", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), evilUdpAddr)
-
-	r := router.NewR(t, myControl, theirControl, evilControl)
-	defer r.RenderFlow()
-
-	myControl.Start()
-	theirControl.Start()
-	evilControl.Start()
-
-	t.Log("Send multiple packets to them (cached during handshake)")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet1"))
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("packet2"))
-
-	t.Log("Route until evil tunnel is closed")
-	h := &header.H{}
-	r.RouteForAllExitFunc(func(p *udp.Packet, c *nebula.Control) router.ExitType {
-		if err := h.Parse(p.Data); err != nil {
-			panic(err)
-		}
-		if h.Type == header.CloseTunnel && p.To == evilUdpAddr {
-			return router.RouteAndExit
-		}
-		return router.KeepRouting
-	})
-
-	t.Log("Verify evil's address is blocked in the new pending handshake")
-	pendingHI := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), true)
-	if pendingHI != nil {
-		assert.NotContains(t, pendingHI.RemoteAddrs, evilUdpAddr,
-			"evil's address should be blocked")
-	}
-
-	t.Log("Inject correct lighthouse addr for them")
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	t.Log("Route until cached packets arrive at the real them")
-	p := r.RouteForAllUntilTxTun(theirControl)
-	assert.NotNil(t, p, "a cached packet should be delivered to the correct host")
-
-	t.Log("Verify the correct host has a tunnel")
-	assertHostInfoPair(t, myUdpAddr, theirUdpAddr, myVpnIpNet, theirVpnIpNet, myControl, theirControl)
-
-	t.Log("Verify no hostinfo artifacts from evil remain")
-	assert.Nil(t, myControl.GetHostInfoByVpnAddr(evilVpnIpNet[0].Addr(), true),
-		"no pending hostinfo for evil")
-	assert.Nil(t, myControl.GetHostInfoByVpnAddr(evilVpnIpNet[0].Addr(), false),
-		"no main hostinfo for evil")
-
-	myControl.Stop()
-	theirControl.Stop()
-	evilControl.Stop()
-}
-
-func TestHandshakeRelayComplete(t *testing.T) {
-	t.Parallel()
-	// Verify that a relay handshake completes correctly and relay state is
-	// properly maintained on all three nodes.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
-
-	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	r := router.NewR(t, myControl, relayControl, theirControl)
-	defer r.RenderFlow()
-
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	t.Log("Trigger handshake via relay")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi via relay"))
-
-	p := r.RouteForAllUntilTxTun(theirControl)
-	assertUdpPacket(t, []byte("Hi via relay"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-
-	t.Log("Verify bidirectional tunnel via relay")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	t.Log("Verify relay state on my side shows relay-to-me")
-	myHI := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, myHI)
-	assert.NotEmpty(t, myHI.CurrentRelaysToMe, "should have relay-to-me for them")
-
-	t.Log("Verify relay state on their side shows relay-to-me")
-	theirHI := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, theirHI)
-	assert.NotEmpty(t, theirHI.CurrentRelaysToMe, "should have relay-to-me for me")
-
-	t.Log("Verify relay node shows through-me relays")
-	relayHI := relayControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	assert.NotNil(t, relayHI)
-
-	myControl.Stop()
-	relayControl.Stop()
-	theirControl.Stop()
-}
-
-// NOTE: Relay V1 cert + IPv6 rejection is not tested here because
-// InjectTunUDPPacket from a V4 node to a V6 address panics in the test
-// framework. The check is in handshake_manager.go handleOutbound relay
-// logic (lines ~304-313): if the relay host has a V1 cert and either
-// address is IPv6, the relay is skipped.
-
-// NOTE: Relay reestablishment (Disestablished state transition) is covered
-// by the existing TestReestablishRelays in handshakes_test.go.

e2e/handshakes_test.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
@@ -84,7 +85,6 @@ func BenchmarkHotPathRelay(b *testing.B) {
 }
 
 func TestGoodHandshake(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
@@ -135,7 +135,6 @@ func TestGoodHandshake(t *testing.T) {
 }
 
 func TestGoodHandshakeNoOverlap(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "2001::69/24", nil) //look ma, cross-stack!
@@ -171,7 +170,6 @@ func TestGoodHandshakeNoOverlap(t *testing.T) {
 }
 
 func TestWrongResponderHandshake(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.100/24", nil)
@@ -248,7 +246,6 @@ func TestWrongResponderHandshake(t *testing.T) {
 }
 
 func TestWrongResponderHandshakeStaticHostMap(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.99/24", nil)
@@ -331,7 +328,6 @@ func TestWrongResponderHandshakeStaticHostMap(t *testing.T) {
 }
 
 func TestStage1Race(t *testing.T) {
-	t.Parallel()
 	// This tests ensures that two hosts handshaking with each other at the same time will allow traffic to flow
 	// But will eventually collapse down to a single tunnel
 
@@ -412,7 +408,6 @@ func TestStage1Race(t *testing.T) {
 }
 
 func TestUncleanShutdownRaceLoser(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me  ", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
@@ -462,7 +457,6 @@ func TestUncleanShutdownRaceLoser(t *testing.T) {
 }
 
 func TestUncleanShutdownRaceWinner(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me  ", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
@@ -514,7 +508,6 @@ func TestUncleanShutdownRaceWinner(t *testing.T) {
 }
 
 func TestRelays(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
@@ -544,7 +537,6 @@ func TestRelays(t *testing.T) {
 }
 
 func TestRelaysDontCareAboutIps(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "2001::9999/24", m{"relay": m{"am_relay": true}})
@@ -574,7 +566,6 @@ func TestRelaysDontCareAboutIps(t *testing.T) {
 }
 
 func TestReestablishRelays(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
@@ -706,7 +697,6 @@ func TestReestablishRelays(t *testing.T) {
 }
 
 func TestStage1RaceRelays(t *testing.T) {
-	t.Parallel()
 	//NOTE: this is a race between me and relay resulting in a full tunnel from me to them via relay
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
@@ -754,12 +744,12 @@ func TestStage1RaceRelays(t *testing.T) {
 }
 
 func TestStage1RaceRelays2(t *testing.T) {
-	t.Parallel()
 	//NOTE: this is a race between me and relay resulting in a full tunnel from me to them via relay
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them   ", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
+	l := NewTestLogger()
 
 	// Teach my how to get to the relay and that their can be reached via the relay
 	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
@@ -781,41 +771,49 @@ func TestStage1RaceRelays2(t *testing.T) {
 	theirControl.Start()
 
 	r.Log("Get a tunnel between me and relay")
+	l.Info("Get a tunnel between me and relay")
 	assertTunnel(t, myVpnIpNet[0].Addr(), relayVpnIpNet[0].Addr(), myControl, relayControl, r)
 
 	r.Log("Get a tunnel between them and relay")
+	l.Info("Get a tunnel between them and relay")
 	assertTunnel(t, theirVpnIpNet[0].Addr(), relayVpnIpNet[0].Addr(), theirControl, relayControl, r)
 
 	r.Log("Trigger a handshake from both them and me via relay to them and me")
+	l.Info("Trigger a handshake from both them and me via relay to them and me")
 	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, theirVpnIpNet[0].Addr(), 80, []byte("Hi from them"))
 
 	//r.RouteUntilAfterMsgType(myControl, header.Control, header.MessageNone)
 	//r.RouteUntilAfterMsgType(theirControl, header.Control, header.MessageNone)
 
-	r.Log("Wait for a packet from them to me; myControl")
+	r.Log("Wait for a packet from them to me")
+	l.Info("Wait for a packet from them to me; myControl")
 	r.RouteForAllUntilTxTun(myControl)
-	r.Log("Wait for a packet from them to me; theirControl")
+	l.Info("Wait for a packet from them to me; theirControl")
 	r.RouteForAllUntilTxTun(theirControl)
 
 	r.Log("Assert the tunnel works")
+	l.Info("Assert the tunnel works")
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 
 	t.Log("Wait until we remove extra tunnels")
-	t.Logf("Waiting for hostinfos to be removed... myControl=%d theirControl=%d relayControl=%d",
-		len(myControl.GetHostmap().Indexes),
-		len(theirControl.GetHostmap().Indexes),
-		len(relayControl.GetHostmap().Indexes),
-	)
+	l.Info("Wait until we remove extra tunnels")
+	l.WithFields(
+		logrus.Fields{
+			"myControl":    len(myControl.GetHostmap().Indexes),
+			"theirControl": len(theirControl.GetHostmap().Indexes),
+			"relayControl": len(relayControl.GetHostmap().Indexes),
+		}).Info("Waiting for hostinfos to be removed...")
 	hostInfos := len(myControl.GetHostmap().Indexes) + len(theirControl.GetHostmap().Indexes) + len(relayControl.GetHostmap().Indexes)
 	retries := 60
 	for hostInfos > 6 && retries > 0 {
 		hostInfos = len(myControl.GetHostmap().Indexes) + len(theirControl.GetHostmap().Indexes) + len(relayControl.GetHostmap().Indexes)
-		t.Logf("Waiting for hostinfos to be removed... myControl=%d theirControl=%d relayControl=%d",
-			len(myControl.GetHostmap().Indexes),
-			len(theirControl.GetHostmap().Indexes),
-			len(relayControl.GetHostmap().Indexes),
-		)
+		l.WithFields(
+			logrus.Fields{
+				"myControl":    len(myControl.GetHostmap().Indexes),
+				"theirControl": len(theirControl.GetHostmap().Indexes),
+				"relayControl": len(relayControl.GetHostmap().Indexes),
+			}).Info("Waiting for hostinfos to be removed...")
 		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
 		t.Log("Connection manager hasn't ticked yet")
 		time.Sleep(time.Second)
@@ -823,6 +821,7 @@ func TestStage1RaceRelays2(t *testing.T) {
 	}
 
 	r.Log("Assert the tunnel works")
+	l.Info("Assert the tunnel works")
 	assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
 
 	myControl.Stop()
@@ -831,7 +830,6 @@ func TestStage1RaceRelays2(t *testing.T) {
 }
 
 func TestRehandshakingRelays(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, relayConfig := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
@@ -935,7 +933,6 @@ func TestRehandshakingRelays(t *testing.T) {
 }
 
 func TestRehandshakingRelaysPrimary(t *testing.T) {
-	t.Parallel()
 	// This test is the same as TestRehandshakingRelays but one of the terminal types is a primary swap winner
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.128/24", m{"relay": m{"use_relays": true}})
@@ -1040,7 +1037,6 @@ func TestRehandshakingRelaysPrimary(t *testing.T) {
 }
 
 func TestRehandshaking(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, myConfig := newSimpleServer(cert.Version1, ca, caKey, "me  ", "10.128.0.2/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, theirConfig := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.1/24", nil)
@@ -1136,7 +1132,6 @@ func TestRehandshaking(t *testing.T) {
 }
 
 func TestRehandshakingLoser(t *testing.T) {
-	t.Parallel()
 	// The purpose of this test is that the race loser renews their certificate and rehandshakes. The final tunnel
 	// Should be the one with the new certificate
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -1235,7 +1230,6 @@ func TestRehandshakingLoser(t *testing.T) {
 }
 
 func TestRaceRegression(t *testing.T) {
-	t.Parallel()
 	// This test forces stage 1, stage 2, stage 1 to be received by me from them
 	// We had a bug where we were not finding the duplicate handshake and responding to the final stage 1 which
 	// caused a cross-linked hostinfo
@@ -1296,7 +1290,6 @@ func TestRaceRegression(t *testing.T) {
 }
 
 func TestV2NonPrimaryWithLighthouse(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh  ", "10.128.0.1/24, ff::1/64", m{"lighthouse": m{"am_lighthouse": true}})
 
@@ -1337,7 +1330,6 @@ func TestV2NonPrimaryWithLighthouse(t *testing.T) {
 }
 
 func TestV2NonPrimaryWithOffNetLighthouse(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh  ", "2001::1/64", m{"lighthouse": m{"am_lighthouse": true}})
 
@@ -1377,84 +1369,7 @@ func TestV2NonPrimaryWithOffNetLighthouse(t *testing.T) {
 	theirControl.Stop()
 }
 
-func TestLighthouseUpdateOnReload(t *testing.T) {
-	t.Parallel()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	// Create the lighthouse
-	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh", "10.128.0.1/24", m{"lighthouse": m{"am_lighthouse": true}})
-
-	// Create a client with NO lighthouse configured and a long update interval.
-	// The initial SendUpdate at startup will be a no-op since no lighthouses are known.
-	myControl, myVpnIpNet, _, myConfig := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.2/24", m{
-		"lighthouse": m{
-			"interval": 600,
-			"local_allow_list": m{
-				"10.0.0.0/24": true,
-				"::/0":        false,
-			},
-		},
-	})
-
-	r := router.NewR(t, lhControl, myControl)
-	defer r.RenderFlow()
-
-	lhControl.Start()
-	myControl.Start()
-
-	// Drain any startup packets (there should be none meaningful)
-	r.FlushAll()
-
-	// Verify lighthouse has no knowledge of the client
-	assert.Nil(t, lhControl.QueryLighthouse(myVpnIpNet[0].Addr()))
-
-	// Build a new config that adds the lighthouse
-	newSettings := make(m)
-	for k, v := range myConfig.Settings {
-		newSettings[k] = v
-	}
-	newSettings["static_host_map"] = m{
-		lhVpnIpNet[0].Addr().String(): []any{lhUdpAddr.String()},
-	}
-	newSettings["lighthouse"] = m{
-		"hosts":    []any{lhVpnIpNet[0].Addr().String()},
-		"interval": 600,
-		"local_allow_list": m{
-			"10.0.0.0/24": true,
-			"::/0":        false,
-		},
-	}
-	newCfg, err := yaml.Marshal(newSettings)
-	require.NoError(t, err)
-
-	// Reload the config. The lighthouse.hosts change triggers TriggerUpdate,
-	// which wakes the update worker. It calls SendUpdate, initiating a
-	// handshake to the new lighthouse and caching the HostUpdateNotification.
-	require.NoError(t, myConfig.ReloadConfigString(string(newCfg)))
-
-	// Route until the lighthouse receives the HostUpdateNotification.
-	// This covers: handshake stage 1, stage 2, then the cached update.
-	done := make(chan struct{})
-	go func() {
-		r.RouteForAllUntilAfterMsgTypeTo(lhControl, header.LightHouse, 0)
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(5 * time.Second):
-		t.Fatal("timed out waiting for lighthouse update after config reload")
-	}
-
-	// Verify lighthouse now has the client's addresses
-	assert.NotNil(t, lhControl.QueryLighthouse(myVpnIpNet[0].Addr()))
-
-	r.RenderHostmaps("Final hostmaps", lhControl, myControl)
-	lhControl.Stop()
-	myControl.Stop()
-}
-
 func TestGoodHandshakeUnsafeDest(t *testing.T) {
-	t.Parallel()
 	unsafePrefix := "192.168.6.0/24"
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(cert.Version2, ca, caKey, "spooky", "10.128.0.2/24", netip.MustParseAddrPort("10.64.0.2:4242"), unsafePrefix, nil)

e2e/helpers_test.go

@@ -4,6 +4,7 @@
 package e2e
 
 import (
+	"fmt"
 	"io"
 	"net/netip"
 	"os"
@@ -11,18 +12,15 @@ import (
 	"testing"
 	"time"
 
-	"log/slog"
-
 	"dario.cat/mergo"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
-
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/logging"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v3"
@@ -134,7 +132,8 @@ func newSimpleServerWithUdpAndUnsafeNetworks(v cert.Version, caCrt cert.Certific
 			"port": udpAddr.Port(),
 		},
 		"logging": m{
-			"level": testLogLevelName(),
+			"timestamp_format": fmt.Sprintf("%v 15:04:05.000000", name),
+			"level":            l.Level.String(),
 		},
 		"timers": m{
 			"pending_deletion_interval": 2,
@@ -235,7 +234,8 @@ func newServer(caCrt []cert.Certificate, certs []cert.Certificate, key []byte, o
 			"port": udpAddr.Port(),
 		},
 		"logging": m{
-			"level": testLogLevelName(),
+			"timestamp_format": fmt.Sprintf("%v 15:04:05.000000", certs[0].Name()),
+			"level":            l.Level.String(),
 		},
 		"timers": m{
 			"pending_deletion_interval": 2,
@@ -379,32 +379,24 @@ func getAddrs(ns []netip.Prefix) []netip.Addr {
 	return a
 }
 
-func NewTestLogger() *slog.Logger {
+func NewTestLogger() *logrus.Logger {
+	l := logrus.New()
+
 	v := os.Getenv("TEST_LOGS")
 	if v == "" {
-		return slog.New(slog.NewTextHandler(io.Discard, nil))
+		l.SetOutput(io.Discard)
+		l.SetLevel(logrus.PanicLevel)
+		return l
 	}
 
-	level := slog.LevelInfo
 	switch v {
 	case "2":
-		level = slog.LevelDebug
+		l.SetLevel(logrus.DebugLevel)
 	case "3":
-		level = logging.LevelTrace
+		l.SetLevel(logrus.TraceLevel)
+	default:
+		l.SetLevel(logrus.InfoLevel)
 	}
-	return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: level}))
-}
 
-// testLogLevelName returns the level name string accepted by logging.ApplyConfig
-// for the current TEST_LOGS setting. Kept in sync with NewTestLogger.
-func testLogLevelName() string {
-	switch os.Getenv("TEST_LOGS") {
-	case "2":
-		return "debug"
-	case "3":
-		return "trace"
-	case "":
-		return "info"
-	}
-	return "info"
+	return l
 }

e2e/leak_test.go

@@ -1,51 +0,0 @@
-//go:build e2e_testing
-// +build e2e_testing
-
-package e2e
-
-import (
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/e2e/router"
-	"go.uber.org/goleak"
-)
-
-// TestNoGoroutineLeaks brings up two nebula instances, completes a tunnel,
-// stops both, and asserts no goroutines leak past the shutdown. goleak's
-// retry mechanism gives the wg.Wait()-driven goroutines a moment to drain
-// before failing the assertion.
-//
-// IgnoreCurrent is necessary in the parallelized suite: other tests can
-// leave goroutines mid-shutdown when this one runs (Stop is async, the
-// wg.Wait() drain is not blocking on test return). We're checking that
-// *this* test's setup tears down cleanly, not that the whole suite is
-// idle at this moment. Intentionally NOT t.Parallel()'d for the same
-// reason — concurrent test goroutines would always show up.
-func TestNoGoroutineLeaks(t *testing.T) {
-	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	myControl.Stop()
-	theirControl.Stop()
-	r.RenderFlow()
-
-	// Settle period: Stop() is non-blocking; the wg-driven goroutines need
-	// a moment to drain. goleak retries internally too, but a short explicit
-	// settle reduces flakes when the suite is busy.
-	time.Sleep(50 * time.Millisecond)
-}

e2e/snat_test.go

@@ -0,0 +1,400 @@
+//go:build e2e_testing
+// +build e2e_testing
+
+package e2e
+
+import (
+	"encoding/binary"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/slackhq/nebula/cert"
+	"github.com/slackhq/nebula/cert_test"
+	"github.com/slackhq/nebula/e2e/router"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// parseIPv4UDPPacket extracts source/dest IPs, ports, and payload from an IPv4 UDP packet.
+func parseIPv4UDPPacket(t testing.TB, pkt []byte) (srcIP, dstIP netip.Addr, srcPort, dstPort uint16, payload []byte) {
+	t.Helper()
+	require.True(t, len(pkt) >= 28, "packet too short for IPv4+UDP header")
+	require.Equal(t, byte(0x45), pkt[0]&0xF0|pkt[0]&0x0F, "not a simple IPv4 packet (IHL!=5)")
+
+	srcIP, _ = netip.AddrFromSlice(pkt[12:16])
+	dstIP, _ = netip.AddrFromSlice(pkt[16:20])
+
+	ihl := int(pkt[0]&0x0F) * 4
+	require.True(t, len(pkt) >= ihl+8, "packet too short for UDP header")
+	srcPort = binary.BigEndian.Uint16(pkt[ihl : ihl+2])
+	dstPort = binary.BigEndian.Uint16(pkt[ihl+2 : ihl+4])
+	udpLen := binary.BigEndian.Uint16(pkt[ihl+4 : ihl+6])
+	payload = pkt[ihl+8 : ihl+int(udpLen)]
+	return
+}
+
+func TestSNAT_IPv6OnlyPeer_IPv4UnsafeTraffic(t *testing.T) {
+	// Scenario: Two IPv6-only VPN nodes. The "router" node has unsafe networks
+	// (192.168.0.0/16) in its cert and a configured SNAT address. The "sender"
+	// node has an unsafe route for 192.168.0.0/16 via the router.
+	//
+	// When sender injects an IPv4 packet destined for the unsafe network, it
+	// gets tunneled to the router. The router's firewall detects this is IPv4
+	// from an IPv6-only peer and applies SNAT, rewriting the source IP to the
+	// SNAT address before delivering it to TUN.
+	//
+	// When a reply comes back from TUN addressed to the SNAT address, the
+	// router un-SNATs it (restoring the original destination) and tunnels it
+	// back to the sender.
+
+	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
+
+	unsafePrefix := "192.168.0.0/16"
+	snatAddr := netip.MustParseAddr("169.254.42.42")
+
+	// Router: IPv6-only with unsafe networks and a manual SNAT address.
+	// Override inbound firewall with local_cidr: "any" so both IPv4 (unsafe)
+	// and IPv6 (VPN) traffic is accepted.
+	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
+		cert.Version2, ca, caKey, "router", "ff::1/64",
+		netip.MustParseAddrPort("[beef::1]:4242"),
+		unsafePrefix,
+		m{
+			"firewall": m{
+				"inbound": []m{{
+					"proto":      "any",
+					"port":       "any",
+					"host":       "any",
+					"local_cidr": "any",
+				}},
+			},
+			"tun": m{
+				"snat_address_for_4over6": snatAddr.String(),
+			},
+		},
+	)
+
+	// Sender: IPv6-only with an unsafe route via the router
+	senderControl, _, _, _ := newSimpleServerWithUdp(
+		cert.Version2, ca, caKey, "sender", "ff::2/64",
+		netip.MustParseAddrPort("[beef::2]:4242"),
+		m{
+			"tun": m{
+				"unsafe_routes": []m{
+					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
+				},
+			},
+		},
+	)
+
+	// Tell sender where the router lives
+	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
+
+	// Build the router and start both nodes
+	r := router.NewR(t, routerControl, senderControl)
+	defer r.RenderFlow()
+
+	routerControl.Start()
+	senderControl.Start()
+
+	// --- Outbound: sender -> IPv4 unsafe dest (via router with SNAT) ---
+
+	origSrcIP := netip.MustParseAddr("10.0.0.1")
+	unsafeDest := netip.MustParseAddr("192.168.1.1")
+	var origSrcPort uint16 = 12345
+	var dstPort uint16 = 80
+
+	t.Log("Sender injects an IPv4 packet to the unsafe network")
+	senderControl.InjectTunUDPPacket(unsafeDest, dstPort, origSrcIP, origSrcPort, []byte("snat me"))
+
+	t.Log("Route packets (handshake + data) until the router gets the packet on TUN")
+	snatPkt := r.RouteForAllUntilTxTun(routerControl)
+
+	t.Log("Verify the packet was SNATted")
+	gotSrcIP, gotDstIP, gotSrcPort, gotDstPort, gotPayload := parseIPv4UDPPacket(t, snatPkt)
+	assert.Equal(t, snatAddr, gotSrcIP, "source IP should be rewritten to the SNAT address")
+	assert.Equal(t, unsafeDest, gotDstIP, "destination IP should be unchanged")
+	assert.Equal(t, dstPort, gotDstPort, "destination port should be unchanged")
+	assert.Equal(t, []byte("snat me"), gotPayload, "payload should be unchanged")
+
+	// Capture the SNAT port (may differ from original if port was remapped)
+	snatPort := gotSrcPort
+	t.Logf("SNAT port: %d (original: %d)", snatPort, origSrcPort)
+
+	// --- Return: reply from unsafe dest -> un-SNATted back to sender ---
+
+	t.Log("Router injects a reply packet from the unsafe dest to the SNAT address")
+	routerControl.InjectTunUDPPacket(snatAddr, snatPort, unsafeDest, dstPort, []byte("reply from unsafe"))
+
+	t.Log("Route until sender gets the reply on TUN")
+	replyPkt := r.RouteForAllUntilTxTun(senderControl)
+
+	t.Log("Verify the reply was un-SNATted")
+	replySrcIP, replyDstIP, replySrcPort, replyDstPort, replyPayload := parseIPv4UDPPacket(t, replyPkt)
+	assert.Equal(t, unsafeDest, replySrcIP, "reply source should be the unsafe dest")
+	assert.Equal(t, origSrcIP, replyDstIP, "reply dest should be the original source IP (un-SNATted)")
+	assert.Equal(t, dstPort, replySrcPort, "reply source port should be the unsafe dest port")
+	assert.Equal(t, origSrcPort, replyDstPort, "reply dest port should be the original source port (un-SNATted)")
+	assert.Equal(t, []byte("reply from unsafe"), replyPayload, "payload should be unchanged")
+
+	r.RenderHostmaps("Final hostmaps", routerControl, senderControl)
+
+	// Also verify normal IPv6 VPN traffic still works between the nodes
+	t.Log("Verify normal IPv6 VPN tunnel still works")
+	assertTunnel(t, routerVpnIpNet[0].Addr(), senderControl.GetVpnAddrs()[0], routerControl, senderControl, r)
+
+	routerControl.Stop()
+	senderControl.Stop()
+}
+
+func TestSNAT_MultipleFlows(t *testing.T) {
+	// Test that multiple distinct IPv4 flows from the same IPv6-only peer
+	// are tracked independently through SNAT.
+
+	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
+
+	unsafePrefix := "192.168.0.0/16"
+	snatAddr := netip.MustParseAddr("169.254.42.42")
+
+	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
+		cert.Version2, ca, caKey, "router", "ff::1/64",
+		netip.MustParseAddrPort("[beef::1]:4242"),
+		unsafePrefix,
+		m{
+			"firewall": m{
+				"inbound": []m{{
+					"proto":      "any",
+					"port":       "any",
+					"host":       "any",
+					"local_cidr": "any",
+				}},
+			},
+			"tun": m{
+				"snat_address_for_4over6": snatAddr.String(),
+			},
+		},
+	)
+
+	senderControl, _, _, _ := newSimpleServerWithUdp(
+		cert.Version2, ca, caKey, "sender", "ff::2/64",
+		netip.MustParseAddrPort("[beef::2]:4242"),
+		m{
+			"tun": m{
+				"unsafe_routes": []m{
+					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
+				},
+			},
+		},
+	)
+
+	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
+
+	r := router.NewR(t, routerControl, senderControl)
+	defer r.RenderFlow()
+	r.CancelFlowLogs()
+
+	routerControl.Start()
+	senderControl.Start()
+
+	unsafeDest := netip.MustParseAddr("192.168.1.1")
+
+	// Send first flow
+	senderControl.InjectTunUDPPacket(unsafeDest, 80, netip.MustParseAddr("10.0.0.1"), 1111, []byte("flow1"))
+	pkt1 := r.RouteForAllUntilTxTun(routerControl)
+	srcIP1, _, srcPort1, _, payload1 := parseIPv4UDPPacket(t, pkt1)
+	assert.Equal(t, snatAddr, srcIP1)
+	assert.Equal(t, []byte("flow1"), payload1)
+
+	// Send second flow (different source port)
+	senderControl.InjectTunUDPPacket(unsafeDest, 80, netip.MustParseAddr("10.0.0.1"), 2222, []byte("flow2"))
+	pkt2 := r.RouteForAllUntilTxTun(routerControl)
+	srcIP2, _, srcPort2, _, payload2 := parseIPv4UDPPacket(t, pkt2)
+	assert.Equal(t, snatAddr, srcIP2)
+	assert.Equal(t, []byte("flow2"), payload2)
+
+	// The two flows should have different SNAT ports (since they're different conntracks)
+	t.Logf("Flow 1 SNAT port: %d, Flow 2 SNAT port: %d", srcPort1, srcPort2)
+
+	// Reply to flow 2 first (out of order)
+	routerControl.InjectTunUDPPacket(snatAddr, srcPort2, unsafeDest, 80, []byte("reply2"))
+	reply2 := r.RouteForAllUntilTxTun(senderControl)
+	_, replyDst2, _, replyDstPort2, replyPayload2 := parseIPv4UDPPacket(t, reply2)
+	assert.Equal(t, netip.MustParseAddr("10.0.0.1"), replyDst2)
+	assert.Equal(t, uint16(2222), replyDstPort2, "reply to flow 2 should restore original port 2222")
+	assert.Equal(t, []byte("reply2"), replyPayload2)
+
+	// Reply to flow 1
+	routerControl.InjectTunUDPPacket(snatAddr, srcPort1, unsafeDest, 80, []byte("reply1"))
+	reply1 := r.RouteForAllUntilTxTun(senderControl)
+	_, replyDst1, _, replyDstPort1, replyPayload1 := parseIPv4UDPPacket(t, reply1)
+	assert.Equal(t, netip.MustParseAddr("10.0.0.1"), replyDst1)
+	assert.Equal(t, uint16(1111), replyDstPort1, "reply to flow 1 should restore original port 1111")
+	assert.Equal(t, []byte("reply1"), replyPayload1)
+
+	routerControl.Stop()
+	senderControl.Stop()
+}
+
+// --- Adversarial SNAT E2E Tests ---
+
+func TestSNAT_UnsolicitedReplyDropped(t *testing.T) {
+	// Without any outbound SNAT traffic, inject a packet from the router's TUN
+	// addressed to the SNAT address. The sender must never receive it because
+	// there's no conntrack entry to un-SNAT through.
+
+	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
+
+	unsafePrefix := "192.168.0.0/16"
+	snatAddr := netip.MustParseAddr("169.254.42.42")
+
+	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
+		cert.Version2, ca, caKey, "router", "ff::1/64",
+		netip.MustParseAddrPort("[beef::1]:4242"),
+		unsafePrefix,
+		m{
+			"firewall": m{
+				"inbound": []m{{
+					"proto":      "any",
+					"port":       "any",
+					"host":       "any",
+					"local_cidr": "any",
+				}},
+			},
+			"tun": m{
+				"snat_address_for_4over6": snatAddr.String(),
+			},
+		},
+	)
+
+	senderControl, _, _, _ := newSimpleServerWithUdp(
+		cert.Version2, ca, caKey, "sender", "ff::2/64",
+		netip.MustParseAddrPort("[beef::2]:4242"),
+		m{
+			"tun": m{
+				"unsafe_routes": []m{
+					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
+				},
+			},
+		},
+	)
+
+	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
+
+	r := router.NewR(t, routerControl, senderControl)
+	defer r.RenderFlow()
+	r.CancelFlowLogs()
+
+	routerControl.Start()
+	senderControl.Start()
+
+	// First establish the tunnel with normal IPv6 traffic so handshake completes
+	assertTunnel(t, routerVpnIpNet[0].Addr(), senderControl.GetVpnAddrs()[0], routerControl, senderControl, r)
+
+	// Inject the unsolicited reply from router's TUN to the SNAT address.
+	// There is NO prior outbound SNAT flow, so no conntrack entry exists.
+	// The router should silently drop this because unSnat finds no matching conntrack.
+	routerControl.InjectTunUDPPacket(snatAddr, 55555, netip.MustParseAddr("192.168.1.1"), 80, []byte("unsolicited"))
+
+	// Send a canary IPv6 VPN packet after the bad one. Since the router processes
+	// TUN packets sequentially, the canary arriving proves the bad packet was processed first.
+	senderVpnAddr := senderControl.GetVpnAddrs()[0]
+	routerControl.InjectTunUDPPacket(senderVpnAddr, 90, routerVpnIpNet[0].Addr(), 80, []byte("canary"))
+	canaryPkt := r.RouteForAllUntilTxTun(senderControl)
+	assertUdpPacket(t, []byte("canary"), canaryPkt, routerVpnIpNet[0].Addr(), senderVpnAddr, 80, 90)
+
+	// The unsolicited packet should have been dropped — nothing else on sender's TUN
+	got := senderControl.GetFromTun(false)
+	assert.Nil(t, got, "sender should not receive unsolicited packet to SNAT address with no conntrack entry")
+
+	routerControl.Stop()
+	senderControl.Stop()
+}
+
+func TestSNAT_NonUnsafeDestDropped(t *testing.T) {
+	// An IPv6-only sender sends IPv4 traffic to a destination outside the router's
+	// unsafe networks (172.16.0.1 when unsafe is 192.168.0.0/16). The router should
+	// reject this because the local address is not routable. This verifies that
+	// willingToHandleLocalAddr enforces boundaries on what SNAT traffic can reach.
+
+	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
+
+	unsafePrefix := "192.168.0.0/16"
+	snatAddr := netip.MustParseAddr("169.254.42.42")
+
+	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
+		cert.Version2, ca, caKey, "router", "ff::1/64",
+		netip.MustParseAddrPort("[beef::1]:4242"),
+		unsafePrefix,
+		m{
+			"firewall": m{
+				"inbound": []m{{
+					"proto":      "any",
+					"port":       "any",
+					"host":       "any",
+					"local_cidr": "any",
+				}},
+			},
+			"tun": m{
+				"snat_address_for_4over6": snatAddr.String(),
+			},
+		},
+	)
+
+	// Sender has unsafe routes for BOTH 192.168.0.0/16 AND 172.16.0.0/12 via router.
+	// This means the sender will route 172.16.0.1 through the tunnel to the router.
+	// But the router should reject it because 172.16.0.0/12 is NOT in its unsafe networks.
+	senderControl, _, _, _ := newSimpleServerWithUdp(
+		cert.Version2, ca, caKey, "sender", "ff::2/64",
+		netip.MustParseAddrPort("[beef::2]:4242"),
+		m{
+			"tun": m{
+				"unsafe_routes": []m{
+					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
+					{"route": "172.16.0.0/12", "via": routerVpnIpNet[0].Addr().String()},
+				},
+			},
+		},
+	)
+
+	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
+
+	r := router.NewR(t, routerControl, senderControl)
+	defer r.RenderFlow()
+	r.CancelFlowLogs()
+
+	routerControl.Start()
+	senderControl.Start()
+
+	// Establish the tunnel first
+	assertTunnel(t, routerVpnIpNet[0].Addr(), senderControl.GetVpnAddrs()[0], routerControl, senderControl, r)
+
+	// Send to 172.16.0.1 (NOT in router's unsafe networks 192.168.0.0/16).
+	// The router should reject this at willingToHandleLocalAddr.
+	senderControl.InjectTunUDPPacket(
+		netip.MustParseAddr("172.16.0.1"), 80,
+		netip.MustParseAddr("10.0.0.1"), 12345,
+		[]byte("wrong dest"),
+	)
+
+	// Send a canary to a valid unsafe destination to prove the bad packet was processed
+	senderControl.InjectTunUDPPacket(
+		netip.MustParseAddr("192.168.1.1"), 80,
+		netip.MustParseAddr("10.0.0.1"), 33333,
+		[]byte("canary"),
+	)
+
+	// Route until the canary arrives — the 172.16.0.1 packet should have been
+	// processed and dropped before the canary gets through
+	canaryPkt := r.RouteForAllUntilTxTun(routerControl)
+	_, canaryDst, _, _, canaryPayload := parseIPv4UDPPacket(t, canaryPkt)
+	assert.Equal(t, netip.MustParseAddr("192.168.1.1"), canaryDst, "canary should arrive at the valid unsafe dest")
+	assert.Equal(t, []byte("canary"), canaryPayload)
+
+	// No more packets — the 172.16.0.1 packet was dropped
+	got := routerControl.GetFromTun(false)
+	assert.Nil(t, got, "packet to non-unsafe destination 172.16.0.1 should be dropped by the router")
+
+	routerControl.Stop()
+	senderControl.Stop()
+}

e2e/tunnels_test.go

@@ -12,14 +12,11 @@ import (
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"gopkg.in/yaml.v3"
 )
 
 func TestDropInactiveTunnels(t *testing.T) {
-	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -64,7 +61,6 @@ func TestDropInactiveTunnels(t *testing.T) {
 }
 
 func TestCertUpgrade(t *testing.T) {
-	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -159,7 +155,6 @@ func TestCertUpgrade(t *testing.T) {
 }
 
 func TestCertDowngrade(t *testing.T) {
-	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -258,7 +253,6 @@ func TestCertDowngrade(t *testing.T) {
 }
 
 func TestCertMismatchCorrection(t *testing.T) {
-	t.Parallel()
 	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
 	// under ideal conditions
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
@@ -326,7 +320,6 @@ func TestCertMismatchCorrection(t *testing.T) {
 }
 
 func TestCrossStackRelaysWork(t *testing.T) {
-	t.Parallel()
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24,fc00::1/64", m{"relay": m{"use_relays": true}})
 	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "10.128.0.128/24,fc00::128/64", m{"relay": m{"am_relay": true}})
@@ -372,107 +365,3 @@ func TestCrossStackRelaysWork(t *testing.T) {
 	//theirControl.Stop()
 	//relayControl.Stop()
 }
-
-func TestCloseTunnelAuthenticated(t *testing.T) {
-	t.Parallel()
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", m{"tunnels": m{"drop_inactive": true, "inactivity_timeout": "5s"}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", m{"tunnels": m{"drop_inactive": true, "inactivity_timeout": "10m"}})
-
-	// Share our underlay information
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	// Start the servers
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-
-	r.Log("Assert the tunnel between me and them works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	r.Log("Close the tunnel")
-	myControl.CloseTunnel(theirVpnIpNet[0].Addr(), false)
-	r.FlushAll()
-
-	waitStart := time.Now()
-	for {
-		myIndexes := len(myControl.GetHostmap().Indexes)
-		theirIndexes := len(theirControl.GetHostmap().Indexes)
-		if myIndexes == 0 && theirIndexes == 0 {
-			break
-		}
-
-		since := time.Since(waitStart)
-		r.Logf("my tunnels: %v; their tunnels: %v; duration: %v", myIndexes, theirIndexes, since)
-		if since > time.Second*6 {
-			t.Fatal("Tunnel should have been declared inactive after 2 seconds and before 6 seconds")
-		}
-
-		time.Sleep(1 * time.Second)
-		//r.FlushAll()
-	}
-
-	r.Logf("Happy path success, tunnels were dropped within %v", time.Since(waitStart))
-
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-	r.Log("Assert another tunnel between me and them works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-	hi := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-	if hi == nil {
-		t.Fatal("There is no hostinfo for this tunnel")
-	}
-	myHi := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-	if myHi == nil {
-		t.Fatal("There is no hostinfo for my tunnel")
-	}
-	r.Log("It does")
-
-	buf := make([]byte, 1024)
-	hdr := header.H{
-		Version:        1,
-		Type:           header.CloseTunnel,
-		Subtype:        0,
-		Reserved:       0,
-		RemoteIndex:    hi.RemoteIndex,
-		MessageCounter: 5,
-	}
-	out, err := hdr.Encode(buf)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	pkt := &udp.Packet{
-		To:   hi.CurrentRemote,
-		From: myHi.CurrentRemote,
-		Data: out,
-	}
-	r.InjectUDPPacket(myControl, theirControl, pkt)
-	r.Log("Injected bogus close tunnel. Let's see!")
-	waitStart = time.Now()
-	for {
-		myIndexes := len(myControl.GetHostmap().Indexes)
-		theirIndexes := len(theirControl.GetHostmap().Indexes)
-		if myIndexes == 0 {
-			t.Fatal("myIndexes should not be 0")
-		}
-		if theirIndexes == 0 {
-			t.Fatal("theirIndexes should not be 0, they should have rejected this bogus packet")
-		}
-
-		since := time.Since(waitStart)
-		r.Logf("my tunnels: %v; their tunnels: %v; duration: %v", myIndexes, theirIndexes, since)
-		if since > time.Second*4 {
-			t.Log("The tunnel would have been gone by now")
-			break
-		}
-
-		time.Sleep(1 * time.Second)
-		r.FlushAll()
-	}
-
-	myControl.Stop()
-	theirControl.Stop()
-}

examples/config.yml

@@ -204,12 +204,6 @@ punchy:
   # Trusted SSH CA public keys. These are the public keys of the CAs that are allowed to sign SSH keys for access.
   #trusted_cas:
     #- "ssh public key string"
-  # sandbox_dir restricts file paths for profiling commands (start-cpu-profile, save-heap-profile,
-  # save-mutex-profile) to the specified directory. Relative paths will be resolved within this directory,
-  # and absolute paths outside of it will be rejected. Default is $TMP/nebula-debug.
-  # The directory is NOT automatically created.
-  # Overriding this to "" is the same as "/" and will allow overwriting any path on the host.
-  #sandbox_dir: /var/tmp/nebula-debug
 
 # EXPERIMENTAL: relay support for networks that can't establish direct connections.
 relay:
@@ -289,24 +283,36 @@ tun:
   # If using massive routes updates, for example BGP, you may need to increase this value to avoid packet loss.
   # SO_RCVBUFFORCE is used to avoid having to raise the system wide max
   #use_system_route_table_buffer_size: 0
+  #
+  # When using the feature to carry IPv4 unsafe_routes through a IPv6-only overlay network (4over6),
+  # the system still needs to use IPv4 addresses to pass that traffic. 
+  # By default, they are randomly chosen out of 169.254.0.0/16 at startup, but if you need them to be static, you can set them here.
+  # Setting these options is not required for use of the 4over6 feature.
+  # this is the address that a client will use as a source IP for packets sent to the router
+  #unsafe_origin_address_for_4over6: 169.254.55.96
+  # this is the IP the router will use internally to hairpin-NAT 4over6 traffic before it hits the operating system.
+  #snat_address_for_4over6: 169.254.12.34
 
 # Configure logging level
 logging:
-  # trace, debug, info, warn, or error. Default is info and is reloadable.
-  # fatal and panic are accepted for backwards compatibility and map to error.
-  #NOTE: Debug and trace modes can log remotely controlled/untrusted data which can quickly fill a disk in some
-  # scenarios. Debug and trace logging are also CPU intensive and will decrease performance overall.
-  # Only enable debug or trace logging while actively investigating an issue.
+  # panic, fatal, error, warning, info, or debug. Default is info and is reloadable.
+  #NOTE: Debug mode can log remotely controlled/untrusted data which can quickly fill a disk in some
+  # scenarios. Debug logging is also CPU intensive and will decrease performance overall.
+  # Only enable debug logging while actively investigating an issue.
   level: info
-  # json or text formats currently available. Default is text.
+  # json or text formats currently available. Default is text
   format: text
-  # Disable timestamp logging. Useful when output is redirected to a logging system that already adds timestamps. Default is false.
+  # Disable timestamp logging. useful when output is redirected to logging system that already adds timestamps. Default is false
   #disable_timestamp: true
-  # Timestamps use RFC3339Nano ("2006-01-02T15:04:05.999999999Z07:00") and are not configurable.
+  # timestamp format is specified in Go time format, see:
+  #     https://golang.org/pkg/time/#pkg-constants
+  # default when `format: json`: "2006-01-02T15:04:05Z07:00" (RFC3339)
+  # default when `format: text`:
+  #     when TTY attached: seconds since beginning of execution
+  #     otherwise: "2006-01-02T15:04:05Z07:00" (RFC3339)
+  # As an example, to log as RFC3339 with millisecond precision, set to:
+  #timestamp_format: "2006-01-02T15:04:05.000Z07:00"
 
-# The stats section is reloadable. A HUP may change the backend, toggle stats
-# on or off, switch the listen/host address, or pick up new DNS for the
-# configured graphite host.
 #stats:
   #type: graphite
   #prefix: nebula
@@ -324,12 +330,10 @@ logging:
   # enables counter metrics for meta packets
   #   e.g.: `messages.tx.handshake`
   # NOTE: `message.{tx,rx}.recv_error` is always emitted
-  # Not reloadable.
   #message_metrics: false
 
   # enables detailed counter metrics for lighthouse packets
   #   e.g.: `lighthouse.rx.HostQuery`
-  # Not reloadable.
   #lighthouse_metrics: false
 
 # Handshake Manager Settings

examples/go_service/main.go

@@ -7,9 +7,9 @@ import (
 	"net"
 	"os"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/logging"
 	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/service"
 )
@@ -64,7 +64,8 @@ pki:
 		return err
 	}
 
-	logger := logging.NewLogger(os.Stdout)
+	logger := logrus.New()
+	logger.Out = os.Stdout
 
 	ctrl, err := nebula.Main(&cfg, false, "custom-app", logger, overlay.NewUserDeviceFromConfig)
 	if err != nil {

firewall.go

@@ -1,13 +1,12 @@
 package nebula
 
 import (
-	"context"
 	"crypto/sha256"
+	"encoding/binary"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"hash/fnv"
-	"log/slog"
 	"net/netip"
 	"reflect"
 	"slices"
@@ -18,15 +17,41 @@ import (
 
 	"github.com/gaissmai/bart"
 	"github.com/rcrowley/go-metrics"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/firewall"
 )
 
+var ErrCannotSNAT = errors.New("cannot SNAT this packet")
+var ErrSNATIdentityMismatch = errors.New("refusing to SNAT for mismatched host")
+var ErrSNATAddressCollision = errors.New("refusing to accept an incoming packet with my SNAT address")
+
+const ipv4SourcePosition = 12
+const ipv4DestinationPosition = 16
+const sourcePortOffset = 0
+const destinationPortOffset = 2
+
 type FirewallInterface interface {
 	AddRule(incoming bool, proto uint8, startPort int32, endPort int32, groups []string, host string, cidr, localCidr string, caName string, caSha string) error
 }
 
+type snatInfo struct {
+	//Src is the source IP+port to write into unsafe-route-bound packet
+	Src netip.AddrPort
+	//SrcVpnIp is the overlay IP associated with this flow. It's needed to associate reply traffic so we can get it back to the right host.
+	SrcVpnIp netip.Addr
+	//SnatPort is the port to rewrite into an overlay-bound packet
+	SnatPort uint16
+}
+
+func (s *snatInfo) Valid() bool {
+	if s == nil {
+		return false
+	}
+	return s.Src.IsValid()
+}
+
 type conn struct {
 	Expires time.Time // Time when this conntrack entry will expire
 
@@ -35,6 +60,9 @@ type conn struct {
 	// fields pack for free after the uint32 above
 	incoming     bool
 	rulesVersion uint16
+
+	//for SNAT support
+	snat *snatInfo
 }
 
 // TODO: need conntrack max tracked connections handling
@@ -67,8 +95,10 @@ type Firewall struct {
 	defaultLocalCIDRAny bool
 	incomingMetrics     firewallMetrics
 	outgoingMetrics     firewallMetrics
+	unsafeIPv4Origin    netip.Addr
+	snatAddr            netip.Addr
 
-	l *slog.Logger
+	l *logrus.Logger
 }
 
 type firewallMetrics struct {
@@ -132,7 +162,7 @@ type firewallLocalCIDR struct {
 
 // NewFirewall creates a new Firewall object. A TimerWheel is created for you from the provided timeouts.
 // The certificate provided should be the highest version loaded in memory.
-func NewFirewall(l *slog.Logger, tcpTimeout, UDPTimeout, defaultTimeout time.Duration, c cert.Certificate) *Firewall {
+func NewFirewall(l *logrus.Logger, tcpTimeout, UDPTimeout, defaultTimeout time.Duration, c cert.Certificate) *Firewall {
 	//TODO: error on 0 duration
 	var tmin, tmax time.Duration
 
@@ -192,14 +222,14 @@ func NewFirewall(l *slog.Logger, tcpTimeout, UDPTimeout, defaultTimeout time.Dur
 	}
 }
 
-func NewFirewallFromConfig(l *slog.Logger, cs *CertState, c *config.C) (*Firewall, error) {
+func NewFirewallFromConfig(l *logrus.Logger, cs *CertState, c *config.C) (*Firewall, error) {
 	certificate := cs.getCertificate(cert.Version2)
-	if certificate == nil {
+	if certificate == nil { //todo if config.initiating_version is set to 1, and unsafe_networks differ, things will suck
 		certificate = cs.getCertificate(cert.Version1)
 	}
 
 	if certificate == nil {
-		panic("No certificate available to reconfigure the firewall")
+		return nil, errors.New("no certificate available to reconfigure the firewall")
 	}
 
 	fw := NewFirewall(
@@ -208,7 +238,6 @@ func NewFirewallFromConfig(l *slog.Logger, cs *CertState, c *config.C) (*Firewal
 		c.GetDuration("firewall.conntrack.udp_timeout", time.Minute*3),
 		c.GetDuration("firewall.conntrack.default_timeout", time.Minute*10),
 		certificate,
-		//TODO: max_connections
 	)
 
 	fw.defaultLocalCIDRAny = c.GetBool("firewall.default_local_cidr_any", false)
@@ -220,7 +249,7 @@ func NewFirewallFromConfig(l *slog.Logger, cs *CertState, c *config.C) (*Firewal
 	case "drop":
 		fw.InSendReject = false
 	default:
-		l.Warn("invalid firewall.inbound_action, defaulting to `drop`", "action", inboundAction)
+		l.WithField("action", inboundAction).Warn("invalid firewall.inbound_action, defaulting to `drop`")
 		fw.InSendReject = false
 	}
 
@@ -231,7 +260,7 @@ func NewFirewallFromConfig(l *slog.Logger, cs *CertState, c *config.C) (*Firewal
 	case "drop":
 		fw.OutSendReject = false
 	default:
-		l.Warn("invalid firewall.outbound_action, defaulting to `drop`", "action", outboundAction)
+		l.WithField("action", inboundAction).Warn("invalid firewall.outbound_action, defaulting to `drop`")
 		fw.OutSendReject = false
 	}
 
@@ -269,7 +298,7 @@ func (f *Firewall) AddRule(incoming bool, proto uint8, startPort int32, endPort
 	case firewall.ProtoICMP, firewall.ProtoICMPv6:
 		//ICMP traffic doesn't have ports, so we always coerce to "any", even if a value is provided
 		if startPort != firewall.PortAny {
-			f.l.Warn("ignoring port specification for ICMP firewall rule", "startPort", startPort)
+			f.l.WithField("startPort", startPort).Warn("ignoring port specification for ICMP firewall rule")
 		}
 		startPort = firewall.PortAny
 		endPort = firewall.PortAny
@@ -291,9 +320,8 @@ func (f *Firewall) AddRule(incoming bool, proto uint8, startPort int32, endPort
 	if !incoming {
 		direction = "outgoing"
 	}
-	f.l.Info("Firewall rule added",
-		"firewallRule", m{"direction": direction, "proto": proto, "startPort": startPort, "endPort": endPort, "groups": groups, "host": host, "cidr": cidr, "localCidr": localCidr, "caName": caName, "caSha": caSha},
-	)
+	f.l.WithField("firewallRule", m{"direction": direction, "proto": proto, "startPort": startPort, "endPort": endPort, "groups": groups, "host": host, "cidr": cidr, "localCidr": localCidr, "caName": caName, "caSha": caSha}).
+		Info("Firewall rule added")
 
 	return fp.addRule(f, startPort, endPort, groups, host, cidr, localCidr, caName, caSha)
 }
@@ -316,7 +344,19 @@ func (f *Firewall) GetRuleHashes() string {
 	return "SHA:" + f.GetRuleHash() + ",FNV:" + strconv.FormatUint(uint64(f.GetRuleHashFNV()), 10)
 }
 
-func AddFirewallRulesFromConfig(l *slog.Logger, inbound bool, c *config.C, fw FirewallInterface) error {
+func (f *Firewall) SetSNATAddressFromInterface(i *Interface) {
+	//address-mutation-avoidance is done inside Interface, the firewall doesn't need to care
+	//todo should snatted conntracks get expired out? Probably not needed until if/when we allow reload
+	f.snatAddr = i.inside.SNATAddress().Addr()
+	f.unsafeIPv4Origin = i.inside.UnsafeIPv4OriginAddress().Addr()
+}
+
+func (f *Firewall) ShouldUnSNAT(fp *firewall.Packet) bool {
+	// f.snatAddr is only valid if we're a snat-capable router
+	return f.snatAddr.IsValid() && fp.RemoteAddr == f.snatAddr
+}
+
+func AddFirewallRulesFromConfig(l *logrus.Logger, inbound bool, c *config.C, fw FirewallInterface) error {
 	var table string
 	if inbound {
 		table = "firewall.inbound"
@@ -374,7 +414,7 @@ func AddFirewallRulesFromConfig(l *slog.Logger, inbound bool, c *config.C, fw Fi
 			startPort = firewall.PortAny
 			endPort = firewall.PortAny
 			if sPort != "" {
-				l.Warn("ignoring port specification for ICMP firewall rule", "port", sPort)
+				l.WithField("port", sPort).Warn("ignoring port specification for ICMP firewall rule")
 			}
 		default:
 			return fmt.Errorf("%s rule #%v; proto was not understood; `%s`", table, i, r.Proto)
@@ -398,11 +438,7 @@ func AddFirewallRulesFromConfig(l *slog.Logger, inbound bool, c *config.C, fw Fi
 		}
 
 		if warning := r.sanity(); warning != nil {
-			l.Warn("firewall rule sanity check",
-				"table", table,
-				"rule", i,
-				"warning", warning,
-			)
+			l.Warnf("%s rule #%v; %s", table, i, warning)
 		}
 
 		err = fw.AddRule(inbound, proto, startPort, endPort, r.Groups, r.Host, r.Cidr, r.LocalCidr, r.CAName, r.CASha)
@@ -420,50 +456,207 @@ var ErrInvalidRemoteIP = errors.New("remote address is not in remote certificate
 var ErrInvalidLocalIP = errors.New("local address is not in list of handled local addresses")
 var ErrNoMatchingRule = errors.New("no matching rule in firewall table")
 
+func (f *Firewall) unSnat(data []byte, fp *firewall.Packet) netip.Addr {
+	c := f.peek(*fp) //unfortunately this needs to lock. Surely there's a better way.
+	if c == nil {
+		return netip.Addr{}
+	}
+	if !c.snat.Valid() {
+		return netip.Addr{}
+	}
+	oldIP := netip.AddrPortFrom(f.snatAddr, fp.RemotePort)
+	rewritePacket(data, fp, oldIP, c.snat.Src, ipv4DestinationPosition, destinationPortOffset)
+	return c.snat.SrcVpnIp
+}
+
+func rewritePacket(data []byte, fp *firewall.Packet, oldIP netip.AddrPort, newIP netip.AddrPort, ipOffset int, portOffset int) {
+	//change address
+	copy(data[ipOffset:], newIP.Addr().AsSlice())
+	recalcIPv4Checksum(data, oldIP.Addr(), newIP.Addr())
+	ipHeaderLen := int(data[0]&0x0F) * 4
+
+	switch fp.Protocol {
+	case firewall.ProtoICMP:
+		binary.BigEndian.PutUint16(data[ipHeaderLen+4:ipHeaderLen+6], newIP.Port()) //we use the ID field as a "port" for ICMP
+		icmpCode := uint16(data[ipHeaderLen+1])                                     //todo not snatting on code yet (but Linux would)
+		recalcICMPv4Checksum(data, icmpCode, icmpCode, oldIP.Port(), newIP.Port())
+	case firewall.ProtoUDP:
+		dstport := ipHeaderLen + portOffset
+		binary.BigEndian.PutUint16(data[dstport:dstport+2], newIP.Port())
+		recalcUDPv4Checksum(data, oldIP, newIP)
+	case firewall.ProtoTCP:
+		dstport := ipHeaderLen + portOffset
+		binary.BigEndian.PutUint16(data[dstport:dstport+2], newIP.Port())
+		recalcTCPv4Checksum(data, oldIP, newIP)
+	}
+}
+
+func (f *Firewall) findUsableSNATPort(fp *firewall.Packet, c *conn) error {
+	const halfThePorts = 0x7fff
+	oldPort := fp.RemotePort
+	conntrack := f.Conntrack
+	conntrack.Lock()
+	defer conntrack.Unlock()
+	for numPortsChecked := 0; numPortsChecked < halfThePorts; numPortsChecked++ {
+		_, ok := conntrack.Conns[*fp]
+		if !ok {
+			//yay, we can use this port
+			//track the snatted flow with the same expiration as the unsnatted version
+			c.snat.SnatPort = fp.RemotePort
+			conntrack.Conns[*fp] = c
+			return nil
+		}
+		//increment and retry. There's probably better strategies out there
+		fp.RemotePort++
+		if fp.RemotePort < halfThePorts {
+			fp.RemotePort += halfThePorts // keep it ephemeral for now
+		}
+	}
+
+	//if we made it here, we failed
+	fp.RemotePort = oldPort
+	return ErrCannotSNAT
+}
+
+func (f *Firewall) applySnat(data []byte, fp *firewall.Packet, c *conn, hostinfo *HostInfo) error {
+	if !f.snatAddr.IsValid() {
+		return ErrCannotSNAT
+	}
+	if f.snatAddr == fp.LocalAddr { //a packet that came from UDP (incoming) should never ever have our snat address on it
+		return ErrSNATAddressCollision
+	}
+	if c.snat.Valid() {
+		//old flow: make sure it came from the right place
+		if !slices.Contains(hostinfo.vpnAddrs, c.snat.SrcVpnIp) {
+			return ErrSNATIdentityMismatch
+		}
+		fp.RemoteAddr = f.snatAddr
+		fp.RemotePort = c.snat.SnatPort
+	} else if hostinfo.vpnAddrs[0].Is6() {
+		//we got a new flow
+		c.snat = &snatInfo{
+			Src:      netip.AddrPortFrom(fp.RemoteAddr, fp.RemotePort),
+			SrcVpnIp: hostinfo.vpnAddrs[0],
+		}
+		fp.RemoteAddr = f.snatAddr
+		//find a new port to use, if needed
+		err := f.findUsableSNATPort(fp, c)
+		if err != nil {
+			c.snat = nil
+			return err
+		}
+	} else {
+		return ErrCannotSNAT
+	}
+
+	newIP := netip.AddrPortFrom(f.snatAddr, c.snat.SnatPort)
+	rewritePacket(data, fp, c.snat.Src, newIP, ipv4SourcePosition, sourcePortOffset)
+	return nil
+}
+
+func (f *Firewall) identifyRemoteNetworkType(h *HostInfo, fp firewall.Packet) NetworkType {
+	if h.networks == nil {
+		// Simple case: Certificate has one address and no unsafe networks
+		if h.vpnAddrs[0] == fp.RemoteAddr {
+			return NetworkTypeVPN
+		} //else, fallthrough
+	} else if nwType, ok := h.networks.Lookup(fp.RemoteAddr); ok {
+		return nwType //will return NetworkTypeVPN or NetworkTypeUnsafe
+	}
+
+	//RemoteAddr not in our networks table
+	if f.snatAddr.IsValid() && fp.IsIPv4() && h.HasOnlyV6Addresses() {
+		return NetworkTypeUnverifiedSNATPeer
+	} else {
+		return NetworkTypeInvalidPeer
+	}
+}
+
+func (f *Firewall) allowRemoteNetworkType(nwType NetworkType, fp firewall.Packet) error {
+	switch nwType {
+	case NetworkTypeVPN:
+		return nil
+	case NetworkTypeInvalidPeer:
+		return ErrInvalidRemoteIP
+	case NetworkTypeVPNPeer:
+		//one day we might need a specialSnatMode case in here to handle routers with v4 addresses when we don't also have a v4 address?
+		return ErrPeerRejected // reject for now, one day this may have different FW rules
+	case NetworkTypeUnsafe:
+		return nil // nothing special, one day this may have different FW rules
+	case NetworkTypeUnverifiedSNATPeer:
+		if f.unsafeIPv4Origin.IsValid() && fp.LocalAddr == f.unsafeIPv4Origin {
+			return nil //the client case
+		}
+		if f.snatAddr.IsValid() {
+			if fp.RemoteAddr == f.snatAddr {
+				return ErrInvalidRemoteIP //we should never get a packet with our SNAT addr as the destination, or "from" our SNAT addr
+			}
+			return nil
+		} else {
+			return ErrInvalidRemoteIP
+		}
+	default:
+		return ErrUnknownNetworkType //should never happen
+	}
+}
+
+func (f *Firewall) willingToHandleLocalAddr(incoming bool, fp firewall.Packet, remoteNwType NetworkType) error {
+	if f.routableNetworks.Contains(fp.LocalAddr) {
+		return nil //easy, this should handle NetworkTypeVPN in all cases, and NetworkTypeUnsafe on the router side
+	}
+	if incoming { //at least for now, reject all traffic other than what we've already decided is locally routable
+		return ErrInvalidLocalIP
+	}
+
+	//below this line, all traffic is outgoing. Outgoing traffic to NetworkTypeUnsafe is not required to be considered inbound-routable
+	if remoteNwType == NetworkTypeUnsafe {
+		return nil
+	}
+
+	return ErrInvalidLocalIP
+}
+
 // Drop returns an error if the packet should be dropped, explaining why. It
 // returns nil if the packet should not be dropped.
-func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {
+func (f *Firewall) Drop(fp firewall.Packet, pkt []byte, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {
+	table := f.OutRules
+	if incoming {
+		table = f.InRules
+	}
+
+	snatmode := fp.IsIPv4() && h.HasOnlyV6Addresses() && f.snatAddr.IsValid()
+	if snatmode {
+		//if this is an IPv4 packet from a V6 only host, and we're configured to snat that kind of traffic, it must be snatted,
+		//so it can never be in the localcache, which lacks SNAT data
+		//nil out the pointer to avoid ever using it
+		localCache = nil
+	}
+
 	// Check if we spoke to this tuple, if we did then allow this packet
-	if f.inConns(fp, h, caPool, localCache) {
+	if localCache != nil {
+		if _, ok := localCache[fp]; ok {
+			return nil //packet matched the cache, we're not snatting, we can return early
+		}
+	}
+	c := f.inConns(fp, h, caPool, localCache)
+	if c != nil {
+		if incoming && snatmode {
+			return f.applySnat(pkt, &fp, c, h)
+		}
 		return nil
 	}
 
 	// Make sure remote address matches nebula certificate, and determine how to treat it
-	if h.networks == nil {
-		// Simple case: Certificate has one address and no unsafe networks
-		if h.vpnAddrs[0] != fp.RemoteAddr {
-			f.metrics(incoming).droppedRemoteAddr.Inc(1)
-			return ErrInvalidRemoteIP
-		}
-	} else {
-		nwType, ok := h.networks.Lookup(fp.RemoteAddr)
-		if !ok {
-			f.metrics(incoming).droppedRemoteAddr.Inc(1)
-			return ErrInvalidRemoteIP
-		}
-		switch nwType {
-		case NetworkTypeVPN:
-			break // nothing special
-		case NetworkTypeVPNPeer:
-			f.metrics(incoming).droppedRemoteAddr.Inc(1)
-			return ErrPeerRejected // reject for now, one day this may have different FW rules
-		case NetworkTypeUnsafe:
-			break // nothing special, one day this may have different FW rules
-		default:
-			f.metrics(incoming).droppedRemoteAddr.Inc(1)
-			return ErrUnknownNetworkType //should never happen
-		}
+	remoteNetworkType := f.identifyRemoteNetworkType(h, fp)
+	if err := f.allowRemoteNetworkType(remoteNetworkType, fp); err != nil {
+		f.metrics(incoming).droppedRemoteAddr.Inc(1)
+		return err
 	}
 
 	// Make sure we are supposed to be handling this local ip address
-	if !f.routableNetworks.Contains(fp.LocalAddr) {
+	if err := f.willingToHandleLocalAddr(incoming, fp, remoteNetworkType); err != nil {
 		f.metrics(incoming).droppedLocalAddr.Inc(1)
-		return ErrInvalidLocalIP
-	}
-
-	table := f.OutRules
-	if incoming {
-		table = f.InRules
+		return err
 	}
 
 	// We now know which firewall table to check against
@@ -473,9 +666,14 @@ func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *
 	}
 
 	// We always want to conntrack since it is a faster operation
-	f.addConn(fp, incoming)
+	c = f.addConn(fp, incoming)
 
-	return nil
+	if incoming && remoteNetworkType == NetworkTypeUnverifiedSNATPeer {
+		return f.applySnat(pkt, &fp, c, h)
+	} else {
+		//outgoing snat is handled before this function is called
+		return nil
+	}
 }
 
 func (f *Firewall) metrics(incoming bool) firewallMetrics {
@@ -502,12 +700,14 @@ func (f *Firewall) EmitStats() {
 	metrics.GetOrRegisterGauge("firewall.rules.hash", nil).Update(int64(f.GetRuleHashFNV()))
 }
 
-func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) bool {
-	if localCache != nil {
-		if _, ok := localCache[fp]; ok {
-			return true
-		}
-	}
+func (f *Firewall) peek(fp firewall.Packet) *conn {
+	f.Conntrack.Lock()
+	c := f.Conntrack.Conns[fp]
+	f.Conntrack.Unlock()
+	return c
+}
+
+func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) *conn {
 	conntrack := f.Conntrack
 	conntrack.Lock()
 
@@ -521,7 +721,7 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 
 	if !ok {
 		conntrack.Unlock()
-		return false
+		return nil
 	}
 
 	if c.rulesVersion != f.rulesVersion {
@@ -534,26 +734,26 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 
 		// We now know which firewall table to check against
 		if !table.match(fp, c.incoming, h.ConnectionState.peerCert, caPool) {
-			if f.l.Enabled(context.Background(), slog.LevelDebug) {
-				h.logger(f.l).Debug("dropping old conntrack entry, does not match new ruleset",
-					"fwPacket", fp,
-					"incoming", c.incoming,
-					"rulesVersion", f.rulesVersion,
-					"oldRulesVersion", c.rulesVersion,
-				)
+			if f.l.Level >= logrus.DebugLevel {
+				h.logger(f.l).
+					WithField("fwPacket", fp).
+					WithField("incoming", c.incoming).
+					WithField("rulesVersion", f.rulesVersion).
+					WithField("oldRulesVersion", c.rulesVersion).
+					Debugln("dropping old conntrack entry, does not match new ruleset")
 			}
 			delete(conntrack.Conns, fp)
 			conntrack.Unlock()
-			return false
+			return nil
 		}
 
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			h.logger(f.l).Debug("keeping old conntrack entry, does match new ruleset",
-				"fwPacket", fp,
-				"incoming", c.incoming,
-				"rulesVersion", f.rulesVersion,
-				"oldRulesVersion", c.rulesVersion,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			h.logger(f.l).
+				WithField("fwPacket", fp).
+				WithField("incoming", c.incoming).
+				WithField("rulesVersion", f.rulesVersion).
+				WithField("oldRulesVersion", c.rulesVersion).
+				Debugln("keeping old conntrack entry, does match new ruleset")
 		}
 
 		c.rulesVersion = f.rulesVersion
@@ -574,12 +774,11 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 		localCache[fp] = struct{}{}
 	}
 
-	return true
+	return c
 }
 
-func (f *Firewall) addConn(fp firewall.Packet, incoming bool) {
+func (f *Firewall) packetTimeout(fp firewall.Packet) time.Duration {
 	var timeout time.Duration
-	c := &conn{}
 
 	switch fp.Protocol {
 	case firewall.ProtoTCP:
@@ -589,7 +788,13 @@ func (f *Firewall) addConn(fp firewall.Packet, incoming bool) {
 	default:
 		timeout = f.DefaultTimeout
 	}
+	return timeout
+}
 
+func (f *Firewall) addConn(fp firewall.Packet, incoming bool) *conn {
+	c := &conn{}
+
+	timeout := f.packetTimeout(fp)
 	conntrack := f.Conntrack
 	conntrack.Lock()
 	if _, ok := conntrack.Conns[fp]; !ok {
@@ -603,7 +808,9 @@ func (f *Firewall) addConn(fp firewall.Packet, incoming bool) {
 	c.rulesVersion = f.rulesVersion
 	c.Expires = time.Now().Add(timeout)
 	conntrack.Conns[fp] = c
+
 	conntrack.Unlock()
+	return c
 }
 
 // Evict checks if a conntrack entry has expired, if so it is removed, if not it is re-added to the wheel
@@ -941,7 +1148,7 @@ type rule struct {
 	CASha     string
 }
 
-func convertRule(l *slog.Logger, p any, table string, i int) (rule, error) {
+func convertRule(l *logrus.Logger, p any, table string, i int) (rule, error) {
 	r := rule{}
 
 	m, ok := p.(map[string]any)
@@ -972,10 +1179,7 @@ func convertRule(l *slog.Logger, p any, table string, i int) (rule, error) {
 			return r, errors.New("group should contain a single value, an array with more than one entry was provided")
 		}
 
-		l.Warn("group was an array with a single value, converting to simple value",
-			"table", table,
-			"rule", i,
-		)
+		l.Warnf("%s rule #%v; group was an array with a single value, converting to simple value", table, i)
 		m["group"] = v[0]
 	}
 

firewall/cache.go

@@ -1,10 +1,10 @@
 package firewall
 
 import (
-	"context"
-	"log/slog"
 	"sync/atomic"
 	"time"
+
+	"github.com/sirupsen/logrus"
 )
 
 // ConntrackCache is used as a local routine cache to know if a given flow
@@ -15,49 +15,41 @@ type ConntrackCacheTicker struct {
 	cacheV    uint64
 	cacheTick atomic.Uint64
 
-	l     *slog.Logger
 	cache ConntrackCache
 }
 
-func NewConntrackCacheTicker(ctx context.Context, l *slog.Logger, d time.Duration) *ConntrackCacheTicker {
+func NewConntrackCacheTicker(d time.Duration) *ConntrackCacheTicker {
 	if d == 0 {
 		return nil
 	}
 
 	c := &ConntrackCacheTicker{
-		l:     l,
 		cache: ConntrackCache{},
 	}
 
-	go c.tick(ctx, d)
+	go c.tick(d)
 
 	return c
 }
 
-func (c *ConntrackCacheTicker) tick(ctx context.Context, d time.Duration) {
-	t := time.NewTicker(d)
-	defer t.Stop()
+func (c *ConntrackCacheTicker) tick(d time.Duration) {
 	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			c.cacheTick.Add(1)
-		}
+		time.Sleep(d)
+		c.cacheTick.Add(1)
 	}
 }
 
 // Get checks if the cache ticker has moved to the next version before returning
 // the map. If it has moved, we reset the map.
-func (c *ConntrackCacheTicker) Get() ConntrackCache {
+func (c *ConntrackCacheTicker) Get(l *logrus.Logger) ConntrackCache {
 	if c == nil {
 		return nil
 	}
 	if tick := c.cacheTick.Load(); tick != c.cacheV {
 		c.cacheV = tick
 		if ll := len(c.cache); ll > 0 {
-			if c.l.Enabled(context.Background(), slog.LevelDebug) {
-				c.l.Debug("resetting conntrack cache", "len", ll)
+			if l.Level == logrus.DebugLevel {
+				l.WithField("len", ll).Debug("resetting conntrack cache")
 			}
 			c.cache = make(ConntrackCache, ll)
 		}

firewall/cache_test.go

@@ -1,69 +0,0 @@
-package firewall
-
-import (
-	"bytes"
-	"log/slog"
-	"strings"
-	"testing"
-
-	"github.com/slackhq/nebula/test"
-	"github.com/stretchr/testify/assert"
-)
-
-// The tests below pin the log format produced by ConntrackCacheTicker.Get
-// so changes cannot silently break what operators are grepping for. The
-// ticker's internal state (cache + cacheTick) is poked directly to avoid
-// racing a goroutine-driven tick in tests.
-
-func newFixedTicker(t *testing.T, l *slog.Logger, cacheLen int) *ConntrackCacheTicker {
-	t.Helper()
-	c := &ConntrackCacheTicker{
-		l:     l,
-		cache: make(ConntrackCache, cacheLen),
-	}
-	for i := 0; i < cacheLen; i++ {
-		c.cache[Packet{LocalPort: uint16(i) + 1}] = struct{}{}
-	}
-	c.cacheTick.Store(1) // cacheV starts at 0, so Get() takes the reset path
-	return c
-}
-
-func TestConntrackCacheTicker_Get_TextFormat(t *testing.T) {
-	buf := &bytes.Buffer{}
-	l := test.NewLoggerWithOutputAndLevel(buf, slog.LevelDebug)
-
-	c := newFixedTicker(t, l, 3)
-	c.Get()
-
-	assert.Equal(t, "level=DEBUG msg=\"resetting conntrack cache\" len=3\n", buf.String())
-}
-
-func TestConntrackCacheTicker_Get_JSONFormat(t *testing.T) {
-	buf := &bytes.Buffer{}
-	l := test.NewJSONLoggerWithOutput(buf, slog.LevelDebug)
-
-	c := newFixedTicker(t, l, 2)
-	c.Get()
-
-	assert.JSONEq(t, `{"level":"DEBUG","msg":"resetting conntrack cache","len":2}`, strings.TrimSpace(buf.String()))
-}
-
-func TestConntrackCacheTicker_Get_QuietBelowDebug(t *testing.T) {
-	buf := &bytes.Buffer{}
-	l := test.NewLoggerWithOutputAndLevel(buf, slog.LevelInfo)
-
-	c := newFixedTicker(t, l, 5)
-	c.Get()
-
-	assert.Empty(t, buf.String())
-}
-
-func TestConntrackCacheTicker_Get_QuietWhenCacheEmpty(t *testing.T) {
-	buf := &bytes.Buffer{}
-	l := test.NewLoggerWithOutputAndLevel(buf, slog.LevelDebug)
-
-	c := newFixedTicker(t, l, 0)
-	c.Get()
-
-	assert.Empty(t, buf.String())
-}

firewall/packet.go

@@ -31,6 +31,10 @@ type Packet struct {
 	Fragment   bool
 }
 
+func (fp *Packet) IsIPv4() bool {
+	return fp.LocalAddr.Is4() && fp.RemoteAddr.Is4()
+}
+
 func (fp *Packet) Copy() *Packet {
 	return &Packet{
 		LocalAddr:  fp.LocalAddr,

firewall_test.go

@@ -3,13 +3,13 @@ package nebula
 import (
 	"bytes"
 	"errors"
-	"log/slog"
 	"math"
 	"net/netip"
 	"testing"
 	"time"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/firewall"
@@ -58,8 +58,9 @@ func TestNewFirewall(t *testing.T) {
 }
 
 func TestFirewall_AddRule(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 
 	c := &dummyCert{}
 	fw := NewFirewall(l, time.Second, time.Minute, time.Hour, c)
@@ -176,8 +177,9 @@ func TestFirewall_AddRule(t *testing.T) {
 }
 
 func TestFirewall_Drop(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("1.1.1.1/8"))
 	p := firewall.Packet{
@@ -211,49 +213,50 @@ func TestFirewall_Drop(t *testing.T) {
 	cp := cert.NewCAPool()
 
 	// Drop outbound
-	assert.Equal(t, ErrNoMatchingRule, fw.Drop(p, false, &h, cp, nil))
+	assert.Equal(t, ErrNoMatchingRule, fw.Drop(p, nil, false, &h, cp, nil))
 	// Allow inbound
 	resetConntrack(fw)
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 	// Allow outbound because conntrack
-	require.NoError(t, fw.Drop(p, false, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, false, &h, cp, nil))
 
 	// test remote mismatch
 	oldRemote := p.RemoteAddr
 	p.RemoteAddr = netip.MustParseAddr("1.2.3.10")
-	assert.Equal(t, fw.Drop(p, false, &h, cp, nil), ErrInvalidRemoteIP)
+	assert.Equal(t, fw.Drop(p, nil, false, &h, cp, nil), ErrInvalidRemoteIP)
 	p.RemoteAddr = oldRemote
 
 	// ensure signer doesn't get in the way of group checks
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "", "signer-shasum"))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "", "signer-shasum-bad"))
-	assert.Equal(t, fw.Drop(p, true, &h, cp, nil), ErrNoMatchingRule)
+	assert.Equal(t, fw.Drop(p, nil, true, &h, cp, nil), ErrNoMatchingRule)
 
 	// test caSha doesn't drop on match
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "", "signer-shasum-bad"))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "", "signer-shasum"))
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 
 	// ensure ca name doesn't get in the way of group checks
 	cp.CAs["signer-shasum"] = &cert.CachedCertificate{Certificate: &dummyCert{name: "ca-good"}}
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "ca-good", ""))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "ca-good-bad", ""))
-	assert.Equal(t, fw.Drop(p, true, &h, cp, nil), ErrNoMatchingRule)
+	assert.Equal(t, fw.Drop(p, nil, true, &h, cp, nil), ErrNoMatchingRule)
 
 	// test caName doesn't drop on match
 	cp.CAs["signer-shasum"] = &cert.CachedCertificate{Certificate: &dummyCert{name: "ca-good"}}
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "ca-good-bad", ""))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "ca-good", ""))
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 }
 
 func TestFirewall_DropV6(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("fd00::/7"))
@@ -289,44 +292,44 @@ func TestFirewall_DropV6(t *testing.T) {
 	cp := cert.NewCAPool()
 
 	// Drop outbound
-	assert.Equal(t, ErrNoMatchingRule, fw.Drop(p, false, &h, cp, nil))
+	assert.Equal(t, ErrNoMatchingRule, fw.Drop(p, nil, false, &h, cp, nil))
 	// Allow inbound
 	resetConntrack(fw)
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 	// Allow outbound because conntrack
-	require.NoError(t, fw.Drop(p, false, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, false, &h, cp, nil))
 
 	// test remote mismatch
 	oldRemote := p.RemoteAddr
 	p.RemoteAddr = netip.MustParseAddr("fd12::56")
-	assert.Equal(t, fw.Drop(p, false, &h, cp, nil), ErrInvalidRemoteIP)
+	assert.Equal(t, fw.Drop(p, nil, false, &h, cp, nil), ErrInvalidRemoteIP)
 	p.RemoteAddr = oldRemote
 
 	// ensure signer doesn't get in the way of group checks
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "", "signer-shasum"))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "", "signer-shasum-bad"))
-	assert.Equal(t, fw.Drop(p, true, &h, cp, nil), ErrNoMatchingRule)
+	assert.Equal(t, fw.Drop(p, nil, true, &h, cp, nil), ErrNoMatchingRule)
 
 	// test caSha doesn't drop on match
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "", "signer-shasum-bad"))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "", "signer-shasum"))
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 
 	// ensure ca name doesn't get in the way of group checks
 	cp.CAs["signer-shasum"] = &cert.CachedCertificate{Certificate: &dummyCert{name: "ca-good"}}
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "ca-good", ""))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "ca-good-bad", ""))
-	assert.Equal(t, fw.Drop(p, true, &h, cp, nil), ErrNoMatchingRule)
+	assert.Equal(t, fw.Drop(p, nil, true, &h, cp, nil), ErrNoMatchingRule)
 
 	// test caName doesn't drop on match
 	cp.CAs["signer-shasum"] = &cert.CachedCertificate{Certificate: &dummyCert{name: "ca-good"}}
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, &c)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"nope"}, "", "", "", "ca-good-bad", ""))
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"default-group"}, "", "", "", "ca-good", ""))
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 }
 
 func BenchmarkFirewallTable_match(b *testing.B) {
@@ -482,8 +485,9 @@ func BenchmarkFirewallTable_match(b *testing.B) {
 }
 
 func TestFirewall_Drop2(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("1.1.1.1/8"))
 
@@ -533,15 +537,16 @@ func TestFirewall_Drop2(t *testing.T) {
 	cp := cert.NewCAPool()
 
 	// h1/c1 lacks the proper groups
-	require.ErrorIs(t, fw.Drop(p, true, &h1, cp, nil), ErrNoMatchingRule)
+	require.ErrorIs(t, fw.Drop(p, nil, true, &h1, cp, nil), ErrNoMatchingRule)
 	// c has the proper groups
 	resetConntrack(fw)
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 }
 
 func TestFirewall_Drop3(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("1.1.1.1/8"))
 
@@ -613,23 +618,24 @@ func TestFirewall_Drop3(t *testing.T) {
 	cp := cert.NewCAPool()
 
 	// c1 should pass because host match
-	require.NoError(t, fw.Drop(p, true, &h1, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h1, cp, nil))
 	// c2 should pass because ca sha match
 	resetConntrack(fw)
-	require.NoError(t, fw.Drop(p, true, &h2, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h2, cp, nil))
 	// c3 should fail because no match
 	resetConntrack(fw)
-	assert.Equal(t, fw.Drop(p, true, &h3, cp, nil), ErrNoMatchingRule)
+	assert.Equal(t, fw.Drop(p, nil, true, &h3, cp, nil), ErrNoMatchingRule)
 
 	// Test a remote address match
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c.Certificate)
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 1, 1, []string{}, "", "1.2.3.4/24", "", "", ""))
-	require.NoError(t, fw.Drop(p, true, &h1, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h1, cp, nil))
 }
 
 func TestFirewall_Drop3V6(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("fd00::/7"))
 
@@ -661,12 +667,13 @@ func TestFirewall_Drop3V6(t *testing.T) {
 	fw := NewFirewall(l, time.Second, time.Minute, time.Hour, c.Certificate)
 	cp := cert.NewCAPool()
 	require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 1, 1, []string{}, "", "fd12::34/120", "", "", ""))
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 }
 
 func TestFirewall_DropConntrackReload(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("1.1.1.1/8"))
 
@@ -702,12 +709,12 @@ func TestFirewall_DropConntrackReload(t *testing.T) {
 	cp := cert.NewCAPool()
 
 	// Drop outbound
-	assert.Equal(t, fw.Drop(p, false, &h, cp, nil), ErrNoMatchingRule)
+	assert.Equal(t, fw.Drop(p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 	// Allow inbound
 	resetConntrack(fw)
-	require.NoError(t, fw.Drop(p, true, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, true, &h, cp, nil))
 	// Allow outbound because conntrack
-	require.NoError(t, fw.Drop(p, false, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, false, &h, cp, nil))
 
 	oldFw := fw
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c.Certificate)
@@ -716,7 +723,7 @@ func TestFirewall_DropConntrackReload(t *testing.T) {
 	fw.rulesVersion = oldFw.rulesVersion + 1
 
 	// Allow outbound because conntrack and new rules allow port 10
-	require.NoError(t, fw.Drop(p, false, &h, cp, nil))
+	require.NoError(t, fw.Drop(p, nil, false, &h, cp, nil))
 
 	oldFw = fw
 	fw = NewFirewall(l, time.Second, time.Minute, time.Hour, c.Certificate)
@@ -725,12 +732,13 @@ func TestFirewall_DropConntrackReload(t *testing.T) {
 	fw.rulesVersion = oldFw.rulesVersion + 1
 
 	// Drop outbound because conntrack doesn't match new ruleset
-	assert.Equal(t, fw.Drop(p, false, &h, cp, nil), ErrNoMatchingRule)
+	assert.Equal(t, fw.Drop(p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 }
 
 func TestFirewall_ICMPPortBehavior(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("1.1.1.1/8"))
 
@@ -770,12 +778,12 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 			p.LocalPort = 0
 			p.RemotePort = 0
 			// Drop outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 			// Allow inbound
 			resetConntrack(fw)
-			require.NoError(t, fw.Drop(*p, true, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, true, &h, cp, nil))
 			//now also allow outbound
-			require.NoError(t, fw.Drop(*p, false, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, false, &h, cp, nil))
 		})
 
 		t.Run("nonzero ports", func(t *testing.T) {
@@ -783,12 +791,12 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 			p.LocalPort = 0xabcd
 			p.RemotePort = 0x1234
 			// Drop outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 			// Allow inbound
 			resetConntrack(fw)
-			require.NoError(t, fw.Drop(*p, true, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, true, &h, cp, nil))
 			//now also allow outbound
-			require.NoError(t, fw.Drop(*p, false, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, false, &h, cp, nil))
 		})
 	})
 
@@ -800,12 +808,12 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 			p.LocalPort = 0
 			p.RemotePort = 0
 			// Drop outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 			// Allow inbound
 			resetConntrack(fw)
-			assert.Equal(t, fw.Drop(*p, true, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, true, &h, cp, nil), ErrNoMatchingRule)
 			//now also allow outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 		})
 
 		t.Run("nonzero ports, still blocked", func(t *testing.T) {
@@ -813,12 +821,12 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 			p.LocalPort = 0xabcd
 			p.RemotePort = 0x1234
 			// Drop outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 			// Allow inbound
 			resetConntrack(fw)
-			assert.Equal(t, fw.Drop(*p, true, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, true, &h, cp, nil), ErrNoMatchingRule)
 			//now also allow outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 		})
 
 		t.Run("nonzero, matching ports, still blocked", func(t *testing.T) {
@@ -826,12 +834,12 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 			p.LocalPort = 80
 			p.RemotePort = 80
 			// Drop outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 			// Allow inbound
 			resetConntrack(fw)
-			assert.Equal(t, fw.Drop(*p, true, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, true, &h, cp, nil), ErrNoMatchingRule)
 			//now also allow outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 		})
 	})
 	t.Run("Any proto, any port", func(t *testing.T) {
@@ -843,12 +851,12 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 			p.LocalPort = 0
 			p.RemotePort = 0
 			// Drop outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 			// Allow inbound
 			resetConntrack(fw)
-			require.NoError(t, fw.Drop(*p, true, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, true, &h, cp, nil))
 			//now also allow outbound
-			require.NoError(t, fw.Drop(*p, false, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, false, &h, cp, nil))
 		})
 
 		t.Run("nonzero ports, allowed", func(t *testing.T) {
@@ -857,23 +865,24 @@ func TestFirewall_ICMPPortBehavior(t *testing.T) {
 			p.LocalPort = 0xabcd
 			p.RemotePort = 0x1234
 			// Drop outbound
-			assert.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			assert.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 			// Allow inbound
 			resetConntrack(fw)
-			require.NoError(t, fw.Drop(*p, true, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, true, &h, cp, nil))
 			//now also allow outbound
-			require.NoError(t, fw.Drop(*p, false, &h, cp, nil))
+			require.NoError(t, fw.Drop(*p, nil, false, &h, cp, nil))
 			//different ID is blocked
 			p.RemotePort++
-			require.Equal(t, fw.Drop(*p, false, &h, cp, nil), ErrNoMatchingRule)
+			require.Equal(t, fw.Drop(*p, nil, false, &h, cp, nil), ErrNoMatchingRule)
 		})
 	})
 
 }
 
 func TestFirewall_DropIPSpoofing(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 	myVpnNetworksTable := new(bart.Lite)
 	myVpnNetworksTable.Insert(netip.MustParsePrefix("192.0.2.1/24"))
 
@@ -913,7 +922,7 @@ func TestFirewall_DropIPSpoofing(t *testing.T) {
 		Protocol:   firewall.ProtoUDP,
 		Fragment:   false,
 	}
-	assert.Equal(t, fw.Drop(p, true, &h1, cp, nil), ErrInvalidRemoteIP)
+	assert.Equal(t, fw.Drop(p, nil, true, &h1, cp, nil), ErrInvalidRemoteIP)
 }
 
 func BenchmarkLookup(b *testing.B) {
@@ -1033,28 +1042,28 @@ func TestNewFirewallFromConfig(t *testing.T) {
 	l := test.NewLogger()
 	// Test a bad rule definition
 	c := &dummyCert{}
-	cs, err := newCertState(cert.Version2, nil, c, false, cert.Curve_CURVE25519, nil, "aes")
+	cs, err := newCertState(l, cert.Version2, nil, c, false, cert.Curve_CURVE25519, nil)
 	require.NoError(t, err)
 
-	conf := config.NewC(test.NewLogger())
+	conf := config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"outbound": "asdf"}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.outbound failed to parse, should be an array of rules")
 
 	// Test both port and code
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"port": "1", "code": "2"}}}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.outbound rule #0; only one of port or code should be provided")
 
 	// Test missing host, group, cidr, ca_name and ca_sha
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{}}}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.outbound rule #0; at least one of host, group, cidr, local_cidr, ca_name, or ca_sha must be provided")
 
 	// Test code/port error
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"code": "a", "host": "testh", "proto": "any"}}}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.outbound rule #0; code was not a number; `a`")
@@ -1064,25 +1073,25 @@ func TestNewFirewallFromConfig(t *testing.T) {
 	require.EqualError(t, err, "firewall.outbound rule #0; port was not a number; `a`")
 
 	// Test proto error
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"code": "1", "host": "testh"}}}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.outbound rule #0; proto was not understood; ``")
 
 	// Test cidr parse error
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"code": "1", "cidr": "testh", "proto": "any"}}}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.outbound rule #0; cidr did not parse; netip.ParsePrefix(\"testh\"): no '/'")
 
 	// Test local_cidr parse error
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"code": "1", "local_cidr": "testh", "proto": "any"}}}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.outbound rule #0; local_cidr did not parse; netip.ParsePrefix(\"testh\"): no '/'")
 
 	// Test both group and groups
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "group": "a", "groups": []string{"b", "c"}}}}
 	_, err = NewFirewallFromConfig(l, cs, conf)
 	require.EqualError(t, err, "firewall.inbound rule #0; only one of group or groups should be defined, both provided")
@@ -1091,35 +1100,35 @@ func TestNewFirewallFromConfig(t *testing.T) {
 func TestAddFirewallRulesFromConfig(t *testing.T) {
 	l := test.NewLogger()
 	// Test adding tcp rule
-	conf := config.NewC(test.NewLogger())
+	conf := config.NewC(l)
 	mf := &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"port": "1", "proto": "tcp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoTCP, startPort: 1, endPort: 1, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
 
 	// Test adding udp rule
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"port": "1", "proto": "udp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoUDP, startPort: 1, endPort: 1, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
 
 	// Test adding icmp rule
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"port": "1", "proto": "icmp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoICMP, startPort: firewall.PortAny, endPort: firewall.PortAny, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
 
 	// Test adding icmp rule no port
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"outbound": []any{map[string]any{"proto": "icmp", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, false, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: false, proto: firewall.ProtoICMP, startPort: firewall.PortAny, endPort: firewall.PortAny, groups: nil, host: "a", ip: "", localIp: ""}, mf.lastCall)
 
 	// Test adding any rule
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "host": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
@@ -1127,14 +1136,14 @@ func TestAddFirewallRulesFromConfig(t *testing.T) {
 
 	// Test adding rule with cidr
 	cidr := netip.MustParsePrefix("10.0.0.0/8")
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "cidr": cidr.String()}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: nil, ip: cidr.String(), localIp: ""}, mf.lastCall)
 
 	// Test adding rule with local_cidr
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "local_cidr": cidr.String()}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
@@ -1142,82 +1151,82 @@ func TestAddFirewallRulesFromConfig(t *testing.T) {
 
 	// Test adding rule with cidr ipv6
 	cidr6 := netip.MustParsePrefix("fd00::/8")
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "cidr": cidr6.String()}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: nil, ip: cidr6.String(), localIp: ""}, mf.lastCall)
 
 	// Test adding rule with any cidr
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "cidr": "any"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: nil, ip: "any", localIp: ""}, mf.lastCall)
 
 	// Test adding rule with junk cidr
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "cidr": "junk/junk"}}}
 	require.EqualError(t, AddFirewallRulesFromConfig(l, true, conf, mf), "firewall.inbound rule #0; cidr did not parse; netip.ParsePrefix(\"junk/junk\"): ParseAddr(\"junk\"): unable to parse IP")
 
 	// Test adding rule with local_cidr ipv6
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "local_cidr": cidr6.String()}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: nil, ip: "", localIp: cidr6.String()}, mf.lastCall)
 
 	// Test adding rule with any local_cidr
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "local_cidr": "any"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: nil, localIp: "any"}, mf.lastCall)
 
 	// Test adding rule with junk local_cidr
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "local_cidr": "junk/junk"}}}
 	require.EqualError(t, AddFirewallRulesFromConfig(l, true, conf, mf), "firewall.inbound rule #0; local_cidr did not parse; netip.ParsePrefix(\"junk/junk\"): ParseAddr(\"junk\"): unable to parse IP")
 
 	// Test adding rule with ca_sha
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "ca_sha": "12312313123"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: nil, ip: "", localIp: "", caSha: "12312313123"}, mf.lastCall)
 
 	// Test adding rule with ca_name
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "ca_name": "root01"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: nil, ip: "", localIp: "", caName: "root01"}, mf.lastCall)
 
 	// Test single group
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "group": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: []string{"a"}, ip: "", localIp: ""}, mf.lastCall)
 
 	// Test single groups
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "groups": "a"}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: []string{"a"}, ip: "", localIp: ""}, mf.lastCall)
 
 	// Test multiple AND groups
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "groups": []string{"a", "b"}}}}
 	require.NoError(t, AddFirewallRulesFromConfig(l, true, conf, mf))
 	assert.Equal(t, addRuleCall{incoming: true, proto: firewall.ProtoAny, startPort: 1, endPort: 1, groups: []string{"a", "b"}, ip: "", localIp: ""}, mf.lastCall)
 
 	// Test Add error
-	conf = config.NewC(test.NewLogger())
+	conf = config.NewC(l)
 	mf = &mockFirewall{}
 	mf.nextCallReturn = errors.New("test error")
 	conf.Settings["firewall"] = map[string]any{"inbound": []any{map[string]any{"port": "1", "proto": "any", "host": "a"}}}
@@ -1225,8 +1234,9 @@ func TestAddFirewallRulesFromConfig(t *testing.T) {
 }
 
 func TestFirewall_convertRule(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 
 	// Ensure group array of 1 is converted and a warning is printed
 	c := map[string]any{
@@ -1234,9 +1244,7 @@ func TestFirewall_convertRule(t *testing.T) {
 	}
 
 	r, err := convertRule(l, c, "test", 1)
-	assert.Contains(t, ob.String(), "group was an array with a single value, converting to simple value")
-	assert.Contains(t, ob.String(), "table=test")
-	assert.Contains(t, ob.String(), "rule=1")
+	assert.Contains(t, ob.String(), "test rule #1; group was an array with a single value, converting to simple value")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"group1"}, r.Groups)
 
@@ -1262,8 +1270,9 @@ func TestFirewall_convertRule(t *testing.T) {
 }
 
 func TestFirewall_convertRuleSanity(t *testing.T) {
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 
 	noWarningPlease := []map[string]any{
 		{"group": "group1"},
@@ -1327,7 +1336,7 @@ func (c *testcase) Test(t *testing.T, fw *Firewall) {
 	t.Helper()
 	cp := cert.NewCAPool()
 	resetConntrack(fw)
-	err := fw.Drop(c.p, true, c.h, cp, nil)
+	err := fw.Drop(c.p, nil, true, c.h, cp, nil)
 	if c.err == nil {
 		require.NoError(t, err, "failed to not drop remote address %s", c.p.RemoteAddr)
 	} else {
@@ -1335,7 +1344,7 @@ func (c *testcase) Test(t *testing.T, fw *Firewall) {
 	}
 }
 
-func buildTestCase(setup testsetup, err error, theirPrefixes ...netip.Prefix) testcase {
+func buildHostinfo(setup testsetup, theirPrefixes ...netip.Prefix) *HostInfo {
 	c1 := dummyCert{
 		name:     "host1",
 		networks: theirPrefixes,
@@ -1355,6 +1364,11 @@ func buildTestCase(setup testsetup, err error, theirPrefixes ...netip.Prefix) te
 		h.vpnAddrs[i] = theirPrefixes[i].Addr()
 	}
 	h.buildNetworks(setup.myVpnNetworksTable, &c1)
+	return &h
+}
+
+func buildTestCase(setup testsetup, err error, theirPrefixes ...netip.Prefix) testcase {
+	h := buildHostinfo(setup, theirPrefixes...)
 	p := firewall.Packet{
 		LocalAddr:  setup.c.Networks()[0].Addr(), //todo?
 		RemoteAddr: theirPrefixes[0].Addr(),
@@ -1364,9 +1378,9 @@ func buildTestCase(setup testsetup, err error, theirPrefixes ...netip.Prefix) te
 		Fragment:   false,
 	}
 	return testcase{
-		h:   &h,
+		h:   h,
 		p:   p,
-		c:   &c1,
+		c:   h.ConnectionState.peerCert.Certificate,
 		err: err,
 	}
 }
@@ -1377,7 +1391,7 @@ type testsetup struct {
 	fw                 *Firewall
 }
 
-func newSetup(t *testing.T, l *slog.Logger, myPrefixes ...netip.Prefix) testsetup {
+func newSetup(t *testing.T, l *logrus.Logger, myPrefixes ...netip.Prefix) testsetup {
 	c := dummyCert{
 		name:     "me",
 		networks: myPrefixes,
@@ -1388,7 +1402,20 @@ func newSetup(t *testing.T, l *slog.Logger, myPrefixes ...netip.Prefix) testsetu
 	return newSetupFromCert(t, l, c)
 }
 
-func newSetupFromCert(t *testing.T, l *slog.Logger, c dummyCert) testsetup {
+func newSnatSetup(t *testing.T, l *logrus.Logger, myPrefix netip.Prefix, snatAddr netip.Addr) testsetup {
+	c := dummyCert{
+		name:     "me",
+		networks: []netip.Prefix{myPrefix},
+		groups:   []string{"default-group"},
+		issuer:   "signer-shasum",
+	}
+
+	out := newSetupFromCert(t, l, c)
+	out.fw.snatAddr = snatAddr
+	return out
+}
+
+func newSetupFromCert(t *testing.T, l *logrus.Logger, c dummyCert) testsetup {
 	myVpnNetworksTable := new(bart.Lite)
 	for _, prefix := range c.Networks() {
 		myVpnNetworksTable.Insert(prefix)
@@ -1405,8 +1432,9 @@ func newSetupFromCert(t *testing.T, l *slog.Logger, c dummyCert) testsetup {
 
 func TestFirewall_Drop_EnforceIPMatch(t *testing.T) {
 	t.Parallel()
+	l := test.NewLogger()
 	ob := &bytes.Buffer{}
-	l := test.NewLoggerWithOutput(ob)
+	l.SetOutput(ob)
 
 	myPrefix := netip.MustParsePrefix("1.1.1.1/8")
 	// for now, it's okay that these are all "incoming", the logic this test tries to check doesn't care about in/out
@@ -1522,3 +1550,59 @@ func resetConntrack(fw *Firewall) {
 	fw.Conntrack.Conns = map[firewall.Packet]*conn{}
 	fw.Conntrack.Unlock()
 }
+
+func TestFirewall_SNAT(t *testing.T) {
+	t.Parallel()
+	l := test.NewLogger()
+	ob := &bytes.Buffer{}
+	l.SetOutput(ob)
+	cp := cert.NewCAPool()
+	myPrefix := netip.MustParsePrefix("1.1.1.1/8")
+
+	MyCert := dummyCert{
+		name:     "me",
+		networks: []netip.Prefix{myPrefix},
+		groups:   []string{"default-group"},
+		issuer:   "signer-shasum",
+	}
+
+	theirPrefix := netip.MustParsePrefix("1.2.2.2/8")
+	snatAddr := netip.MustParseAddr("169.254.55.96")
+	t.Run("allow inbound all matching", func(t *testing.T) {
+		t.Parallel()
+		myCert := MyCert.Copy()
+		setup := newSnatSetup(t, l, myPrefix, snatAddr)
+		fw := NewFirewall(l, time.Second, time.Minute, time.Hour, myCert)
+		require.NoError(t, fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"any"}, "", "", "", "", ""))
+		resetConntrack(setup.fw)
+		h := buildHostinfo(setup, theirPrefix)
+		p := firewall.Packet{
+			LocalAddr:  setup.c.Networks()[0].Addr(), //todo?
+			RemoteAddr: h.vpnAddrs[0],
+			LocalPort:  10,
+			RemotePort: 90,
+			Protocol:   firewall.ProtoUDP,
+			Fragment:   false,
+		}
+		require.NoError(t, setup.fw.Drop(p, nil, true, h, cp, nil))
+	})
+	//t.Run("allow inbound unsafe route", func(t *testing.T) {
+	//	t.Parallel()
+	//	unsafePrefix := netip.MustParsePrefix("192.168.0.0/24")
+	//	c := dummyCert{
+	//		name:           "me",
+	//		networks:       []netip.Prefix{myPrefix},
+	//		unsafeNetworks: []netip.Prefix{unsafePrefix},
+	//		groups:         []string{"default-group"},
+	//		issuer:         "signer-shasum",
+	//	}
+	//	unsafeSetup := newSetupFromCert(t, l, c)
+	//	tc := buildTestCase(unsafeSetup, nil, twoPrefixes...)
+	//	tc.p.LocalAddr = netip.MustParseAddr("192.168.0.3")
+	//	tc.err = ErrNoMatchingRule
+	//	tc.Test(t, unsafeSetup.fw) //should hit firewall and bounce off
+	//	require.NoError(t, unsafeSetup.fw.AddRule(true, firewall.ProtoAny, 0, 0, []string{"any"}, "", "", unsafePrefix.String(), "", ""))
+	//	tc.err = nil
+	//	tc.Test(t, unsafeSetup.fw) //should pass
+	//})
+}

go.mod

@@ -1,6 +1,6 @@
 module github.com/slackhq/nebula
 
-go 1.25.0
+go 1.25
 
 require (
 	dario.cat/mergo v1.0.2
@@ -13,26 +13,26 @@ require (
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
 	github.com/kardianos/service v1.2.4
-	github.com/miekg/dns v1.1.72
-	github.com/miekg/pkcs11 v1.1.2
+	github.com/miekg/dns v1.1.70
+	github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b
 	github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
+	github.com/sirupsen/logrus v1.9.4
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
 	github.com/stretchr/testify v1.11.1
 	github.com/vishvananda/netlink v1.3.1
-	go.uber.org/goleak v1.3.0
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/crypto v0.50.0
+	golang.org/x/crypto v0.47.0
 	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
-	golang.org/x/net v0.52.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.43.0
-	golang.org/x/term v0.42.0
+	golang.org/x/net v0.49.0
+	golang.org/x/sync v0.19.0
+	golang.org/x/sys v0.40.0
+	golang.org/x/term v0.39.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
-	golang.zx2c4.com/wireguard/windows v0.6.1
+	golang.zx2c4.com/wireguard/windows v0.5.3
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 	gvisor.dev/gvisor v0.0.0-20240423190808-9d7a357edefe
@@ -50,7 +50,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/mod v0.34.0 // indirect
+	golang.org/x/mod v0.31.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
 )

go.sum

@@ -85,10 +85,10 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
-github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
-github.com/miekg/pkcs11 v1.1.2 h1:/VxmeAX5qU6Q3EwafypogwWbYryHFmF2RpkJmw3m4MQ=
-github.com/miekg/pkcs11 v1.1.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
+github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b h1:J/AzCvg5z0Hn1rqZUJjpbzALUmkKX0Zwbc/i4fw7Sfk=
+github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
@@ -133,6 +133,8 @@ github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncj
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
@@ -162,16 +164,16 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 h1:Di6/M8l0O2lCLc6VVRWhgCiApHV8MnQurBnFSHsQtNY=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -182,8 +184,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -191,8 +193,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -208,11 +210,11 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -223,8 +225,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -233,8 +235,8 @@ golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeu
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
 golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
-golang.zx2c4.com/wireguard/windows v0.6.1 h1:XMaKojH1Hs/raMrmnir4n35nTvzvWj7NmSYzHn2F4qU=
-golang.zx2c4.com/wireguard/windows v0.6.1/go.mod h1:04aqInu5GYuTFvMuDw/rKBAF7mHrltW/3rekpfbbZDM=
+golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
+golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

handshake/credential.go

@@ -1,57 +0,0 @@
-package handshake
-
-import (
-	"crypto/rand"
-
-	"github.com/flynn/noise"
-	"github.com/slackhq/nebula/cert"
-)
-
-// Credential holds everything needed to participate in a handshake
-// at a given cert version. Version and Curve are read from Cert; the public
-// half of the static keypair likewise comes from Cert.PublicKey().
-type Credential struct {
-	Cert        cert.Certificate  // the certificate
-	Bytes       []byte            // pre-marshaled certificate bytes
-	privateKey  []byte            // static private key (public half lives in Cert)
-	cipherSuite noise.CipherSuite // pre-built cipher suite (DH + cipher + hash)
-}
-
-// NewCredential creates a Credential with all material needed for handshake
-// participation. The cipherSuite should be pre-built by the caller with the
-// appropriate DH function, cipher, and hash.
-func NewCredential(
-	c cert.Certificate,
-	hsBytes []byte,
-	privateKey []byte,
-	cipherSuite noise.CipherSuite,
-) *Credential {
-	return &Credential{
-		Cert:        c,
-		Bytes:       hsBytes,
-		privateKey:  privateKey,
-		cipherSuite: cipherSuite,
-	}
-}
-
-// buildHandshakeState creates a noise.HandshakeState from this credential.
-func (hc *Credential) buildHandshakeState(initiator bool, pattern noise.HandshakePattern) (*noise.HandshakeState, error) {
-	return noise.NewHandshakeState(noise.Config{
-		CipherSuite:           hc.cipherSuite,
-		Random:                rand.Reader,
-		Pattern:               pattern,
-		Initiator:             initiator,
-		StaticKeypair:         noise.DHKey{Private: hc.privateKey, Public: hc.Cert.PublicKey()},
-		PresharedKey:          []byte{},
-		PresharedKeyPlacement: 0,
-	})
-}
-
-// GetCredentialFunc returns the handshake credential for the given version,
-// or nil if that version is not available.
-//
-// Implementations must return credentials drawn from a snapshot stable for
-// the lifetime of any single Machine. The Machine may call this multiple
-// times during a handshake (e.g. when negotiating to the peer's version)
-// and assumes the underlying static keypair is consistent across calls.
-type GetCredentialFunc func(v cert.Version) *Credential

handshake/errors.go

@@ -1,21 +0,0 @@
-package handshake
-
-import "errors"
-
-var (
-	ErrInitiateOnResponder     = errors.New("initiate called on responder")
-	ErrInitiateAlreadyCalled   = errors.New("initiate already called")
-	ErrInitiateNotCalled       = errors.New("initiate must be called before ProcessPacket for initiators")
-	ErrPacketTooShort          = errors.New("packet too short")
-	ErrPublicKeyMismatch       = errors.New("public key mismatch between certificate and handshake")
-	ErrIncompleteHandshake     = errors.New("handshake completed without receiving required content")
-	ErrMachineFailed           = errors.New("handshake machine has failed")
-	ErrUnknownSubtype          = errors.New("unknown handshake subtype")
-	ErrMissingContent          = errors.New("expected handshake content but message was empty")
-	ErrUnexpectedContent       = errors.New("received unexpected handshake content")
-	ErrIndexAllocation         = errors.New("failed to allocate local index")
-	ErrNoCredential            = errors.New("no handshake credential available for cert version")
-	ErrAsymmetricCipherKeys    = errors.New("noise produced only one cipher key")
-	ErrMultiMessageUnsupported = errors.New("multi-message handshake patterns are not yet supported by the manager")
-	ErrSubtypeMismatch         = errors.New("packet subtype does not match handshake machine subtype")
-)

handshake/handshake.proto

@@ -1,29 +0,0 @@
-// This file documents the wire format the nebula handshake speaks. It is
-// not run through protoc; the encoder/decoder in payload.go is hand-written
-// against this shape directly to keep the parser narrow and panic-free.
-//
-// Any change to the wire format must be reflected here, and adding a new
-// field requires updating MarshalPayload / unmarshalPayloadDetails together
-// with the field-uniqueness and wire-type checks in those functions.
-
-syntax = "proto3";
-package nebula.handshake;
-
-message NebulaHandshake {
-  NebulaHandshakeDetails Details = 1;
-  bytes Hmac = 2;
-}
-
-message NebulaHandshakeDetails {
-  bytes Cert = 1;
-  uint32 InitiatorIndex = 2;
-  uint32 ResponderIndex = 3;
-  // Cookie was reserved for an anti-DoS mechanism that was never
-  // implemented. No released version of nebula has ever populated it; the
-  // hand-written parser silently skips it on read.
-  uint64 Cookie = 4 [deprecated = true];
-  uint64 Time = 5;
-  uint32 CertVersion = 8;
-  // reserved for WIP multiport
-  reserved 6, 7;
-}

handshake/helpers_test.go

@@ -1,116 +0,0 @@
-package handshake
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/flynn/noise"
-	"github.com/slackhq/nebula/cert"
-	ct "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/header"
-	"github.com/stretchr/testify/require"
-)
-
-// testCertState holds cert material for a test peer.
-type testCertState struct {
-	version cert.Version
-	creds   map[cert.Version]*Credential
-}
-
-func (s *testCertState) getCredential(v cert.Version) *Credential {
-	return s.creds[v]
-}
-
-func newTestCertState(
-	t *testing.T, ca cert.Certificate, caKey []byte, name string, networks []netip.Prefix,
-) *testCertState {
-	return newTestCertStateWithCipher(t, ca, caKey, name, networks, noise.CipherChaChaPoly)
-}
-
-func newTestCertStateWithCipher(
-	t *testing.T, ca cert.Certificate, caKey []byte, name string, networks []netip.Prefix,
-	cipher noise.CipherFunc,
-) *testCertState {
-	t.Helper()
-	c, _, rawPrivKey, _ := ct.NewTestCert(
-		cert.Version2, cert.Curve_CURVE25519, ca, caKey,
-		name, ca.NotBefore(), ca.NotAfter(), networks, nil, nil,
-	)
-
-	priv, _, _, err := cert.UnmarshalPrivateKeyFromPEM(rawPrivKey)
-	require.NoError(t, err)
-
-	hsBytes, err := c.MarshalForHandshakes()
-	require.NoError(t, err)
-
-	ncs := noise.NewCipherSuite(noise.DH25519, cipher, noise.HashSHA256)
-	return &testCertState{
-		version: cert.Version2,
-		creds: map[cert.Version]*Credential{
-			cert.Version2: NewCredential(c, hsBytes, priv, ncs),
-		},
-	}
-}
-
-func testVerifier(pool *cert.CAPool) CertVerifier {
-	return func(c cert.Certificate) (*cert.CachedCertificate, error) {
-		return pool.VerifyCertificate(time.Now(), c)
-	}
-}
-
-func newTestMachine(
-	t *testing.T,
-	cs *testCertState,
-	verifier CertVerifier,
-	initiator bool,
-	localIndex uint32,
-) *Machine {
-	t.Helper()
-	m, err := NewMachine(
-		cs.version, cs.getCredential,
-		verifier, func() (uint32, error) { return localIndex, nil },
-		initiator, header.HandshakeIXPSK0,
-	)
-	require.NoError(t, err)
-	return m
-}
-
-func initiateHandshake(
-	t *testing.T,
-	initCS *testCertState, initVerifier CertVerifier,
-	respCS *testCertState, respVerifier CertVerifier,
-) (initM, respM *Machine, respResult *Result, resp []byte, err error) {
-	t.Helper()
-	initM = newTestMachine(t, initCS, initVerifier, true, 100)
-	msg1, merr := initM.Initiate(nil)
-	require.NoError(t, merr)
-
-	respM = newTestMachine(t, respCS, respVerifier, false, 200)
-	resp, respResult, err = respM.ProcessPacket(nil, msg1)
-	return
-}
-
-func doFullHandshake(
-	t *testing.T, initCS, respCS *testCertState, caPool *cert.CAPool,
-) (initResult, respResult *Result) {
-	t.Helper()
-	v := testVerifier(caPool)
-
-	initM := newTestMachine(t, initCS, v, true, 1000)
-	respM := newTestMachine(t, respCS, v, false, 2000)
-
-	msg1, err := initM.Initiate(nil)
-	require.NoError(t, err)
-
-	resp, respResult, err := respM.ProcessPacket(nil, msg1)
-	require.NoError(t, err)
-	require.NotNil(t, respResult)
-	require.NotEmpty(t, resp)
-
-	_, initResult, err = initM.ProcessPacket(nil, resp)
-	require.NoError(t, err)
-	require.NotNil(t, initResult)
-
-	return initResult, respResult
-}

handshake/machine.go

@@ -1,444 +0,0 @@
-package handshake
-
-import (
-	"bytes"
-	"fmt"
-	"slices"
-	"time"
-
-	"github.com/flynn/noise"
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/header"
-)
-
-// IndexAllocator is called by the Machine to allocate a local index for the
-// handshake. It is called at most once, when the first outgoing message that
-// carries a payload is built.
-//
-// Implementations MUST NOT return 0. Zero is reserved as a sentinel meaning
-// "no index assigned" on the wire and in the payload-presence checks. If an
-// allocator ever returned 0, a legitimate handshake's payload could be
-// indistinguishable from an empty one and would be rejected.
-type IndexAllocator func() (uint32, error)
-
-// CertVerifier is called by the Machine after reconstructing the peer's
-// certificate from the handshake. The verifier performs all validation
-// (CA trust, expiry, policy checks, allow lists).
-type CertVerifier func(cert.Certificate) (*cert.CachedCertificate, error)
-
-// Result contains the results of a successful handshake.
-// Returned by ProcessPacket when the handshake is complete.
-type Result struct {
-	EKey          *noise.CipherState
-	DKey          *noise.CipherState
-	MyCert        cert.Certificate
-	RemoteCert    *cert.CachedCertificate
-	RemoteIndex   uint32
-	LocalIndex    uint32
-	HandshakeTime uint64
-	MessageIndex  uint64 // number of messages exchanged during the handshake
-	Initiator     bool
-}
-
-// Machine drives a Noise handshake through N messages. It handles Noise
-// protocol operations, certificate reconstruction, and payload encoding.
-// Certificate validation is delegated to the caller via CertVerifier.
-//
-// A Machine is not safe for concurrent use. The caller must ensure that
-// Initiate and ProcessPacket are not called concurrently.
-//
-// Error contract: when ProcessPacket or Initiate returns an error, callers
-// must check Failed() to decide what to do next. If Failed() is false the
-// underlying noise state was not advanced (the packet was rejected before
-// ReadMessage took effect, or the rejection is non-fatal like a stale
-// retransmit) and the Machine can accept another packet. If Failed() is
-// true the Machine is unrecoverable and the caller must abandon it.
-type Machine struct {
-	hs             *noise.HandshakeState
-	getCred        GetCredentialFunc
-	allocIndex     IndexAllocator
-	verifier       CertVerifier
-	result         *Result
-	msgs           []msgFlags
-	myVersion      cert.Version
-	subtype        header.MessageSubType
-	indexAllocated bool
-	remoteCertSet  bool
-	payloadSet     bool
-	failed         bool
-}
-
-// NewMachine creates a handshake state machine. The subtype determines both
-// the noise pattern and the per-message content layout. The credential for
-// `version` is fetched via getCred and used to seed the noise.HandshakeState.
-// IndexAllocator is called lazily when the first outgoing payload is built.
-func NewMachine(
-	version cert.Version,
-	getCred GetCredentialFunc,
-	verifier CertVerifier,
-	allocIndex IndexAllocator,
-	initiator bool,
-	subtype header.MessageSubType,
-) (*Machine, error) {
-	info, err := subtypeInfoFor(subtype)
-	if err != nil {
-		return nil, err
-	}
-
-	cred := getCred(version)
-	if cred == nil {
-		return nil, fmt.Errorf("%w: %v", ErrNoCredential, version)
-	}
-
-	hs, err := cred.buildHandshakeState(initiator, info.pattern)
-	if err != nil {
-		return nil, fmt.Errorf("build noise state: %w", err)
-	}
-
-	return &Machine{
-		hs:         hs,
-		subtype:    subtype,
-		msgs:       info.msgs,
-		getCred:    getCred,
-		allocIndex: allocIndex,
-		verifier:   verifier,
-		myVersion:  version,
-		result: &Result{
-			Initiator: initiator,
-		},
-	}, nil
-}
-
-// Failed returns true if the Machine is in an unrecoverable state.
-func (m *Machine) Failed() bool {
-	return m.failed
-}
-
-// Subtype returns the handshake subtype this Machine was built for.
-func (m *Machine) Subtype() header.MessageSubType {
-	return m.subtype
-}
-
-// MessageIndex returns the noise handshake message index, which equals the
-// wire counter of the most recently sent or received message.
-func (m *Machine) MessageIndex() int {
-	return m.hs.MessageIndex()
-}
-
-// requireComplete checks that both a peer cert and payload have been received.
-// Marks the machine as failed if not.
-func (m *Machine) requireComplete() error {
-	if !m.payloadSet || !m.remoteCertSet {
-		m.failed = true
-		return ErrIncompleteHandshake
-	}
-	return nil
-}
-
-// myMsgFlags returns the flags for the current outgoing message.
-func (m *Machine) myMsgFlags() msgFlags {
-	idx := m.hs.MessageIndex()
-	if idx < len(m.msgs) {
-		return m.msgs[idx]
-	}
-	return msgFlags{}
-}
-
-// peerMsgFlags returns the flags for the message we just read.
-func (m *Machine) peerMsgFlags() msgFlags {
-	idx := m.hs.MessageIndex() - 1
-	if idx >= 0 && idx < len(m.msgs) {
-		return m.msgs[idx]
-	}
-	return msgFlags{}
-}
-
-// Initiate produces the first handshake message. Only valid for initiators,
-// and must be called exactly once before ProcessPacket.
-//
-// out is a destination buffer the message is appended to and returned. Pass
-// nil to allocate fresh, or pass a re-used buffer sliced to length 0 (e.g.
-// buf[:0]) with sufficient capacity to avoid allocation.
-//
-// An error return may not indicate a fatal condition, check Failed() to
-// determine if the Machine can still be used.
-func (m *Machine) Initiate(out []byte) ([]byte, error) {
-	if m.failed {
-		return nil, ErrMachineFailed
-	}
-	if !m.result.Initiator {
-		m.failed = true
-		return nil, ErrInitiateOnResponder
-	}
-	if m.hs.MessageIndex() != 0 {
-		m.failed = true
-		return nil, ErrInitiateAlreadyCalled
-	}
-
-	// At MessageIndex=0 with RemoteIndex still zero, buildResponse produces
-	// header counter 1 and remote index 0, which is what the initial message needs.
-	out, _, _, err := m.buildResponse(out)
-	if err != nil {
-		m.failed = true
-		return nil, err
-	}
-	return out, nil
-}
-
-// ProcessPacket handles an incoming handshake message. It advances the Noise
-// state, validates the peer certificate via the verifier, and optionally
-// produces a response.
-//
-// out is a destination buffer the response is appended to and returned. Pass
-// nil to allocate fresh, or pass a re-used buffer sliced to length 0 (e.g.
-// buf[:0]) with sufficient capacity to avoid allocation. The returned slice
-// is nil when no outgoing message is produced (handshake complete on this
-// side, or final message of a multi-message pattern).
-//
-// Returns a non-nil Result when the handshake is complete.
-// An error return may not indicate a fatal condition, check Failed() to
-// determine if the Machine can still be used.
-func (m *Machine) ProcessPacket(out, packet []byte) ([]byte, *Result, error) {
-	if m.failed {
-		return nil, nil, ErrMachineFailed
-	}
-	if len(packet) < header.Len {
-		return nil, nil, ErrPacketTooShort
-	}
-	// Reject packets whose subtype doesn't match the one this Machine was
-	// built for. A pending handshake that suddenly receives a different
-	// subtype on its index is either a stray packet that matched by chance
-	// or a peer protocol violation; drop it without failing the Machine so
-	// the legitimate retransmit can still complete.
-	if header.MessageSubType(packet[1]) != m.subtype {
-		return nil, nil, ErrSubtypeMismatch
-	}
-	if m.result.Initiator && m.hs.MessageIndex() == 0 {
-		m.failed = true
-		return nil, nil, ErrInitiateNotCalled
-	}
-
-	// The (eKey, dKey) ordering here is correct for IX, where the initiator
-	// completes the handshake by reading the responder's stage-2 message.
-	// noise returns (cs1, cs2) where cs1 is the initiator->responder cipher.
-	// For 3-message patterns where a responder finishes by reading the final
-	// message, this ordering would be wrong; revisit when XX/pqIX lands.
-	msg, eKey, dKey, err := m.hs.ReadMessage(nil, packet[header.Len:])
-	if err != nil {
-		// Noise ReadMessage failed. The noise library checkpoints and rolls back
-		// on failure, so the Machine is still alive. The caller can retry with
-		// a different packet.
-		return nil, nil, fmt.Errorf("noise ReadMessage: %w", err)
-	}
-
-	// From here on, noise state has advanced. Any error is fatal.
-	flags := m.peerMsgFlags()
-
-	if err := m.processPayload(msg, flags); err != nil {
-		return nil, nil, err
-	}
-
-	// If ReadMessage derived keys, the handshake is complete. Noise should
-	// always produce both keys together; asymmetry is a protocol invariant
-	// violation.
-	if eKey != nil || dKey != nil {
-		if eKey == nil || dKey == nil {
-			m.failed = true
-			return nil, nil, ErrAsymmetricCipherKeys
-		}
-		if err := m.requireComplete(); err != nil {
-			return nil, nil, err
-		}
-		return nil, m.completed(eKey, dKey), nil
-	}
-
-	// ReadMessage didn't complete, produce the next outgoing message
-	out, dk, ek, err := m.buildResponse(out)
-	if err != nil {
-		m.failed = true
-		return nil, nil, err
-	}
-
-	if ek != nil || dk != nil {
-		if ek == nil || dk == nil {
-			m.failed = true
-			return nil, nil, ErrAsymmetricCipherKeys
-		}
-		if err := m.requireComplete(); err != nil {
-			return nil, nil, err
-		}
-		return out, m.completed(ek, dk), nil
-	}
-
-	return out, nil, nil
-}
-
-func (m *Machine) completed(eKey, dKey *noise.CipherState) *Result {
-	m.result.EKey = eKey
-	m.result.DKey = dKey
-	m.result.MessageIndex = uint64(m.hs.MessageIndex())
-	return m.result
-}
-
-func (m *Machine) processPayload(msg []byte, flags msgFlags) error {
-	if len(msg) == 0 {
-		if flags.expectsPayload || flags.expectsCert {
-			m.failed = true
-			return ErrMissingContent
-		}
-		return nil
-	}
-
-	payload, err := UnmarshalPayload(msg)
-	if err != nil {
-		m.failed = true
-		return fmt.Errorf("unmarshal handshake: %w", err)
-	}
-
-	// Assert the payload contains exactly what we expect
-	hasPayloadData := payload.InitiatorIndex != 0 || payload.ResponderIndex != 0 || payload.Time != 0
-	if hasPayloadData != flags.expectsPayload {
-		m.failed = true
-		return ErrUnexpectedContent
-	}
-
-	hasCertData := len(payload.Cert) > 0
-	if hasCertData != flags.expectsCert {
-		m.failed = true
-		return ErrUnexpectedContent
-	}
-
-	// Process payload
-	if flags.expectsPayload {
-		if m.result.Initiator {
-			m.result.RemoteIndex = payload.ResponderIndex
-		} else {
-			m.result.RemoteIndex = payload.InitiatorIndex
-		}
-		m.result.HandshakeTime = payload.Time
-		m.payloadSet = true
-	}
-
-	// Process certificate
-	if flags.expectsCert {
-		if err := m.validateCert(payload); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (m *Machine) validateCert(payload Payload) error {
-	cred := m.getCred(m.myVersion)
-	if cred == nil {
-		m.failed = true
-		return fmt.Errorf("%w: %v", ErrNoCredential, m.myVersion)
-	}
-	rc, err := cert.Recombine(
-		cert.Version(payload.CertVersion),
-		payload.Cert,
-		m.hs.PeerStatic(),
-		cred.Cert.Curve(),
-	)
-	if err != nil {
-		m.failed = true
-		return fmt.Errorf("recombine cert: %w", err)
-	}
-
-	if !bytes.Equal(rc.PublicKey(), m.hs.PeerStatic()) {
-		m.failed = true
-		return ErrPublicKeyMismatch
-	}
-
-	// Version negotiation, if the peer sent a different version and we have it, switch
-	if rc.Version() != m.myVersion {
-		if m.getCred(rc.Version()) != nil {
-			m.myVersion = rc.Version()
-		}
-	}
-
-	verified, err := m.verifier(rc)
-	if err != nil {
-		m.failed = true
-		return fmt.Errorf("verify cert: %w", err)
-	}
-
-	m.result.RemoteCert = verified
-	m.remoteCertSet = true
-	return nil
-}
-
-func (m *Machine) marshalOutgoing(flags msgFlags) ([]byte, error) {
-	if !flags.expectsPayload && !flags.expectsCert {
-		return nil, nil
-	}
-
-	var p Payload
-	if flags.expectsPayload {
-		if !m.indexAllocated {
-			index, err := m.allocIndex()
-			if err != nil {
-				return nil, fmt.Errorf("%w: %w", ErrIndexAllocation, err)
-			}
-			m.result.LocalIndex = index
-			m.indexAllocated = true
-		}
-
-		if m.result.Initiator {
-			p.InitiatorIndex = m.result.LocalIndex
-		} else {
-			p.ResponderIndex = m.result.LocalIndex
-			p.InitiatorIndex = m.result.RemoteIndex
-		}
-		p.Time = uint64(time.Now().UnixNano())
-	}
-	if flags.expectsCert {
-		cred := m.getCred(m.myVersion)
-		if cred == nil {
-			return nil, fmt.Errorf("%w: %v", ErrNoCredential, m.myVersion)
-		}
-		p.Cert = cred.Bytes
-		p.CertVersion = uint32(cred.Cert.Version())
-		m.result.MyCert = cred.Cert
-	}
-
-	return MarshalPayload(nil, p), nil
-}
-
-func (m *Machine) buildResponse(out []byte) ([]byte, *noise.CipherState, *noise.CipherState, error) {
-	flags := m.myMsgFlags()
-	hsBytes, err := m.marshalOutgoing(flags)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	// Extend out by header.Len to make room for the header. slices.Grow is a
-	// no-op when the cap is already sufficient (the zero-copy case where the
-	// caller passed a pre-sized buffer). header.Encode overwrites the new
-	// bytes, so they don't need to be zeroed.
-	start := len(out)
-	out = slices.Grow(out, header.Len)[:start+header.Len]
-	header.Encode(
-		out[start:],
-		header.Version, header.Handshake, m.subtype,
-		m.result.RemoteIndex,
-		uint64(m.hs.MessageIndex()+1),
-	)
-
-	// noise.WriteMessage appends the encrypted handshake message to out,
-	// reusing capacity when present.
-	//
-	// The (dKey, eKey) ordering here is correct for IX, where the responder
-	// completes the handshake by writing the stage-2 message. noise returns
-	// (cs1, cs2) where cs1 is the initiator->responder cipher (which is the
-	// responder's decrypt key). For 3-message patterns where an initiator
-	// finishes by writing the final message, this ordering would be wrong;
-	// revisit when XX/pqIX lands.
-	out, dKey, eKey, err := m.hs.WriteMessage(out, hsBytes)
-	if err != nil {
-		return nil, nil, nil, fmt.Errorf("noise WriteMessage: %w", err)
-	}
-
-	return out, dKey, eKey, nil
-}

handshake/machine_test.go

@@ -1,662 +0,0 @@
-package handshake
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/flynn/noise"
-	"github.com/slackhq/nebula/cert"
-	ct "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/noiseutil"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMachineIXHappyPath(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-
-	initCS := newTestCertState(t, ca, caKey, "initiator", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	respCS := newTestCertState(t, ca, caKey, "responder", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-
-	initR, respR := doFullHandshake(t, initCS, respCS, caPool)
-
-	assert.Equal(t, "responder", initR.RemoteCert.Certificate.Name())
-	assert.Equal(t, "initiator", respR.RemoteCert.Certificate.Name())
-
-	assert.Equal(t, uint32(1000), initR.LocalIndex)
-	assert.Equal(t, uint32(2000), initR.RemoteIndex)
-	assert.Equal(t, uint32(2000), respR.LocalIndex)
-	assert.Equal(t, uint32(1000), respR.RemoteIndex)
-
-	assert.Equal(t, uint64(2), initR.MessageIndex, "IX has 2 messages")
-	assert.Equal(t, uint64(2), respR.MessageIndex, "IX has 2 messages")
-
-	ct1, err := initR.EKey.Encrypt(nil, nil, []byte("hello"))
-	require.NoError(t, err)
-	pt1, err := respR.DKey.Decrypt(nil, nil, ct1)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("hello"), pt1)
-
-	ct2, err := respR.EKey.Encrypt(nil, nil, []byte("world"))
-	require.NoError(t, err)
-	pt2, err := initR.DKey.Decrypt(nil, nil, ct2)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("world"), pt2)
-}
-
-func TestMachineInitiateErrors(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	cs := newTestCertState(t, ca, caKey, "test", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	v := testVerifier(caPool)
-
-	t.Run("initiate on responder", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		_, err := m.Initiate(nil)
-		require.ErrorIs(t, err, ErrInitiateOnResponder)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("initiate called twice", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, true, 100)
-		_, err := m.Initiate(nil)
-		require.NoError(t, err)
-		_, err = m.Initiate(nil)
-		require.ErrorIs(t, err, ErrInitiateAlreadyCalled)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("process packet before initiate on initiator", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, true, 100)
-		_, _, err := m.ProcessPacket(nil, make([]byte, 100))
-		require.ErrorIs(t, err, ErrInitiateNotCalled)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("calling failed machine", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		_, err := m.Initiate(nil) // fails: responder
-		require.Error(t, err)
-		_, err = m.Initiate(nil) // fails: already failed
-		require.ErrorIs(t, err, ErrMachineFailed)
-	})
-}
-
-func TestMachineProcessPacketErrors(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	cs := newTestCertState(t, ca, caKey, "test", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	v := testVerifier(caPool)
-
-	t.Run("packet too short", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		_, _, err := m.ProcessPacket(nil, []byte{1, 2, 3})
-		require.ErrorIs(t, err, ErrPacketTooShort)
-		assert.False(t, m.Failed(), "short packet should not kill machine")
-	})
-
-	t.Run("noise decryption failure is recoverable", func(t *testing.T) {
-		initCS := newTestCertState(t, ca, caKey, "init", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-		initM := newTestMachine(t, initCS, v, true, 100)
-		msg1, err := initM.Initiate(nil)
-		require.NoError(t, err)
-
-		respM := newTestMachine(t, cs, v, false, 200)
-		resp, _, err := respM.ProcessPacket(nil, msg1)
-		require.NoError(t, err)
-
-		corrupted := make([]byte, len(resp))
-		copy(corrupted, resp)
-		for i := header.Len; i < len(corrupted); i++ {
-			corrupted[i] ^= 0xff
-		}
-		_, _, err = initM.ProcessPacket(nil, corrupted)
-		require.Error(t, err)
-		assert.False(t, initM.Failed(), "noise failure should be recoverable")
-
-		// And the machine should still complete a real handshake afterward.
-		_, result, err := initM.ProcessPacket(nil, resp)
-		require.NoError(t, err)
-		require.NotNil(t, result, "initiator should complete on the legitimate response")
-	})
-
-	t.Run("invalid cert is fatal", func(t *testing.T) {
-		otherCA, _, otherCAKey, _ := ct.NewTestCaCert(
-			cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-		)
-		otherCS := newTestCertState(t, otherCA, otherCAKey, "other", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-
-		initM := newTestMachine(t, otherCS, testVerifier(ct.NewTestCAPool(otherCA)), true, 100)
-		msg1, err := initM.Initiate(nil)
-		require.NoError(t, err)
-
-		respM := newTestMachine(t, cs, v, false, 200)
-		_, _, err = respM.ProcessPacket(nil, msg1)
-		require.Error(t, err)
-		assert.True(t, respM.Failed(), "cert validation failure should kill machine")
-	})
-
-	t.Run("subtype mismatch is recoverable", func(t *testing.T) {
-		initCS := newTestCertState(t, ca, caKey, "init", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-		initM := newTestMachine(t, initCS, v, true, 100)
-		msg1, err := initM.Initiate(nil)
-		require.NoError(t, err)
-
-		// Mutate the subtype byte (offset 1 in the header) to a value the
-		// responder Machine wasn't built for.
-		bad := make([]byte, len(msg1))
-		copy(bad, msg1)
-		bad[1] = 0xff
-
-		respM := newTestMachine(t, cs, v, false, 200)
-		_, _, err = respM.ProcessPacket(nil, bad)
-		require.ErrorIs(t, err, ErrSubtypeMismatch)
-		assert.False(t, respM.Failed(), "subtype mismatch should not kill the machine")
-
-		// And the machine should still complete a real handshake afterward.
-		resp, result, err := respM.ProcessPacket(nil, msg1)
-		require.NoError(t, err)
-		require.NotNil(t, result, "responder should complete on the legitimate stage-1 packet")
-		assert.NotEmpty(t, resp, "responder should produce a stage-2 reply")
-	})
-}
-
-// TestMachineProcessPayload exercises processPayload's internal validation
-// directly. Most of these failure modes can't be reached black-box once the
-// subtype check at the top of ProcessPacket gates external callers, so we
-// drive them by hand here for coverage.
-func TestMachineProcessPayload(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	cs := newTestCertState(t, ca, caKey, "test", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	v := testVerifier(caPool)
-
-	t.Run("empty message with expects fails", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		err := m.processPayload(nil, msgFlags{expectsPayload: true, expectsCert: true})
-		require.ErrorIs(t, err, ErrMissingContent)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("empty message with no expects passes", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		err := m.processPayload(nil, msgFlags{})
-		require.NoError(t, err)
-		assert.False(t, m.Failed())
-	})
-
-	t.Run("malformed protobuf is fatal", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		err := m.processPayload([]byte{0xff, 0xff, 0xff}, msgFlags{expectsPayload: true, expectsCert: true})
-		require.Error(t, err)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("unexpected payload data is fatal", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		// A payload with index data when none was expected.
-		bytes := MarshalPayload(nil, Payload{InitiatorIndex: 42, Time: 1})
-		err := m.processPayload(bytes, msgFlags{expectsPayload: false, expectsCert: false})
-		require.ErrorIs(t, err, ErrUnexpectedContent)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("unexpected cert data is fatal", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		// A payload with cert when none was expected.
-		bytes := MarshalPayload(nil, Payload{Cert: []byte{1, 2, 3}, CertVersion: 2})
-		err := m.processPayload(bytes, msgFlags{expectsPayload: false, expectsCert: false})
-		require.ErrorIs(t, err, ErrUnexpectedContent)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("missing payload data when expected is fatal", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		// Cert present, but no index/time fields.
-		bytes := MarshalPayload(nil, Payload{Cert: []byte{1, 2, 3}, CertVersion: 2})
-		err := m.processPayload(bytes, msgFlags{expectsPayload: true, expectsCert: true})
-		require.ErrorIs(t, err, ErrUnexpectedContent)
-		assert.True(t, m.Failed())
-	})
-}
-
-// TestMachineRequireComplete checks the fail-on-incomplete-handshake path
-// directly. Like processPayload above this isn't reachable from a normal IX
-// flow, so we drive it by hand.
-func TestMachineRequireComplete(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	cs := newTestCertState(t, ca, caKey, "test", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	v := testVerifier(caPool)
-
-	t.Run("missing both fails", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		err := m.requireComplete()
-		require.ErrorIs(t, err, ErrIncompleteHandshake)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("payload only fails", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		m.payloadSet = true
-		err := m.requireComplete()
-		require.ErrorIs(t, err, ErrIncompleteHandshake)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("cert only fails", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		m.remoteCertSet = true
-		err := m.requireComplete()
-		require.ErrorIs(t, err, ErrIncompleteHandshake)
-		assert.True(t, m.Failed())
-	})
-
-	t.Run("both set passes", func(t *testing.T) {
-		m := newTestMachine(t, cs, v, false, 100)
-		m.payloadSet = true
-		m.remoteCertSet = true
-		err := m.requireComplete()
-		require.NoError(t, err)
-		assert.False(t, m.Failed())
-	})
-}
-
-func TestMachineAESCipher(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-
-	initCS := newTestCertStateWithCipher(
-		t, ca, caKey, "init",
-		[]netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")},
-		noiseutil.CipherAESGCM,
-	)
-	respCS := newTestCertStateWithCipher(
-		t, ca, caKey, "resp",
-		[]netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")},
-		noiseutil.CipherAESGCM,
-	)
-
-	initR, respR := doFullHandshake(t, initCS, respCS, caPool)
-
-	ct1, err := initR.EKey.Encrypt(nil, nil, []byte("works"))
-	require.NoError(t, err)
-	pt1, err := respR.DKey.Decrypt(nil, nil, ct1)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("works"), pt1)
-
-	ct2, err := respR.EKey.Encrypt(nil, nil, []byte("back"))
-	require.NoError(t, err)
-	pt2, err := initR.DKey.Decrypt(nil, nil, ct2)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("back"), pt2)
-}
-
-func TestResultFields(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	initCS := newTestCertState(t, ca, caKey, "init", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	respCS := newTestCertState(t, ca, caKey, "resp", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-
-	initR, respR := doFullHandshake(t, initCS, respCS, caPool)
-
-	assert.True(t, initR.Initiator)
-	assert.False(t, respR.Initiator)
-	assert.NotZero(t, initR.HandshakeTime)
-	assert.NotZero(t, respR.HandshakeTime)
-	assert.NotNil(t, initR.RemoteCert)
-	assert.NotNil(t, respR.RemoteCert)
-}
-
-func TestMachineBufferReuse(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	initCS := newTestCertState(t, ca, caKey, "init", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	respCS := newTestCertState(t, ca, caKey, "resp", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-	v := testVerifier(caPool)
-
-	initM := newTestMachine(t, initCS, v, true, 1000)
-	respM := newTestMachine(t, respCS, v, false, 2000)
-
-	msg1, err := initM.Initiate(nil)
-	require.NoError(t, err)
-
-	t.Run("response writes into provided buffer", func(t *testing.T) {
-		buf := make([]byte, 0, 4096)
-		resp, result, err := respM.ProcessPacket(buf, msg1)
-		require.NoError(t, err)
-		require.NotNil(t, result)
-
-		assert.NotEmpty(t, resp, "response should have content")
-		assert.Equal(t, &buf[:1][0], &resp[:1][0],
-			"response should reuse the provided buffer's backing array")
-	})
-
-	t.Run("initiate writes into provided buffer", func(t *testing.T) {
-		initM2 := newTestMachine(t, initCS, v, true, 3000)
-		buf := make([]byte, 0, 4096)
-		msg, err := initM2.Initiate(buf)
-		require.NoError(t, err)
-
-		assert.NotEmpty(t, msg, "initiate should have content")
-		assert.Equal(t, &buf[:1][0], &msg[:1][0],
-			"initiate should reuse the provided buffer's backing array")
-	})
-
-	t.Run("nil out still works", func(t *testing.T) {
-		initM2 := newTestMachine(t, initCS, v, true, 4000)
-		respM2 := newTestMachine(t, respCS, v, false, 5000)
-
-		msg1, err := initM2.Initiate(nil)
-		require.NoError(t, err)
-
-		resp, _, err := respM2.ProcessPacket(nil, msg1)
-		require.NoError(t, err)
-
-		out, result, err := initM2.ProcessPacket(nil, resp)
-		require.NoError(t, err)
-		assert.NotNil(t, result)
-		assert.Nil(t, out, "initiator should have no response for IX msg2")
-	})
-}
-
-func TestMachineMsgIndexTracking(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	initCS := newTestCertState(t, ca, caKey, "init", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	respCS := newTestCertState(t, ca, caKey, "resp", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-	v := testVerifier(caPool)
-
-	initM := newTestMachine(t, initCS, v, true, 100)
-	respM := newTestMachine(t, respCS, v, false, 200)
-
-	msg1, err := initM.Initiate(nil)
-	require.NoError(t, err)
-
-	resp1, result1, err := respM.ProcessPacket(nil, msg1)
-	require.NoError(t, err)
-	assert.NotNil(t, result1)
-
-	_, result2, err := initM.ProcessPacket(nil, resp1)
-	require.NoError(t, err)
-	assert.NotNil(t, result2)
-}
-
-func TestMachineThreeMessagePattern(t *testing.T) {
-	registerTestXXInfo(t)
-
-	// Use HandshakeXX (3 messages) to verify the Machine handles multi-message
-	// patterns correctly. XX flow:
-	//   msg1 (I->R): [E]           - payload only, no cert
-	//   msg2 (R->I): [E, ee, S, es] - payload + cert
-	//   msg3 (I->R): [S, se]       - cert only (no payload, not first two)
-
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-	v := testVerifier(caPool)
-
-	initCS := newTestCertState(t, ca, caKey, "init", []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")})
-	respCS := newTestCertState(t, ca, caKey, "resp", []netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")})
-
-	initM, err := NewMachine(
-		cert.Version2,
-		initCS.getCredential, v,
-		func() (uint32, error) { return 1000, nil },
-		true, header.HandshakeXXPSK0,
-	)
-	require.NoError(t, err)
-
-	respM, err := NewMachine(
-		cert.Version2,
-		respCS.getCredential, v,
-		func() (uint32, error) { return 2000, nil },
-		false, header.HandshakeXXPSK0,
-	)
-	require.NoError(t, err)
-
-	// msg1: initiator -> responder (E only, no cert)
-	msg1, err := initM.Initiate(nil)
-	require.NoError(t, err)
-	assert.NotEmpty(t, msg1)
-
-	// Responder processes msg1, should not complete yet, should produce msg2
-	msg2, result, err := respM.ProcessPacket(nil, msg1)
-	require.NoError(t, err)
-	assert.Nil(t, result, "XX should not complete on msg1")
-	assert.NotEmpty(t, msg2, "responder should produce msg2")
-
-	// Initiator processes msg2: gets responder's cert, produces msg3, and
-	// completes (WriteMessage for msg3 derives keys)
-	msg3, initResult, err := initM.ProcessPacket(nil, msg2)
-	require.NoError(t, err)
-	require.NotNil(t, initResult, "XX initiator should complete after reading msg2 and writing msg3")
-	assert.NotEmpty(t, msg3, "initiator should produce msg3")
-	assert.Equal(t, "resp", initResult.RemoteCert.Certificate.Name())
-
-	// Responder processes msg3: gets initiator's cert and completes
-	_, respResult, err := respM.ProcessPacket(nil, msg3)
-	require.NoError(t, err)
-	require.NotNil(t, respResult, "XX responder should complete on msg3")
-	assert.Equal(t, "init", respResult.RemoteCert.Certificate.Name())
-
-	assert.Equal(t, uint64(3), initResult.MessageIndex, "XX has 3 messages")
-	assert.Equal(t, uint64(3), respResult.MessageIndex, "XX has 3 messages")
-
-	// Verify keys work
-	ct1, err := initResult.EKey.Encrypt(nil, nil, []byte("three messages"))
-	require.NoError(t, err)
-	pt1, err := respResult.DKey.Decrypt(nil, nil, ct1)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("three messages"), pt1)
-}
-
-// NOTE: ErrIncompleteHandshake is tested implicitly. It can't be triggered with
-// IX since the cert is always in the payload. A 3-message pattern test (HybridIX)
-// should exercise the case where cert arrives in msg3 and verify that completing
-// without it fails.
-
-func TestMachineExpiredCert(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519,
-		time.Now().Add(-24*time.Hour), time.Now().Add(24*time.Hour),
-		nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-
-	expCert, _, expKeyPEM, _ := ct.NewTestCert(
-		cert.Version2, cert.Curve_CURVE25519, ca, caKey,
-		"expired", time.Now().Add(-2*time.Hour), time.Now().Add(-1*time.Hour),
-		[]netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")}, nil, nil,
-	)
-	expKey, _, _, err := cert.UnmarshalPrivateKeyFromPEM(expKeyPEM)
-	require.NoError(t, err)
-	expHsBytes, err := expCert.MarshalForHandshakes()
-	require.NoError(t, err)
-	ncs := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
-
-	expiredCS := &testCertState{
-		version: cert.Version2,
-		creds: map[cert.Version]*Credential{
-			cert.Version2: NewCredential(expCert, expHsBytes, expKey, ncs),
-		},
-	}
-
-	respCS := newTestCertState(
-		t, ca, caKey, "responder",
-		[]netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")},
-	)
-
-	_, respM, _, _, err := initiateHandshake(
-		t, expiredCS, testVerifier(caPool),
-		respCS, testVerifier(caPool),
-	)
-	require.ErrorContains(t, err, "verify cert")
-	assert.True(t, respM.Failed())
-}
-
-func TestMachineNoCertNetworks(t *testing.T) {
-	ca, _, caKey, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca)
-
-	caHsBytes, err := ca.MarshalForHandshakes()
-	require.NoError(t, err)
-	ncs := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
-
-	noNetCS := &testCertState{
-		version: cert.Version2,
-		creds: map[cert.Version]*Credential{
-			cert.Version2: NewCredential(ca, caHsBytes, caKey, ncs),
-		},
-	}
-
-	respCS := newTestCertState(
-		t, ca, caKey, "responder",
-		[]netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")},
-	)
-
-	_, respM, _, _, err := initiateHandshake(
-		t, noNetCS, testVerifier(caPool),
-		respCS, testVerifier(caPool),
-	)
-	require.Error(t, err)
-	assert.True(t, respM.Failed())
-}
-
-func TestMachineDifferentCAs(t *testing.T) {
-	ca1, _, caKey1, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	ca2, _, caKey2, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-
-	initCS := newTestCertState(
-		t, ca1, caKey1, "init",
-		[]netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")},
-	)
-	respCS := newTestCertState(
-		t, ca2, caKey2, "resp",
-		[]netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")},
-	)
-
-	_, respM, _, _, err := initiateHandshake(
-		t, initCS, testVerifier(ct.NewTestCAPool(ca1)),
-		respCS, testVerifier(ct.NewTestCAPool(ca2)),
-	)
-	require.ErrorContains(t, err, "verify cert")
-	assert.True(t, respM.Failed())
-}
-
-func TestMachineVersionNegotiation(t *testing.T) {
-	ca1, _, caKey1, _ := ct.NewTestCaCert(
-		cert.Version1, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	ca2, _, caKey2, _ := ct.NewTestCaCert(
-		cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil,
-	)
-	caPool := ct.NewTestCAPool(ca1, ca2)
-
-	makeMultiVersionResp := func(t *testing.T) *testCertState {
-		t.Helper()
-		respCertV1, _, respKeyPEM, _ := ct.NewTestCert(
-			cert.Version1, cert.Curve_CURVE25519, ca1, caKey1, "resp",
-			ca1.NotBefore(), ca1.NotAfter(),
-			[]netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")}, nil, nil,
-		)
-		respKey, _, _, _ := cert.UnmarshalPrivateKeyFromPEM(respKeyPEM)
-		respCertV2, _ := ct.NewTestCertDifferentVersion(respCertV1, cert.Version2, ca2, caKey2)
-		respHsV1, _ := respCertV1.MarshalForHandshakes()
-		respHsV2, _ := respCertV2.MarshalForHandshakes()
-		ncs := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
-		return &testCertState{
-			version: cert.Version1,
-			creds: map[cert.Version]*Credential{
-				cert.Version1: NewCredential(respCertV1, respHsV1, respKey, ncs),
-				cert.Version2: NewCredential(respCertV2, respHsV2, respKey, ncs),
-			},
-		}
-	}
-
-	t.Run("responder matches initiator version", func(t *testing.T) {
-		initCS := newTestCertState(
-			t, ca2, caKey2, "init",
-			[]netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")},
-		)
-		respCS := makeMultiVersionResp(t)
-		v := testVerifier(caPool)
-
-		initM, _, respResult, resp, err := initiateHandshake(
-			t, initCS, v,
-			respCS, v,
-		)
-		require.NoError(t, err)
-		require.NotNil(t, respResult)
-
-		assert.Equal(t, cert.Version2, respResult.MyCert.Version(),
-			"responder should negotiate to initiator's version")
-
-		_, initResult, err := initM.ProcessPacket(nil, resp)
-		require.NoError(t, err)
-		require.NotNil(t, initResult)
-		assert.Equal(t, cert.Version2, initResult.RemoteCert.Certificate.Version(),
-			"initiator should see V2 cert from responder")
-	})
-
-	t.Run("responder keeps version when no match available", func(t *testing.T) {
-		initCS := newTestCertState(
-			t, ca2, caKey2, "init",
-			[]netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")},
-		)
-
-		respCert, _, respKeyPEM, _ := ct.NewTestCert(
-			cert.Version1, cert.Curve_CURVE25519, ca1, caKey1, "resp",
-			ca1.NotBefore(), ca1.NotAfter(),
-			[]netip.Prefix{netip.MustParsePrefix("10.0.0.2/24")}, nil, nil,
-		)
-		respKey, _, _, _ := cert.UnmarshalPrivateKeyFromPEM(respKeyPEM)
-		respHs, _ := respCert.MarshalForHandshakes()
-		ncs := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
-		respCS := &testCertState{
-			version: cert.Version1,
-			creds: map[cert.Version]*Credential{
-				cert.Version1: NewCredential(respCert, respHs, respKey, ncs),
-			},
-		}
-
-		v := testVerifier(caPool)
-		_, _, respResult, _, err := initiateHandshake(
-			t, initCS, v,
-			respCS, v,
-		)
-		require.NoError(t, err)
-		require.NotNil(t, respResult)
-
-		assert.Equal(t, cert.Version1, respResult.MyCert.Version(),
-			"responder should keep V1 when V2 not available")
-	})
-}

handshake/patterns.go

@@ -1,54 +0,0 @@
-package handshake
-
-import (
-	"fmt"
-
-	"github.com/flynn/noise"
-	"github.com/slackhq/nebula/header"
-)
-
-// msgFlags tracks what application data a handshake message carries.
-type msgFlags struct {
-	expectsPayload bool // message carries indexes and time
-	expectsCert    bool // message carries the certificate
-}
-
-// subtypeInfo bundles the noise pattern with the per-message flags for a
-// given handshake subtype.
-type subtypeInfo struct {
-	pattern noise.HandshakePattern
-	msgs    []msgFlags
-}
-
-// subtypeInfos defines the noise pattern and message content layout for each
-// handshake subtype.
-var subtypeInfos = map[header.MessageSubType]subtypeInfo{
-	// IX: 2 messages, both carry payload and cert
-	header.HandshakeIXPSK0: {
-		pattern: noise.HandshakeIX,
-		msgs: []msgFlags{
-			{expectsPayload: true, expectsCert: true},
-			{expectsPayload: true, expectsCert: true},
-		},
-	},
-
-	// XX: 3 messages
-	//   msg1 (I->R): payload only
-	//   msg2 (R->I): payload + cert
-	//   msg3 (I->R): cert only
-	//header.HandshakeXXPSK0: {
-	//	pattern: noise.HandshakeXX,
-	//	msgs: []msgFlags{
-	//		{expectsPayload: true, expectsCert: false},
-	//		{expectsPayload: true, expectsCert: true},
-	//		{expectsPayload: false, expectsCert: true},
-	//	},
-	//},
-}
-
-func subtypeInfoFor(subtype header.MessageSubType) (subtypeInfo, error) {
-	if info, ok := subtypeInfos[subtype]; ok {
-		return info, nil
-	}
-	return subtypeInfo{}, fmt.Errorf("%w: %d", ErrUnknownSubtype, subtype)
-}

handshake/patterns_test.go

@@ -1,63 +0,0 @@
-package handshake
-
-import (
-	"testing"
-
-	"github.com/flynn/noise"
-	"github.com/slackhq/nebula/header"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSubtypeInfo(t *testing.T) {
-	t.Run("IX", func(t *testing.T) {
-		info, err := subtypeInfoFor(header.HandshakeIXPSK0)
-		require.NoError(t, err)
-		assert.Equal(t, noise.HandshakeIX.Name, info.pattern.Name)
-		require.Len(t, info.msgs, 2)
-		// msg1: payload + cert
-		assert.True(t, info.msgs[0].expectsPayload)
-		assert.True(t, info.msgs[0].expectsCert)
-		// msg2: payload + cert
-		assert.True(t, info.msgs[1].expectsPayload)
-		assert.True(t, info.msgs[1].expectsCert)
-	})
-
-	t.Run("XX", func(t *testing.T) {
-		registerTestXXInfo(t)
-		info, err := subtypeInfoFor(header.HandshakeXXPSK0)
-		require.NoError(t, err)
-		assert.Equal(t, noise.HandshakeXX.Name, info.pattern.Name)
-		require.Len(t, info.msgs, 3)
-		// msg1: payload only
-		assert.True(t, info.msgs[0].expectsPayload)
-		assert.False(t, info.msgs[0].expectsCert)
-		// msg2: payload + cert
-		assert.True(t, info.msgs[1].expectsPayload)
-		assert.True(t, info.msgs[1].expectsCert)
-		// msg3: cert only
-		assert.False(t, info.msgs[2].expectsPayload)
-		assert.True(t, info.msgs[2].expectsCert)
-	})
-
-	t.Run("unknown subtype returns error", func(t *testing.T) {
-		_, err := subtypeInfoFor(99)
-		require.ErrorIs(t, err, ErrUnknownSubtype)
-	})
-}
-
-// registerTestXXInfo temporarily registers XX subtype info for testing.
-func registerTestXXInfo(t *testing.T) {
-	t.Helper()
-	subtypeInfos[header.HandshakeXXPSK0] = subtypeInfo{
-		pattern: noise.HandshakeXX,
-		msgs: []msgFlags{
-			{expectsPayload: true, expectsCert: false},
-			{expectsPayload: true, expectsCert: true},
-			{expectsPayload: false, expectsCert: true},
-		},
-	}
-	t.Cleanup(func() {
-		delete(subtypeInfos, header.HandshakeXXPSK0)
-	})
-}

handshake/payload.go

@@ -1,173 +0,0 @@
-package handshake
-
-import (
-	"errors"
-	"math"
-
-	"google.golang.org/protobuf/encoding/protowire"
-)
-
-var (
-	errInvalidHandshakeMessage = errors.New("invalid handshake message")
-	errInvalidHandshakeDetails = errors.New("invalid handshake details")
-)
-
-// Payload represents the decoded fields of a handshake message.
-// Wire format is protobuf-compatible with NebulaHandshake{Details: NebulaHandshakeDetails{...}}.
-type Payload struct {
-	Cert           []byte
-	InitiatorIndex uint32
-	ResponderIndex uint32
-	Time           uint64
-	CertVersion    uint32
-}
-
-// Proto field numbers for NebulaHandshakeDetails
-const (
-	fieldCert           = 1 // bytes
-	fieldInitiatorIndex = 2 // uint32
-	fieldResponderIndex = 3 // uint32
-	fieldTime           = 5 // uint64
-	fieldCertVersion    = 8 // uint32
-)
-
-// MarshalPayload encodes a handshake payload in protobuf wire format compatible
-// with NebulaHandshake{Details: NebulaHandshakeDetails{...}}.
-// Returns out (which may be nil), with the marshalled Payload appended to it.
-func MarshalPayload(out []byte, p Payload) []byte {
-	var details []byte
-
-	if len(p.Cert) > 0 {
-		details = protowire.AppendTag(details, fieldCert, protowire.BytesType)
-		details = protowire.AppendBytes(details, p.Cert)
-	}
-	if p.InitiatorIndex != 0 {
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, uint64(p.InitiatorIndex))
-	}
-	if p.ResponderIndex != 0 {
-		details = protowire.AppendTag(details, fieldResponderIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, uint64(p.ResponderIndex))
-	}
-	if p.Time != 0 {
-		details = protowire.AppendTag(details, fieldTime, protowire.VarintType)
-		details = protowire.AppendVarint(details, p.Time)
-	}
-	if p.CertVersion != 0 {
-		details = protowire.AppendTag(details, fieldCertVersion, protowire.VarintType)
-		details = protowire.AppendVarint(details, uint64(p.CertVersion))
-	}
-
-	out = protowire.AppendTag(out, 1, protowire.BytesType)
-	out = protowire.AppendBytes(out, details)
-
-	return out
-}
-
-// UnmarshalPayload decodes a protobuf-encoded NebulaHandshake message.
-func UnmarshalPayload(b []byte) (Payload, error) {
-	var p Payload
-
-	for len(b) > 0 {
-		num, typ, n := protowire.ConsumeTag(b)
-		if n < 0 {
-			return p, errInvalidHandshakeMessage
-		}
-		b = b[n:]
-
-		switch {
-		case num == 1 && typ == protowire.BytesType:
-			details, n := protowire.ConsumeBytes(b)
-			if n < 0 {
-				return p, errInvalidHandshakeMessage
-			}
-			b = b[n:]
-			if err := unmarshalPayloadDetails(&p, details); err != nil {
-				return p, err
-			}
-		default:
-			n := protowire.ConsumeFieldValue(num, typ, b)
-			if n < 0 {
-				return p, errInvalidHandshakeMessage
-			}
-			b = b[n:]
-		}
-	}
-
-	return p, nil
-}
-
-func unmarshalPayloadDetails(p *Payload, b []byte) error {
-	for len(b) > 0 {
-		num, typ, n := protowire.ConsumeTag(b)
-		if n < 0 {
-			return errInvalidHandshakeDetails
-		}
-		b = b[n:]
-
-		// For known field numbers, reject any non-matching wire type as a
-		// hard error rather than silently skipping. The caller will catch
-		// missing-field cases downstream, but a wire-type mismatch on a tag
-		// we know is a peer protocol violation worth flagging here.
-		// Repeated occurrences of a singular field follow proto3 last-wins.
-		switch num {
-		case fieldCert:
-			if typ != protowire.BytesType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeBytes(b)
-			if n < 0 {
-				return errInvalidHandshakeDetails
-			}
-			p.Cert = append([]byte(nil), v...)
-			b = b[n:]
-		case fieldInitiatorIndex:
-			if typ != protowire.VarintType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeVarint(b)
-			if n < 0 || v > math.MaxUint32 {
-				return errInvalidHandshakeDetails
-			}
-			p.InitiatorIndex = uint32(v)
-			b = b[n:]
-		case fieldResponderIndex:
-			if typ != protowire.VarintType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeVarint(b)
-			if n < 0 || v > math.MaxUint32 {
-				return errInvalidHandshakeDetails
-			}
-			p.ResponderIndex = uint32(v)
-			b = b[n:]
-		case fieldTime:
-			if typ != protowire.VarintType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeVarint(b)
-			if n < 0 {
-				return errInvalidHandshakeDetails
-			}
-			p.Time = v
-			b = b[n:]
-		case fieldCertVersion:
-			if typ != protowire.VarintType {
-				return errInvalidHandshakeDetails
-			}
-			v, n := protowire.ConsumeVarint(b)
-			if n < 0 || v > math.MaxUint32 {
-				return errInvalidHandshakeDetails
-			}
-			p.CertVersion = uint32(v)
-			b = b[n:]
-		default:
-			n := protowire.ConsumeFieldValue(num, typ, b)
-			if n < 0 {
-				return errInvalidHandshakeDetails
-			}
-			b = b[n:]
-		}
-	}
-	return nil
-}

handshake/payload_test.go

@@ -1,361 +0,0 @@
-package handshake
-
-import (
-	"bytes"
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/encoding/protowire"
-)
-
-func TestPayloadRoundTrip(t *testing.T) {
-	t.Run("all fields set", func(t *testing.T) {
-		data := MarshalPayload(nil, Payload{
-			Cert:           []byte("test-cert-bytes"),
-			CertVersion:    2,
-			InitiatorIndex: 12345,
-			ResponderIndex: 67890,
-			Time:           1234567890,
-		})
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-
-		assert.Equal(t, []byte("test-cert-bytes"), got.Cert)
-		assert.Equal(t, uint32(12345), got.InitiatorIndex)
-		assert.Equal(t, uint32(67890), got.ResponderIndex)
-		assert.Equal(t, uint64(1234567890), got.Time)
-		assert.Equal(t, uint32(2), got.CertVersion)
-	})
-
-	t.Run("minimal fields", func(t *testing.T) {
-		data := MarshalPayload(nil, Payload{InitiatorIndex: 1})
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-
-		assert.Equal(t, uint32(1), got.InitiatorIndex)
-		assert.Equal(t, uint32(0), got.ResponderIndex)
-		assert.Equal(t, uint64(0), got.Time)
-		assert.Nil(t, got.Cert)
-	})
-
-	t.Run("empty payload", func(t *testing.T) {
-		data := MarshalPayload(nil, Payload{})
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-
-		assert.Equal(t, uint32(0), got.InitiatorIndex)
-	})
-
-	t.Run("large cert bytes", func(t *testing.T) {
-		bigCert := make([]byte, 4096)
-		for i := range bigCert {
-			bigCert[i] = byte(i % 256)
-		}
-
-		data := MarshalPayload(nil, Payload{
-			Cert:           bigCert,
-			CertVersion:    2,
-			InitiatorIndex: 999,
-		})
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-
-		assert.Equal(t, bigCert, got.Cert)
-		assert.Equal(t, uint32(999), got.InitiatorIndex)
-	})
-
-	t.Run("append to existing buffer", func(t *testing.T) {
-		prefix := []byte("prefix")
-		data := MarshalPayload(prefix, Payload{InitiatorIndex: 42})
-
-		assert.Equal(t, []byte("prefix"), data[:6])
-
-		got, err := UnmarshalPayload(data[6:])
-		require.NoError(t, err)
-		assert.Equal(t, uint32(42), got.InitiatorIndex)
-	})
-}
-
-func TestPayloadUnknownFields(t *testing.T) {
-	t.Run("unknown field in outer message is skipped", func(t *testing.T) {
-		// Marshal a normal payload then append an unknown field (field 99, varint)
-		data := MarshalPayload(nil, Payload{InitiatorIndex: 42})
-		data = protowire.AppendTag(data, 99, protowire.VarintType)
-		data = protowire.AppendVarint(data, 12345)
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-		assert.Equal(t, uint32(42), got.InitiatorIndex)
-	})
-
-	t.Run("unknown field in details is skipped", func(t *testing.T) {
-		// Build details with a known field + unknown field
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, 77)
-		// Unknown field 50, varint
-		details = protowire.AppendTag(details, 50, protowire.VarintType)
-		details = protowire.AppendVarint(details, 9999)
-		// Another known field after the unknown one
-		details = protowire.AppendTag(details, fieldResponderIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, 88)
-
-		// Wrap in outer message
-		var data []byte
-		data = protowire.AppendTag(data, 1, protowire.BytesType)
-		data = protowire.AppendBytes(data, details)
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-		assert.Equal(t, uint32(77), got.InitiatorIndex)
-		assert.Equal(t, uint32(88), got.ResponderIndex)
-	})
-
-	t.Run("reserved fields 6 and 7 are skipped", func(t *testing.T) {
-		// Fields 6 and 7 are reserved in the proto definition
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, 100)
-		details = protowire.AppendTag(details, 6, protowire.VarintType)
-		details = protowire.AppendVarint(details, 1)
-		details = protowire.AppendTag(details, 7, protowire.VarintType)
-		details = protowire.AppendVarint(details, 2)
-
-		var data []byte
-		data = protowire.AppendTag(data, 1, protowire.BytesType)
-		data = protowire.AppendBytes(data, details)
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-		assert.Equal(t, uint32(100), got.InitiatorIndex)
-	})
-}
-
-func TestPayloadBytesConsumed(t *testing.T) {
-	t.Run("all bytes consumed on valid input", func(t *testing.T) {
-		original := Payload{
-			Cert:           []byte("cert"),
-			CertVersion:    2,
-			InitiatorIndex: 100,
-			ResponderIndex: 200,
-			Time:           999,
-		}
-		data := MarshalPayload(nil, original)
-
-		got, err := UnmarshalPayload(data)
-		require.NoError(t, err)
-
-		// Re-marshal and compare — proves we consumed and reproduced all fields
-		remarshaled := MarshalPayload(nil, got)
-		assert.Equal(t, data, remarshaled)
-	})
-}
-
-// wrapDetails wraps raw detail bytes in the outer NebulaHandshake envelope
-// so UnmarshalPayload can reach unmarshalPayloadDetails.
-func wrapDetails(details []byte) []byte {
-	var out []byte
-	out = protowire.AppendTag(out, 1, protowire.BytesType)
-	out = protowire.AppendBytes(out, details)
-	return out
-}
-
-func TestPayloadUnmarshalErrors(t *testing.T) {
-	t.Run("nil input", func(t *testing.T) {
-		got, err := UnmarshalPayload(nil)
-		require.NoError(t, err)
-		assert.Equal(t, uint32(0), got.InitiatorIndex)
-	})
-
-	t.Run("truncated outer tag", func(t *testing.T) {
-		_, err := UnmarshalPayload([]byte{0x80})
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated outer details field", func(t *testing.T) {
-		_, err := UnmarshalPayload([]byte{0x0a, 0x64, 0x01, 0x02, 0x03, 0x04, 0x05})
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated outer unknown field", func(t *testing.T) {
-		// Valid tag for unknown field 99 varint, but no value follows
-		var data []byte
-		data = protowire.AppendTag(data, 99, protowire.VarintType)
-		_, err := UnmarshalPayload(data)
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated details tag", func(t *testing.T) {
-		_, err := UnmarshalPayload(wrapDetails([]byte{0x80}))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated cert bytes", func(t *testing.T) {
-		// Field 1 (cert), bytes type, length 10 but only 2 bytes
-		var details []byte
-		details = protowire.AppendTag(details, fieldCert, protowire.BytesType)
-		details = append(details, 0x0a, 0x01, 0x02) // length 10, only 2 bytes
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated initiator index varint", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = append(details, 0x80) // incomplete varint
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated responder index varint", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldResponderIndex, protowire.VarintType)
-		details = append(details, 0x80)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated time varint", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldTime, protowire.VarintType)
-		details = append(details, 0x80)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated cert version varint", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldCertVersion, protowire.VarintType)
-		details = append(details, 0x80)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("truncated unknown field in details", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, 50, protowire.VarintType)
-		details = append(details, 0x80) // incomplete varint
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("cert with wrong wire type rejected", func(t *testing.T) {
-		// fieldCert as Varint instead of Bytes.
-		var details []byte
-		details = protowire.AppendTag(details, fieldCert, protowire.VarintType)
-		details = protowire.AppendVarint(details, 42)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("initiator index with wrong wire type rejected", func(t *testing.T) {
-		// fieldInitiatorIndex as Bytes instead of Varint.
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.BytesType)
-		details = protowire.AppendBytes(details, []byte{1, 2, 3})
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("time with wrong wire type rejected", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldTime, protowire.BytesType)
-		details = protowire.AppendBytes(details, []byte{1, 2, 3})
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("cert version with wrong wire type rejected", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldCertVersion, protowire.BytesType)
-		details = protowire.AppendBytes(details, []byte{1, 2, 3})
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("repeated singular field follows proto3 last-wins", func(t *testing.T) {
-		// Per proto3, multiple instances of a singular field are accepted and
-		// the last value wins. We keep this behavior so that peers using
-		// alternative encoders aren't rejected.
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, 1)
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, 42)
-		got, err := UnmarshalPayload(wrapDetails(details))
-		require.NoError(t, err)
-		assert.Equal(t, uint32(42), got.InitiatorIndex)
-	})
-
-	t.Run("initiator index varint overflow rejected", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldInitiatorIndex, protowire.VarintType)
-		details = protowire.AppendVarint(details, math.MaxUint32+1)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-	t.Run("cert version varint overflow rejected", func(t *testing.T) {
-		var details []byte
-		details = protowire.AppendTag(details, fieldCertVersion, protowire.VarintType)
-		details = protowire.AppendVarint(details, math.MaxUint32+1)
-		_, err := UnmarshalPayload(wrapDetails(details))
-		assert.Error(t, err)
-	})
-
-}
-
-// FuzzPayload feeds arbitrary bytes through UnmarshalPayload to confirm it
-// never panics, and for any input that parses cleanly, that re-marshal +
-// re-parse is a fix-point. Inputs come from an authenticated peer (post-
-// noise-decrypt), so the threat model is "valid peer behaving arbitrarily,"
-// not "unauthenticated injection."
-func FuzzPayload(f *testing.F) {
-	// Seed corpus with a handful of known-good shapes.
-	f.Add(MarshalPayload(nil, Payload{}))
-	f.Add(MarshalPayload(nil, Payload{Cert: []byte{1, 2, 3}, CertVersion: 2}))
-	f.Add(MarshalPayload(nil, Payload{InitiatorIndex: 42, Time: 1}))
-	f.Add(MarshalPayload(nil, Payload{
-		Cert:           []byte("seed-cert"),
-		InitiatorIndex: 1,
-		ResponderIndex: 2,
-		Time:           3,
-		CertVersion:    2,
-	}))
-	f.Add([]byte{})
-	f.Add([]byte{0xff})
-
-	f.Fuzz(func(t *testing.T, data []byte) {
-		p1, err := UnmarshalPayload(data)
-		if err != nil {
-			return
-		}
-
-		// For any input that parses, re-marshaling and re-parsing must
-		// yield an equivalent Payload. This catches dispatch bugs (e.g.
-		// emitting a field on marshal that we don't accept on parse) and
-		// any non-idempotent parsing behavior.
-		b2 := MarshalPayload(nil, p1)
-		p2, err := UnmarshalPayload(b2)
-		if err != nil {
-			t.Fatalf("re-parse of self-marshaled payload failed: %v\nintermediate: %x\n", err, b2)
-		}
-		if !payloadsEqual(p1, p2) {
-			t.Fatalf("re-marshal not idempotent\nfirst:  %+v\nsecond: %+v", p1, p2)
-		}
-	})
-}
-
-func payloadsEqual(a, b Payload) bool {
-	return bytes.Equal(a.Cert, b.Cert) &&
-		a.InitiatorIndex == b.InitiatorIndex &&
-		a.ResponderIndex == b.ResponderIndex &&
-		a.Time == b.Time &&
-		a.CertVersion == b.CertVersion
-}

handshake_ix.go

@@ -0,0 +1,678 @@
+package nebula
+
+import (
+	"bytes"
+	"net/netip"
+	"time"
+
+	"github.com/flynn/noise"
+	"github.com/sirupsen/logrus"
+	"github.com/slackhq/nebula/cert"
+	"github.com/slackhq/nebula/header"
+)
+
+// NOISE IX Handshakes
+
+// This function constructs a handshake packet, but does not actually send it
+// Sending is done by the handshake manager
+func ixHandshakeStage0(f *Interface, hh *HandshakeHostInfo) bool {
+	err := f.handshakeManager.allocateIndex(hh)
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", hh.hostinfo.vpnAddrs).
+			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).Error("Failed to generate index")
+		return false
+	}
+
+	cs := f.pki.getCertState()
+	v := cs.initiatingVersion
+	if hh.initiatingVersionOverride != cert.VersionPre1 {
+		v = hh.initiatingVersionOverride
+	} else if v < cert.Version2 {
+		// If we're connecting to a v6 address we should encourage use of a V2 cert
+		for _, a := range hh.hostinfo.vpnAddrs {
+			if a.Is6() {
+				v = cert.Version2
+				break
+			}
+		}
+	}
+
+	crt := cs.getCertificate(v)
+	if crt == nil {
+		f.l.WithField("vpnAddrs", hh.hostinfo.vpnAddrs).
+			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).
+			WithField("certVersion", v).
+			Error("Unable to handshake with host because no certificate is available")
+		return false
+	}
+
+	crtHs := cs.getHandshakeBytes(v)
+	if crtHs == nil {
+		f.l.WithField("vpnAddrs", hh.hostinfo.vpnAddrs).
+			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).
+			WithField("certVersion", v).
+			Error("Unable to handshake with host because no certificate handshake bytes is available")
+		return false
+	}
+
+	ci, err := NewConnectionState(f.l, cs, crt, true, noise.HandshakeIX)
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", hh.hostinfo.vpnAddrs).
+			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).
+			WithField("certVersion", v).
+			Error("Failed to create connection state")
+		return false
+	}
+	hh.hostinfo.ConnectionState = ci
+
+	hs := &NebulaHandshake{
+		Details: &NebulaHandshakeDetails{
+			InitiatorIndex: hh.hostinfo.localIndexId,
+			Time:           uint64(time.Now().UnixNano()),
+			Cert:           crtHs,
+			CertVersion:    uint32(v),
+		},
+	}
+
+	hsBytes, err := hs.Marshal()
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", hh.hostinfo.vpnAddrs).
+			WithField("certVersion", v).
+			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).Error("Failed to marshal handshake message")
+		return false
+	}
+
+	h := header.Encode(make([]byte, header.Len), header.Version, header.Handshake, header.HandshakeIXPSK0, 0, 1)
+
+	msg, _, _, err := ci.H.WriteMessage(h, hsBytes)
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", hh.hostinfo.vpnAddrs).
+			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).Error("Failed to call noise.WriteMessage")
+		return false
+	}
+
+	// We are sending handshake packet 1, so we don't expect to receive
+	// handshake packet 1 from the responder
+	ci.window.Update(f.l, 1)
+
+	hh.hostinfo.HandshakePacket[0] = msg
+	hh.ready = true
+	return true
+}
+
+func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H) {
+	cs := f.pki.getCertState()
+	crt := cs.GetDefaultCertificate()
+	if crt == nil {
+		f.l.WithField("from", via).
+			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).
+			WithField("certVersion", cs.initiatingVersion).
+			Error("Unable to handshake with host because no certificate is available")
+		return
+	}
+
+	ci, err := NewConnectionState(f.l, cs, crt, false, noise.HandshakeIX)
+	if err != nil {
+		f.l.WithError(err).WithField("from", via).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			Error("Failed to create connection state")
+		return
+	}
+
+	// Mark packet 1 as seen so it doesn't show up as missed
+	ci.window.Update(f.l, 1)
+
+	msg, _, _, err := ci.H.ReadMessage(nil, packet[header.Len:])
+	if err != nil {
+		f.l.WithError(err).WithField("from", via).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			Error("Failed to call noise.ReadMessage")
+		return
+	}
+
+	hs := &NebulaHandshake{}
+	err = hs.Unmarshal(msg)
+	if err != nil || hs.Details == nil {
+		f.l.WithError(err).WithField("from", via).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			Error("Failed unmarshal handshake message")
+		return
+	}
+
+	rc, err := cert.Recombine(cert.Version(hs.Details.CertVersion), hs.Details.Cert, ci.H.PeerStatic(), ci.Curve())
+	if err != nil {
+		f.l.WithError(err).WithField("from", via).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			Info("Handshake did not contain a certificate")
+		return
+	}
+
+	remoteCert, err := f.pki.GetCAPool().VerifyCertificate(time.Now(), rc)
+	if err != nil {
+		fp, fperr := rc.Fingerprint()
+		if fperr != nil {
+			fp = "<error generating certificate fingerprint>"
+		}
+
+		e := f.l.WithError(err).WithField("from", via).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			WithField("certVpnNetworks", rc.Networks()).
+			WithField("certFingerprint", fp)
+
+		if f.l.Level >= logrus.DebugLevel {
+			e = e.WithField("cert", rc)
+		}
+
+		e.Info("Invalid certificate from host")
+		return
+	}
+
+	if !bytes.Equal(remoteCert.Certificate.PublicKey(), ci.H.PeerStatic()) {
+		f.l.WithField("from", via).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			WithField("cert", remoteCert).Info("public key mismatch between certificate and handshake")
+		return
+	}
+
+	if remoteCert.Certificate.Version() != ci.myCert.Version() {
+		// We started off using the wrong certificate version, lets see if we can match the version that was sent to us
+		myCertOtherVersion := cs.getCertificate(remoteCert.Certificate.Version())
+		if myCertOtherVersion == nil {
+			if f.l.Level >= logrus.DebugLevel {
+				f.l.WithError(err).WithFields(m{
+					"from":      via,
+					"handshake": m{"stage": 1, "style": "ix_psk0"},
+					"cert":      remoteCert,
+				}).Debug("Might be unable to handshake with host due to missing certificate version")
+			}
+		} else {
+			// Record the certificate we are actually using
+			ci.myCert = myCertOtherVersion
+		}
+	}
+
+	if len(remoteCert.Certificate.Networks()) == 0 {
+		f.l.WithError(err).WithField("from", via).
+			WithField("cert", remoteCert).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			Info("No networks in certificate")
+		return
+	}
+
+	certName := remoteCert.Certificate.Name()
+	certVersion := remoteCert.Certificate.Version()
+	fingerprint := remoteCert.Fingerprint
+	issuer := remoteCert.Certificate.Issuer()
+	vpnNetworks := remoteCert.Certificate.Networks()
+
+	anyVpnAddrsInCommon := false
+	vpnAddrs := make([]netip.Addr, len(vpnNetworks))
+	for i, network := range vpnNetworks {
+		if f.myVpnAddrsTable.Contains(network.Addr()) {
+			f.l.WithField("vpnNetworks", vpnNetworks).WithField("from", via).
+				WithField("certName", certName).
+				WithField("certVersion", certVersion).
+				WithField("fingerprint", fingerprint).
+				WithField("issuer", issuer).
+				WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("Refusing to handshake with myself")
+			return
+		}
+		vpnAddrs[i] = network.Addr()
+		if f.myVpnNetworksTable.Contains(network.Addr()) {
+			anyVpnAddrsInCommon = true
+		}
+	}
+
+	if !via.IsRelayed {
+		// We only want to apply the remote allow list for direct tunnels here
+		if !f.lightHouse.GetRemoteAllowList().AllowAll(vpnAddrs, via.UdpAddr.Addr()) {
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+				Debug("lighthouse.remote_allow_list denied incoming handshake")
+			return
+		}
+	}
+
+	myIndex, err := generateIndex(f.l)
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("Failed to generate index")
+		return
+	}
+
+	hostinfo := &HostInfo{
+		ConnectionState:   ci,
+		localIndexId:      myIndex,
+		remoteIndexId:     hs.Details.InitiatorIndex,
+		vpnAddrs:          vpnAddrs,
+		HandshakePacket:   make(map[uint8][]byte, 0),
+		lastHandshakeTime: hs.Details.Time,
+		relayState: RelayState{
+			relays:         nil,
+			relayForByAddr: map[netip.Addr]*Relay{},
+			relayForByIdx:  map[uint32]*Relay{},
+		},
+	}
+
+	msgRxL := f.l.WithFields(m{
+		"vpnAddrs":       vpnAddrs,
+		"from":           via,
+		"certName":       certName,
+		"certVersion":    certVersion,
+		"fingerprint":    fingerprint,
+		"issuer":         issuer,
+		"initiatorIndex": hs.Details.InitiatorIndex,
+		"responderIndex": hs.Details.ResponderIndex,
+		"remoteIndex":    h.RemoteIndex,
+		"handshake":      m{"stage": 1, "style": "ix_psk0"},
+	})
+
+	if anyVpnAddrsInCommon {
+		msgRxL.Info("Handshake message received")
+	} else {
+		//todo warn if not lighthouse or relay?
+		msgRxL.Info("Handshake message received, but no vpnNetworks in common.")
+	}
+
+	hs.Details.ResponderIndex = myIndex
+	hs.Details.Cert = cs.getHandshakeBytes(ci.myCert.Version())
+	if hs.Details.Cert == nil {
+		msgRxL.WithField("myCertVersion", ci.myCert.Version()).
+			Error("Unable to handshake with host because no certificate handshake bytes is available")
+		return
+	}
+
+	hs.Details.CertVersion = uint32(ci.myCert.Version())
+	// Update the time in case their clock is way off from ours
+	hs.Details.Time = uint64(time.Now().UnixNano())
+
+	hsBytes, err := hs.Marshal()
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("Failed to marshal handshake message")
+		return
+	}
+
+	nh := header.Encode(make([]byte, header.Len), header.Version, header.Handshake, header.HandshakeIXPSK0, hs.Details.InitiatorIndex, 2)
+	msg, dKey, eKey, err := ci.H.WriteMessage(nh, hsBytes)
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("Failed to call noise.WriteMessage")
+		return
+	} else if dKey == nil || eKey == nil {
+		f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("Noise did not arrive at a key")
+		return
+	}
+
+	hostinfo.HandshakePacket[0] = make([]byte, len(packet[header.Len:]))
+	copy(hostinfo.HandshakePacket[0], packet[header.Len:])
+
+	// Regardless of whether you are the sender or receiver, you should arrive here
+	// and complete standing up the connection.
+	hostinfo.HandshakePacket[2] = make([]byte, len(msg))
+	copy(hostinfo.HandshakePacket[2], msg)
+
+	// We are sending handshake packet 2, so we don't expect to receive
+	// handshake packet 2 from the initiator.
+	ci.window.Update(f.l, 2)
+
+	ci.peerCert = remoteCert
+	ci.dKey = NewNebulaCipherState(dKey)
+	ci.eKey = NewNebulaCipherState(eKey)
+
+	hostinfo.remotes = f.lightHouse.QueryCache(vpnAddrs)
+	if !via.IsRelayed {
+		hostinfo.SetRemote(via.UdpAddr)
+	}
+	hostinfo.buildNetworks(f.myVpnNetworksTable, remoteCert.Certificate)
+
+	existing, err := f.handshakeManager.CheckAndComplete(hostinfo, 0, f)
+	if err != nil {
+		switch err {
+		case ErrAlreadySeen:
+			// Update remote if preferred
+			if existing.SetRemoteIfPreferred(f.hostMap, via) {
+				// Send a test packet to ensure the other side has also switched to
+				// the preferred remote
+				f.SendMessageToVpnAddr(header.Test, header.TestRequest, vpnAddrs[0], []byte(""), make([]byte, 12, 12), make([]byte, mtu))
+			}
+
+			msg = existing.HandshakePacket[2]
+			f.messageMetrics.Tx(header.Handshake, header.MessageSubType(msg[1]), 1)
+			if !via.IsRelayed {
+				err := f.outside.WriteTo(msg, via.UdpAddr)
+				if err != nil {
+					f.l.WithField("vpnAddrs", existing.vpnAddrs).WithField("from", via).
+						WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).WithField("cached", true).
+						WithError(err).Error("Failed to send handshake message")
+				} else {
+					f.l.WithField("vpnAddrs", existing.vpnAddrs).WithField("from", via).
+						WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).WithField("cached", true).
+						Info("Handshake message sent")
+				}
+				return
+			} else {
+				if via.relay == nil {
+					f.l.Error("Handshake send failed: both addr and via.relay are nil.")
+					return
+				}
+				hostinfo.relayState.InsertRelayTo(via.relayHI.vpnAddrs[0])
+				f.SendVia(via.relayHI, via.relay, msg, make([]byte, 12), make([]byte, mtu), false)
+				f.l.WithField("vpnAddrs", existing.vpnAddrs).WithField("relay", via.relayHI.vpnAddrs[0]).
+					WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).WithField("cached", true).
+					Info("Handshake message sent")
+				return
+			}
+		case ErrExistingHostInfo:
+			// This means there was an existing tunnel and this handshake was older than the one we are currently based on
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+				WithField("certName", certName).
+				WithField("certVersion", certVersion).
+				WithField("oldHandshakeTime", existing.lastHandshakeTime).
+				WithField("newHandshakeTime", hostinfo.lastHandshakeTime).
+				WithField("fingerprint", fingerprint).
+				WithField("issuer", issuer).
+				WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+				WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+				Info("Handshake too old")
+
+			// Send a test packet to trigger an authenticated tunnel test, this should suss out any lingering tunnel issues
+			f.SendMessageToVpnAddr(header.Test, header.TestRequest, vpnAddrs[0], []byte(""), make([]byte, 12, 12), make([]byte, mtu))
+			return
+		case ErrLocalIndexCollision:
+			// This means we failed to insert because of collision on localIndexId. Just let the next handshake packet retry
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+				WithField("certName", certName).
+				WithField("certVersion", certVersion).
+				WithField("fingerprint", fingerprint).
+				WithField("issuer", issuer).
+				WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+				WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+				WithField("localIndex", hostinfo.localIndexId).WithField("collision", existing.vpnAddrs).
+				Error("Failed to add HostInfo due to localIndex collision")
+			return
+		default:
+			// Shouldn't happen, but just in case someone adds a new error type to CheckAndComplete
+			// And we forget to update it here
+			f.l.WithError(err).WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+				WithField("certName", certName).
+				WithField("certVersion", certVersion).
+				WithField("fingerprint", fingerprint).
+				WithField("issuer", issuer).
+				WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+				WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+				Error("Failed to add HostInfo to HostMap")
+			return
+		}
+	}
+
+	// Do the send
+	f.messageMetrics.Tx(header.Handshake, header.MessageSubType(msg[1]), 1)
+	if !via.IsRelayed {
+		err = f.outside.WriteTo(msg, via.UdpAddr)
+		log := f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+			WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 2, "style": "ix_psk0"})
+		if err != nil {
+			log.WithError(err).Error("Failed to send handshake")
+		} else {
+			log.Info("Handshake message sent")
+		}
+	} else {
+		if via.relay == nil {
+			f.l.Error("Handshake send failed: both addr and via.relay are nil.")
+			return
+		}
+		hostinfo.relayState.InsertRelayTo(via.relayHI.vpnAddrs[0])
+		// I successfully received a handshake. Just in case I marked this tunnel as 'Disestablished', ensure
+		// it's correctly marked as working.
+		via.relayHI.relayState.UpdateRelayForByIdxState(via.remoteIdx, Established)
+		f.SendVia(via.relayHI, via.relay, msg, make([]byte, 12), make([]byte, mtu), false)
+		f.l.WithField("vpnAddrs", vpnAddrs).WithField("relay", via.relayHI.vpnAddrs[0]).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+			WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			Info("Handshake message sent")
+	}
+
+	f.connectionManager.AddTrafficWatch(hostinfo)
+
+	hostinfo.remotes.RefreshFromHandshake(vpnAddrs)
+
+	return
+}
+
+func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packet []byte, h *header.H) bool {
+	if hh == nil {
+		// Nothing here to tear down, got a bogus stage 2 packet
+		return true
+	}
+
+	hh.Lock()
+	defer hh.Unlock()
+
+	hostinfo := hh.hostinfo
+	if !via.IsRelayed {
+		// The vpnAddr we know about is the one we tried to handshake with, use it to apply the remote allow list.
+		if !f.lightHouse.GetRemoteAllowList().AllowAll(hostinfo.vpnAddrs, via.UdpAddr.Addr()) {
+			f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).Debug("lighthouse.remote_allow_list denied incoming handshake")
+			return false
+		}
+	}
+
+	ci := hostinfo.ConnectionState
+	msg, eKey, dKey, err := ci.H.ReadMessage(nil, packet[header.Len:])
+	if err != nil {
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).WithField("header", h).
+			Error("Failed to call noise.ReadMessage")
+
+		// We don't want to tear down the connection on a bad ReadMessage because it could be an attacker trying
+		// to DOS us. Every other error condition after should to allow a possible good handshake to complete in the
+		// near future
+		return false
+	} else if dKey == nil || eKey == nil {
+		f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			Error("Noise did not arrive at a key")
+
+		// This should be impossible in IX but just in case, if we get here then there is no chance to recover
+		// the handshake state machine. Tear it down
+		return true
+	}
+
+	hs := &NebulaHandshake{}
+	err = hs.Unmarshal(msg)
+	if err != nil || hs.Details == nil {
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).Error("Failed unmarshal handshake message")
+
+		// The handshake state machine is complete, if things break now there is no chance to recover. Tear down and start again
+		return true
+	}
+
+	rc, err := cert.Recombine(cert.Version(hs.Details.CertVersion), hs.Details.Cert, ci.H.PeerStatic(), ci.Curve())
+	if err != nil {
+		f.l.WithError(err).WithField("from", via).
+			WithField("vpnAddrs", hostinfo.vpnAddrs).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			Info("Handshake did not contain a certificate")
+		return true
+	}
+
+	remoteCert, err := f.pki.GetCAPool().VerifyCertificate(time.Now(), rc)
+	if err != nil {
+		fp, err := rc.Fingerprint()
+		if err != nil {
+			fp = "<error generating certificate fingerprint>"
+		}
+
+		e := f.l.WithError(err).WithField("from", via).
+			WithField("vpnAddrs", hostinfo.vpnAddrs).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			WithField("certFingerprint", fp).
+			WithField("certVpnNetworks", rc.Networks())
+
+		if f.l.Level >= logrus.DebugLevel {
+			e = e.WithField("cert", rc)
+		}
+
+		e.Info("Invalid certificate from host")
+		return true
+	}
+	if !bytes.Equal(remoteCert.Certificate.PublicKey(), ci.H.PeerStatic()) {
+		f.l.WithField("from", via).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			WithField("cert", remoteCert).Info("public key mismatch between certificate and handshake")
+		return true
+	}
+
+	if len(remoteCert.Certificate.Networks()) == 0 {
+		f.l.WithError(err).WithField("from", via).
+			WithField("vpnAddrs", hostinfo.vpnAddrs).
+			WithField("cert", remoteCert).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			Info("No networks in certificate")
+		return true
+	}
+
+	vpnNetworks := remoteCert.Certificate.Networks()
+	certName := remoteCert.Certificate.Name()
+	certVersion := remoteCert.Certificate.Version()
+	fingerprint := remoteCert.Fingerprint
+	issuer := remoteCert.Certificate.Issuer()
+
+	hostinfo.remoteIndexId = hs.Details.ResponderIndex
+	hostinfo.lastHandshakeTime = hs.Details.Time
+
+	// Store their cert and our symmetric keys
+	ci.peerCert = remoteCert
+	ci.dKey = NewNebulaCipherState(dKey)
+	ci.eKey = NewNebulaCipherState(eKey)
+
+	// Make sure the current udpAddr being used is set for responding
+	if !via.IsRelayed {
+		hostinfo.SetRemote(via.UdpAddr)
+	} else {
+		hostinfo.relayState.InsertRelayTo(via.relayHI.vpnAddrs[0])
+	}
+
+	correctHostResponded := false
+	anyVpnAddrsInCommon := false
+	vpnAddrs := make([]netip.Addr, len(vpnNetworks))
+	for i, network := range vpnNetworks {
+		vpnAddrs[i] = network.Addr()
+		if f.myVpnNetworksTable.Contains(network.Addr()) {
+			anyVpnAddrsInCommon = true
+		}
+		if hostinfo.vpnAddrs[0] == network.Addr() {
+			// todo is it more correct to see if any of hostinfo.vpnAddrs are in the cert? it should have len==1, but one day it might not?
+			correctHostResponded = true
+		}
+	}
+
+	// Ensure the right host responded
+	if !correctHostResponded {
+		f.l.WithField("intendedVpnAddrs", hostinfo.vpnAddrs).WithField("haveVpnNetworks", vpnNetworks).
+			WithField("from", via).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			Info("Incorrect host responded to handshake")
+
+		// Release our old handshake from pending, it should not continue
+		f.handshakeManager.DeleteHostInfo(hostinfo)
+
+		// Create a new hostinfo/handshake for the intended vpn ip
+		//TODO is hostinfo.vpnAddrs[0] always the address to use?
+		f.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], func(newHH *HandshakeHostInfo) {
+			// Block the current used address
+			newHH.hostinfo.remotes = hostinfo.remotes
+			newHH.hostinfo.remotes.BlockRemote(via)
+
+			f.l.WithField("blockedUdpAddrs", newHH.hostinfo.remotes.CopyBlockedRemotes()).
+				WithField("vpnNetworks", vpnNetworks).
+				WithField("remotes", newHH.hostinfo.remotes.CopyAddrs(f.hostMap.GetPreferredRanges())).
+				Info("Blocked addresses for handshakes")
+
+			// Swap the packet store to benefit the original intended recipient
+			newHH.packetStore = hh.packetStore
+			hh.packetStore = []*cachedPacket{}
+
+			// Finally, put the correct vpn addrs in the host info, tell them to close the tunnel, and return true to tear down
+			hostinfo.vpnAddrs = vpnAddrs
+			f.sendCloseTunnel(hostinfo)
+		})
+
+		return true
+	}
+
+	// Mark packet 2 as seen so it doesn't show up as missed
+	ci.window.Update(f.l, 2)
+
+	duration := time.Since(hh.startTime).Nanoseconds()
+	msgRxL := f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+		WithField("certName", certName).
+		WithField("certVersion", certVersion).
+		WithField("fingerprint", fingerprint).
+		WithField("issuer", issuer).
+		WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+		WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+		WithField("durationNs", duration).
+		WithField("sentCachedPackets", len(hh.packetStore))
+	if anyVpnAddrsInCommon {
+		msgRxL.Info("Handshake message received")
+	} else {
+		//todo warn if not lighthouse or relay?
+		msgRxL.Info("Handshake message received, but no vpnNetworks in common.")
+	}
+
+	// Build up the radix for the firewall if we have subnets in the cert
+	hostinfo.vpnAddrs = vpnAddrs
+	hostinfo.buildNetworks(f.myVpnNetworksTable, remoteCert.Certificate)
+
+	// Complete our handshake and update metrics, this will replace any existing tunnels for the vpnAddrs here
+	f.handshakeManager.Complete(hostinfo, f)
+	f.connectionManager.AddTrafficWatch(hostinfo)
+
+	if f.l.Level >= logrus.DebugLevel {
+		hostinfo.logger(f.l).Debugf("Sending %d stored packets", len(hh.packetStore))
+	}
+
+	if len(hh.packetStore) > 0 {
+		nb := make([]byte, 12, 12)
+		out := make([]byte, mtu)
+		for _, cp := range hh.packetStore {
+			cp.callback(cp.messageType, cp.messageSubType, hostinfo, cp.packet, nb, out)
+		}
+		f.cachedPacketMetrics.sent.Inc(int64(len(hh.packetStore)))
+	}
+
+	hostinfo.remotes.RefreshFromHandshake(vpnAddrs)
+	f.metricHandshakes.Update(duration)
+
+	return false
+}

handshake_manager_test.go

@@ -5,7 +5,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/gaissmai/bart"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/test"
@@ -28,7 +27,7 @@ func Test_NewHandshakeManagerVpnIp(t *testing.T) {
 		initiatingVersion: cert.Version1,
 		privateKey:        []byte{},
 		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
+		v1HandshakeBytes:  []byte{},
 	}
 
 	blah := NewHandshakeManager(l, mainHM, lh, &udp.NoopConn{}, defaultHandshakeConfig)
@@ -101,137 +100,3 @@ func (mw *mockEncWriter) GetHostInfo(_ netip.Addr) *HostInfo {
 func (mw *mockEncWriter) GetCertState() *CertState {
 	return &CertState{initiatingVersion: cert.Version2}
 }
-
-func TestValidatePeerCert(t *testing.T) {
-	l := test.NewLogger()
-
-	myNetwork := netip.MustParsePrefix("10.0.0.1/24")
-	myAddrTable := new(bart.Lite)
-	myAddrTable.Insert(netip.PrefixFrom(myNetwork.Addr(), myNetwork.Addr().BitLen()))
-	myNetTable := new(bart.Lite)
-	myNetTable.Insert(myNetwork.Masked())
-
-	newHM := func() *HandshakeManager {
-		hm := NewHandshakeManager(l, newHostMap(l), newTestLighthouse(), &udp.NoopConn{}, defaultHandshakeConfig)
-		hm.f = &Interface{
-			handshakeManager:   hm,
-			pki:                &PKI{},
-			l:                  l,
-			myVpnAddrsTable:    myAddrTable,
-			myVpnNetworksTable: myNetTable,
-			lightHouse:         hm.lightHouse,
-		}
-		return hm
-	}
-
-	cached := func(networks ...netip.Prefix) *cert.CachedCertificate {
-		return &cert.CachedCertificate{
-			Certificate: &dummyCert{name: "peer", networks: networks},
-		}
-	}
-
-	via := ViaSender{
-		UdpAddr:   netip.MustParseAddrPort("198.51.100.7:4242"),
-		IsRelayed: true, // skip the remote allow list (covered separately)
-	}
-
-	t.Run("addr inside our networks sets anyVpnAddrsInCommon", func(t *testing.T) {
-		hm := newHM()
-		// 10.0.0.2 falls inside our 10.0.0.0/24
-		addrs, common, ok := hm.validatePeerCert(via, cached(netip.MustParsePrefix("10.0.0.2/24")))
-		assert.True(t, ok)
-		assert.True(t, common)
-		assert.Equal(t, []netip.Addr{netip.MustParseAddr("10.0.0.2")}, addrs)
-	})
-
-	t.Run("addr outside our networks leaves anyVpnAddrsInCommon false", func(t *testing.T) {
-		hm := newHM()
-		addrs, common, ok := hm.validatePeerCert(via, cached(netip.MustParsePrefix("192.168.1.5/24")))
-		assert.True(t, ok)
-		assert.False(t, common)
-		assert.Equal(t, []netip.Addr{netip.MustParseAddr("192.168.1.5")}, addrs)
-	})
-
-	t.Run("any matching network is enough", func(t *testing.T) {
-		hm := newHM()
-		addrs, common, ok := hm.validatePeerCert(via, cached(
-			netip.MustParsePrefix("192.168.1.5/24"),
-			netip.MustParsePrefix("10.0.0.42/24"),
-		))
-		assert.True(t, ok)
-		assert.True(t, common)
-		assert.Len(t, addrs, 2)
-	})
-
-	t.Run("self-handshake is rejected", func(t *testing.T) {
-		hm := newHM()
-		// 10.0.0.1 is in myVpnAddrsTable
-		addrs, common, ok := hm.validatePeerCert(via, cached(netip.MustParsePrefix("10.0.0.1/24")))
-		assert.False(t, ok)
-		assert.False(t, common)
-		assert.Nil(t, addrs)
-	})
-
-	t.Run("cert with no networks is rejected", func(t *testing.T) {
-		hm := newHM()
-		addrs, common, ok := hm.validatePeerCert(via, cached())
-		assert.False(t, ok)
-		assert.False(t, common)
-		assert.Nil(t, addrs)
-	})
-}
-
-func TestHandleIncomingDispatch(t *testing.T) {
-	l := test.NewLogger()
-
-	newHM := func() *HandshakeManager {
-		hm := NewHandshakeManager(l, newHostMap(l), newTestLighthouse(), &udp.NoopConn{}, defaultHandshakeConfig)
-		hm.f = &Interface{
-			handshakeManager: hm,
-			pki:              &PKI{},
-			l:                l,
-		}
-		return hm
-	}
-
-	via := ViaSender{
-		UdpAddr:   netip.MustParseAddrPort("198.51.100.7:4242"),
-		IsRelayed: true, // bypass remote allow list
-	}
-
-	// A packet body of zero length is fine for these tests: dispatch is
-	// gated on header fields, and we assert that we never reach noise/cert
-	// processing for any of the malformed shapes here.
-	pkt := make([]byte, header.Len)
-
-	t.Run("unsupported subtype dropped", func(t *testing.T) {
-		hm := newHM()
-		h := &header.H{Type: header.Handshake, Subtype: header.MessageSubType(99), MessageCounter: 1}
-		hm.HandleIncoming(via, pkt, h)
-		assert.Empty(t, hm.indexes, "no pending handshake should be created")
-	})
-
-	t.Run("stage-1 with non-zero RemoteIndex dropped", func(t *testing.T) {
-		hm := newHM()
-		h := &header.H{
-			Type:           header.Handshake,
-			Subtype:        header.HandshakeIXPSK0,
-			RemoteIndex:    0xdeadbeef,
-			MessageCounter: 1,
-		}
-		hm.HandleIncoming(via, pkt, h)
-		assert.Empty(t, hm.indexes, "spoofed stage-1 must not create a pending machine")
-	})
-
-	t.Run("continuation with no matching pending index dropped", func(t *testing.T) {
-		hm := newHM()
-		h := &header.H{
-			Type:           header.Handshake,
-			Subtype:        header.HandshakeIXPSK0,
-			RemoteIndex:    0xcafef00d,
-			MessageCounter: 2,
-		}
-		hm.HandleIncoming(via, pkt, h)
-		assert.Empty(t, hm.indexes, "orphan stage-2 must not create state")
-	})
-}

header/header.go

@@ -55,10 +55,8 @@ const (
 )
 
 const (
-	TestRequest      MessageSubType = 0
-	TestReply        MessageSubType = 1
-	MTUDProbeRequest MessageSubType = 2
-	MTUDProbeReply   MessageSubType = 3
+	TestRequest MessageSubType = 0
+	TestReply   MessageSubType = 1
 )
 
 const (
@@ -69,10 +67,8 @@ const (
 var ErrHeaderTooShort = errors.New("header is too short")
 
 var subTypeTestMap = map[MessageSubType]string{
-	TestRequest:      "testRequest",
-	TestReply:        "testReply",
-	MTUDProbeRequest: "mtudProbeRequest",
-	MTUDProbeReply:   "mtudProbeReply",
+	TestRequest: "testRequest",
+	TestReply:   "testReply",
 }
 
 var subTypeNoneMap = map[MessageSubType]string{0: "none"}

hostmap.go

@@ -1,11 +1,9 @@
 package nebula
 
 import (
-	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/netip"
 	"slices"
@@ -15,10 +13,10 @@ import (
 
 	"github.com/gaissmai/bart"
 	"github.com/rcrowley/go-metrics"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/logging"
 )
 
 const defaultPromoteEvery = 1000       // Count of packets sent before we try moving a tunnel to a preferred underlay ip address
@@ -62,7 +60,7 @@ type HostMap struct {
 	RemoteIndexes   map[uint32]*HostInfo
 	Hosts           map[netip.Addr]*HostInfo
 	preferredRanges atomic.Pointer[[]netip.Prefix]
-	l               *slog.Logger
+	l               *logrus.Logger
 }
 
 // For synchronization, treat the pointed-to Relay struct as immutable. To edit the Relay
@@ -226,6 +224,9 @@ const (
 	NetworkTypeVPNPeer
 	// NetworkTypeUnsafe is a network from Certificate.UnsafeNetworks()
 	NetworkTypeUnsafe
+	// NetworkTypeUnverifiedSNATPeer is used to indicate traffic we're willing to route, but never deliver to a NetworkTypeVPN
+	NetworkTypeUnverifiedSNATPeer
+	NetworkTypeInvalidPeer
 )
 
 type HostInfo struct {
@@ -279,6 +280,15 @@ type HostInfo struct {
 	lastUsed time.Time
 }
 
+func (i *HostInfo) HasOnlyV6Addresses() bool {
+	for _, vpnIp := range i.vpnAddrs {
+		if !vpnIp.Is6() {
+			return false
+		}
+	}
+	return true
+}
+
 type ViaSender struct {
 	UdpAddr   netip.AddrPort
 	relayHI   *HostInfo // relayHI is the host info object of the relay
@@ -315,7 +325,7 @@ type cachedPacketMetrics struct {
 	dropped metrics.Counter
 }
 
-func NewHostMapFromConfig(l *slog.Logger, c *config.C) *HostMap {
+func NewHostMapFromConfig(l *logrus.Logger, c *config.C) *HostMap {
 	hm := newHostMap(l)
 
 	hm.reload(c, true)
@@ -323,12 +333,13 @@ func NewHostMapFromConfig(l *slog.Logger, c *config.C) *HostMap {
 		hm.reload(c, false)
 	})
 
-	l.Info("Main HostMap created", "preferredRanges", hm.GetPreferredRanges())
+	l.WithField("preferredRanges", hm.GetPreferredRanges()).
+		Info("Main HostMap created")
 
 	return hm
 }
 
-func newHostMap(l *slog.Logger) *HostMap {
+func newHostMap(l *logrus.Logger) *HostMap {
 	return &HostMap{
 		Indexes:       map[uint32]*HostInfo{},
 		Relays:        map[uint32]*HostInfo{},
@@ -347,10 +358,7 @@ func (hm *HostMap) reload(c *config.C, initial bool) {
 			preferredRange, err := netip.ParsePrefix(rawPreferredRange)
 
 			if err != nil {
-				hm.l.Warn("Failed to parse preferred ranges, ignoring",
-					"error", err,
-					"range", rawPreferredRanges,
-				)
+				hm.l.WithError(err).WithField("range", rawPreferredRanges).Warn("Failed to parse preferred ranges, ignoring")
 				continue
 			}
 
@@ -359,10 +367,7 @@ func (hm *HostMap) reload(c *config.C, initial bool) {
 
 		oldRanges := hm.preferredRanges.Swap(&preferredRanges)
 		if !initial {
-			hm.l.Info("preferred_ranges changed",
-				"oldPreferredRanges", *oldRanges,
-				"newPreferredRanges", preferredRanges,
-			)
+			hm.l.WithField("oldPreferredRanges", *oldRanges).WithField("newPreferredRanges", preferredRanges).Info("preferred_ranges changed")
 		}
 	}
 }
@@ -495,11 +500,10 @@ func (hm *HostMap) unlockedInnerDeleteHostInfo(hostinfo *HostInfo, addr netip.Ad
 		hm.Indexes = map[uint32]*HostInfo{}
 	}
 
-	if hm.l.Enabled(context.Background(), slog.LevelDebug) {
-		hm.l.Debug("Hostmap hostInfo deleted",
-			"hostMap", m{"mapTotalSize": len(hm.Hosts),
-				"vpnAddrs": hostinfo.vpnAddrs, "indexNumber": hostinfo.localIndexId, "remoteIndexNumber": hostinfo.remoteIndexId},
-		)
+	if hm.l.Level >= logrus.DebugLevel {
+		hm.l.WithField("hostMap", m{"mapTotalSize": len(hm.Hosts),
+			"vpnAddrs": hostinfo.vpnAddrs, "indexNumber": hostinfo.localIndexId, "remoteIndexNumber": hostinfo.remoteIndexId}).
+			Debug("Hostmap hostInfo deleted")
 	}
 
 	if isLastHostinfo {
@@ -612,9 +616,9 @@ func (hm *HostMap) queryVpnAddr(vpnIp netip.Addr, promoteIfce *Interface) *HostI
 // unlockedAddHostInfo assumes you have a write-lock and will add a hostinfo object to the hostmap Indexes and RemoteIndexes maps.
 // If an entry exists for the Hosts table (vpnIp -> hostinfo) then the provided hostinfo will be made primary
 func (hm *HostMap) unlockedAddHostInfo(hostinfo *HostInfo, f *Interface) {
-	if f.dnsServer != nil {
+	if f.serveDns {
 		remoteCert := hostinfo.ConnectionState.peerCert
-		f.dnsServer.Add(remoteCert.Certificate.Name()+".", hostinfo.vpnAddrs)
+		dnsR.Add(remoteCert.Certificate.Name()+".", hostinfo.vpnAddrs)
 	}
 	for _, addr := range hostinfo.vpnAddrs {
 		hm.unlockedInnerAddHostInfo(addr, hostinfo, f)
@@ -623,11 +627,10 @@ func (hm *HostMap) unlockedAddHostInfo(hostinfo *HostInfo, f *Interface) {
 	hm.Indexes[hostinfo.localIndexId] = hostinfo
 	hm.RemoteIndexes[hostinfo.remoteIndexId] = hostinfo
 
-	if hm.l.Enabled(context.Background(), slog.LevelDebug) {
-		hm.l.Debug("Hostmap vpnIp added",
-			"hostMap", m{"vpnAddrs": hostinfo.vpnAddrs, "mapTotalSize": len(hm.Hosts),
-				"hostinfo": m{"existing": true, "localIndexId": hostinfo.localIndexId, "vpnAddrs": hostinfo.vpnAddrs}},
-		)
+	if hm.l.Level >= logrus.DebugLevel {
+		hm.l.WithField("hostMap", m{"vpnAddrs": hostinfo.vpnAddrs, "mapTotalSize": len(hm.Hosts),
+			"hostinfo": m{"existing": true, "localIndexId": hostinfo.localIndexId, "vpnAddrs": hostinfo.vpnAddrs}}).
+			Debug("Hostmap vpnIp added")
 	}
 }
 
@@ -793,21 +796,18 @@ func (i *HostInfo) buildNetworks(myVpnNetworksTable *bart.Lite, c cert.Certifica
 	}
 }
 
-// logger returns a derived slog.Logger with per-hostinfo fields pre-bound.
-func (i *HostInfo) logger(l *slog.Logger) *slog.Logger {
+func (i *HostInfo) logger(l *logrus.Logger) *logrus.Entry {
 	if i == nil {
-		return l
+		return logrus.NewEntry(l)
 	}
 
-	li := l.With(
-		"vpnAddrs", i.vpnAddrs,
-		"localIndex", i.localIndexId,
-		"remoteIndex", i.remoteIndexId,
-	)
+	li := l.WithField("vpnAddrs", i.vpnAddrs).
+		WithField("localIndex", i.localIndexId).
+		WithField("remoteIndex", i.remoteIndexId)
 
 	if connState := i.ConnectionState; connState != nil {
 		if peerCert := connState.peerCert; peerCert != nil {
-			li = li.With("certName", peerCert.Certificate.Name())
+			li = li.WithField("certName", peerCert.Certificate.Name())
 		}
 	}
 
@@ -816,17 +816,14 @@ func (i *HostInfo) logger(l *slog.Logger) *slog.Logger {
 
 // Utility functions
 
-func localAddrs(l *slog.Logger, allowList *LocalAllowList) []netip.Addr {
+func localAddrs(l *logrus.Logger, allowList *LocalAllowList) []netip.Addr {
 	//FIXME: This function is pretty garbage
 	var finalAddrs []netip.Addr
 	ifaces, _ := net.Interfaces()
 	for _, i := range ifaces {
 		allow := allowList.AllowName(i.Name)
-		if l.Enabled(context.Background(), logging.LevelTrace) {
-			l.Log(context.Background(), logging.LevelTrace, "localAllowList.AllowName",
-				"interfaceName", i.Name,
-				"allow", allow,
-			)
+		if l.Level >= logrus.TraceLevel {
+			l.WithField("interfaceName", i.Name).WithField("allow", allow).Trace("localAllowList.AllowName")
 		}
 
 		if !allow {
@@ -844,8 +841,8 @@ func localAddrs(l *slog.Logger, allowList *LocalAllowList) []netip.Addr {
 			}
 
 			if !addr.IsValid() {
-				if l.Enabled(context.Background(), slog.LevelDebug) {
-					l.Debug("addr was invalid", "localAddr", rawAddr)
+				if l.Level >= logrus.DebugLevel {
+					l.WithField("localAddr", rawAddr).Debug("addr was invalid")
 				}
 				continue
 			}
@@ -853,11 +850,8 @@ func localAddrs(l *slog.Logger, allowList *LocalAllowList) []netip.Addr {
 
 			if addr.IsLoopback() == false && addr.IsLinkLocalUnicast() == false {
 				isAllowed := allowList.Allow(addr)
-				if l.Enabled(context.Background(), logging.LevelTrace) {
-					l.Log(context.Background(), logging.LevelTrace, "localAllowList.Allow",
-						"localAddr", addr,
-						"allowed", isAllowed,
-					)
+				if l.Level >= logrus.TraceLevel {
+					l.WithField("localAddr", addr).WithField("allowed", isAllowed).Trace("localAllowList.Allow")
 				}
 				if !isAllowed {
 					continue

hostmap_test.go

@@ -196,7 +196,7 @@ func TestHostMap_DeleteHostInfo(t *testing.T) {
 
 func TestHostMap_reload(t *testing.T) {
 	l := test.NewLogger()
-	c := config.NewC(test.NewLogger())
+	c := config.NewC(l)
 
 	hm := NewHostMapFromConfig(l, c)
 

inside.go

@@ -1,10 +1,9 @@
 package nebula
 
 import (
-	"context"
-	"log/slog"
 	"net/netip"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/iputil"
@@ -15,11 +14,8 @@ import (
 func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet, nb, out []byte, q int, localCache firewall.ConntrackCache) {
 	err := newPacket(packet, false, fwPacket)
 	if err != nil {
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			f.l.Debug("Error while validating outbound packet",
-				"packet", packet,
-				"error", err,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			f.l.WithField("packet", packet).Debugf("Error while validating outbound packet: %s", err)
 		}
 		return
 	}
@@ -39,7 +35,7 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		if immediatelyForwardToSelf {
 			_, err := f.readers[q].Write(packet)
 			if err != nil {
-				f.l.Error("Failed to forward to tun", "error", err)
+				f.l.WithError(err).Error("Failed to forward to tun")
 			}
 		}
 		// Otherwise, drop. On linux, we should never see these packets - Linux
@@ -52,17 +48,14 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		return
 	}
 
-	hostinfo, ready := f.getOrHandshakeConsiderRouting(fwPacket, func(hh *HandshakeHostInfo) {
-		hh.cachePacket(f.l, header.Message, 0, packet, f.sendMessageNow, f.cachedPacketMetrics)
-	})
+	hostinfo, ready := f.getHostinfo(packet, fwPacket)
 
 	if hostinfo == nil {
 		f.rejectInside(packet, out, q)
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			f.l.Debug("dropping outbound packet, vpnAddr not in our vpn networks or in unsafe networks",
-				"vpnAddr", fwPacket.RemoteAddr,
-				"fwPacket", fwPacket,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			f.l.WithField("vpnAddr", fwPacket.RemoteAddr).
+				WithField("fwPacket", fwPacket).
+				Debugln("dropping outbound packet, vpnAddr not in our vpn networks or in unsafe networks")
 		}
 		return
 	}
@@ -71,21 +64,40 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		return
 	}
 
-	dropReason := f.firewall.Drop(*fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache)
+	dropReason := f.firewall.Drop(*fwPacket, packet, false, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason == nil {
 		f.sendNoMetrics(header.Message, 0, hostinfo.ConnectionState, hostinfo, netip.AddrPort{}, packet, nb, out, q)
-
 	} else {
 		f.rejectInside(packet, out, q)
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(f.l).Debug("dropping outbound packet",
-				"fwPacket", fwPacket,
-				"reason", dropReason,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			hostinfo.logger(f.l).
+				WithField("fwPacket", fwPacket).
+				WithField("reason", dropReason).
+				Debugln("dropping outbound packet")
 		}
 	}
 }
 
+func (f *Interface) getHostinfo(packet []byte, fwPacket *firewall.Packet) (*HostInfo, bool) {
+	if f.firewall.ShouldUnSNAT(fwPacket) {
+		//unsnat packet re-writing also happens here, would be nice to not,
+		//but we need to do the unsnat lookup to find the hostinfo so we can run the firewall checks
+		destVpnAddr := f.firewall.unSnat(packet, fwPacket)
+		if destVpnAddr.IsValid() {
+			//because this was a snatted packet, we know it has an on-overlay destination, so no routing should be required.
+			return f.getOrHandshakeNoRouting(destVpnAddr, func(hh *HandshakeHostInfo) {
+				hh.cachePacket(f.l, header.Message, 0, packet, f.sendMessageNow, f.cachedPacketMetrics)
+			})
+		} else {
+			return nil, false
+		}
+	} else { //if we didn't need to unsnat
+		return f.getOrHandshakeConsiderRouting(fwPacket, func(hh *HandshakeHostInfo) {
+			hh.cachePacket(f.l, header.Message, 0, packet, f.sendMessageNow, f.cachedPacketMetrics)
+		})
+	}
+}
+
 func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
 	if !f.firewall.InSendReject {
 		return
@@ -98,7 +110,7 @@ func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
 
 	_, err := f.readers[q].Write(out)
 	if err != nil {
-		f.l.Error("Failed to write to tun", "error", err)
+		f.l.WithError(err).Error("Failed to write to tun")
 	}
 }
 
@@ -113,11 +125,11 @@ func (f *Interface) rejectOutside(packet []byte, ci *ConnectionState, hostinfo *
 	}
 
 	if len(out) > iputil.MaxRejectPacketSize {
-		if f.l.Enabled(context.Background(), slog.LevelInfo) {
-			f.l.Info("rejectOutside: packet too big, not sending",
-				"packet", packet,
-				"outPacket", out,
-			)
+		if f.l.GetLevel() >= logrus.InfoLevel {
+			f.l.
+				WithField("packet", packet).
+				WithField("outPacket", out).
+				Info("rejectOutside: packet too big, not sending")
 		}
 		return
 	}
@@ -189,11 +201,10 @@ func (f *Interface) getOrHandshakeConsiderRouting(fwPacket *firewall.Packet, cac
 		// This would also need to interact with unsafe_route updates through reloading the config or
 		// use of the use_system_route_table option
 
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			f.l.Debug("Calculated gateway for ECMP not available, attempting other gateways",
-				"destination", destinationAddr,
-				"originalGateway", gatewayAddr,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			f.l.WithField("destination", destinationAddr).
+				WithField("originalGateway", gatewayAddr).
+				Debugln("Calculated gateway for ECMP not available, attempting other gateways")
 		}
 
 		for i := range gateways {
@@ -219,18 +230,17 @@ func (f *Interface) sendMessageNow(t header.MessageType, st header.MessageSubTyp
 	fp := &firewall.Packet{}
 	err := newPacket(p, false, fp)
 	if err != nil {
-		f.l.Warn("error while parsing outgoing packet for firewall check", "error", err)
+		f.l.Warnf("error while parsing outgoing packet for firewall check; %v", err)
 		return
 	}
 
 	// check if packet is in outbound fw rules
-	dropReason := f.firewall.Drop(*fp, false, hostinfo, f.pki.GetCAPool(), nil)
+	dropReason := f.firewall.Drop(*fp, p, false, hostinfo, f.pki.GetCAPool(), nil)
 	if dropReason != nil {
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			f.l.Debug("dropping cached packet",
-				"fwPacket", fp,
-				"reason", dropReason,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			f.l.WithField("fwPacket", fp).
+				WithField("reason", dropReason).
+				Debugln("dropping cached packet")
 		}
 		return
 	}
@@ -246,10 +256,9 @@ func (f *Interface) SendMessageToVpnAddr(t header.MessageType, st header.Message
 	})
 
 	if hostInfo == nil {
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			f.l.Debug("dropping SendMessageToVpnAddr, vpnAddr not in our vpn networks or in unsafe routes",
-				"vpnAddr", vpnAddr,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			f.l.WithField("vpnAddr", vpnAddr).
+				Debugln("dropping SendMessageToVpnAddr, vpnAddr not in our vpn networks or in unsafe routes")
 		}
 		return
 	}
@@ -305,12 +314,12 @@ func (f *Interface) SendVia(via *HostInfo,
 		if noiseutil.EncryptLockNeeded {
 			via.ConnectionState.writeLock.Unlock()
 		}
-		via.logger(f.l).Error("SendVia out buffer not large enough for relay",
-			"outCap", cap(out),
-			"payloadLen", len(ad),
-			"headerLen", len(out),
-			"cipherOverhead", via.ConnectionState.eKey.Overhead(),
-		)
+		via.logger(f.l).
+			WithField("outCap", cap(out)).
+			WithField("payloadLen", len(ad)).
+			WithField("headerLen", len(out)).
+			WithField("cipherOverhead", via.ConnectionState.eKey.Overhead()).
+			Error("SendVia out buffer not large enough for relay")
 		return
 	}
 
@@ -330,12 +339,12 @@ func (f *Interface) SendVia(via *HostInfo,
 		via.ConnectionState.writeLock.Unlock()
 	}
 	if err != nil {
-		via.logger(f.l).Info("Failed to EncryptDanger in sendVia", "error", err)
+		via.logger(f.l).WithError(err).Info("Failed to EncryptDanger in sendVia")
 		return
 	}
 	err = f.writers[0].WriteTo(out, via.remote)
 	if err != nil {
-		via.logger(f.l).Info("Failed to WriteTo in sendVia", "error", err)
+		via.logger(f.l).WithError(err).Info("Failed to WriteTo in sendVia")
 	}
 	f.connectionManager.RelayUsed(relay.LocalIndex)
 }
@@ -374,10 +383,8 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 		// finally used again. This tunnel would eventually be torn down and recreated if this action didn't help.
 		f.lightHouse.QueryServer(hostinfo.vpnAddrs[0])
 		hostinfo.lastRebindCount = f.rebindCount
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			f.l.Debug("Lighthouse update triggered for punch due to rebind counter",
-				"vpnAddrs", hostinfo.vpnAddrs,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).Debug("Lighthouse update triggered for punch due to rebind counter")
 		}
 	}
 
@@ -387,30 +394,24 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 		ci.writeLock.Unlock()
 	}
 	if err != nil {
-		hostinfo.logger(f.l).Error("Failed to encrypt outgoing packet",
-			"error", err,
-			"udpAddr", remote,
-			"counter", c,
-			"attemptedCounter", c,
-		)
+		hostinfo.logger(f.l).WithError(err).
+			WithField("udpAddr", remote).WithField("counter", c).
+			WithField("attemptedCounter", c).
+			Error("Failed to encrypt outgoing packet")
 		return
 	}
 
 	if remote.IsValid() {
 		err = f.writers[q].WriteTo(out, remote)
 		if err != nil {
-			hostinfo.logger(f.l).Error("Failed to write outgoing packet",
-				"error", err,
-				"udpAddr", remote,
-			)
+			hostinfo.logger(f.l).WithError(err).
+				WithField("udpAddr", remote).Error("Failed to write outgoing packet")
 		}
 	} else if hostinfo.remote.IsValid() {
 		err = f.writers[q].WriteTo(out, hostinfo.remote)
 		if err != nil {
-			hostinfo.logger(f.l).Error("Failed to write outgoing packet",
-				"error", err,
-				"udpAddr", remote,
-			)
+			hostinfo.logger(f.l).WithError(err).
+				WithField("udpAddr", remote).Error("Failed to write outgoing packet")
 		}
 	} else {
 		// Try to send via a relay
@@ -418,10 +419,7 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 			relayHostInfo, relay, err := f.hostMap.QueryVpnAddrsRelayFor(hostinfo.vpnAddrs, relayIP)
 			if err != nil {
 				hostinfo.relayState.DeleteRelay(relayIP)
-				hostinfo.logger(f.l).Info("sendNoMetrics failed to find HostInfo",
-					"relay", relayIP,
-					"error", err,
-				)
+				hostinfo.logger(f.l).WithField("relay", relayIP).WithError(err).Info("sendNoMetrics failed to find HostInfo")
 				continue
 			}
 			f.SendVia(relayHostInfo, relay, out, nb, fullOut[:header.Len+len(out)], true)

interface.go

@@ -5,15 +5,15 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
-	"sync"
+	"os"
+	"runtime"
 	"sync/atomic"
 	"time"
 
 	"github.com/gaissmai/bart"
 	"github.com/rcrowley/go-metrics"
-
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
@@ -30,11 +30,10 @@ type InterfaceConfig struct {
 	pki                *PKI
 	Cipher             string
 	Firewall           *Firewall
-	DnsServer          *dnsServer
+	ServeDns           bool
 	HandshakeManager   *HandshakeManager
 	lightHouse         *LightHouse
 	connectionManager  *connectionManager
-	pmtudManager       *pmtudManager
 	DropLocalBroadcast bool
 	DropMulticast      bool
 	routines           int
@@ -48,7 +47,7 @@ type InterfaceConfig struct {
 	reQueryWait     time.Duration
 
 	ConntrackCacheTimeout time.Duration
-	l                     *slog.Logger
+	l                     *logrus.Logger
 }
 
 type Interface struct {
@@ -58,9 +57,8 @@ type Interface struct {
 	pki                   *PKI
 	firewall              *Firewall
 	connectionManager     *connectionManager
-	pmtudManager          *pmtudManager
 	handshakeManager      *HandshakeManager
-	dnsServer             *dnsServer
+	serveDns              bool
 	createTime            time.Time
 	lightHouse            *LightHouse
 	myBroadcastAddrsTable *bart.Lite
@@ -88,22 +86,14 @@ type Interface struct {
 
 	conntrackCacheTimeout time.Duration
 
-	ctx     context.Context
 	writers []udp.Conn
 	readers []io.ReadWriteCloser
-	wg      sync.WaitGroup
-
-	// fatalErr holds the first unexpected reader error that caused shutdown.
-	// nil means "no fatal error" (yet)
-	fatalErr atomic.Pointer[error]
-	// triggerShutdown is a function that will be run exactly once, when onFatal swaps something non-nil into fatalErr
-	triggerShutdown func()
 
 	metricHandshakes    metrics.Histogram
 	messageMetrics      *MessageMetrics
 	cachedPacketMetrics *cachedPacketMetrics
 
-	l *slog.Logger
+	l *logrus.Logger
 }
 
 type EncWriter interface {
@@ -174,13 +164,12 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 
 	cs := c.pki.getCertState()
 	ifce := &Interface{
-		ctx:                   ctx,
 		pki:                   c.pki,
 		hostMap:               c.HostMap,
 		outside:               c.Outside,
 		inside:                c.Inside,
 		firewall:              c.Firewall,
-		dnsServer:             c.DnsServer,
+		serveDns:              c.ServeDns,
 		handshakeManager:      c.HandshakeManager,
 		createTime:            time.Now(),
 		lightHouse:            c.lightHouse,
@@ -197,7 +186,6 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		myBroadcastAddrsTable: cs.myVpnBroadcastAddrsTable,
 		relayManager:          c.relayManager,
 		connectionManager:     c.connectionManager,
-		pmtudManager:          c.pmtudManager,
 		conntrackCacheTimeout: c.ConntrackCacheTimeout,
 
 		metricHandshakes: metrics.GetOrRegisterHistogram("handshakes", nil, metrics.NewExpDecaySample(1028, 0.015)),
@@ -215,7 +203,6 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 	ifce.reQueryWait.Store(int64(c.reQueryWait))
 
 	ifce.connectionManager.intf = ifce
-	ifce.pmtudManager.intf = ifce
 
 	return ifce, nil
 }
@@ -223,21 +210,18 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 // activate creates the interface on the host. After the interface is created, any
 // other services that want to bind listeners to its IP may do so successfully. However,
 // the interface isn't going to process anything until run() is called.
-func (f *Interface) activate() error {
+func (f *Interface) activate() {
 	// actually turn on tun dev
 
 	addr, err := f.outside.LocalAddr()
 	if err != nil {
-		f.l.Error("Failed to get udp listen address", "error", err)
+		f.l.WithError(err).Error("Failed to get udp listen address")
 	}
 
-	f.l.Info("Nebula interface is active",
-		"interface", f.inside.Name(),
-		"networks", f.myVpnNetworks,
-		"build", f.version,
-		"udpAddr", addr,
-		"boringcrypto", boringEnabled(),
-	)
+	f.l.WithField("interface", f.inside.Name()).WithField("networks", f.myVpnNetworks).
+		WithField("build", f.version).WithField("udpAddr", addr).
+		WithField("boringcrypto", boringEnabled()).
+		Info("Nebula interface is active")
 
 	if f.routines > 1 {
 		if !f.inside.SupportsMultiqueue() || !f.outside.SupportsMultipleReaders() {
@@ -254,58 +238,34 @@ func (f *Interface) activate() error {
 		if i > 0 {
 			reader, err = f.inside.NewMultiQueueReader()
 			if err != nil {
-				return err
+				f.l.Fatal(err)
 			}
 		}
 		f.readers[i] = reader
 	}
 
-	f.wg.Add(1) // for us to wait on Close() to return
-	if err = f.inside.Activate(); err != nil {
-		f.wg.Done()
+	if err := f.inside.Activate(); err != nil {
 		f.inside.Close()
-		return err
+		f.l.Fatal(err)
 	}
-
-	return nil
+	f.firewall.SetSNATAddressFromInterface(f)
 }
 
-func (f *Interface) run() (func() error, error) {
+func (f *Interface) run() {
 	// Launch n queues to read packets from udp
 	for i := 0; i < f.routines; i++ {
-		f.wg.Go(func() {
-			f.listenOut(i)
-		})
+		go f.listenOut(i)
 	}
 
 	// Launch n queues to read packets from tun dev
 	for i := 0; i < f.routines; i++ {
-		f.wg.Go(func() {
-			f.listenIn(f.readers[i], i)
-		})
-	}
-
-	return func() error {
-		f.wg.Wait()
-		if e := f.fatalErr.Load(); e != nil {
-			return *e
-		}
-		return nil
-	}, nil
-}
-
-// onFatal stores the first fatal reader error, and calls triggerShutdown if it was the first one
-func (f *Interface) onFatal(err error) {
-	swapped := f.fatalErr.CompareAndSwap(nil, &err)
-	if !swapped {
-		return
-	}
-	if f.triggerShutdown != nil {
-		f.triggerShutdown()
+		go f.listenIn(f.readers[i], i)
 	}
 }
 
 func (f *Interface) listenOut(i int) {
+	runtime.LockOSThread()
+
 	var li udp.Conn
 	if i > 0 {
 		li = f.writers[i]
@@ -313,47 +273,42 @@ func (f *Interface) listenOut(i int) {
 		li = f.outside
 	}
 
-	ctCache := firewall.NewConntrackCacheTicker(f.ctx, f.l, f.conntrackCacheTimeout)
+	ctCache := firewall.NewConntrackCacheTicker(f.conntrackCacheTimeout)
 	lhh := f.lightHouse.NewRequestHandler()
 	plaintext := make([]byte, udp.MTU)
 	h := &header.H{}
 	fwPacket := &firewall.Packet{}
 	nb := make([]byte, 12, 12)
 
-	err := li.ListenOut(func(fromUdpAddr netip.AddrPort, payload []byte) {
-		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr}, plaintext[:0], payload, h, fwPacket, lhh, nb, i, ctCache.Get())
+	li.ListenOut(func(fromUdpAddr netip.AddrPort, payload []byte) {
+		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr}, plaintext[:0], payload, h, fwPacket, lhh, nb, i, ctCache.Get(f.l))
 	})
-
-	if err != nil && !f.closed.Load() {
-		f.l.Error("Error while reading inbound packet, closing", "error", err)
-		f.onFatal(err)
-	}
-
-	f.l.Debug("underlay reader is done", "reader", i)
 }
 
 func (f *Interface) listenIn(reader io.ReadWriteCloser, i int) {
+	runtime.LockOSThread()
+
 	packet := make([]byte, mtu)
 	out := make([]byte, mtu)
 	fwPacket := &firewall.Packet{}
 	nb := make([]byte, 12, 12)
 
-	conntrackCache := firewall.NewConntrackCacheTicker(f.ctx, f.l, f.conntrackCacheTimeout)
+	conntrackCache := firewall.NewConntrackCacheTicker(f.conntrackCacheTimeout)
 
 	for {
 		n, err := reader.Read(packet)
 		if err != nil {
-			if !f.closed.Load() {
-				f.l.Error("Error while reading outbound packet, closing", "error", err, "reader", i)
-				f.onFatal(err)
+			if errors.Is(err, os.ErrClosed) && f.closed.Load() {
+				return
 			}
-			break
+
+			f.l.WithError(err).Error("Error while reading outbound packet")
+			// This only seems to happen when something fatal happens to the fd, so exit.
+			os.Exit(2)
 		}
 
-		f.consumeInsidePacket(packet[:n], fwPacket, nb, out, i, conntrackCache.Get())
+		f.consumeInsidePacket(packet[:n], fwPacket, nb, out, i, conntrackCache.Get(f.l))
 	}
-
-	f.l.Debug("overlay reader is done", "reader", i)
 }
 
 func (f *Interface) RegisterConfigChangeCallbacks(c *config.C) {
@@ -373,7 +328,7 @@ func (f *Interface) reloadDisconnectInvalid(c *config.C) {
 	if initial || c.HasChanged("pki.disconnect_invalid") {
 		f.disconnectInvalid.Store(c.GetBool("pki.disconnect_invalid", true))
 		if !initial {
-			f.l.Info("pki.disconnect_invalid changed", "value", f.disconnectInvalid.Load())
+			f.l.Infof("pki.disconnect_invalid changed to %v", f.disconnectInvalid.Load())
 		}
 	}
 }
@@ -387,9 +342,10 @@ func (f *Interface) reloadFirewall(c *config.C) {
 
 	fw, err := NewFirewallFromConfig(f.l, f.pki.getCertState(), c)
 	if err != nil {
-		f.l.Error("Error while creating firewall during reload", "error", err)
+		f.l.WithError(err).Error("Error while creating firewall during reload")
 		return
 	}
+	fw.SetSNATAddressFromInterface(f)
 
 	oldFw := f.firewall
 	conntrack := oldFw.Conntrack
@@ -400,11 +356,10 @@ func (f *Interface) reloadFirewall(c *config.C) {
 	// If rulesVersion is back to zero, we have wrapped all the way around. Be
 	// safe and just reset conntrack in this case.
 	if fw.rulesVersion == 0 {
-		f.l.Warn("firewall rulesVersion has overflowed, resetting conntrack",
-			"firewallHashes", fw.GetRuleHashes(),
-			"oldFirewallHashes", oldFw.GetRuleHashes(),
-			"rulesVersion", fw.rulesVersion,
-		)
+		f.l.WithField("firewallHashes", fw.GetRuleHashes()).
+			WithField("oldFirewallHashes", oldFw.GetRuleHashes()).
+			WithField("rulesVersion", fw.rulesVersion).
+			Warn("firewall rulesVersion has overflowed, resetting conntrack")
 	} else {
 		fw.Conntrack = conntrack
 	}
@@ -412,11 +367,10 @@ func (f *Interface) reloadFirewall(c *config.C) {
 	f.firewall = fw
 
 	oldFw.Destroy()
-	f.l.Info("New firewall has been installed",
-		"firewallHashes", fw.GetRuleHashes(),
-		"oldFirewallHashes", oldFw.GetRuleHashes(),
-		"rulesVersion", fw.rulesVersion,
-	)
+	f.l.WithField("firewallHashes", fw.GetRuleHashes()).
+		WithField("oldFirewallHashes", oldFw.GetRuleHashes()).
+		WithField("rulesVersion", fw.rulesVersion).
+		Info("New firewall has been installed")
 }
 
 func (f *Interface) reloadSendRecvError(c *config.C) {
@@ -438,7 +392,8 @@ func (f *Interface) reloadSendRecvError(c *config.C) {
 			}
 		}
 
-		f.l.Info("Loaded send_recv_error config", "sendRecvError", f.sendRecvErrorConfig.String())
+		f.l.WithField("sendRecvError", f.sendRecvErrorConfig.String()).
+			Info("Loaded send_recv_error config")
 	}
 }
 
@@ -461,7 +416,8 @@ func (f *Interface) reloadAcceptRecvError(c *config.C) {
 			}
 		}
 
-		f.l.Info("Loaded accept_recv_error config", "acceptRecvError", f.acceptRecvErrorConfig.String())
+		f.l.WithField("acceptRecvError", f.acceptRecvErrorConfig.String()).
+			Info("Loaded accept_recv_error config")
 	}
 }
 
@@ -528,23 +484,23 @@ func (f *Interface) GetCertState() *CertState {
 }
 
 func (f *Interface) Close() error {
-	var errs []error
 	f.closed.Store(true)
 
-	// Release the udp readers
-	for i, u := range f.writers {
+	for _, u := range f.writers {
 		err := u.Close()
 		if err != nil {
-			f.l.Error("Error while closing udp socket", "error", err, "writer", i)
-			errs = append(errs, err)
+			f.l.WithError(err).Error("Error while closing udp socket")
+		}
+	}
+	for i, r := range f.readers {
+		if i == 0 {
+			continue // f.readers[0] is f.inside, which we want to save for last
+		}
+		if err := r.Close(); err != nil {
+			f.l.WithError(err).Error("Error while closing tun reader")
 		}
 	}
 
-	// Release the tun device (closing the tun also closes all readers)
-	closeErr := f.inside.Close()
-	if closeErr != nil {
-		errs = append(errs, closeErr)
-	}
-	f.wg.Done()
-	return errors.Join(errs...)
+	// Release the tun device
+	return f.inside.Close()
 }

lighthouse.go

@@ -5,7 +5,6 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/netip"
 	"slices"
@@ -16,10 +15,10 @@ import (
 
 	"github.com/gaissmai/bart"
 	"github.com/rcrowley/go-metrics"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/logging"
 	"github.com/slackhq/nebula/udp"
 	"github.com/slackhq/nebula/util"
 )
@@ -70,19 +69,18 @@ type LightHouse struct {
 	// Addr's of relays that can be used by peers to access me
 	relaysForMe atomic.Pointer[[]netip.Addr]
 
-	updateTrigger chan struct{}
-	queryChan     chan netip.Addr
+	queryChan chan netip.Addr
 
 	calculatedRemotes atomic.Pointer[bart.Table[[]*calculatedRemote]] // Maps VpnAddr to []*calculatedRemote
 
 	metrics           *MessageMetrics
 	metricHolepunchTx metrics.Counter
-	l                 *slog.Logger
+	l                 *logrus.Logger
 }
 
 // NewLightHouseFromConfig will build a Lighthouse struct from the values provided in the config object
 // addrMap should be nil unless this is during a config reload
-func NewLightHouseFromConfig(ctx context.Context, l *slog.Logger, c *config.C, cs *CertState, pc udp.Conn, p *Punchy) (*LightHouse, error) {
+func NewLightHouseFromConfig(ctx context.Context, l *logrus.Logger, c *config.C, cs *CertState, pc udp.Conn, p *Punchy) (*LightHouse, error) {
 	amLighthouse := c.GetBool("lighthouse.am_lighthouse", false)
 	nebulaPort := uint32(c.GetInt("listen.port", 0))
 	if amLighthouse && nebulaPort == 0 {
@@ -107,7 +105,6 @@ func NewLightHouseFromConfig(ctx context.Context, l *slog.Logger, c *config.C, c
 		nebulaPort:         nebulaPort,
 		punchConn:          pc,
 		punchy:             p,
-		updateTrigger:      make(chan struct{}, 1),
 		queryChan:          make(chan netip.Addr, c.GetUint32("handshakes.query_buffer", 64)),
 		l:                  l,
 	}
@@ -134,7 +131,7 @@ func NewLightHouseFromConfig(ctx context.Context, l *slog.Logger, c *config.C, c
 		case *util.ContextualError:
 			v.Log(l)
 		case error:
-			l.Error("failed to reload lighthouse", "error", err)
+			l.WithError(err).Error("failed to reload lighthouse")
 		}
 	})
 
@@ -206,10 +203,8 @@ func (lh *LightHouse) reload(c *config.C, initial bool) error {
 			//TODO: we could technically insert all returned addrs instead of just the first one if a dns lookup was used
 			addr := addrs[0].Unmap()
 			if lh.myVpnNetworksTable.Contains(addr) {
-				lh.l.Warn("Ignoring lighthouse.advertise_addrs report because it is within the nebula network range",
-					"addr", rawAddr,
-					"entry", i+1,
-				)
+				lh.l.WithField("addr", rawAddr).WithField("entry", i+1).
+					Warn("Ignoring lighthouse.advertise_addrs report because it is within the nebula network range")
 				continue
 			}
 
@@ -227,9 +222,7 @@ func (lh *LightHouse) reload(c *config.C, initial bool) error {
 		lh.interval.Store(int64(c.GetInt("lighthouse.interval", 10)))
 
 		if !initial {
-			lh.l.Info("lighthouse.interval changed",
-				"interval", lh.interval.Load(),
-			)
+			lh.l.Infof("lighthouse.interval changed to %v", lh.interval.Load())
 
 			if lh.updateCancel != nil {
 				// May not always have a running routine
@@ -323,7 +316,6 @@ func (lh *LightHouse) reload(c *config.C, initial bool) error {
 		if !initial {
 			//NOTE: we are not tearing down existing lighthouse connections because they might be used for non lighthouse traffic
 			lh.l.Info("lighthouse.hosts has changed")
-			lh.TriggerUpdate()
 		}
 	}
 
@@ -341,12 +333,9 @@ func (lh *LightHouse) reload(c *config.C, initial bool) error {
 			for _, v := range c.GetStringSlice("relay.relays", nil) {
 				configRIP, err := netip.ParseAddr(v)
 				if err != nil {
-					lh.l.Warn("Parse relay from config failed",
-						"relay", v,
-						"error", err,
-					)
+					lh.l.WithField("relay", v).WithError(err).Warn("Parse relay from config failed")
 				} else {
-					lh.l.Info("Read relay from config", "relay", v)
+					lh.l.WithField("relay", v).Info("Read relay from config")
 					relaysForMe = append(relaysForMe, configRIP)
 				}
 			}
@@ -371,10 +360,8 @@ func (lh *LightHouse) parseLighthouses(c *config.C) ([]netip.Addr, error) {
 		}
 
 		if !lh.myVpnNetworksTable.Contains(addr) {
-			lh.l.Warn("lighthouse host is not within our networks, lighthouse functionality will work but layer 3 network traffic to the lighthouse will not",
-				"vpnAddr", addr,
-				"networks", lh.myVpnNetworks,
-			)
+			lh.l.WithFields(m{"vpnAddr": addr, "networks": lh.myVpnNetworks}).
+				Warn("lighthouse host is not within our networks, lighthouse functionality will work but layer 3 network traffic to the lighthouse will not")
 		}
 		out[i] = addr
 	}
@@ -445,11 +432,8 @@ func (lh *LightHouse) loadStaticMap(c *config.C, staticList map[netip.Addr]struc
 		}
 
 		if !lh.myVpnNetworksTable.Contains(vpnAddr) {
-			lh.l.Warn("static_host_map key is not within our networks, layer 3 network traffic to this host will not work",
-				"vpnAddr", vpnAddr,
-				"networks", lh.myVpnNetworks,
-				"entry", i+1,
-			)
+			lh.l.WithFields(m{"vpnAddr": vpnAddr, "networks": lh.myVpnNetworks, "entry": i + 1}).
+				Warn("static_host_map key is not within our networks, layer 3 network traffic to this host will not work")
 		}
 
 		vals, ok := v.([]any)
@@ -550,13 +534,12 @@ func (lh *LightHouse) DeleteVpnAddrs(allVpnAddrs []netip.Addr) {
 	lh.Lock()
 	rm, ok := lh.addrMap[allVpnAddrs[0]]
 	if ok {
-		debugEnabled := lh.l.Enabled(context.Background(), slog.LevelDebug)
 		for _, addr := range allVpnAddrs {
 			srm := lh.addrMap[addr]
 			if srm == rm {
 				delete(lh.addrMap, addr)
-				if debugEnabled {
-					lh.l.Debug("deleting from lighthouse", "vpnAddr", addr)
+				if lh.l.Level >= logrus.DebugLevel {
+					lh.l.Debugf("deleting %s from lighthouse.", addr)
 				}
 			}
 		}
@@ -673,12 +656,9 @@ func (lh *LightHouse) unlockedGetRemoteList(allAddrs []netip.Addr) *RemoteList {
 
 func (lh *LightHouse) shouldAdd(vpnAddrs []netip.Addr, to netip.Addr) bool {
 	allow := lh.GetRemoteAllowList().AllowAll(vpnAddrs, to)
-	if lh.l.Enabled(context.Background(), logging.LevelTrace) {
-		lh.l.Log(context.Background(), logging.LevelTrace, "remoteAllowList.Allow",
-			"vpnAddrs", vpnAddrs,
-			"udpAddr", to,
-			"allow", allow,
-		)
+	if lh.l.Level >= logrus.TraceLevel {
+		lh.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", to).WithField("allow", allow).
+			Trace("remoteAllowList.Allow")
 	}
 	if !allow {
 		return false
@@ -695,12 +675,9 @@ func (lh *LightHouse) shouldAdd(vpnAddrs []netip.Addr, to netip.Addr) bool {
 func (lh *LightHouse) unlockedShouldAddV4(vpnAddr netip.Addr, to *V4AddrPort) bool {
 	udpAddr := protoV4AddrPortToNetAddrPort(to)
 	allow := lh.GetRemoteAllowList().Allow(vpnAddr, udpAddr.Addr())
-	if lh.l.Enabled(context.Background(), logging.LevelTrace) {
-		lh.l.Log(context.Background(), logging.LevelTrace, "remoteAllowList.Allow",
-			"vpnAddr", vpnAddr,
-			"udpAddr", udpAddr,
-			"allow", allow,
-		)
+	if lh.l.Level >= logrus.TraceLevel {
+		lh.l.WithField("vpnAddr", vpnAddr).WithField("udpAddr", udpAddr).WithField("allow", allow).
+			Trace("remoteAllowList.Allow")
 	}
 
 	if !allow {
@@ -718,12 +695,9 @@ func (lh *LightHouse) unlockedShouldAddV4(vpnAddr netip.Addr, to *V4AddrPort) bo
 func (lh *LightHouse) unlockedShouldAddV6(vpnAddr netip.Addr, to *V6AddrPort) bool {
 	udpAddr := protoV6AddrPortToNetAddrPort(to)
 	allow := lh.GetRemoteAllowList().Allow(vpnAddr, udpAddr.Addr())
-	if lh.l.Enabled(context.Background(), logging.LevelTrace) {
-		lh.l.Log(context.Background(), logging.LevelTrace, "remoteAllowList.Allow",
-			"vpnAddr", vpnAddr,
-			"udpAddr", udpAddr,
-			"allow", allow,
-		)
+	if lh.l.Level >= logrus.TraceLevel {
+		lh.l.WithField("vpnAddr", vpnAddr).WithField("udpAddr", udpAddr).WithField("allow", allow).
+			Trace("remoteAllowList.Allow")
 	}
 
 	if !allow {
@@ -798,10 +772,8 @@ func (lh *LightHouse) innerQueryServer(addr netip.Addr, nb, out []byte) {
 
 		if v == cert.Version1 {
 			if !addr.Is4() {
-				lh.l.Error("Can't query lighthouse for v6 address using a v1 protocol",
-					"queryVpnAddr", addr,
-					"lighthouseAddr", lhVpnAddr,
-				)
+				lh.l.WithField("queryVpnAddr", addr).WithField("lighthouseAddr", lhVpnAddr).
+					Error("Can't query lighthouse for v6 address using a v1 protocol")
 				continue
 			}
 
@@ -812,11 +784,9 @@ func (lh *LightHouse) innerQueryServer(addr netip.Addr, nb, out []byte) {
 
 				v1Query, err = msg.Marshal()
 				if err != nil {
-					lh.l.Error("Failed to marshal lighthouse v1 query payload",
-						"error", err,
-						"queryVpnAddr", addr,
-						"lighthouseAddr", lhVpnAddr,
-					)
+					lh.l.WithError(err).WithField("queryVpnAddr", addr).
+						WithField("lighthouseAddr", lhVpnAddr).
+						Error("Failed to marshal lighthouse v1 query payload")
 					continue
 				}
 			}
@@ -831,11 +801,9 @@ func (lh *LightHouse) innerQueryServer(addr netip.Addr, nb, out []byte) {
 
 				v2Query, err = msg.Marshal()
 				if err != nil {
-					lh.l.Error("Failed to marshal lighthouse v2 query payload",
-						"error", err,
-						"queryVpnAddr", addr,
-						"lighthouseAddr", lhVpnAddr,
-					)
+					lh.l.WithError(err).WithField("queryVpnAddr", addr).
+						WithField("lighthouseAddr", lhVpnAddr).
+						Error("Failed to marshal lighthouse v2 query payload")
 					continue
 				}
 			}
@@ -844,11 +812,7 @@ func (lh *LightHouse) innerQueryServer(addr netip.Addr, nb, out []byte) {
 			queried++
 
 		} else {
-			lh.l.Debug("unsupported protocol version",
-				"op", "query",
-				"queryVpnAddr", addr,
-				"version", v,
-			)
+			lh.l.Debugf("Can not query lighthouse for %v using unknown protocol version: %v", addr, v)
 			continue
 		}
 	}
@@ -877,24 +841,11 @@ func (lh *LightHouse) StartUpdateWorker() {
 				return
 			case <-clockSource.C:
 				continue
-			case <-lh.updateTrigger:
-				continue
 			}
 		}
 	}()
 }
 
-// TriggerUpdate requests an immediate lighthouse update. This is a non-blocking
-// operation intended to be called after a handshake completes with a lighthouse,
-// so the lighthouse has our current addresses without waiting for the next
-// periodic update.
-func (lh *LightHouse) TriggerUpdate() {
-	select {
-	case lh.updateTrigger <- struct{}{}:
-	default:
-	}
-}
-
 func (lh *LightHouse) SendUpdate() {
 	var v4 []*V4AddrPort
 	var v6 []*V6AddrPort
@@ -940,9 +891,8 @@ func (lh *LightHouse) SendUpdate() {
 		if v == cert.Version1 {
 			if v1Update == nil {
 				if !lh.myVpnNetworks[0].Addr().Is4() {
-					lh.l.Warn("cannot update lighthouse using v1 protocol without an IPv4 address",
-						"lighthouseAddr", lhVpnAddr,
-					)
+					lh.l.WithField("lighthouseAddr", lhVpnAddr).
+						Warn("cannot update lighthouse using v1 protocol without an IPv4 address")
 					continue
 				}
 				var relays []uint32
@@ -966,10 +916,8 @@ func (lh *LightHouse) SendUpdate() {
 
 				v1Update, err = msg.Marshal()
 				if err != nil {
-					lh.l.Error("Error while marshaling for lighthouse v1 update",
-						"error", err,
-						"lighthouseAddr", lhVpnAddr,
-					)
+					lh.l.WithError(err).WithField("lighthouseAddr", lhVpnAddr).
+						Error("Error while marshaling for lighthouse v1 update")
 					continue
 				}
 			}
@@ -995,10 +943,8 @@ func (lh *LightHouse) SendUpdate() {
 
 				v2Update, err = msg.Marshal()
 				if err != nil {
-					lh.l.Error("Error while marshaling for lighthouse v2 update",
-						"error", err,
-						"lighthouseAddr", lhVpnAddr,
-					)
+					lh.l.WithError(err).WithField("lighthouseAddr", lhVpnAddr).
+						Error("Error while marshaling for lighthouse v2 update")
 					continue
 				}
 			}
@@ -1007,10 +953,7 @@ func (lh *LightHouse) SendUpdate() {
 			updated++
 
 		} else {
-			lh.l.Debug("unsupported protocol version",
-				"op", "update",
-				"version", v,
-			)
+			lh.l.Debugf("Can not update lighthouse using unknown protocol version: %v", v)
 			continue
 		}
 	}
@@ -1024,7 +967,7 @@ type LightHouseHandler struct {
 	out  []byte
 	pb   []byte
 	meta *NebulaMeta
-	l    *slog.Logger
+	l    *logrus.Logger
 }
 
 func (lh *LightHouse) NewRequestHandler() *LightHouseHandler {
@@ -1073,19 +1016,14 @@ func (lhh *LightHouseHandler) HandleRequest(rAddr netip.AddrPort, fromVpnAddrs [
 	n := lhh.resetMeta()
 	err := n.Unmarshal(p)
 	if err != nil {
-		lhh.l.Error("Failed to unmarshal lighthouse packet",
-			"error", err,
-			"vpnAddrs", fromVpnAddrs,
-			"udpAddr", rAddr,
-		)
+		lhh.l.WithError(err).WithField("vpnAddrs", fromVpnAddrs).WithField("udpAddr", rAddr).
+			Error("Failed to unmarshal lighthouse packet")
 		return
 	}
 
 	if n.Details == nil {
-		lhh.l.Error("Invalid lighthouse update",
-			"vpnAddrs", fromVpnAddrs,
-			"udpAddr", rAddr,
-		)
+		lhh.l.WithField("vpnAddrs", fromVpnAddrs).WithField("udpAddr", rAddr).
+			Error("Invalid lighthouse update")
 		return
 	}
 
@@ -1113,29 +1051,25 @@ func (lhh *LightHouseHandler) HandleRequest(rAddr netip.AddrPort, fromVpnAddrs [
 func (lhh *LightHouseHandler) handleHostQuery(n *NebulaMeta, fromVpnAddrs []netip.Addr, addr netip.AddrPort, w EncWriter) {
 	// Exit if we don't answer queries
 	if !lhh.lh.amLighthouse {
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Debug("I don't answer queries, but received one", "from", addr)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.Debugln("I don't answer queries, but received from: ", addr)
 		}
 		return
 	}
 
 	queryVpnAddr, useVersion, err := n.Details.GetVpnAddrAndVersion()
 	if err != nil {
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Debug("Dropping malformed HostQuery",
-				"from", fromVpnAddrs,
-				"details", n.Details,
-			)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.WithField("from", fromVpnAddrs).WithField("details", n.Details).
+				Debugln("Dropping malformed HostQuery")
 		}
 		return
 	}
 	if useVersion == cert.Version1 && queryVpnAddr.Is6() {
 		// this case really shouldn't be possible to represent, but reject it anyway.
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Debug("invalid vpn addr for v1 handleHostQuery",
-				"vpnAddrs", fromVpnAddrs,
-				"queryVpnAddr", queryVpnAddr,
-			)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.WithField("vpnAddrs", fromVpnAddrs).WithField("queryVpnAddr", queryVpnAddr).
+				Debugln("invalid vpn addr for v1 handleHostQuery")
 		}
 		return
 	}
@@ -1160,10 +1094,7 @@ func (lhh *LightHouseHandler) handleHostQuery(n *NebulaMeta, fromVpnAddrs []neti
 	}
 
 	if err != nil {
-		lhh.l.Error("Failed to marshal lighthouse host query reply",
-			"error", err,
-			"vpnAddrs", fromVpnAddrs,
-		)
+		lhh.l.WithError(err).WithField("vpnAddrs", fromVpnAddrs).Error("Failed to marshal lighthouse host query reply")
 		return
 	}
 
@@ -1191,10 +1122,8 @@ func (lhh *LightHouseHandler) sendHostPunchNotification(n *NebulaMeta, fromVpnAd
 			if ok {
 				whereToPunch = newDest
 			} else {
-				if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-					lhh.l.Debug("unable to punch to host, no addresses in common",
-						"to", crt.Networks(),
-					)
+				if lhh.l.Level >= logrus.DebugLevel {
+					lhh.l.WithField("to", crt.Networks()).Debugln("unable to punch to host, no addresses in common")
 				}
 			}
 		}
@@ -1220,10 +1149,7 @@ func (lhh *LightHouseHandler) sendHostPunchNotification(n *NebulaMeta, fromVpnAd
 	}
 
 	if err != nil {
-		lhh.l.Error("Failed to marshal lighthouse host was queried for",
-			"error", err,
-			"vpnAddrs", fromVpnAddrs,
-		)
+		lhh.l.WithError(err).WithField("vpnAddrs", fromVpnAddrs).Error("Failed to marshal lighthouse host was queried for")
 		return
 	}
 
@@ -1265,11 +1191,8 @@ func (lhh *LightHouseHandler) coalesceAnswers(v cert.Version, c *cache, n *Nebul
 				n.Details.RelayVpnAddrs = append(n.Details.RelayVpnAddrs, netAddrToProtoAddr(r))
 			}
 		} else {
-			if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-				lhh.l.Debug("unsupported protocol version",
-					"op", "coalesceAnswers",
-					"version", v,
-				)
+			if lhh.l.Level >= logrus.DebugLevel {
+				lhh.l.WithField("version", v).Debug("unsupported protocol version")
 			}
 		}
 	}
@@ -1282,11 +1205,8 @@ func (lhh *LightHouseHandler) handleHostQueryReply(n *NebulaMeta, fromVpnAddrs [
 
 	certVpnAddr, _, err := n.Details.GetVpnAddrAndVersion()
 	if err != nil {
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Error("dropping malformed HostQueryReply",
-				"error", err,
-				"vpnAddrs", fromVpnAddrs,
-			)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.WithError(err).WithField("vpnAddrs", fromVpnAddrs).Error("dropping malformed HostQueryReply")
 		}
 		return
 	}
@@ -1311,8 +1231,8 @@ func (lhh *LightHouseHandler) handleHostQueryReply(n *NebulaMeta, fromVpnAddrs [
 
 func (lhh *LightHouseHandler) handleHostUpdateNotification(n *NebulaMeta, fromVpnAddrs []netip.Addr, w EncWriter) {
 	if !lhh.lh.amLighthouse {
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Debug("I am not a lighthouse, do not take host updates", "from", fromVpnAddrs)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.Debugln("I am not a lighthouse, do not take host updates: ", fromVpnAddrs)
 		}
 		return
 	}
@@ -1335,11 +1255,8 @@ func (lhh *LightHouseHandler) handleHostUpdateNotification(n *NebulaMeta, fromVp
 
 	//Simple check that the host sent this not someone else, if detailsVpnAddr is filled
 	if detailsVpnAddr.IsValid() && !slices.Contains(fromVpnAddrs, detailsVpnAddr) {
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Debug("Host sent invalid update",
-				"vpnAddrs", fromVpnAddrs,
-				"answer", detailsVpnAddr,
-			)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.WithField("vpnAddrs", fromVpnAddrs).WithField("answer", detailsVpnAddr).Debugln("Host sent invalid update")
 		}
 		return
 	}
@@ -1361,9 +1278,7 @@ func (lhh *LightHouseHandler) handleHostUpdateNotification(n *NebulaMeta, fromVp
 	switch useVersion {
 	case cert.Version1:
 		if !fromVpnAddrs[0].Is4() {
-			lhh.l.Error("Can not send HostUpdateNotificationAck for a ipv6 vpn ip in a v1 message",
-				"vpnAddrs", fromVpnAddrs,
-			)
+			lhh.l.WithField("vpnAddrs", fromVpnAddrs).Error("Can not send HostUpdateNotificationAck for a ipv6 vpn ip in a v1 message")
 			return
 		}
 		vpnAddrB := fromVpnAddrs[0].As4()
@@ -1371,16 +1286,13 @@ func (lhh *LightHouseHandler) handleHostUpdateNotification(n *NebulaMeta, fromVp
 	case cert.Version2:
 		// do nothing, we want to send a blank message
 	default:
-		lhh.l.Error("invalid protocol version", "useVersion", useVersion)
+		lhh.l.WithField("useVersion", useVersion).Error("invalid protocol version")
 		return
 	}
 
 	ln, err := n.MarshalTo(lhh.pb)
 	if err != nil {
-		lhh.l.Error("Failed to marshal lighthouse host update ack",
-			"error", err,
-			"vpnAddrs", fromVpnAddrs,
-		)
+		lhh.l.WithError(err).WithField("vpnAddrs", fromVpnAddrs).Error("Failed to marshal lighthouse host update ack")
 		return
 	}
 
@@ -1397,11 +1309,8 @@ func (lhh *LightHouseHandler) handleHostPunchNotification(n *NebulaMeta, fromVpn
 
 	detailsVpnAddr, _, err := n.Details.GetVpnAddrAndVersion()
 	if err != nil {
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Debug("dropping invalid HostPunchNotification",
-				"details", n.Details,
-				"error", err,
-			)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.WithField("details", n.Details).WithError(err).Debugln("dropping invalid HostPunchNotification")
 		}
 		return
 	}
@@ -1418,11 +1327,8 @@ func (lhh *LightHouseHandler) handleHostPunchNotification(n *NebulaMeta, fromVpn
 			lhh.lh.punchConn.WriteTo(empty, vpnPeer)
 		}()
 
-		if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-			lhh.l.Debug("Punching",
-				"vpnPeer", vpnPeer,
-				"logVpnAddr", logVpnAddr,
-			)
+		if lhh.l.Level >= logrus.DebugLevel {
+			lhh.l.Debugf("Punching on %v for %v", vpnPeer, logVpnAddr)
 		}
 	}
 
@@ -1447,10 +1353,8 @@ func (lhh *LightHouseHandler) handleHostPunchNotification(n *NebulaMeta, fromVpn
 	if lhh.lh.punchy.GetRespond() {
 		go func() {
 			time.Sleep(lhh.lh.punchy.GetRespondDelay())
-			if lhh.l.Enabled(context.Background(), slog.LevelDebug) {
-				lhh.l.Debug("Sending a nebula test packet",
-					"vpnAddr", detailsVpnAddr,
-				)
+			if lhh.l.Level >= logrus.DebugLevel {
+				lhh.l.Debugf("Sending a nebula test packet to vpn addr %s", detailsVpnAddr)
 			}
 			//NOTE: we have to allocate a new output buffer here since we are spawning a new goroutine
 			// for each punchBack packet. We should move this into a timerwheel or a single goroutine

logger.go

@@ -0,0 +1,45 @@
+package nebula
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"github.com/slackhq/nebula/config"
+)
+
+func configLogger(l *logrus.Logger, c *config.C) error {
+	// set up our logging level
+	logLevel, err := logrus.ParseLevel(strings.ToLower(c.GetString("logging.level", "info")))
+	if err != nil {
+		return fmt.Errorf("%s; possible levels: %s", err, logrus.AllLevels)
+	}
+	l.SetLevel(logLevel)
+
+	disableTimestamp := c.GetBool("logging.disable_timestamp", false)
+	timestampFormat := c.GetString("logging.timestamp_format", "")
+	fullTimestamp := (timestampFormat != "")
+	if timestampFormat == "" {
+		timestampFormat = time.RFC3339
+	}
+
+	logFormat := strings.ToLower(c.GetString("logging.format", "text"))
+	switch logFormat {
+	case "text":
+		l.Formatter = &logrus.TextFormatter{
+			TimestampFormat:  timestampFormat,
+			FullTimestamp:    fullTimestamp,
+			DisableTimestamp: disableTimestamp,
+		}
+	case "json":
+		l.Formatter = &logrus.JSONFormatter{
+			TimestampFormat:  timestampFormat,
+			DisableTimestamp: disableTimestamp,
+		}
+	default:
+		return fmt.Errorf("unknown log format `%s`. possible formats: %s", logFormat, []string{"text", "json"})
+	}
+
+	return nil
+}

logging/logger.go

@@ -1,233 +0,0 @@
-// Package logging wires the nebula runtime-reconfigurable slog handler used
-// by nebula.Main and the nebula CLI binaries. Callers build a logger with
-// NewLogger, then call ApplyConfig at startup and from a config reload
-// callback to push logging.level, logging.format, and
-// logging.disable_timestamp changes onto the logger without rebuilding it.
-package logging
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"log/slog"
-	"strings"
-	"sync/atomic"
-	"time"
-)
-
-// Config is the subset of *config.C that ApplyConfig reads. Declaring it
-// here keeps the logging package from depending on config directly, which
-// would cycle through the shared test helpers (test.NewLogger imports
-// logging, and config's tests import test). *config.C satisfies this
-// interface structurally with no adapter.
-type Config interface {
-	GetString(key, def string) string
-	GetBool(key string, def bool) bool
-}
-
-// LevelTrace is a custom slog level below Debug, used when logging.level is
-// "trace". slog has no builtin trace level; the value is one step below
-// slog.LevelDebug in slog's 4-point spacing.
-const LevelTrace = slog.Level(-8)
-
-// NewLogger returns a *slog.Logger whose level, format, and timestamp
-// emission can be reconfigured at runtime via ApplyConfig and the SSH debug
-// commands. The default configuration is info-level text output so log
-// calls made before ApplyConfig runs still produce output. Timestamps
-// follow slog's default RFC3339Nano format; set logging.disable_timestamp
-// in config to suppress them.
-//
-// ApplyConfig and the SSH commands discover the reconfig surface via
-// structural type-assertion on l.Handler(), so replacement implementations
-// (tests, platform-specific sinks) need only implement the subset of
-// {SetLevel(slog.Level), SetFormat(string) error, SetDisableTimestamp(bool)}
-// they care about. Callers that pass a plain *slog.Logger without these
-// methods get a silent no-op; reconfiguration is always opt-in.
-func NewLogger(w io.Writer) *slog.Logger {
-	return slog.New(NewHandler(w))
-}
-
-// NewHandler builds the *Handler that NewLogger wraps. Exported for
-// platform-specific sinks (notably cmd/nebula-service/logs_windows.go)
-// that want to wrap the handler with extra behavior, such as tagging each
-// record with its Event Log severity, while still benefiting from all the
-// level / format / timestamp / WithAttrs machinery implemented here.
-func NewHandler(w io.Writer) *Handler {
-	root := &handlerRoot{}
-	root.level.Set(slog.LevelInfo)
-	opts := &slog.HandlerOptions{Level: &root.level}
-	return &Handler{
-		root: root,
-		text: slog.NewTextHandler(w, opts),
-		json: slog.NewJSONHandler(w, opts),
-	}
-}
-
-// handlerRoot carries the reconfiguration state shared by every logger
-// derived from a NewHandler call. All fields are consulted on the log
-// path and updated lock-free.
-type handlerRoot struct {
-	level            slog.LevelVar
-	disableTimestamp atomic.Bool
-	// jsonMode picks which of the pre-derived inner handlers Handler.Handle
-	// dispatches to. Flipping it propagates instantly to every derived logger
-	// without rebuilding or chain-replaying anything.
-	jsonMode atomic.Bool
-}
-
-// Handler is the slog.Handler returned by NewHandler. It holds two
-// pre-derived slog handlers -- one text, one json -- both built from the
-// same accumulated WithAttrs/WithGroup state. Handle picks which one to
-// dispatch to based on handlerRoot.jsonMode, so a SetFormat call takes
-// effect immediately across the whole process without having to rebuild
-// any derived loggers.
-type Handler struct {
-	root *handlerRoot
-	text slog.Handler
-	json slog.Handler
-}
-
-func (h *Handler) Enabled(_ context.Context, l slog.Level) bool {
-	return h.root.level.Level() <= l
-}
-
-func (h *Handler) Handle(ctx context.Context, r slog.Record) error {
-	if h.root.disableTimestamp.Load() {
-		r.Time = time.Time{}
-	}
-	if h.root.jsonMode.Load() {
-		return h.json.Handle(ctx, r)
-	}
-	return h.text.Handle(ctx, r)
-}
-
-func (h *Handler) WithAttrs(attrs []slog.Attr) slog.Handler {
-	if len(attrs) == 0 {
-		return h
-	}
-	return &Handler{
-		root: h.root,
-		text: h.text.WithAttrs(attrs),
-		json: h.json.WithAttrs(attrs),
-	}
-}
-
-func (h *Handler) WithGroup(name string) slog.Handler {
-	if name == "" {
-		return h
-	}
-	return &Handler{
-		root: h.root,
-		text: h.text.WithGroup(name),
-		json: h.json.WithGroup(name),
-	}
-}
-
-// SetLevel updates the effective log level. Propagates to every derived
-// logger via the shared LevelVar.
-func (h *Handler) SetLevel(level slog.Level) { h.root.level.Set(level) }
-
-// GetLevel reports the current log level.
-func (h *Handler) GetLevel() slog.Level { return h.root.level.Level() }
-
-// SetFormat flips the output format atomically. Valid formats are "text"
-// and "json". Every derived logger sees the new format on its next Handle
-// call; no rebuild or registration is required.
-func (h *Handler) SetFormat(format string) error {
-	switch format {
-	case "text":
-		h.root.jsonMode.Store(false)
-	case "json":
-		h.root.jsonMode.Store(true)
-	default:
-		return fmt.Errorf("unknown log format `%s`. possible formats: %s", format, []string{"text", "json"})
-	}
-	return nil
-}
-
-// GetFormat reports the currently selected format name.
-func (h *Handler) GetFormat() string {
-	if h.root.jsonMode.Load() {
-		return "json"
-	}
-	return "text"
-}
-
-// SetDisableTimestamp toggles whether Handle zeroes r.Time before
-// dispatching (slog's builtin text/json handlers skip emitting the time
-// attribute on a zero time).
-func (h *Handler) SetDisableTimestamp(v bool) { h.root.disableTimestamp.Store(v) }
-
-// ApplyConfig reads logging.level, logging.format, and (optionally)
-// logging.disable_timestamp from c and applies them to l. The reconfig
-// surface is discovered via structural type-assertion on l.Handler(), so
-// foreign handlers silently opt out of whichever capabilities they do not
-// implement.
-//
-// nebula.Main does NOT call this function on your behalf; callers that want
-// config-driven log level / format / timestamp updates invoke it at
-// startup and register it as a reload callback themselves. This keeps the
-// library from mutating an embedder's logger without their say-so.
-func ApplyConfig(l *slog.Logger, c Config) error {
-	h := l.Handler()
-
-	lvl, err := ParseLevel(strings.ToLower(c.GetString("logging.level", "info")))
-	if err != nil {
-		return err
-	}
-	if ls, ok := h.(interface{ SetLevel(slog.Level) }); ok {
-		ls.SetLevel(lvl)
-	}
-
-	format := strings.ToLower(c.GetString("logging.format", "text"))
-	if fs, ok := h.(interface{ SetFormat(string) error }); ok {
-		if err := fs.SetFormat(format); err != nil {
-			return err
-		}
-	}
-
-	if ts, ok := h.(interface{ SetDisableTimestamp(bool) }); ok {
-		ts.SetDisableTimestamp(c.GetBool("logging.disable_timestamp", false))
-	}
-	return nil
-}
-
-// ParseLevel converts a config-string level name ("trace", "debug", "info",
-// "warn"/"warning", "error", "fatal"/"panic") to a slog.Level. "fatal" and
-// "panic" are accepted for backwards compatibility with pre-slog configs
-// and both map to slog.LevelError.
-func ParseLevel(s string) (slog.Level, error) {
-	switch s {
-	case "trace":
-		return LevelTrace, nil
-	case "debug":
-		return slog.LevelDebug, nil
-	case "info":
-		return slog.LevelInfo, nil
-	case "warn", "warning":
-		return slog.LevelWarn, nil
-	case "error":
-		return slog.LevelError, nil
-	case "fatal", "panic":
-		return slog.LevelError, nil
-	default:
-		return 0, fmt.Errorf("not a valid logging level: %q", s)
-	}
-}
-
-// LevelName returns a human-readable name for a slog.Level matching the
-// strings accepted by ParseLevel.
-func LevelName(l slog.Level) string {
-	switch {
-	case l <= LevelTrace:
-		return "trace"
-	case l <= slog.LevelDebug:
-		return "debug"
-	case l <= slog.LevelInfo:
-		return "info"
-	case l <= slog.LevelWarn:
-		return "warn"
-	default:
-		return "error"
-	}
-}

logging/logger_bench_test.go

@@ -1,90 +0,0 @@
-package logging
-
-import (
-	"context"
-	"io"
-	"log/slog"
-	"testing"
-)
-
-// BenchmarkLogger_* compare the handler returned by NewLogger against a
-// stock slog text handler. The key thing we care about is the per-log
-// cost on a logger that has been derived via .With(), because that is the
-// shape subsystems store on their structs (HostInfo.logger(),
-// lh.l.With("subsystem", ...), etc.) and call from hot paths.
-
-func BenchmarkLogger_Stock_RootInfo(b *testing.B) {
-	l := slog.New(slog.DiscardHandler)
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		l.Info("hello", "i", i)
-	}
-}
-
-func BenchmarkLogger_Nebula_RootInfo(b *testing.B) {
-	l := NewLogger(io.Discard)
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		l.Info("hello", "i", i)
-	}
-}
-
-func BenchmarkLogger_Stock_DerivedInfo(b *testing.B) {
-	l := slog.New(slog.DiscardHandler).With(
-		"subsystem", "bench",
-		"localIndex", 1234,
-	)
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		l.Info("hello", "i", i)
-	}
-}
-
-func BenchmarkLogger_Nebula_DerivedInfo(b *testing.B) {
-	l := NewLogger(io.Discard).With(
-		"subsystem", "bench",
-		"localIndex", 1234,
-	)
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		l.Info("hello", "i", i)
-	}
-}
-
-// Gated-off-path benchmarks: mimic the typical hot-path shape
-// `if l.Enabled(ctx, slog.LevelDebug) { ... }` where the log is gated below
-// the active level. This is the dominant pattern in inside.go/outside.go and
-// what we pay on every packet.
-func BenchmarkLogger_Stock_DerivedEnabledGateMiss(b *testing.B) {
-	l := slog.New(slog.DiscardHandler).With(
-		"subsystem", "bench",
-		"localIndex", 1234,
-	)
-	ctx := context.Background()
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if l.Enabled(ctx, slog.LevelDebug) {
-			l.Debug("hello", "i", i)
-		}
-	}
-}
-
-func BenchmarkLogger_Nebula_DerivedEnabledGateMiss(b *testing.B) {
-	l := NewLogger(io.Discard).With(
-		"subsystem", "bench",
-		"localIndex", 1234,
-	)
-	ctx := context.Background()
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if l.Enabled(ctx, slog.LevelDebug) {
-			l.Debug("hello", "i", i)
-		}
-	}
-}

main.go

@@ -3,13 +3,13 @@ package nebula
 import (
 	"context"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/netip"
 	"runtime/debug"
 	"strings"
 	"time"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/sshd"
@@ -20,7 +20,7 @@ import (
 
 type m = map[string]any
 
-func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, deviceFactory overlay.DeviceFactory) (retcon *Control, reterr error) {
+func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logger, deviceFactory overlay.DeviceFactory) (retcon *Control, reterr error) {
 	ctx, cancel := context.WithCancel(context.Background())
 	// Automatically cancel the context if Main returns an error, to signal all created goroutines to quit.
 	defer func() {
@@ -33,6 +33,11 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		buildVersion = moduleVersion()
 	}
 
+	l := logger
+	l.Formatter = &logrus.TextFormatter{
+		FullTimestamp: true,
+	}
+
 	// Print the config if in test, the exit comes later
 	if configTest {
 		b, err := yaml.Marshal(c.Settings)
@@ -41,9 +46,21 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		}
 
 		// Print the final config
-		l.Info(string(b))
+		l.Println(string(b))
 	}
 
+	err := configLogger(l, c)
+	if err != nil {
+		return nil, util.ContextualizeIfNeeded("Failed to configure the logger", err)
+	}
+
+	c.RegisterReloadCallback(func(c *config.C) {
+		err := configLogger(l, c)
+		if err != nil {
+			l.WithError(err).Error("Failed to configure the logger")
+		}
+	})
+
 	pki, err := NewPKIFromConfig(l, c)
 	if err != nil {
 		return nil, util.ContextualizeIfNeeded("Failed to load PKI from config", err)
@@ -53,9 +70,9 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 	if err != nil {
 		return nil, util.ContextualizeIfNeeded("Error while loading firewall rules", err)
 	}
-	l.Info("Firewall started", "firewallHashes", fw.GetRuleHashes())
+	l.WithField("firewallHashes", fw.GetRuleHashes()).Info("Firewall started")
 
-	ssh, err := sshd.NewSSHServer(l.With("subsystem", "sshd"))
+	ssh, err := sshd.NewSSHServer(l.WithField("subsystem", "sshd"))
 	if err != nil {
 		return nil, util.ContextualizeIfNeeded("Error while creating SSH server", err)
 	}
@@ -64,7 +81,7 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 	if c.GetBool("sshd.enabled", false) {
 		sshStart, err = configSSH(l, ssh, c)
 		if err != nil {
-			l.Warn("Failed to configure sshd, ssh debugging will not be available", "error", err)
+			l.WithError(err).Warn("Failed to configure sshd, ssh debugging will not be available")
 			sshStart = nil
 		}
 	}
@@ -82,7 +99,7 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 			routines = 1
 		}
 		if routines > 1 {
-			l.Info("Using multiple routines", "routines", routines)
+			l.WithField("routines", routines).Info("Using multiple routines")
 		}
 	} else {
 		// deprecated and undocumented
@@ -90,7 +107,7 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		udpQueues := c.GetInt("listen.routines", 1)
 		routines = max(tunQueues, udpQueues)
 		if routines != 1 {
-			l.Warn("Setting tun.routines and listen.routines is deprecated. Use `routines` instead", "routines", routines)
+			l.WithField("routines", routines).Warn("Setting tun.routines and listen.routines is deprecated. Use `routines` instead")
 		}
 	}
 
@@ -103,7 +120,7 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		conntrackCacheTimeout = 1 * time.Second
 	}
 	if conntrackCacheTimeout > 0 {
-		l.Info("Using routine-local conntrack cache", "duration", conntrackCacheTimeout)
+		l.WithField("duration", conntrackCacheTimeout).Info("Using routine-local conntrack cache")
 	}
 
 	var tun overlay.Device
@@ -114,7 +131,8 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 			deviceFactory = overlay.NewDeviceFromConfig
 		}
 
-		tun, err = deviceFactory(c, l, pki.getCertState().myVpnNetworks, routines)
+		cs := pki.getCertState()
+		tun, err = deviceFactory(c, l, cs.myVpnNetworks, cs.GetDefaultCertificate().UnsafeNetworks(), routines)
 		if err != nil {
 			return nil, util.ContextualizeIfNeeded("Failed to get a tun/tap device", err)
 		}
@@ -149,7 +167,7 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		}
 
 		for i := 0; i < routines; i++ {
-			l.Info("listening", "addr", netip.AddrPortFrom(listenHost, uint16(port)))
+			l.Infof("listening on %v", netip.AddrPortFrom(listenHost, uint16(port)))
 			udpServer, err := udp.NewListener(l, listenHost, port, routines > 1, c.GetInt("listen.batch", 64))
 			if err != nil {
 				return nil, util.NewContextualError("Failed to open udp listener", m{"queue": i}, err)
@@ -172,7 +190,6 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 	hostMap := NewHostMapFromConfig(l, c)
 	punchy := NewPunchyFromConfig(l, c)
 	connManager := newConnectionManagerFromConfig(l, c, hostMap, punchy)
-	pmtudMgr := newPMTUDManagerFromConfig(l, c, tun)
 	lightHouse, err := NewLightHouseFromConfig(ctx, l, c, pki.getCertState(), udpConns[0], punchy)
 	if err != nil {
 		return nil, util.ContextualizeIfNeeded("Failed to initialize lighthouse handler", err)
@@ -185,19 +202,27 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		messageMetrics = newMessageMetricsOnlyRecvError()
 	}
 
+	useRelays := c.GetBool("relay.use_relays", DefaultUseRelays) && !c.GetBool("relay.am_relay", false)
+
 	handshakeConfig := HandshakeConfig{
-		tryInterval:    c.GetDuration("handshakes.try_interval", DefaultHandshakeTryInterval),
-		retries:        int64(c.GetInt("handshakes.retries", DefaultHandshakeRetries)),
-		triggerBuffer:  c.GetInt("handshakes.trigger_buffer", DefaultHandshakeTriggerBuffer),
+		tryInterval:   c.GetDuration("handshakes.try_interval", DefaultHandshakeTryInterval),
+		retries:       int64(c.GetInt("handshakes.retries", DefaultHandshakeRetries)),
+		triggerBuffer: c.GetInt("handshakes.trigger_buffer", DefaultHandshakeTriggerBuffer),
+		useRelays:     useRelays,
+
 		messageMetrics: messageMetrics,
 	}
 
 	handshakeManager := NewHandshakeManager(l, hostMap, lightHouse, udpConns[0], handshakeConfig)
 	lightHouse.handshakeTrigger = handshakeManager.trigger
 
-	ds, err := newDnsServerFromConfig(ctx, l, pki.getCertState(), hostMap, c)
-	if err != nil {
-		l.Warn("Failed to start DNS responder", "error", err)
+	serveDns := false
+	if c.GetBool("lighthouse.serve_dns", false) {
+		if c.GetBool("lighthouse.am_lighthouse", false) {
+			serveDns = true
+		} else {
+			l.Warn("DNS server refusing to run because this host is not a lighthouse.")
+		}
 	}
 
 	ifConfig := &InterfaceConfig{
@@ -206,10 +231,9 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		Outside:               udpConns[0],
 		pki:                   pki,
 		Firewall:              fw,
-		DnsServer:             ds,
+		ServeDns:              serveDns,
 		HandshakeManager:      handshakeManager,
 		connectionManager:     connManager,
-		pmtudManager:          pmtudMgr,
 		lightHouse:            lightHouse,
 		tryPromoteEvery:       c.GetUint32("counters.try_promote", defaultPromoteEvery),
 		reQueryEvery:          c.GetUint32("counters.requery_every_packets", defaultReQueryEvery),
@@ -244,7 +268,7 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		go handshakeManager.Run(ctx)
 	}
 
-	stats, err := newStatsServerFromConfig(ctx, l, c, buildVersion, configTest)
+	statsStart, err := startStats(l, c, buildVersion, configTest)
 	if err != nil {
 		return nil, util.ContextualizeIfNeeded("Failed to start stats emitter", err)
 	}
@@ -257,18 +281,23 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 
 	attachCommands(l, c, ssh, ifce)
 
+	// Start DNS server last to allow using the nebula IP as lighthouse.dns.host
+	var dnsStart func()
+	if lightHouse.amLighthouse && serveDns {
+		l.Debugln("Starting dns server")
+		dnsStart = dnsMain(l, pki.getCertState(), hostMap, c)
+	}
+
 	return &Control{
-		state:                  StateReady,
-		f:                      ifce,
-		l:                      l,
-		ctx:                    ctx,
-		cancel:                 cancel,
-		sshStart:               sshStart,
-		statsStart:             stats.Start,
-		dnsStart:               ds.Start,
-		lighthouseStart:        lightHouse.StartUpdateWorker,
-		connectionManagerStart: connManager.Start,
-		pmtudManagerStart:      pmtudMgr.Start,
+		ifce,
+		l,
+		ctx,
+		cancel,
+		sshStart,
+		statsStart,
+		dnsStart,
+		lightHouse.StartUpdateWorker,
+		connManager.Start,
 	}, nil
 }
 

nebula.pb.go

@@ -124,7 +124,7 @@ func (x NebulaControl_MessageType) String() string {
 }
 
 func (NebulaControl_MessageType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_2d65afa7693df5ef, []int{6, 0}
+	return fileDescriptor_2d65afa7693df5ef, []int{8, 0}
 }
 
 type NebulaMeta struct {
@@ -489,6 +489,142 @@ func (m *NebulaPing) GetTime() uint64 {
 	return 0
 }
 
+type NebulaHandshake struct {
+	Details *NebulaHandshakeDetails `protobuf:"bytes,1,opt,name=Details,proto3" json:"Details,omitempty"`
+	Hmac    []byte                  `protobuf:"bytes,2,opt,name=Hmac,proto3" json:"Hmac,omitempty"`
+}
+
+func (m *NebulaHandshake) Reset()         { *m = NebulaHandshake{} }
+func (m *NebulaHandshake) String() string { return proto.CompactTextString(m) }
+func (*NebulaHandshake) ProtoMessage()    {}
+func (*NebulaHandshake) Descriptor() ([]byte, []int) {
+	return fileDescriptor_2d65afa7693df5ef, []int{6}
+}
+func (m *NebulaHandshake) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *NebulaHandshake) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_NebulaHandshake.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *NebulaHandshake) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_NebulaHandshake.Merge(m, src)
+}
+func (m *NebulaHandshake) XXX_Size() int {
+	return m.Size()
+}
+func (m *NebulaHandshake) XXX_DiscardUnknown() {
+	xxx_messageInfo_NebulaHandshake.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_NebulaHandshake proto.InternalMessageInfo
+
+func (m *NebulaHandshake) GetDetails() *NebulaHandshakeDetails {
+	if m != nil {
+		return m.Details
+	}
+	return nil
+}
+
+func (m *NebulaHandshake) GetHmac() []byte {
+	if m != nil {
+		return m.Hmac
+	}
+	return nil
+}
+
+type NebulaHandshakeDetails struct {
+	Cert           []byte `protobuf:"bytes,1,opt,name=Cert,proto3" json:"Cert,omitempty"`
+	InitiatorIndex uint32 `protobuf:"varint,2,opt,name=InitiatorIndex,proto3" json:"InitiatorIndex,omitempty"`
+	ResponderIndex uint32 `protobuf:"varint,3,opt,name=ResponderIndex,proto3" json:"ResponderIndex,omitempty"`
+	Cookie         uint64 `protobuf:"varint,4,opt,name=Cookie,proto3" json:"Cookie,omitempty"`
+	Time           uint64 `protobuf:"varint,5,opt,name=Time,proto3" json:"Time,omitempty"`
+	CertVersion    uint32 `protobuf:"varint,8,opt,name=CertVersion,proto3" json:"CertVersion,omitempty"`
+}
+
+func (m *NebulaHandshakeDetails) Reset()         { *m = NebulaHandshakeDetails{} }
+func (m *NebulaHandshakeDetails) String() string { return proto.CompactTextString(m) }
+func (*NebulaHandshakeDetails) ProtoMessage()    {}
+func (*NebulaHandshakeDetails) Descriptor() ([]byte, []int) {
+	return fileDescriptor_2d65afa7693df5ef, []int{7}
+}
+func (m *NebulaHandshakeDetails) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *NebulaHandshakeDetails) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_NebulaHandshakeDetails.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *NebulaHandshakeDetails) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_NebulaHandshakeDetails.Merge(m, src)
+}
+func (m *NebulaHandshakeDetails) XXX_Size() int {
+	return m.Size()
+}
+func (m *NebulaHandshakeDetails) XXX_DiscardUnknown() {
+	xxx_messageInfo_NebulaHandshakeDetails.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_NebulaHandshakeDetails proto.InternalMessageInfo
+
+func (m *NebulaHandshakeDetails) GetCert() []byte {
+	if m != nil {
+		return m.Cert
+	}
+	return nil
+}
+
+func (m *NebulaHandshakeDetails) GetInitiatorIndex() uint32 {
+	if m != nil {
+		return m.InitiatorIndex
+	}
+	return 0
+}
+
+func (m *NebulaHandshakeDetails) GetResponderIndex() uint32 {
+	if m != nil {
+		return m.ResponderIndex
+	}
+	return 0
+}
+
+func (m *NebulaHandshakeDetails) GetCookie() uint64 {
+	if m != nil {
+		return m.Cookie
+	}
+	return 0
+}
+
+func (m *NebulaHandshakeDetails) GetTime() uint64 {
+	if m != nil {
+		return m.Time
+	}
+	return 0
+}
+
+func (m *NebulaHandshakeDetails) GetCertVersion() uint32 {
+	if m != nil {
+		return m.CertVersion
+	}
+	return 0
+}
+
 type NebulaControl struct {
 	Type                NebulaControl_MessageType `protobuf:"varint,1,opt,name=Type,proto3,enum=nebula.NebulaControl_MessageType" json:"Type,omitempty"`
 	InitiatorRelayIndex uint32                    `protobuf:"varint,2,opt,name=InitiatorRelayIndex,proto3" json:"InitiatorRelayIndex,omitempty"`
@@ -503,7 +639,7 @@ func (m *NebulaControl) Reset()         { *m = NebulaControl{} }
 func (m *NebulaControl) String() string { return proto.CompactTextString(m) }
 func (*NebulaControl) ProtoMessage()    {}
 func (*NebulaControl) Descriptor() ([]byte, []int) {
-	return fileDescriptor_2d65afa7693df5ef, []int{6}
+	return fileDescriptor_2d65afa7693df5ef, []int{8}
 }
 func (m *NebulaControl) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -593,55 +729,65 @@ func init() {
 	proto.RegisterType((*V4AddrPort)(nil), "nebula.V4AddrPort")
 	proto.RegisterType((*V6AddrPort)(nil), "nebula.V6AddrPort")
 	proto.RegisterType((*NebulaPing)(nil), "nebula.NebulaPing")
+	proto.RegisterType((*NebulaHandshake)(nil), "nebula.NebulaHandshake")
+	proto.RegisterType((*NebulaHandshakeDetails)(nil), "nebula.NebulaHandshakeDetails")
 	proto.RegisterType((*NebulaControl)(nil), "nebula.NebulaControl")
 }
 
 func init() { proto.RegisterFile("nebula.proto", fileDescriptor_2d65afa7693df5ef) }
 
 var fileDescriptor_2d65afa7693df5ef = []byte{
-	// 665 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x54, 0xcd, 0x6e, 0xd3, 0x5c,
-	0x10, 0x8d, 0x1d, 0x27, 0x69, 0x27, 0x4d, 0x3e, 0x7f, 0x53, 0x51, 0x12, 0x24, 0xac, 0xe0, 0x45,
-	0x55, 0xb1, 0x48, 0x51, 0x5a, 0xba, 0xa6, 0x2d, 0x42, 0xa9, 0xd4, 0x9f, 0x70, 0x55, 0x8a, 0xc4,
-	0xce, 0xb5, 0x2f, 0x8d, 0x55, 0xc7, 0x37, 0xb5, 0x6f, 0x50, 0xf3, 0x16, 0x3c, 0x0c, 0x0f, 0x01,
-	0xbb, 0x2e, 0x59, 0xa2, 0x66, 0xc9, 0x92, 0x17, 0x40, 0xf7, 0xfa, 0xbf, 0x31, 0xb0, 0xbb, 0x33,
-	0xe7, 0x9c, 0x99, 0xc9, 0xc9, 0x8c, 0x61, 0xcd, 0xa7, 0x97, 0x33, 0xcf, 0xea, 0x4f, 0x03, 0xc6,
-	0x19, 0xd6, 0xa3, 0xc8, 0xfc, 0xa9, 0x02, 0x9c, 0xca, 0xe7, 0x09, 0xe5, 0x16, 0x0e, 0x40, 0x3b,
-	0x9f, 0x4f, 0x69, 0x47, 0xe9, 0x29, 0x5b, 0xed, 0x81, 0xd1, 0x8f, 0x35, 0x19, 0xa3, 0x7f, 0x42,
-	0xc3, 0xd0, 0xba, 0xa2, 0x82, 0x45, 0x24, 0x17, 0x77, 0xa0, 0xf1, 0x9a, 0x72, 0xcb, 0xf5, 0xc2,
-	0x8e, 0xda, 0x53, 0xb6, 0x9a, 0x83, 0xee, 0xb2, 0x2c, 0x26, 0x90, 0x84, 0x69, 0xfe, 0x52, 0xa0,
-	0x99, 0x2b, 0x85, 0x2b, 0xa0, 0x9d, 0x32, 0x9f, 0xea, 0x15, 0x6c, 0xc1, 0xea, 0x90, 0x85, 0xfc,
-	0xed, 0x8c, 0x06, 0x73, 0x5d, 0x41, 0x84, 0x76, 0x1a, 0x12, 0x3a, 0xf5, 0xe6, 0xba, 0x8a, 0x4f,
-	0x60, 0x43, 0xe4, 0xde, 0x4d, 0x1d, 0x8b, 0xd3, 0x53, 0xc6, 0xdd, 0x8f, 0xae, 0x6d, 0x71, 0x97,
-	0xf9, 0x7a, 0x15, 0xbb, 0xf0, 0x48, 0x60, 0x27, 0xec, 0x13, 0x75, 0x0a, 0x90, 0x96, 0x40, 0xa3,
-	0x99, 0x6f, 0x8f, 0x0b, 0x50, 0x0d, 0xdb, 0x00, 0x02, 0x7a, 0x3f, 0x66, 0xd6, 0xc4, 0xd5, 0xeb,
-	0xb8, 0x0e, 0xff, 0x65, 0x71, 0xd4, 0xb6, 0x21, 0x26, 0x1b, 0x59, 0x7c, 0x7c, 0x38, 0xa6, 0xf6,
-	0xb5, 0xbe, 0x22, 0x26, 0x4b, 0xc3, 0x88, 0xb2, 0x8a, 0x4f, 0xa1, 0x5b, 0x3e, 0xd9, 0xbe, 0x7d,
-	0xad, 0x83, 0xf9, 0x4d, 0x85, 0xff, 0x97, 0x4c, 0x41, 0x13, 0xe0, 0xcc, 0x73, 0x2e, 0xa6, 0xfe,
-	0xbe, 0xe3, 0x04, 0xd2, 0xfa, 0xd6, 0x81, 0xda, 0x51, 0x48, 0x2e, 0x8b, 0x9b, 0xd0, 0x48, 0x08,
-	0x75, 0x69, 0xf2, 0x5a, 0x62, 0xb2, 0xc8, 0x91, 0x04, 0xc4, 0x3e, 0xe8, 0x67, 0x9e, 0x43, 0xa8,
-	0x67, 0xcd, 0xe3, 0x54, 0xd8, 0xa9, 0xf5, 0xaa, 0x71, 0xc5, 0x25, 0x0c, 0x07, 0xd0, 0x2a, 0x92,
-	0x1b, 0xbd, 0xea, 0x52, 0xf5, 0x22, 0x05, 0x77, 0xa1, 0x79, 0xb1, 0x2b, 0x9e, 0x23, 0x16, 0x70,
-	0xf1, 0xa7, 0x0b, 0x05, 0x26, 0x8a, 0x0c, 0x22, 0x79, 0x9a, 0x54, 0xed, 0x65, 0x2a, 0xed, 0x81,
-	0x6a, 0x2f, 0xa7, 0xca, 0x68, 0xd8, 0x81, 0x86, 0xcd, 0x66, 0x3e, 0xa7, 0x41, 0xa7, 0x2a, 0x8c,
-	0x21, 0x49, 0x68, 0x6e, 0x82, 0x26, 0x7f, 0x71, 0x1b, 0xd4, 0xa1, 0x2b, 0x5d, 0xd3, 0x88, 0x3a,
-	0x74, 0x45, 0x7c, 0xcc, 0xe4, 0x26, 0x6a, 0x44, 0x3d, 0x66, 0xe6, 0x2e, 0x40, 0x36, 0x06, 0x62,
-	0xa4, 0x8a, 0x5c, 0x26, 0x51, 0x05, 0x04, 0x4d, 0x60, 0x52, 0xd3, 0x22, 0xf2, 0x6d, 0xbe, 0x02,
-	0xc8, 0xc6, 0xf8, 0x57, 0x8f, 0xb4, 0x42, 0x35, 0x57, 0xe1, 0x36, 0x39, 0xac, 0x91, 0xeb, 0x5f,
-	0xfd, 0xfd, 0xb0, 0x04, 0xa3, 0xe4, 0xb0, 0x10, 0xb4, 0x73, 0x77, 0x42, 0xe3, 0x3e, 0xf2, 0x6d,
-	0x9a, 0x4b, 0x67, 0x23, 0xc4, 0x7a, 0x05, 0x57, 0xa1, 0x16, 0x2d, 0xa1, 0x62, 0x7e, 0xa9, 0x42,
-	0x2b, 0x2a, 0x7c, 0xc8, 0x7c, 0x1e, 0x30, 0x0f, 0x5f, 0x16, 0xba, 0x3f, 0x2b, 0x76, 0x8f, 0x49,
-	0x25, 0x03, 0xbc, 0x80, 0xf5, 0x23, 0xdf, 0xe5, 0xae, 0xc5, 0x59, 0x20, 0x57, 0xe0, 0xc8, 0x77,
-	0xe8, 0x6d, 0xec, 0x53, 0x19, 0x24, 0x14, 0x84, 0x86, 0x53, 0xe6, 0x3b, 0x34, 0xaf, 0x88, 0x7c,
-	0x29, 0x83, 0xf0, 0x39, 0xb4, 0x93, 0xa5, 0x3c, 0x67, 0xf2, 0xaf, 0xd1, 0xd2, 0x03, 0x78, 0x80,
-	0xe4, 0x97, 0xfb, 0x4d, 0xc0, 0x26, 0x92, 0x5d, 0x4b, 0xd9, 0x4b, 0x18, 0xf6, 0xa1, 0x99, 0x2f,
-	0x5c, 0x76, 0x38, 0x79, 0x42, 0x7a, 0x0c, 0x69, 0xf1, 0x46, 0x89, 0xa2, 0x48, 0x31, 0x87, 0x7f,
-	0xfa, 0x8e, 0x6d, 0x00, 0x1e, 0x06, 0xd4, 0xe2, 0x54, 0xf2, 0x09, 0xbd, 0x99, 0xd1, 0x90, 0xeb,
-	0x0a, 0x3e, 0x86, 0xf5, 0x42, 0x5e, 0x58, 0x12, 0x52, 0x5d, 0x3d, 0xd8, 0xf9, 0x7a, 0x6f, 0x28,
-	0x77, 0xf7, 0x86, 0xf2, 0xe3, 0xde, 0x50, 0x3e, 0x2f, 0x8c, 0xca, 0xdd, 0xc2, 0xa8, 0x7c, 0x5f,
-	0x18, 0x95, 0x0f, 0xdd, 0x2b, 0x97, 0x8f, 0x67, 0x97, 0x7d, 0x9b, 0x4d, 0xb6, 0x43, 0xcf, 0xb2,
-	0xaf, 0xc7, 0x37, 0xdb, 0xd1, 0x48, 0x97, 0x75, 0xf9, 0x39, 0xdf, 0xf9, 0x1d, 0x00, 0x00, 0xff,
-	0xff, 0x51, 0x0a, 0xe3, 0xd7, 0xde, 0x05, 0x00, 0x00,
+	// 785 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x84, 0x55, 0xcd, 0x6e, 0xeb, 0x44,
+	0x14, 0x8e, 0x1d, 0x27, 0x4e, 0x4f, 0x7e, 0xae, 0x39, 0x15, 0xc1, 0x41, 0x22, 0x0a, 0x5e, 0x54,
+	0x57, 0x2c, 0x72, 0x51, 0x5a, 0xae, 0x58, 0x72, 0x1b, 0x84, 0xd2, 0xaa, 0x3f, 0x61, 0x54, 0x8a,
+	0xc4, 0x06, 0xb9, 0xf6, 0xd0, 0x58, 0x71, 0x3c, 0xa9, 0x3d, 0x41, 0xcd, 0x5b, 0xf0, 0x30, 0x3c,
+	0x04, 0xec, 0xba, 0x42, 0x2c, 0x51, 0xbb, 0x64, 0xc9, 0x0b, 0xa0, 0x19, 0xff, 0x27, 0x86, 0xbb,
+	0x9b, 0x73, 0xbe, 0xef, 0x3b, 0x73, 0xe6, 0xf3, 0x9c, 0x31, 0x74, 0x02, 0x7a, 0xb7, 0xf1, 0xed,
+	0xf1, 0x3a, 0x64, 0x9c, 0x61, 0x33, 0x8e, 0xac, 0xbf, 0x55, 0x80, 0x2b, 0xb9, 0xbc, 0xa4, 0xdc,
+	0xc6, 0x09, 0x68, 0x37, 0xdb, 0x35, 0x35, 0x95, 0x91, 0xf2, 0xba, 0x37, 0x19, 0x8e, 0x13, 0x4d,
+	0xce, 0x18, 0x5f, 0xd2, 0x28, 0xb2, 0xef, 0xa9, 0x60, 0x11, 0xc9, 0xc5, 0x63, 0xd0, 0xbf, 0xa6,
+	0xdc, 0xf6, 0xfc, 0xc8, 0x54, 0x47, 0xca, 0xeb, 0xf6, 0x64, 0xb0, 0x2f, 0x4b, 0x08, 0x24, 0x65,
+	0x5a, 0xff, 0x28, 0xd0, 0x2e, 0x94, 0xc2, 0x16, 0x68, 0x57, 0x2c, 0xa0, 0x46, 0x0d, 0xbb, 0x70,
+	0x30, 0x63, 0x11, 0xff, 0x76, 0x43, 0xc3, 0xad, 0xa1, 0x20, 0x42, 0x2f, 0x0b, 0x09, 0x5d, 0xfb,
+	0x5b, 0x43, 0xc5, 0x8f, 0xa1, 0x2f, 0x72, 0xdf, 0xad, 0x5d, 0x9b, 0xd3, 0x2b, 0xc6, 0xbd, 0x9f,
+	0x3c, 0xc7, 0xe6, 0x1e, 0x0b, 0x8c, 0x3a, 0x0e, 0xe0, 0x43, 0x81, 0x5d, 0xb2, 0x9f, 0xa9, 0x5b,
+	0x82, 0xb4, 0x14, 0x9a, 0x6f, 0x02, 0x67, 0x51, 0x82, 0x1a, 0xd8, 0x03, 0x10, 0xd0, 0xf7, 0x0b,
+	0x66, 0xaf, 0x3c, 0xa3, 0x89, 0x87, 0xf0, 0x2a, 0x8f, 0xe3, 0x6d, 0x75, 0xd1, 0xd9, 0xdc, 0xe6,
+	0x8b, 0xe9, 0x82, 0x3a, 0x4b, 0xa3, 0x25, 0x3a, 0xcb, 0xc2, 0x98, 0x72, 0x80, 0x9f, 0xc0, 0xa0,
+	0xba, 0xb3, 0x77, 0xce, 0xd2, 0x00, 0xeb, 0x77, 0x15, 0x3e, 0xd8, 0x33, 0x05, 0x2d, 0x80, 0x6b,
+	0xdf, 0xbd, 0x5d, 0x07, 0xef, 0x5c, 0x37, 0x94, 0xd6, 0x77, 0x4f, 0x55, 0x53, 0x21, 0x85, 0x2c,
+	0x1e, 0x81, 0x9e, 0x12, 0x9a, 0xd2, 0xe4, 0x4e, 0x6a, 0xb2, 0xc8, 0x91, 0x14, 0xc4, 0x31, 0x18,
+	0xd7, 0xbe, 0x4b, 0xa8, 0x6f, 0x6f, 0x93, 0x54, 0x64, 0x36, 0x46, 0xf5, 0xa4, 0xe2, 0x1e, 0x86,
+	0x13, 0xe8, 0x96, 0xc9, 0xfa, 0xa8, 0xbe, 0x57, 0xbd, 0x4c, 0xc1, 0x13, 0x68, 0xdf, 0x9e, 0x88,
+	0xe5, 0x9c, 0x85, 0x5c, 0x7c, 0x74, 0xa1, 0xc0, 0x54, 0x91, 0x43, 0xa4, 0x48, 0x93, 0xaa, 0xb7,
+	0xb9, 0x4a, 0xdb, 0x51, 0xbd, 0x2d, 0xa8, 0x72, 0x1a, 0x9a, 0xa0, 0x3b, 0x6c, 0x13, 0x70, 0x1a,
+	0x9a, 0x75, 0x61, 0x0c, 0x49, 0x43, 0xeb, 0x08, 0x34, 0x79, 0xe2, 0x1e, 0xa8, 0x33, 0x4f, 0xba,
+	0xa6, 0x11, 0x75, 0xe6, 0x89, 0xf8, 0x82, 0xc9, 0x9b, 0xa8, 0x11, 0xf5, 0x82, 0x59, 0x27, 0x00,
+	0x79, 0x1b, 0x88, 0xb1, 0x2a, 0x76, 0x99, 0xc4, 0x15, 0x10, 0x34, 0x81, 0x49, 0x4d, 0x97, 0xc8,
+	0xb5, 0xf5, 0x15, 0x40, 0xde, 0xc6, 0xfb, 0xf6, 0xc8, 0x2a, 0xd4, 0x0b, 0x15, 0x1e, 0xd3, 0xc1,
+	0x9a, 0x7b, 0xc1, 0xfd, 0xff, 0x0f, 0x96, 0x60, 0x54, 0x0c, 0x16, 0x82, 0x76, 0xe3, 0xad, 0x68,
+	0xb2, 0x8f, 0x5c, 0x5b, 0xd6, 0xde, 0xd8, 0x08, 0xb1, 0x51, 0xc3, 0x03, 0x68, 0xc4, 0x97, 0x50,
+	0xb1, 0x7e, 0x84, 0x57, 0x71, 0xdd, 0x99, 0x1d, 0xb8, 0xd1, 0xc2, 0x5e, 0x52, 0xfc, 0x32, 0x9f,
+	0x51, 0x45, 0x5e, 0x9f, 0x9d, 0x0e, 0x32, 0xe6, 0xee, 0xa0, 0x8a, 0x26, 0x66, 0x2b, 0xdb, 0x91,
+	0x4d, 0x74, 0x88, 0x5c, 0x5b, 0x7f, 0x28, 0xd0, 0xaf, 0xd6, 0x09, 0xfa, 0x94, 0x86, 0x5c, 0xee,
+	0xd2, 0x21, 0x72, 0x8d, 0x47, 0xd0, 0x3b, 0x0b, 0x3c, 0xee, 0xd9, 0x9c, 0x85, 0x67, 0x81, 0x4b,
+	0x1f, 0x13, 0xa7, 0x77, 0xb2, 0x82, 0x47, 0x68, 0xb4, 0x66, 0x81, 0x4b, 0x13, 0x5e, 0xec, 0xe7,
+	0x4e, 0x16, 0xfb, 0xd0, 0x9c, 0x32, 0xb6, 0xf4, 0xa8, 0xa9, 0x49, 0x67, 0x92, 0x28, 0xf3, 0xab,
+	0x91, 0xfb, 0x85, 0x23, 0x68, 0x8b, 0x1e, 0x6e, 0x69, 0x18, 0x79, 0x2c, 0x30, 0x5b, 0xb2, 0x60,
+	0x31, 0x75, 0xae, 0xb5, 0x9a, 0x86, 0x7e, 0xae, 0xb5, 0x74, 0xa3, 0x65, 0xfd, 0x5a, 0x87, 0x6e,
+	0x7c, 0xb0, 0x29, 0x0b, 0x78, 0xc8, 0x7c, 0xfc, 0xa2, 0xf4, 0xdd, 0x3e, 0x2d, 0xbb, 0x96, 0x90,
+	0x2a, 0x3e, 0xdd, 0xe7, 0x70, 0x98, 0x1d, 0x4e, 0x0e, 0x4f, 0xf1, 0xdc, 0x55, 0x90, 0x50, 0x64,
+	0xc7, 0x2c, 0x28, 0x62, 0x07, 0xaa, 0x20, 0xfc, 0x0c, 0x7a, 0xe9, 0x38, 0xdf, 0x30, 0x79, 0xa9,
+	0xb5, 0xec, 0xe9, 0xd8, 0x41, 0x8a, 0xcf, 0xc2, 0x37, 0x21, 0x5b, 0x49, 0x76, 0x23, 0x63, 0xef,
+	0x61, 0x38, 0x86, 0x76, 0xb1, 0x70, 0xd5, 0x93, 0x53, 0x24, 0x64, 0xcf, 0x48, 0x56, 0x5c, 0xaf,
+	0x50, 0x94, 0x29, 0xd6, 0xec, 0xbf, 0xfe, 0x00, 0x7d, 0xc0, 0x69, 0x48, 0x6d, 0x4e, 0x25, 0x9f,
+	0xd0, 0x87, 0x0d, 0x8d, 0xb8, 0xa1, 0xe0, 0x47, 0x70, 0x58, 0xca, 0x0b, 0x4b, 0x22, 0x6a, 0xa8,
+	0xa7, 0xc7, 0xbf, 0x3d, 0x0f, 0x95, 0xa7, 0xe7, 0xa1, 0xf2, 0xd7, 0xf3, 0x50, 0xf9, 0xe5, 0x65,
+	0x58, 0x7b, 0x7a, 0x19, 0xd6, 0xfe, 0x7c, 0x19, 0xd6, 0x7e, 0x18, 0xdc, 0x7b, 0x7c, 0xb1, 0xb9,
+	0x1b, 0x3b, 0x6c, 0xf5, 0x26, 0xf2, 0x6d, 0x67, 0xb9, 0x78, 0x78, 0x13, 0xb7, 0x74, 0xd7, 0x94,
+	0x3f, 0xc2, 0xe3, 0x7f, 0x03, 0x00, 0x00, 0xff, 0xff, 0xea, 0x6f, 0xbc, 0x50, 0x18, 0x07, 0x00,
+	0x00,
 }
 
 func (m *NebulaMeta) Marshal() (dAtA []byte, err error) {
@@ -926,6 +1072,103 @@ func (m *NebulaPing) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *NebulaHandshake) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NebulaHandshake) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NebulaHandshake) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Hmac) > 0 {
+		i -= len(m.Hmac)
+		copy(dAtA[i:], m.Hmac)
+		i = encodeVarintNebula(dAtA, i, uint64(len(m.Hmac)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Details != nil {
+		{
+			size, err := m.Details.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintNebula(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *NebulaHandshakeDetails) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NebulaHandshakeDetails) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NebulaHandshakeDetails) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.CertVersion != 0 {
+		i = encodeVarintNebula(dAtA, i, uint64(m.CertVersion))
+		i--
+		dAtA[i] = 0x40
+	}
+	if m.Time != 0 {
+		i = encodeVarintNebula(dAtA, i, uint64(m.Time))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.Cookie != 0 {
+		i = encodeVarintNebula(dAtA, i, uint64(m.Cookie))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.ResponderIndex != 0 {
+		i = encodeVarintNebula(dAtA, i, uint64(m.ResponderIndex))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.InitiatorIndex != 0 {
+		i = encodeVarintNebula(dAtA, i, uint64(m.InitiatorIndex))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Cert) > 0 {
+		i -= len(m.Cert)
+		copy(dAtA[i:], m.Cert)
+		i = encodeVarintNebula(dAtA, i, uint64(len(m.Cert)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *NebulaControl) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -1132,6 +1375,51 @@ func (m *NebulaPing) Size() (n int) {
 	return n
 }
 
+func (m *NebulaHandshake) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Details != nil {
+		l = m.Details.Size()
+		n += 1 + l + sovNebula(uint64(l))
+	}
+	l = len(m.Hmac)
+	if l > 0 {
+		n += 1 + l + sovNebula(uint64(l))
+	}
+	return n
+}
+
+func (m *NebulaHandshakeDetails) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Cert)
+	if l > 0 {
+		n += 1 + l + sovNebula(uint64(l))
+	}
+	if m.InitiatorIndex != 0 {
+		n += 1 + sovNebula(uint64(m.InitiatorIndex))
+	}
+	if m.ResponderIndex != 0 {
+		n += 1 + sovNebula(uint64(m.ResponderIndex))
+	}
+	if m.Cookie != 0 {
+		n += 1 + sovNebula(uint64(m.Cookie))
+	}
+	if m.Time != 0 {
+		n += 1 + sovNebula(uint64(m.Time))
+	}
+	if m.CertVersion != 0 {
+		n += 1 + sovNebula(uint64(m.CertVersion))
+	}
+	return n
+}
+
 func (m *NebulaControl) Size() (n int) {
 	if m == nil {
 		return 0
@@ -1948,6 +2236,305 @@ func (m *NebulaPing) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *NebulaHandshake) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowNebula
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NebulaHandshake: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NebulaHandshake: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthNebula
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthNebula
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Details == nil {
+				m.Details = &NebulaHandshakeDetails{}
+			}
+			if err := m.Details.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hmac", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthNebula
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthNebula
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Hmac = append(m.Hmac[:0], dAtA[iNdEx:postIndex]...)
+			if m.Hmac == nil {
+				m.Hmac = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipNebula(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthNebula
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NebulaHandshakeDetails) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowNebula
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NebulaHandshakeDetails: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NebulaHandshakeDetails: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cert", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthNebula
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthNebula
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Cert = append(m.Cert[:0], dAtA[iNdEx:postIndex]...)
+			if m.Cert == nil {
+				m.Cert = []byte{}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InitiatorIndex", wireType)
+			}
+			m.InitiatorIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.InitiatorIndex |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResponderIndex", wireType)
+			}
+			m.ResponderIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ResponderIndex |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cookie", wireType)
+			}
+			m.Cookie = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Cookie |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Time", wireType)
+			}
+			m.Time = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Time |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CertVersion", wireType)
+			}
+			m.CertVersion = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNebula
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.CertVersion |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipNebula(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthNebula
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *NebulaControl) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0

nebula.proto

@@ -60,9 +60,21 @@ message NebulaPing {
 	uint64 Time = 2;
 }
 
-// NebulaHandshake / NebulaHandshakeDetails moved to
-// handshake/handshake.proto. The handshake package speaks that wire format
-// directly via a hand-written encoder/decoder.
+message NebulaHandshake {
+  NebulaHandshakeDetails Details = 1;
+  bytes Hmac = 2;
+}
+
+message NebulaHandshakeDetails {
+  bytes Cert = 1;
+  uint32 InitiatorIndex = 2;
+  uint32 ResponderIndex = 3;
+  uint64 Cookie = 4;
+  uint64 Time = 5;
+  uint32 CertVersion = 8;
+  // reserved for WIP multiport
+  reserved 6, 7;
+}
 
 message NebulaControl {
   enum MessageType {

noise.go

@@ -15,12 +15,14 @@ type endianness interface {
 var noiseEndianness endianness = binary.BigEndian
 
 type NebulaCipherState struct {
-	c cipher.AEAD
+	c noise.Cipher
+	//k [32]byte
+	//n uint64
 }
 
 func NewNebulaCipherState(s *noise.CipherState) *NebulaCipherState {
-	x := s.Cipher()
-	return &NebulaCipherState{c: x.(cipher.AEAD)}
+	return &NebulaCipherState{c: s.Cipher()}
+
 }
 
 // EncryptDanger encrypts and authenticates a given payload.
@@ -44,7 +46,7 @@ func (s *NebulaCipherState) EncryptDanger(out, ad, plaintext []byte, n uint64, n
 		nb[2] = 0
 		nb[3] = 0
 		noiseEndianness.PutUint64(nb[4:], n)
-		out = s.c.Seal(out, nb, plaintext, ad)
+		out = s.c.(cipher.AEAD).Seal(out, nb, plaintext, ad)
 		//l.Debugf("Encryption: outlen: %d, nonce: %d, ad: %s, plainlen %d", len(out), n, ad, len(plaintext))
 		return out, nil
 	} else {
@@ -59,7 +61,7 @@ func (s *NebulaCipherState) DecryptDanger(out, ad, ciphertext []byte, n uint64,
 		nb[2] = 0
 		nb[3] = 0
 		noiseEndianness.PutUint64(nb[4:], n)
-		return s.c.Open(out, nb, ciphertext, ad)
+		return s.c.(cipher.AEAD).Open(out, nb, ciphertext, ad)
 	} else {
 		return []byte{}, nil
 	}
@@ -67,7 +69,7 @@ func (s *NebulaCipherState) DecryptDanger(out, ad, ciphertext []byte, n uint64,
 
 func (s *NebulaCipherState) Overhead() int {
 	if s != nil {
-		return s.c.Overhead()
+		return s.c.(cipher.AEAD).Overhead()
 	}
 	return 0
 }

outside.go

@@ -1,16 +1,15 @@
 package nebula
 
 import (
-	"context"
 	"encoding/binary"
 	"errors"
-	"log/slog"
 	"net/netip"
 	"time"
 
 	"github.com/google/gopacket/layers"
 	"golang.org/x/net/ipv6"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
 	"golang.org/x/net/ipv4"
@@ -25,11 +24,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 	if err != nil {
 		// Hole punch packets are 0 or 1 byte big, so lets ignore printing those errors
 		if len(packet) > 1 {
-			f.l.Info("Error while parsing inbound packet",
-				"from", via,
-				"error", err,
-				"packet", packet,
-			)
+			f.l.WithField("packet", packet).Infof("Error while parsing inbound packet from %s: %s", via, err)
 		}
 		return
 	}
@@ -37,8 +32,8 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 	//l.Error("in packet ", header, packet[HeaderLen:])
 	if !via.IsRelayed {
 		if f.myVpnNetworksTable.Contains(via.UdpAddr.Addr()) {
-			if f.l.Enabled(context.Background(), slog.LevelDebug) {
-				f.l.Debug("Refusing to process double encrypted packet", "from", via)
+			if f.l.Level >= logrus.DebugLevel {
+				f.l.WithField("from", via).Debug("Refusing to process double encrypted packet")
 			}
 			return
 		}
@@ -92,10 +87,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 			if !ok {
 				// The only way this happens is if hostmap has an index to the correct HostInfo, but the HostInfo is missing
 				// its internal mapping. This should never happen.
-				hostinfo.logger(f.l).Error("HostInfo missing remote relay index",
-					"vpnAddrs", hostinfo.vpnAddrs,
-					"remoteIndex", h.RemoteIndex,
-				)
+				hostinfo.logger(f.l).WithFields(logrus.Fields{"vpnAddrs": hostinfo.vpnAddrs, "remoteIndex": h.RemoteIndex}).Error("HostInfo missing remote relay index")
 				return
 			}
 
@@ -116,11 +108,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 				// Find the target HostInfo relay object
 				targetHI, targetRelay, err := f.hostMap.QueryVpnAddrsRelayFor(hostinfo.vpnAddrs, relay.PeerAddr)
 				if err != nil {
-					hostinfo.logger(f.l).Info("Failed to find target host info by ip",
-						"relayTo", relay.PeerAddr,
-						"error", err,
-						"hostinfo.vpnAddrs", hostinfo.vpnAddrs,
-					)
+					hostinfo.logger(f.l).WithField("relayTo", relay.PeerAddr).WithError(err).WithField("hostinfo.vpnAddrs", hostinfo.vpnAddrs).Info("Failed to find target host info by ip")
 					return
 				}
 
@@ -136,11 +124,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 						hostinfo.logger(f.l).Error("Unexpected Relay Type of Terminal")
 					}
 				} else {
-					hostinfo.logger(f.l).Info("Unexpected target relay state",
-						"relayTo", relay.PeerAddr,
-						"relayFrom", hostinfo.vpnAddrs[0],
-						"targetRelayState", targetRelay.State,
-					)
+					hostinfo.logger(f.l).WithFields(logrus.Fields{"relayTo": relay.PeerAddr, "relayFrom": hostinfo.vpnAddrs[0], "targetRelayState": targetRelay.State}).Info("Unexpected target relay state")
 					return
 				}
 			}
@@ -154,11 +138,9 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).Error("Failed to decrypt lighthouse packet",
-				"error", err,
-				"from", via,
-				"packet", packet,
-			)
+			hostinfo.logger(f.l).WithError(err).WithField("from", via).
+				WithField("packet", packet).
+				Error("Failed to decrypt lighthouse packet")
 			return
 		}
 
@@ -175,28 +157,17 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).Error("Failed to decrypt test packet",
-				"error", err,
-				"from", via,
-				"packet", packet,
-			)
+			hostinfo.logger(f.l).WithError(err).WithField("from", via).
+				WithField("packet", packet).
+				Error("Failed to decrypt test packet")
 			return
 		}
 
-		switch h.Subtype {
-		case header.TestRequest:
+		if h.Subtype == header.TestRequest {
 			// This testRequest might be from TryPromoteBest, so we should roam
 			// to the new IP address before responding
 			f.handleHostRoaming(hostinfo, via)
 			f.send(header.Test, header.TestReply, ci, hostinfo, d, nb, out)
-		case header.MTUDProbeRequest:
-			// Reply with just the 8-byte ack header so the reverse path doesn't have to
-			// carry the full probe size; we only verify the forward direction.
-			if len(d) >= 8 {
-				f.send(header.Test, header.MTUDProbeReply, ci, hostinfo, d[:8], nb, out)
-			}
-		case header.MTUDProbeReply:
-			f.pmtudManager.HandleReply(hostinfo.localIndexId, d)
 		}
 
 		// Fallthrough to the bottom to record incoming traffic
@@ -219,17 +190,9 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 		if !f.handleEncrypted(ci, via, h) {
 			return
 		}
-		_, err = f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
-		if err != nil {
-			hostinfo.logger(f.l).Error("Failed to decrypt CloseTunnel packet",
-				"error", err,
-				"from", via,
-				"packet", packet,
-			)
-			return
-		}
 
-		hostinfo.logger(f.l).Info("Close tunnel received, tearing down.", "from", via)
+		hostinfo.logger(f.l).WithField("from", via).
+			Info("Close tunnel received, tearing down.")
 
 		f.closeTunnel(hostinfo)
 		return
@@ -241,11 +204,9 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).Error("Failed to decrypt Control packet",
-				"error", err,
-				"from", via,
-				"packet", packet,
-			)
+			hostinfo.logger(f.l).WithError(err).WithField("from", via).
+				WithField("packet", packet).
+				Error("Failed to decrypt Control packet")
 			return
 		}
 
@@ -253,9 +214,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 	default:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(f.l).Debug("Unexpected packet received", "from", via)
-		}
+		hostinfo.logger(f.l).Debugf("Unexpected packet received from %s", via)
 		return
 	}
 
@@ -266,7 +225,6 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 // closeTunnel closes a tunnel locally, it does not send a closeTunnel packet to the remote
 func (f *Interface) closeTunnel(hostInfo *HostInfo) {
-	f.pmtudManager.OnTunnelDown(hostInfo)
 	final := f.hostMap.DeleteHostInfo(hostInfo)
 	if final {
 		// We no longer have any tunnels with this vpn addr, clear learned lighthouse state to lower memory usage
@@ -282,31 +240,23 @@ func (f *Interface) sendCloseTunnel(h *HostInfo) {
 func (f *Interface) handleHostRoaming(hostinfo *HostInfo, via ViaSender) {
 	if !via.IsRelayed && hostinfo.remote != via.UdpAddr {
 		if !f.lightHouse.GetRemoteAllowList().AllowAll(hostinfo.vpnAddrs, via.UdpAddr.Addr()) {
-			if f.l.Enabled(context.Background(), slog.LevelDebug) {
-				hostinfo.logger(f.l).Debug("lighthouse.remote_allow_list denied roaming", "newAddr", via.UdpAddr)
-			}
+			hostinfo.logger(f.l).WithField("newAddr", via.UdpAddr).Debug("lighthouse.remote_allow_list denied roaming")
 			return
 		}
 
 		if !hostinfo.lastRoam.IsZero() && via.UdpAddr == hostinfo.lastRoamRemote && time.Since(hostinfo.lastRoam) < RoamingSuppressSeconds*time.Second {
-			if f.l.Enabled(context.Background(), slog.LevelDebug) {
-				hostinfo.logger(f.l).Debug("Suppressing roam back to previous remote",
-					"suppressSeconds", RoamingSuppressSeconds,
-					"udpAddr", hostinfo.remote,
-					"newAddr", via.UdpAddr,
-				)
+			if f.l.Level >= logrus.DebugLevel {
+				hostinfo.logger(f.l).WithField("udpAddr", hostinfo.remote).WithField("newAddr", via.UdpAddr).
+					Debugf("Suppressing roam back to previous remote for %d seconds", RoamingSuppressSeconds)
 			}
 			return
 		}
 
-		hostinfo.logger(f.l).Info("Host roamed to new udp ip/port.",
-			"udpAddr", hostinfo.remote,
-			"newAddr", via.UdpAddr,
-		)
+		hostinfo.logger(f.l).WithField("udpAddr", hostinfo.remote).WithField("newAddr", via.UdpAddr).
+			Info("Host roamed to new udp ip/port.")
 		hostinfo.lastRoam = time.Now()
 		hostinfo.lastRoamRemote = hostinfo.remote
 		hostinfo.SetRemote(via.UdpAddr)
-		f.pmtudManager.OnRoam(hostinfo)
 	}
 
 }
@@ -534,9 +484,8 @@ func (f *Interface) decrypt(hostinfo *HostInfo, mc uint64, out []byte, packet []
 	}
 
 	if !hostinfo.ConnectionState.window.Update(f.l, mc) {
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(f.l).Debug("dropping out of window packet", "header", h)
-		}
+		hostinfo.logger(f.l).WithField("header", h).
+			Debugln("dropping out of window packet")
 		return nil, errors.New("out of window packet")
 	}
 
@@ -548,36 +497,32 @@ func (f *Interface) decryptToTun(hostinfo *HostInfo, messageCounter uint64, out
 
 	out, err = hostinfo.ConnectionState.dKey.DecryptDanger(out, packet[:header.Len], packet[header.Len:], messageCounter, nb)
 	if err != nil {
-		hostinfo.logger(f.l).Error("Failed to decrypt packet", "error", err)
+		hostinfo.logger(f.l).WithError(err).Error("Failed to decrypt packet")
 		return false
 	}
 
 	err = newPacket(out, true, fwPacket)
 	if err != nil {
-		hostinfo.logger(f.l).Warn("Error while validating inbound packet",
-			"error", err,
-			"packet", out,
-		)
+		hostinfo.logger(f.l).WithError(err).WithField("packet", out).
+			Warnf("Error while validating inbound packet")
 		return false
 	}
 
 	if !hostinfo.ConnectionState.window.Update(f.l, messageCounter) {
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(f.l).Debug("dropping out of window packet", "fwPacket", fwPacket)
-		}
+		hostinfo.logger(f.l).WithField("fwPacket", fwPacket).
+			Debugln("dropping out of window packet")
 		return false
 	}
 
-	dropReason := f.firewall.Drop(*fwPacket, true, hostinfo, f.pki.GetCAPool(), localCache)
+	dropReason := f.firewall.Drop(*fwPacket, out, true, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason != nil {
 		// NOTE: We give `packet` as the `out` here since we already decrypted from it and we don't need it anymore
 		// This gives us a buffer to build the reject packet in
 		f.rejectOutside(out, hostinfo.ConnectionState, hostinfo, nb, packet, q)
-		if f.l.Enabled(context.Background(), slog.LevelDebug) {
-			hostinfo.logger(f.l).Debug("dropping inbound packet",
-				"fwPacket", fwPacket,
-				"reason", dropReason,
-			)
+		if f.l.Level >= logrus.DebugLevel {
+			hostinfo.logger(f.l).WithField("fwPacket", fwPacket).
+				WithField("reason", dropReason).
+				Debugln("dropping inbound packet")
 		}
 		return false
 	}
@@ -585,7 +530,7 @@ func (f *Interface) decryptToTun(hostinfo *HostInfo, messageCounter uint64, out
 	f.connectionManager.In(hostinfo)
 	_, err = f.readers[q].Write(out)
 	if err != nil {
-		f.l.Error("Failed to write to tun", "error", err)
+		f.l.WithError(err).Error("Failed to write to tun")
 	}
 	return true
 }
@@ -601,41 +546,35 @@ func (f *Interface) sendRecvError(endpoint netip.AddrPort, index uint32) {
 
 	b := header.Encode(make([]byte, header.Len), header.Version, header.RecvError, 0, index, 0)
 	_ = f.outside.WriteTo(b, endpoint)
-	if f.l.Enabled(context.Background(), slog.LevelDebug) {
-		f.l.Debug("Recv error sent",
-			"index", index,
-			"udpAddr", endpoint,
-		)
+	if f.l.Level >= logrus.DebugLevel {
+		f.l.WithField("index", index).
+			WithField("udpAddr", endpoint).
+			Debug("Recv error sent")
 	}
 }
 
 func (f *Interface) handleRecvError(addr netip.AddrPort, h *header.H) {
 	if !f.acceptRecvErrorConfig.ShouldRecvError(addr) {
-		f.l.Debug("Recv error received, ignoring",
-			"index", h.RemoteIndex,
-			"udpAddr", addr,
-		)
+		f.l.WithField("index", h.RemoteIndex).
+			WithField("udpAddr", addr).
+			Debug("Recv error received, ignoring")
 		return
 	}
 
-	if f.l.Enabled(context.Background(), slog.LevelDebug) {
-		f.l.Debug("Recv error received",
-			"index", h.RemoteIndex,
-			"udpAddr", addr,
-		)
+	if f.l.Level >= logrus.DebugLevel {
+		f.l.WithField("index", h.RemoteIndex).
+			WithField("udpAddr", addr).
+			Debug("Recv error received")
 	}
 
 	hostinfo := f.hostMap.QueryReverseIndex(h.RemoteIndex)
 	if hostinfo == nil {
-		f.l.Debug("Did not find remote index in main hostmap", "remoteIndex", h.RemoteIndex)
+		f.l.WithField("remoteIndex", h.RemoteIndex).Debugln("Did not find remote index in main hostmap")
 		return
 	}
 
 	if hostinfo.remote.IsValid() && hostinfo.remote != addr {
-		f.l.Info("Someone spoofing recv_errors?",
-			"addr", addr,
-			"hostinfoRemote", hostinfo.remote,
-		)
+		f.l.Infoln("Someone spoofing recv_errors? ", addr, hostinfo.remote)
 		return
 	}
 

overlay/device.go

@@ -11,17 +11,11 @@ type Device interface {
 	io.ReadWriteCloser
 	Activate() error
 	Networks() []netip.Prefix
+	UnsafeNetworks() []netip.Prefix
+	UnsafeIPv4OriginAddress() netip.Prefix
+	SNATAddress() netip.Prefix
 	Name() string
 	RoutesFor(netip.Addr) routing.Gateways
 	SupportsMultiqueue() bool
 	NewMultiQueueReader() (io.ReadWriteCloser, error)
-	// SupportsPerPeerMTU reports whether SetPeerMTU is implemented for real on
-	// this platform. PMTUD requires this; the manager will refuse to enable when
-	// false even if the operator set tun.max_mtu, because a discovered MTU we
-	// can't actually install does the operator no good.
-	SupportsPerPeerMTU() bool
-	// SetPeerMTU installs a per-peer MTU on the routing table so the kernel will
-	// surface PTB / EMSGSIZE for inside packets to that peer that would exceed mtu.
-	// Pass mtu=0 to remove the override and let the device default apply.
-	SetPeerMTU(addr netip.Addr, mtu int) error
 }

overlay/route.go

@@ -2,7 +2,6 @@ package overlay
 
 import (
 	"fmt"
-	"log/slog"
 	"math"
 	"net"
 	"net/netip"
@@ -10,6 +9,7 @@ import (
 	"strconv"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 )
@@ -48,14 +48,11 @@ func (r Route) String() string {
 	return s
 }
 
-func makeRouteTree(l *slog.Logger, routes []Route, allowMTU bool) (*bart.Table[routing.Gateways], error) {
+func makeRouteTree(l *logrus.Logger, routes []Route, allowMTU bool) (*bart.Table[routing.Gateways], error) {
 	routeTree := new(bart.Table[routing.Gateways])
 	for _, r := range routes {
 		if !allowMTU && r.MTU > 0 {
-			l.Warn("route MTU is not supported on this platform",
-				"goos", runtime.GOOS,
-				"route", r,
-			)
+			l.WithField("route", r).Warnf("route MTU is not supported in %s", runtime.GOOS)
 		}
 
 		gateways := r.Via

overlay/route_test.go

@@ -295,7 +295,7 @@ func Test_makeRouteTree(t *testing.T) {
 	routes, err := parseUnsafeRoutes(c, []netip.Prefix{n})
 	require.NoError(t, err)
 	assert.Len(t, routes, 2)
-	routeTree, err := makeRouteTree(test.NewLogger(), routes, true)
+	routeTree, err := makeRouteTree(l, routes, true)
 	require.NoError(t, err)
 
 	ip, err := netip.ParseAddr("1.0.0.2")
@@ -367,7 +367,7 @@ func Test_makeMultipathUnsafeRouteTree(t *testing.T) {
 	routes, err := parseUnsafeRoutes(c, []netip.Prefix{n})
 	require.NoError(t, err)
 	assert.Len(t, routes, 3)
-	routeTree, err := makeRouteTree(test.NewLogger(), routes, true)
+	routeTree, err := makeRouteTree(l, routes, true)
 	require.NoError(t, err)
 
 	ip, err := netip.ParseAddr("192.168.86.1")

overlay/tun.go

@@ -1,11 +1,13 @@
 package overlay
 
 import (
+	"crypto/rand"
 	"fmt"
-	"log/slog"
+	"io"
 	"net"
 	"net/netip"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/util"
 )
@@ -22,22 +24,22 @@ func (e *NameError) Error() string {
 }
 
 // TODO: We may be able to remove routines
-type DeviceFactory func(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error)
+type DeviceFactory func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error)
 
-func NewDeviceFromConfig(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
+func NewDeviceFromConfig(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error) {
 	switch {
 	case c.GetBool("tun.disabled", false):
 		tun := newDisabledTun(vpnNetworks, c.GetInt("tun.tx_queue", 500), c.GetBool("stats.message_metrics", false), l)
 		return tun, nil
 
 	default:
-		return newTun(c, l, vpnNetworks, routines > 1)
+		return newTun(c, l, vpnNetworks, unsafeNetworks, routines > 1)
 	}
 }
 
 func NewFdDeviceFromConfig(fd *int) DeviceFactory {
-	return func(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
-		return newTunFromFd(c, l, *fd, vpnNetworks)
+	return func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error) {
+		return newTunFromFd(c, l, *fd, vpnNetworks, unsafeNetworks)
 	}
 }
 
@@ -129,3 +131,85 @@ func selectGateway(dest netip.Prefix, gateways []netip.Prefix) (netip.Prefix, er
 
 	return netip.Prefix{}, fmt.Errorf("no gateway found for %v in the list of vpn networks", dest)
 }
+
+// genLinkLocal generates a random IPv4 link-local address.
+// If randomizer is nil, it uses rand.Reader to find two random bytes
+func genLinkLocal(randomizer io.Reader) netip.Prefix {
+	if randomizer == nil {
+		randomizer = rand.Reader
+	}
+	octets := []byte{169, 254, 0, 0}
+	_, _ = randomizer.Read(octets[2:4])
+	return coerceLinkLocal(octets)
+}
+
+func coerceLinkLocal(octets []byte) netip.Prefix {
+	if octets[3] == 0 {
+		octets[3] = 1 //please no .0 addresses
+	} else if octets[2] == 255 && octets[3] == 255 {
+		octets[3] = 254 //please no broadcast addresses
+	}
+	out, _ := netip.AddrFromSlice(octets)
+	return netip.PrefixFrom(out, 32)
+}
+
+// prepareUnsafeOriginAddr provides the IPv4 address used on IPv6-only clients that need to access IPv4 unsafe routes
+func prepareUnsafeOriginAddr(d Device, l *logrus.Logger, c *config.C, routes []Route) netip.Prefix {
+	if !d.Networks()[0].Addr().Is6() {
+		return netip.Prefix{} //if we have an IPv4 assignment within the overlay, we don't need an unsafe origin address
+	}
+
+	needed := false
+	for _, route := range routes { //or if we have a route defined into an IPv4 range
+		if route.Cidr.Addr().Is4() {
+			needed = true //todo should this only apply to unsafe routes? almost certainly
+			break
+		}
+	}
+	if !needed {
+		return netip.Prefix{}
+	}
+
+	//todo better config name for sure
+	if a := c.GetString("tun.unsafe_origin_address_for_4over6", ""); a != "" {
+		out, err := netip.ParseAddr(a)
+		if err != nil {
+			l.WithField("value", a).WithError(err).Warn("failed to parse tun.unsafe_origin_address_for_4over6, will use a random value")
+		} else if !out.Is4() || !out.IsLinkLocalUnicast() {
+			l.WithField("value", out).Warn("tun.unsafe_origin_address_for_4over6 must be an IPv4 address")
+		} else if out.IsValid() {
+			return netip.PrefixFrom(out, 32)
+		}
+	}
+	return genLinkLocal(nil)
+}
+
+// prepareSnatAddr provides the address that an IPv6-only unsafe router should use to SNAT traffic before handing it to the operating system
+func prepareSnatAddr(d Device, l *logrus.Logger, c *config.C) netip.Prefix {
+	if !d.Networks()[0].Addr().Is6() {
+		return netip.Prefix{} //if we have an IPv4 assignment within the overlay, we don't need a snat address
+	}
+
+	needed := false
+	for _, un := range d.UnsafeNetworks() { //if we are an unsafe router for an IPv4 range
+		if un.Addr().Is4() {
+			needed = true
+			break
+		}
+	}
+	if !needed {
+		return netip.Prefix{}
+	}
+
+	if a := c.GetString("tun.snat_address_for_4over6", ""); a != "" {
+		out, err := netip.ParseAddr(a)
+		if err != nil {
+			l.WithField("value", a).WithError(err).Warn("failed to parse tun.snat_address_for_4over6, will use a random value")
+		} else if !out.Is4() || !out.IsLinkLocalUnicast() {
+			l.WithField("value", out).Warn("tun.snat_address_for_4over6 must be an IPv4 address")
+		} else if out.IsValid() {
+			return netip.PrefixFrom(out, 32)
+		}
+	}
+	return genLinkLocal(nil)
+}

overlay/tun_android.go

@@ -6,12 +6,12 @@ package overlay
 import (
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"os"
 	"sync/atomic"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
@@ -19,14 +19,16 @@ import (
 
 type tun struct {
 	io.ReadWriteCloser
-	fd          int
-	vpnNetworks []netip.Prefix
-	Routes      atomic.Pointer[[]Route]
-	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	l           *slog.Logger
+	fd               int
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	Routes           atomic.Pointer[[]Route]
+	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	l                *logrus.Logger
 }
 
-func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
+func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
 	// XXX Android returns an fd in non-blocking mode which is necessary for shutdown to work properly.
 	// Be sure not to call file.Fd() as it will set the fd to blocking mode.
 	file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
@@ -35,6 +37,7 @@ func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip
 		ReadWriteCloser: file,
 		fd:              deviceFd,
 		vpnNetworks:     vpnNetworks,
+		unsafeNetworks:  unsafeNetworks,
 		l:               l,
 	}
 
@@ -53,7 +56,7 @@ func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip
 	return t, nil
 }
 
-func newTun(_ *config.C, _ *slog.Logger, _ []netip.Prefix, _ bool) (*tun, error) {
+func newTun(_ *config.C, _ *logrus.Logger, _ []netip.Prefix, _ []netip.Prefix, _ bool) (*tun, error) {
 	return nil, fmt.Errorf("newTun not supported in Android")
 }
 
@@ -76,6 +79,8 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
+
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -91,18 +96,22 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *tun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *tun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (t *tun) Name() string {
 	return "android"
 }
 
-func (t *tun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *tun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *tun) SupportsMultiqueue() bool {
 	return false
 }

overlay/tun_darwin.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"os"
 	"sync/atomic"
@@ -15,6 +14,7 @@ import (
 	"unsafe"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
@@ -24,13 +24,15 @@ import (
 
 type tun struct {
 	io.ReadWriteCloser
-	Device      string
-	vpnNetworks []netip.Prefix
-	DefaultMTU  int
-	Routes      atomic.Pointer[[]Route]
-	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	linkAddr    *netroute.LinkAddr
-	l           *slog.Logger
+	Device           string
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	DefaultMTU       int
+	Routes           atomic.Pointer[[]Route]
+	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	linkAddr         *netroute.LinkAddr
+	l                *logrus.Logger
 
 	// cache out buffer since we need to prepend 4 bytes for tun metadata
 	out []byte
@@ -79,7 +81,7 @@ type ifreqAlias6 struct {
 	Lifetime   addrLifetime
 }
 
-func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*tun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
 	name := c.GetString("tun.dev", "")
 	ifIndex := -1
 	if name != "" && name != "utun" {
@@ -127,6 +129,7 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*t
 		ReadWriteCloser: os.NewFile(uintptr(fd), ""),
 		Device:          name,
 		vpnNetworks:     vpnNetworks,
+		unsafeNetworks:  unsafeNetworks,
 		DefaultMTU:      c.GetInt("tun.mtu", DefaultMTU),
 		l:               l,
 	}
@@ -153,7 +156,7 @@ func (t *tun) deviceBytes() (o [16]byte) {
 	return
 }
 
-func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (*tun, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported in Darwin")
 }
 
@@ -213,6 +216,11 @@ func (t *tun) Activate() error {
 			}
 		}
 	}
+	if t.unsafeIPv4Origin.IsValid() && t.unsafeIPv4Origin.Addr().Is4() {
+		if err = t.activate4(t.unsafeIPv4Origin); err != nil {
+			return err
+		}
+	}
 
 	// Run the interface
 	ifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING
@@ -314,6 +322,10 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	if initial {
+		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
+	}
+
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -389,7 +401,8 @@ func (t *tun) addRoutes(logErrors bool) error {
 		err := addRoute(r.Cidr, t.linkAddr)
 		if err != nil {
 			if errors.Is(err, unix.EEXIST) {
-				t.l.Warn("unable to add unsafe_route, identical route already exists", "route", r.Cidr)
+				t.l.WithField("route", r.Cidr).
+					Warnf("unable to add unsafe_route, identical route already exists")
 			} else {
 				retErr := util.NewContextualError("Failed to add route", map[string]any{"route": r}, err)
 				if logErrors {
@@ -399,7 +412,7 @@ func (t *tun) addRoutes(logErrors bool) error {
 				}
 			}
 		} else {
-			t.l.Info("Added route", "route", r)
+			t.l.WithField("route", r).Info("Added route")
 		}
 	}
 
@@ -414,9 +427,9 @@ func (t *tun) removeRoutes(routes []Route) error {
 
 		err := delRoute(r.Cidr, t.linkAddr)
 		if err != nil {
-			t.l.Error("Failed to remove route", "error", err, "route", r)
+			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
-			t.l.Info("Removed route", "route", r)
+			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
 	return nil
@@ -544,18 +557,22 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *tun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *tun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (t *tun) Name() string {
 	return t.Device
 }
 
-func (t *tun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *tun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *tun) SupportsMultiqueue() bool {
 	return false
 }

overlay/tun_disabled.go

@@ -1,14 +1,13 @@
 package overlay
 
 import (
-	"context"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"strings"
 
 	"github.com/rcrowley/go-metrics"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/iputil"
 	"github.com/slackhq/nebula/routing"
 )
@@ -20,10 +19,10 @@ type disabledTun struct {
 	// Track these metrics since we don't have the tun device to do it for us
 	tx metrics.Counter
 	rx metrics.Counter
-	l  *slog.Logger
+	l  *logrus.Logger
 }
 
-func newDisabledTun(vpnNetworks []netip.Prefix, queueLen int, metricsEnabled bool, l *slog.Logger) *disabledTun {
+func newDisabledTun(vpnNetworks []netip.Prefix, queueLen int, metricsEnabled bool, l *logrus.Logger) *disabledTun {
 	tun := &disabledTun{
 		vpnNetworks: vpnNetworks,
 		read:        make(chan []byte, queueLen),
@@ -53,6 +52,17 @@ func (t *disabledTun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (*disabledTun) UnsafeNetworks() []netip.Prefix {
+	return nil
+}
+func (*disabledTun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
+func (*disabledTun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (*disabledTun) Name() string {
 	return "disabled"
 }
@@ -68,8 +78,8 @@ func (t *disabledTun) Read(b []byte) (int, error) {
 	}
 
 	t.tx.Inc(1)
-	if t.l.Enabled(context.Background(), slog.LevelDebug) {
-		t.l.Debug("Write payload", "raw", prettyPacket(r))
+	if t.l.Level >= logrus.DebugLevel {
+		t.l.WithField("raw", prettyPacket(r)).Debugf("Write payload")
 	}
 
 	return copy(b, r), nil
@@ -86,7 +96,7 @@ func (t *disabledTun) handleICMPEchoRequest(b []byte) bool {
 	select {
 	case t.read <- out:
 	default:
-		t.l.Debug("tun_disabled: dropped ICMP Echo Reply response")
+		t.l.Debugf("tun_disabled: dropped ICMP Echo Reply response")
 	}
 
 	return true
@@ -97,23 +107,15 @@ func (t *disabledTun) Write(b []byte) (int, error) {
 
 	// Check for ICMP Echo Request before spending time doing the full parsing
 	if t.handleICMPEchoRequest(b) {
-		if t.l.Enabled(context.Background(), slog.LevelDebug) {
-			t.l.Debug("Disabled tun responded to ICMP Echo Request", "raw", prettyPacket(b))
+		if t.l.Level >= logrus.DebugLevel {
+			t.l.WithField("raw", prettyPacket(b)).Debugf("Disabled tun responded to ICMP Echo Request")
 		}
-	} else if t.l.Enabled(context.Background(), slog.LevelDebug) {
-		t.l.Debug("Disabled tun received unexpected payload", "raw", prettyPacket(b))
+	} else if t.l.Level >= logrus.DebugLevel {
+		t.l.WithField("raw", prettyPacket(b)).Debugf("Disabled tun received unexpected payload")
 	}
 	return len(b), nil
 }
 
-func (t *disabledTun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *disabledTun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *disabledTun) SupportsMultiqueue() bool {
 	return true
 }

overlay/tun_file_linux_test.go

@@ -1,120 +0,0 @@
-//go:build linux && !android && !e2e_testing
-// +build linux,!android,!e2e_testing
-
-package overlay
-
-import (
-	"errors"
-	"os"
-	"sync"
-	"testing"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-// newReadPipe returns a read fd. The matching write fd is registered for cleanup.
-// The caller takes ownership of the read fd (pass it to newTunFd / newFriend).
-func newReadPipe(t *testing.T) int {
-	t.Helper()
-	var fds [2]int
-	if err := unix.Pipe2(fds[:], unix.O_CLOEXEC); err != nil {
-		t.Fatalf("pipe2: %v", err)
-	}
-	t.Cleanup(func() { _ = unix.Close(fds[1]) })
-	return fds[0]
-}
-
-func TestTunFile_WakeForShutdown_UnblocksRead(t *testing.T) {
-	tf, err := newTunFd(newReadPipe(t))
-	if err != nil {
-		t.Fatalf("newTunFd: %v", err)
-	}
-	t.Cleanup(func() { _ = tf.Close() })
-
-	done := make(chan error, 1)
-	go func() {
-		_, err := tf.Read(make([]byte, 64))
-		done <- err
-	}()
-
-	// Verify Read is actually blocked in poll.
-	select {
-	case err := <-done:
-		t.Fatalf("Read returned before shutdown signal: %v", err)
-	case <-time.After(50 * time.Millisecond):
-	}
-
-	if err := tf.wakeForShutdown(); err != nil {
-		t.Fatalf("wakeForShutdown: %v", err)
-	}
-
-	select {
-	case err := <-done:
-		if !errors.Is(err, os.ErrClosed) {
-			t.Fatalf("expected os.ErrClosed, got %v", err)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("Read did not wake on shutdown")
-	}
-}
-
-func TestTunFile_WakeForShutdown_WakesFriends(t *testing.T) {
-	parent, err := newTunFd(newReadPipe(t))
-	if err != nil {
-		t.Fatalf("newTunFd: %v", err)
-	}
-	friend, err := parent.newFriend(newReadPipe(t))
-	if err != nil {
-		_ = parent.Close()
-		t.Fatalf("newFriend: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = friend.Close()
-		_ = parent.Close()
-	})
-
-	readers := []*tunFile{parent, friend}
-	errs := make([]error, len(readers))
-	var wg sync.WaitGroup
-	for i, r := range readers {
-		wg.Add(1)
-		go func(i int, r *tunFile) {
-			defer wg.Done()
-			_, errs[i] = r.Read(make([]byte, 64))
-		}(i, r)
-	}
-
-	time.Sleep(50 * time.Millisecond)
-
-	if err := parent.wakeForShutdown(); err != nil {
-		t.Fatalf("wakeForShutdown: %v", err)
-	}
-
-	done := make(chan struct{})
-	go func() { wg.Wait(); close(done) }()
-	select {
-	case <-done:
-	case <-time.After(2 * time.Second):
-		t.Fatal("readers did not wake")
-	}
-
-	for i, err := range errs {
-		if !errors.Is(err, os.ErrClosed) {
-			t.Errorf("reader %d: expected os.ErrClosed, got %v", i, err)
-		}
-	}
-}
-
-func TestTunFile_Close_Idempotent(t *testing.T) {
-	tf, err := newTunFd(newReadPipe(t))
-	if err != nil {
-		t.Fatalf("newTunFd: %v", err)
-	}
-	if err := tf.Close(); err != nil {
-		t.Fatalf("first Close: %v", err)
-	}
-	if err := tf.Close(); err != nil {
-		t.Fatalf("second Close should be a no-op, got %v", err)
-	}
-}

overlay/tun_freebsd.go

@@ -9,18 +9,15 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"log/slog"
 	"net/netip"
-	"os"
 	"sync/atomic"
 	"syscall"
 	"time"
 	"unsafe"
 
 	"github.com/gaissmai/bart"
-
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	netroute "golang.org/x/net/route"
@@ -89,238 +86,141 @@ type ifreqAlias6 struct {
 }
 
 type tun struct {
-	Device      string
-	vpnNetworks []netip.Prefix
-	MTU         int
-	Routes      atomic.Pointer[[]Route]
-	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	linkAddr    *netroute.LinkAddr
-	l           *slog.Logger
-
-	fd        int
-	shutdownR int // read end of the shutdown pipe; closing the write end wakes blocked polls
-	shutdownW int // write end of the shutdown pipe; closing this signals shutdown to any blocked reader/writer
-	readPoll  [2]unix.PollFd
-	writePoll [2]unix.PollFd
-	closed    atomic.Bool
-}
-
-// blockOnRead waits until the tun fd is readable or shutdown has been signaled.
-// Returns os.ErrClosed if Close was called.
-func (t *tun) blockOnRead() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(t.readPoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	tunEvents := t.readPoll[0].Revents
-	shutdownEvents := t.readPoll[1].Revents
-	t.readPoll[0].Revents = 0
-	t.readPoll[1].Revents = 0
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	}
-	if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (t *tun) blockOnWrite() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(t.writePoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	tunEvents := t.writePoll[0].Revents
-	shutdownEvents := t.writePoll[1].Revents
-	t.writePoll[0].Revents = 0
-	t.writePoll[1].Revents = 0
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	}
-	if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
+	Device           string
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	MTU              int
+	Routes           atomic.Pointer[[]Route]
+	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	linkAddr         *netroute.LinkAddr
+	l                *logrus.Logger
+	devFd            int
 }
 
 func (t *tun) Read(to []byte) (int, error) {
+	// use readv() to read from the tunnel device, to eliminate the need for copying the buffer
+	if t.devFd < 0 {
+		return -1, syscall.EINVAL
+	}
+
 	// first 4 bytes is protocol family, in network byte order
-	var head [4]byte
-	iovecs := [2]syscall.Iovec{
+	head := make([]byte, 4)
+
+	iovecs := []syscall.Iovec{
 		{&head[0], 4},
 		{&to[0], uint64(len(to))},
 	}
-	for {
-		n, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(t.fd), uintptr(unsafe.Pointer(&iovecs[0])), 2)
-		if errno == 0 {
-			bytesRead := int(n)
-			if bytesRead < 4 {
-				return 0, nil
-			}
-			return bytesRead - 4, nil
-		}
-		switch errno {
-		case unix.EAGAIN:
-			if err := t.blockOnRead(); err != nil {
-				return 0, err
-			}
-		case unix.EINTR:
-			// retry
-		case unix.EBADF:
-			return 0, os.ErrClosed
-		default:
-			return 0, errno
-		}
+
+	n, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))
+
+	var err error
+	if errno != 0 {
+		err = syscall.Errno(errno)
+	} else {
+		err = nil
+	}
+	// fix bytes read number to exclude header
+	bytesRead := int(n)
+	if bytesRead < 0 {
+		return bytesRead, err
+	} else if bytesRead < 4 {
+		return 0, err
+	} else {
+		return bytesRead - 4, err
 	}
 }
 
 // Write is only valid for single threaded use
 func (t *tun) Write(from []byte) (int, error) {
+	// use writev() to write to the tunnel device, to eliminate the need for copying the buffer
+	if t.devFd < 0 {
+		return -1, syscall.EINVAL
+	}
+
 	if len(from) <= 1 {
 		return 0, syscall.EIO
 	}
-
 	ipVer := from[0] >> 4
-	var head [4]byte
+	var head []byte
 	// first 4 bytes is protocol family, in network byte order
-	switch ipVer {
-	case 4:
-		head[3] = syscall.AF_INET
-	case 6:
-		head[3] = syscall.AF_INET6
-	default:
+	if ipVer == 4 {
+		head = []byte{0, 0, 0, syscall.AF_INET}
+	} else if ipVer == 6 {
+		head = []byte{0, 0, 0, syscall.AF_INET6}
+	} else {
 		return 0, fmt.Errorf("unable to determine IP version from packet")
 	}
-
-	iovecs := [2]syscall.Iovec{
+	iovecs := []syscall.Iovec{
 		{&head[0], 4},
 		{&from[0], uint64(len(from))},
 	}
-	for {
-		n, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(t.fd), uintptr(unsafe.Pointer(&iovecs[0])), 2)
-		if errno == 0 {
-			return int(n) - 4, nil
-		}
-		switch errno {
-		case unix.EAGAIN:
-			if err := t.blockOnWrite(); err != nil {
-				return 0, err
-			}
-		case unix.EINTR:
-			// retry
-		case unix.EBADF:
-			return 0, os.ErrClosed
-		default:
-			return 0, errno
-		}
+
+	n, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))
+
+	var err error
+	if errno != 0 {
+		err = syscall.Errno(errno)
+	} else {
+		err = nil
 	}
+
+	return int(n) - 4, err
 }
 
 func (t *tun) Close() error {
-	if t.closed.Swap(true) {
-		return nil
-	}
-
-	// Closing the write end of the shutdown pipe causes any blocked Poll to
-	// return with POLLHUP on the shutdown fd, so readers/writers wake up and
-	// exit with os.ErrClosed.
-	if t.shutdownW >= 0 {
-		_ = unix.Close(t.shutdownW)
-		t.shutdownW = -1
-	}
-
-	if t.fd >= 0 {
-		if err := unix.Close(t.fd); err != nil {
-			t.l.Error("Error closing device", "error", err)
-		}
-		t.fd = -1
-	}
-
-	if t.shutdownR >= 0 {
-		_ = unix.Close(t.shutdownR)
-		t.shutdownR = -1
-	}
-
-	c := make(chan struct{})
-	go func() {
-		// destroying the interface can block if a read() is still pending. Do this asynchronously.
-		defer close(c)
-		s, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, syscall.IPPROTO_IP)
-		if err == nil {
-			defer syscall.Close(s)
-			ifreq := ifreqDestroy{Name: t.deviceBytes()}
-			err = ioctl(uintptr(s), syscall.SIOCIFDESTROY, uintptr(unsafe.Pointer(&ifreq)))
-		}
+	if t.devFd >= 0 {
+		err := syscall.Close(t.devFd)
 		if err != nil {
-			t.l.Error("Error destroying tunnel", "error", err)
+			t.l.WithError(err).Error("Error closing device")
 		}
-	}()
+		t.devFd = -1
 
-	// wait up to 1 second so we start blocking at the ioctl
-	select {
-	case <-c:
-	case <-time.After(1 * time.Second):
+		c := make(chan struct{})
+		go func() {
+			// destroying the interface can block if a read() is still pending. Do this asynchronously.
+			defer close(c)
+			s, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, syscall.IPPROTO_IP)
+			if err == nil {
+				defer syscall.Close(s)
+				ifreq := ifreqDestroy{Name: t.deviceBytes()}
+				err = ioctl(uintptr(s), syscall.SIOCIFDESTROY, uintptr(unsafe.Pointer(&ifreq)))
+			}
+			if err != nil {
+				t.l.WithError(err).Error("Error destroying tunnel")
+			}
+		}()
+
+		// wait up to 1 second so we start blocking at the ioctl
+		select {
+		case <-c:
+		case <-time.After(1 * time.Second):
+		}
 	}
 
 	return nil
 }
 
-func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (*tun, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported in FreeBSD")
 }
 
-func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*tun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
 	// Try to open existing tun device
 	var fd int
 	var err error
 	deviceName := c.GetString("tun.dev", "")
 	if deviceName != "" {
-		fd, err = unix.Open("/dev/"+deviceName, os.O_RDWR, 0)
+		fd, err = syscall.Open("/dev/"+deviceName, syscall.O_RDWR, 0)
 	}
 	if errors.Is(err, fs.ErrNotExist) || deviceName == "" {
 		// If the device doesn't already exist, request a new one and rename it
-		fd, err = unix.Open("/dev/tun", os.O_RDWR, 0)
+		fd, err = syscall.Open("/dev/tun", syscall.O_RDWR, 0)
 	}
 	if err != nil {
 		return nil, err
 	}
 
-	if err = unix.SetNonblock(fd, true); err != nil {
-		_ = unix.Close(fd)
-		return nil, fmt.Errorf("failed to set tun device as nonblocking: %w", err)
-	}
-
-	// Shutdown pipe lets Close wake any reader/writer blocked in Poll.
-	var pipeFds [2]int
-	if err = unix.Pipe2(pipeFds[:], unix.O_CLOEXEC|unix.O_NONBLOCK); err != nil {
-		_ = unix.Close(fd)
-		return nil, fmt.Errorf("failed to create shutdown pipe: %w", err)
-	}
-	shutdownR, shutdownW := pipeFds[0], pipeFds[1]
-
-	closeOnErr := true
-	defer func() {
-		if closeOnErr {
-			_ = unix.Close(fd)
-			_ = unix.Close(shutdownR)
-			_ = unix.Close(shutdownW)
-		}
-	}()
-
 	// Read the name of the interface
 	var name [16]byte
 	arg := fiodgnameArg{length: 16, buf: unsafe.Pointer(&name)}
@@ -339,7 +239,7 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*t
 	}
 
 	if ctrlErr != nil {
-		return nil, ctrlErr
+		return nil, err
 	}
 
 	ifName := string(bytes.TrimRight(name[:], "\x00"))
@@ -355,6 +255,8 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*t
 		}
 		defer syscall.Close(s)
 
+		fd := uintptr(s)
+
 		var fromName [16]byte
 		var toName [16]byte
 		copy(fromName[:], ifName)
@@ -366,32 +268,22 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*t
 		}
 
 		// Set the device name
-		_ = ioctl(uintptr(s), syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
+		_ = ioctl(fd, syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
 	}
 
 	t := &tun{
-		Device:      deviceName,
-		vpnNetworks: vpnNetworks,
-		MTU:         c.GetInt("tun.mtu", DefaultMTU),
-		l:           l,
-		fd:          fd,
-		shutdownR:   shutdownR,
-		shutdownW:   shutdownW,
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(shutdownR), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(shutdownR), Events: unix.POLLIN},
-		},
+		Device:         deviceName,
+		vpnNetworks:    vpnNetworks,
+		unsafeNetworks: unsafeNetworks,
+		MTU:            c.GetInt("tun.mtu", DefaultMTU),
+		l:              l,
+		devFd:          fd,
 	}
 
 	err = t.reload(c, true)
 	if err != nil {
 		return nil, err
 	}
-	closeOnErr = false
 
 	c.RegisterReloadCallback(func(c *config.C) {
 		err := t.reload(c, false)
@@ -521,6 +413,10 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	if initial {
+		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
+	}
+
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -557,18 +453,22 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *tun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *tun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (t *tun) Name() string {
 	return t.Device
 }
 
-func (t *tun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *tun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
@@ -594,7 +494,7 @@ func (t *tun) addRoutes(logErrors bool) error {
 				return retErr
 			}
 		} else {
-			t.l.Info("Added route", "route", r)
+			t.l.WithField("route", r).Info("Added route")
 		}
 	}
 
@@ -609,9 +509,9 @@ func (t *tun) removeRoutes(routes []Route) error {
 
 		err := delRoute(r.Cidr, t.linkAddr)
 		if err != nil {
-			t.l.Error("Failed to remove route", "error", err, "route", r)
+			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
-			t.l.Info("Removed route", "route", r)
+			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
 	return nil

overlay/tun_ios.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"os"
 	"sync"
@@ -15,6 +14,7 @@ import (
 	"syscall"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
@@ -22,20 +22,23 @@ import (
 
 type tun struct {
 	io.ReadWriteCloser
-	vpnNetworks []netip.Prefix
-	Routes      atomic.Pointer[[]Route]
-	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	l           *slog.Logger
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	Routes           atomic.Pointer[[]Route]
+	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	l                *logrus.Logger
 }
 
-func newTun(_ *config.C, _ *slog.Logger, _ []netip.Prefix, _ bool) (*tun, error) {
+func newTun(_ *config.C, _ *logrus.Logger, _ []netip.Prefix, _ []netip.Prefix, _ bool) (*tun, error) {
 	return nil, fmt.Errorf("newTun not supported in iOS")
 }
 
-func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
+func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
 	file := os.NewFile(uintptr(deviceFd), "/dev/tun")
 	t := &tun{
 		vpnNetworks:     vpnNetworks,
+		unsafeNetworks:  unsafeNetworks,
 		ReadWriteCloser: &tunReadCloser{f: file},
 		l:               l,
 	}
@@ -69,6 +72,8 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
+
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -147,18 +152,22 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *tun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *tun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (t *tun) Name() string {
 	return "iOS"
 }
 
-func (t *tun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *tun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *tun) SupportsMultiqueue() bool {
 	return false
 }

overlay/tun_linux.go

@@ -4,10 +4,8 @@
 package overlay
 
 import (
-	"encoding/binary"
 	"fmt"
 	"io"
-	"log/slog"
 	"net"
 	"net/netip"
 	"os"
@@ -18,6 +16,7 @@ import (
 	"unsafe"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
@@ -25,182 +24,17 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// tunFile wraps a TUN file descriptor with poll-based reads. The FD provided will be changed to non-blocking.
-// A shared eventfd allows Close to wake all readers blocked in poll.
-type tunFile struct {
-	fd         int
-	shutdownFd int
-	lastOne    bool
-	readPoll   [2]unix.PollFd
-	writePoll  [2]unix.PollFd
-	closed     bool
-}
-
-// newFriend makes a tunFile for a MultiQueueReader that copies the shutdown eventfd from the parent tun
-func (r *tunFile) newFriend(fd int) (*tunFile, error) {
-	if err := unix.SetNonblock(fd, true); err != nil {
-		return nil, fmt.Errorf("failed to set tun fd non-blocking: %w", err)
-	}
-	return &tunFile{
-		fd:         fd,
-		shutdownFd: r.shutdownFd,
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(r.shutdownFd), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(r.shutdownFd), Events: unix.POLLIN},
-		},
-	}, nil
-}
-
-func newTunFd(fd int) (*tunFile, error) {
-	if err := unix.SetNonblock(fd, true); err != nil {
-		return nil, fmt.Errorf("failed to set tun fd non-blocking: %w", err)
-	}
-
-	shutdownFd, err := unix.Eventfd(0, unix.EFD_NONBLOCK|unix.EFD_CLOEXEC)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create eventfd: %w", err)
-	}
-
-	out := &tunFile{
-		fd:         fd,
-		shutdownFd: shutdownFd,
-		lastOne:    true,
-		readPoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLIN},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-		writePoll: [2]unix.PollFd{
-			{Fd: int32(fd), Events: unix.POLLOUT},
-			{Fd: int32(shutdownFd), Events: unix.POLLIN},
-		},
-	}
-
-	return out, nil
-}
-
-func (r *tunFile) blockOnRead() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(r.readPoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	//always reset these!
-	tunEvents := r.readPoll[0].Revents
-	shutdownEvents := r.readPoll[1].Revents
-	r.readPoll[0].Revents = 0
-	r.readPoll[1].Revents = 0
-	//do the err check before trusting the potentially bogus bits we just got
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	} else if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (r *tunFile) blockOnWrite() error {
-	const problemFlags = unix.POLLHUP | unix.POLLNVAL | unix.POLLERR
-	var err error
-	for {
-		_, err = unix.Poll(r.writePoll[:], -1)
-		if err != unix.EINTR {
-			break
-		}
-	}
-	//always reset these!
-	tunEvents := r.writePoll[0].Revents
-	shutdownEvents := r.writePoll[1].Revents
-	r.writePoll[0].Revents = 0
-	r.writePoll[1].Revents = 0
-	//do the err check before trusting the potentially bogus bits we just got
-	if err != nil {
-		return err
-	}
-	if shutdownEvents&(unix.POLLIN|problemFlags) != 0 {
-		return os.ErrClosed
-	} else if tunEvents&problemFlags != 0 {
-		return os.ErrClosed
-	}
-	return nil
-}
-
-func (r *tunFile) Read(buf []byte) (int, error) {
-	for {
-		if n, err := unix.Read(r.fd, buf); err == nil {
-			return n, nil
-		} else if err == unix.EAGAIN {
-			if err = r.blockOnRead(); err != nil {
-				return 0, err
-			}
-			continue
-		} else if err == unix.EINTR {
-			continue
-		} else if err == unix.EBADF {
-			return 0, os.ErrClosed
-		} else {
-			return 0, err
-		}
-	}
-}
-
-func (r *tunFile) Write(buf []byte) (int, error) {
-	for {
-		if n, err := unix.Write(r.fd, buf); err == nil {
-			return n, nil
-		} else if err == unix.EAGAIN {
-			if err = r.blockOnWrite(); err != nil {
-				return 0, err
-			}
-			continue
-		} else if err == unix.EINTR {
-			continue
-		} else if err == unix.EBADF {
-			return 0, os.ErrClosed
-		} else {
-			return 0, err
-		}
-	}
-}
-
-func (r *tunFile) wakeForShutdown() error {
-	var buf [8]byte
-	binary.NativeEndian.PutUint64(buf[:], 1)
-	_, err := unix.Write(int(r.readPoll[1].Fd), buf[:])
-	return err
-}
-
-func (r *tunFile) Close() error {
-	if r.closed { // avoid closing more than once. Technically a fd could get re-used, which would be a problem
-		return nil
-	}
-	r.closed = true
-	if r.lastOne {
-		_ = unix.Close(r.shutdownFd)
-	}
-	return unix.Close(r.fd)
-}
-
 type tun struct {
-	*tunFile
-	readers     []*tunFile
-	closeLock   sync.Mutex
-	Device      string
-	vpnNetworks []netip.Prefix
-	MaxMTU      int
-	DefaultMTU  int
-	TXQueueLen  int
-	deviceIndex int
-	ioctlFd     uintptr
+	io.ReadWriteCloser
+	fd             int
+	Device         string
+	vpnNetworks    []netip.Prefix
+	unsafeNetworks []netip.Prefix
+	MaxMTU         int
+	DefaultMTU     int
+	TXQueueLen     int
+	deviceIndex    int
+	ioctlFd        uintptr
 
 	Routes                    atomic.Pointer[[]Route]
 	routeTree                 atomic.Pointer[bart.Table[routing.Gateways]]
@@ -213,13 +47,28 @@ type tun struct {
 	routesFromSystem     map[netip.Prefix]routing.Gateways
 	routesFromSystemLock sync.Mutex
 
-	l *slog.Logger
+	snatAddr         netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+
+	l *logrus.Logger
 }
 
 func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *tun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *tun) SNATAddress() netip.Prefix {
+	return t.snatAddr
+}
+
 type ifReq struct {
 	Name  [16]byte
 	Flags uint16
@@ -238,8 +87,10 @@ type ifreqQLEN struct {
 	pad   [8]byte
 }
 
-func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
-	t, err := newTunGeneric(c, l, deviceFd, vpnNetworks)
+func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
+	file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
+
+	t, err := newTunGeneric(c, l, file, vpnNetworks, unsafeNetworks)
 	if err != nil {
 		return nil, err
 	}
@@ -249,7 +100,7 @@ func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip
 	return t, nil
 }
 
-func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, multiqueue bool) (*tun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, multiqueue bool) (*tun, error) {
 	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
 	if err != nil {
 		// If /dev/net/tun doesn't exist, try to create it (will happen in docker)
@@ -280,7 +131,6 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, multiqueue
 	nameStr := c.GetString("tun.dev", "")
 	copy(req.Name[:], nameStr)
 	if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
-		_ = unix.Close(fd)
 		return nil, &NameError{
 			Name:       nameStr,
 			Underlying: err,
@@ -288,7 +138,8 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, multiqueue
 	}
 	name := strings.Trim(string(req.Name[:]), "\x00")
 
-	t, err := newTunGeneric(c, l, fd, vpnNetworks)
+	file := os.NewFile(uintptr(fd), "/dev/net/tun")
+	t, err := newTunGeneric(c, l, file, vpnNetworks, unsafeNetworks)
 	if err != nil {
 		return nil, err
 	}
@@ -298,18 +149,12 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, multiqueue
 	return t, nil
 }
 
-// newTunGeneric does all the stuff common to different tun initialization paths. It will close your files on error.
-func newTunGeneric(c *config.C, l *slog.Logger, fd int, vpnNetworks []netip.Prefix) (*tun, error) {
-	tfd, err := newTunFd(fd)
-	if err != nil {
-		_ = unix.Close(fd)
-		return nil, err
-	}
+func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
 	t := &tun{
-		tunFile:                   tfd,
-		readers:                   []*tunFile{tfd},
-		closeLock:                 sync.Mutex{},
+		ReadWriteCloser:           file,
+		fd:                        int(file.Fd()),
 		vpnNetworks:               vpnNetworks,
+		unsafeNetworks:            unsafeNetworks,
 		TXQueueLen:                c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
 		useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0),
@@ -317,8 +162,8 @@ func newTunGeneric(c *config.C, l *slog.Logger, fd int, vpnNetworks []netip.Pref
 		l:                         l,
 	}
 
-	if err = t.reload(c, true); err != nil {
-		_ = t.Close()
+	err := t.reload(c, true)
+	if err != nil {
 		return nil, err
 	}
 
@@ -342,6 +187,11 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	if initial {
+		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes) //todo MUST be different from t.snatAddr!
+		t.snatAddr = prepareSnatAddr(t, t.l, c)
+	}
+
 	routeTree, err := makeRouteTree(t.l, routes, true)
 	if err != nil {
 		return err
@@ -368,13 +218,6 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		}
 	}
 
-	// tun.max_mtu raises the device MTU above tun.mtu so PMTUD has headroom to
-	// install per-peer routes between tun.mtu (floor) and tun.max_mtu (ceiling).
-	// When unset (default 0) the device MTU is unchanged from existing behavior.
-	if pmtudCeiling := c.GetInt("tun.max_mtu", 0); pmtudCeiling > newMaxMTU {
-		newMaxMTU = pmtudCeiling
-	}
-
 	t.MaxMTU = newMaxMTU
 	t.DefaultMTU = newDefaultMTU
 
@@ -385,16 +228,16 @@ func (t *tun) reload(c *config.C, initial bool) error {
 	if !initial {
 		if oldMaxMTU != newMaxMTU {
 			t.setMTU()
-			t.l.Info("Set max MTU", "mtu", t.MaxMTU, "oldMTU", oldMaxMTU)
+			t.l.Infof("Set max MTU to %v was %v", t.MaxMTU, oldMaxMTU)
 		}
 
 		if oldDefaultMTU != newDefaultMTU {
 			for i := range t.vpnNetworks {
 				err := t.setDefaultRoute(t.vpnNetworks[i])
 				if err != nil {
-					t.l.Warn(err.Error())
+					t.l.Warn(err)
 				} else {
-					t.l.Info("Set default MTU", "mtu", t.DefaultMTU, "oldMTU", oldDefaultMTU)
+					t.l.Infof("Set default MTU to %v was %v", t.DefaultMTU, oldDefaultMTU)
 				}
 			}
 		}
@@ -418,9 +261,6 @@ func (t *tun) SupportsMultiqueue() bool {
 }
 
 func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	t.closeLock.Lock()
-	defer t.closeLock.Unlock()
-
 	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
 	if err != nil {
 		return nil, err
@@ -430,19 +270,12 @@ func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI | unix.IFF_MULTI_QUEUE)
 	copy(req.Name[:], t.Device)
 	if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
-		_ = unix.Close(fd)
 		return nil, err
 	}
 
-	out, err := t.tunFile.newFriend(fd)
-	if err != nil {
-		_ = unix.Close(fd)
-		return nil, err
-	}
+	file := os.NewFile(uintptr(fd), "/dev/net/tun")
 
-	t.readers = append(t.readers, out)
-
-	return out, nil
+	return file, nil
 }
 
 func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
@@ -450,6 +283,29 @@ func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
 	return r
 }
 
+func (t *tun) Write(b []byte) (int, error) {
+	var nn int
+	maximum := len(b)
+
+	for {
+		n, err := unix.Write(t.fd, b[nn:maximum])
+		if n > 0 {
+			nn += n
+		}
+		if nn == len(b) {
+			return nn, err
+		}
+
+		if err != nil {
+			return nn, err
+		}
+
+		if n == 0 {
+			return nn, io.ErrUnexpectedEOF
+		}
+	}
+}
+
 func (t *tun) deviceBytes() (o [16]byte) {
 	for i, c := range t.Device {
 		o[i] = byte(c)
@@ -479,6 +335,17 @@ func (t *tun) addIPs(link netlink.Link) error {
 		}
 	}
 
+	if t.unsafeIPv4Origin.IsValid() {
+		newAddrs = append(newAddrs, &netlink.Addr{
+			IPNet: &net.IPNet{
+				IP:   t.unsafeIPv4Origin.Addr().AsSlice(),
+				Mask: net.CIDRMask(t.unsafeIPv4Origin.Bits(), t.unsafeIPv4Origin.Addr().BitLen()),
+			},
+			Label: t.unsafeIPv4Origin.Addr().Zone(),
+		})
+		t.l.WithField("address", t.unsafeIPv4Origin).Info("Adding origin address for IPv4 unsafe_routes")
+	}
+
 	//add all new addresses
 	for i := range newAddrs {
 		//AddrReplace still adds new IPs, but if their properties change it will change them as well
@@ -499,9 +366,9 @@ func (t *tun) addIPs(link netlink.Link) error {
 		}
 		err = netlink.AddrDel(link, &al[i])
 		if err != nil {
-			t.l.Error("failed to remove address from tun address list", "error", err)
+			t.l.WithError(err).Error("failed to remove address from tun address list")
 		} else {
-			t.l.Info("removed address not listed in cert(s)", "removed", al[i].String())
+			t.l.WithField("removed", al[i].String()).Info("removed address not listed in cert(s)")
 		}
 	}
 
@@ -545,12 +412,12 @@ func (t *tun) Activate() error {
 	ifrq := ifreqQLEN{Name: devName, Value: int32(t.TXQueueLen)}
 	if err = ioctl(t.ioctlFd, unix.SIOCSIFTXQLEN, uintptr(unsafe.Pointer(&ifrq))); err != nil {
 		// If we can't set the queue length nebula will still work but it may lead to packet loss
-		t.l.Error("Failed to set tun tx queue length", "error", err)
+		t.l.WithError(err).Error("Failed to set tun tx queue length")
 	}
 
 	const modeNone = 1
 	if err = netlink.LinkSetIP6AddrGenMode(link, modeNone); err != nil {
-		t.l.Warn("Failed to disable link local address generation", "error", err)
+		t.l.WithError(err).Warn("Failed to disable link local address generation")
 	}
 
 	if err = t.addIPs(link); err != nil {
@@ -566,7 +433,13 @@ func (t *tun) Activate() error {
 	//set route MTU
 	for i := range t.vpnNetworks {
 		if err = t.setDefaultRoute(t.vpnNetworks[i]); err != nil {
-			return fmt.Errorf("failed to set default route MTU: %w", err)
+			return fmt.Errorf("failed to set default route MTU for %s: %w", t.vpnNetworks[i], err)
+		}
+	}
+
+	if t.unsafeIPv4Origin.IsValid() {
+		if err = t.setDefaultRoute(t.unsafeIPv4Origin); err != nil {
+			return fmt.Errorf("failed to set default route MTU for %s: %w", t.unsafeIPv4Origin, err)
 		}
 	}
 
@@ -589,10 +462,27 @@ func (t *tun) setMTU() {
 	ifm := ifreqMTU{Name: t.deviceBytes(), MTU: int32(t.MaxMTU)}
 	if err := ioctl(t.ioctlFd, unix.SIOCSIFMTU, uintptr(unsafe.Pointer(&ifm))); err != nil {
 		// This is currently a non fatal condition because the route table must have the MTU set appropriately as well
-		t.l.Error("Failed to set tun mtu", "error", err)
+		t.l.WithError(err).Error("Failed to set tun mtu")
 	}
 }
 
+func (t *tun) setSnatRoute() error {
+	dr := &net.IPNet{
+		IP:   t.snatAddr.Masked().Addr().AsSlice(),
+		Mask: net.CIDRMask(t.snatAddr.Bits(), t.snatAddr.Addr().BitLen()),
+	}
+
+	nr := netlink.Route{
+		LinkIndex: t.deviceIndex,
+		Dst:       dr,
+		Scope:     unix.RT_SCOPE_LINK,
+		//Protocol: unix.RTPROT_KERNEL,
+		Table: unix.RT_TABLE_MAIN,
+		Type:  unix.RTN_UNICAST,
+	}
+	return netlink.RouteReplace(&nr)
+}
+
 func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 	dr := &net.IPNet{
 		IP:   cidr.Masked().Addr().AsSlice(),
@@ -603,7 +493,7 @@ func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 		LinkIndex: t.deviceIndex,
 		Dst:       dr,
 		MTU:       t.DefaultMTU,
-		AdvMSS:    t.advMSS(Route{Cidr: cidr}),
+		AdvMSS:    t.advMSS(Route{}),
 		Scope:     unix.RT_SCOPE_LINK,
 		Src:       net.IP(cidr.Addr().AsSlice()),
 		Protocol:  unix.RTPROT_KERNEL,
@@ -612,7 +502,7 @@ func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 	}
 	err := netlink.RouteReplace(&nr)
 	if err != nil {
-		t.l.Warn("Failed to set default route MTU, retrying", "error", err, "cidr", cidr)
+		t.l.WithError(err).WithField("cidr", cidr).Warn("Failed to set default route MTU, retrying")
 		//retry twice more -- on some systems there appears to be a race condition where if we set routes too soon, netlink says `invalid argument`
 		for i := 0; i < 2; i++ {
 			time.Sleep(100 * time.Millisecond)
@@ -620,11 +510,7 @@ func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 			if err == nil {
 				break
 			} else {
-				t.l.Warn("Failed to set default route MTU, retrying",
-					"error", err,
-					"cidr", cidr,
-					"mtu", t.DefaultMTU,
-				)
+				t.l.WithError(err).WithField("cidr", cidr).WithField("mtu", t.DefaultMTU).Warn("Failed to set default route MTU, retrying")
 			}
 		}
 		if err != nil {
@@ -669,10 +555,17 @@ func (t *tun) addRoutes(logErrors bool) error {
 				return retErr
 			}
 		} else {
-			t.l.Info("Added route", "route", r)
+			t.l.WithField("route", r).Info("Added route")
 		}
 	}
 
+	if t.snatAddr.IsValid() {
+		//at least for Linux, we need to set a return route for the SNATted traffic in order to satisfy the reverse-path filter,
+		//and to help the kernel deliver our reply traffic to the tun device.
+		//however, it is important that we do not actually /assign/ the SNAT address,
+		//since link-local addresses will not be routed between interfaces without significant trickery.
+		return t.setSnatRoute()
+	}
 	return nil
 }
 
@@ -701,9 +594,9 @@ func (t *tun) removeRoutes(routes []Route) {
 
 		err := netlink.RouteDel(&nr)
 		if err != nil {
-			t.l.Error("Failed to remove route", "error", err, "route", r)
+			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
-			t.l.Info("Removed route", "route", r)
+			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
 }
@@ -712,68 +605,17 @@ func (t *tun) Name() string {
 	return t.Device
 }
 
-func (t *tun) SupportsPerPeerMTU() bool {
-	return true
-}
-
-// SetPeerMTU installs a host route (/32 for an IPv4 vpn address, /128 for an IPv6
-// vpn address) to addr through this tun device with the given MTU. This causes
-// the kernel to reject (or surface PTB to apps for) inside packets to addr that
-// would exceed mtu. Pass mtu=0 to remove the override and let the per-vpn-network
-// route apply again. PoC: assumes addr is reachable directly via this device.
-func (t *tun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	bits := addr.BitLen()
-	prefix := netip.PrefixFrom(addr, bits)
-
-	dr := &net.IPNet{
-		IP:   addr.AsSlice(),
-		Mask: net.CIDRMask(bits, bits),
-	}
-
-	if mtu == 0 {
-		nr := netlink.Route{
-			LinkIndex: t.deviceIndex,
-			Dst:       dr,
-			Scope:     unix.RT_SCOPE_LINK,
-		}
-		if err := netlink.RouteDel(&nr); err != nil {
-			return fmt.Errorf("failed to remove per-peer mtu route %v: %w", prefix, err)
-		}
-		return nil
-	}
-
-	nr := netlink.Route{
-		LinkIndex: t.deviceIndex,
-		Dst:       dr,
-		MTU:       mtu,
-		AdvMSS:    t.advMSS(Route{Cidr: prefix, MTU: mtu}),
-		Scope:     unix.RT_SCOPE_LINK,
-	}
-	if err := netlink.RouteReplace(&nr); err != nil {
-		return fmt.Errorf("failed to set per-peer mtu route %v mtu=%d: %w", prefix, mtu, err)
-	}
-	return nil
-}
-
 func (t *tun) advMSS(r Route) int {
 	mtu := r.MTU
 	if r.MTU == 0 {
 		mtu = t.DefaultMTU
 	}
 
-	// We only need to set advmss if the route MTU does not match the device MTU.
-	if mtu == t.MaxMTU {
-		return 0
+	// We only need to set advmss if the route MTU does not match the device MTU
+	if mtu != t.MaxMTU {
+		return mtu - 40
 	}
-
-	// MSS = MTU - (IP header + TCP header). TCP is always 20 bytes; IP is 20 for
-	// v4 and 40 for v6. r.Cidr is the route destination so it tells us which
-	// family this route is in. If Cidr is unset (empty Route) we default to v4.
-	addr := r.Cidr.Addr()
-	if addr.Is6() && !addr.Is4In6() {
-		return mtu - 60
-	}
-	return mtu - 40
+	return 0
 }
 
 func (t *tun) watchRoutes() {
@@ -783,11 +625,11 @@ func (t *tun) watchRoutes() {
 	netlinkOptions := netlink.RouteSubscribeOptions{
 		ReceiveBufferSize:      t.useSystemRoutesBufferSize,
 		ReceiveBufferForceSize: t.useSystemRoutesBufferSize != 0,
-		ErrorCallback:          func(e error) { t.l.Error("netlink error", "error", e) },
+		ErrorCallback:          func(e error) { t.l.WithError(e).Errorf("netlink error") },
 	}
 
 	if err := netlink.RouteSubscribeWithOptions(rch, doneChan, netlinkOptions); err != nil {
-		t.l.Error("failed to subscribe to system route changes", "error", err)
+		t.l.WithError(err).Errorf("failed to subscribe to system route changes")
 		return
 	}
 
@@ -829,7 +671,7 @@ func (t *tun) getGatewaysFromRoute(r *netlink.Route) routing.Gateways {
 
 	link, err := netlink.LinkByName(t.Device)
 	if err != nil {
-		t.l.Error("Ignoring route update: failed to get link by name", "deviceName", t.Device)
+		t.l.WithField("deviceName", t.Device).Error("Ignoring route update: failed to get link by name")
 		return gateways
 	}
 
@@ -841,10 +683,10 @@ func (t *tun) getGatewaysFromRoute(r *netlink.Route) routing.Gateways {
 				gateways = append(gateways, routing.NewGateway(gwAddr, 1))
 			} else {
 				// Gateway isn't in our overlay network, ignore
-				t.l.Debug("Ignoring route update, gateway is not in our network", "route", r)
+				t.l.WithField("route", r).Debug("Ignoring route update, gateway is not in our network")
 			}
 		} else {
-			t.l.Debug("Ignoring route update, invalid gateway or via address", "route", r)
+			t.l.WithField("route", r).Debug("Ignoring route update, invalid gateway or via address")
 		}
 	}
 
@@ -857,10 +699,10 @@ func (t *tun) getGatewaysFromRoute(r *netlink.Route) routing.Gateways {
 					gateways = append(gateways, routing.NewGateway(gwAddr, p.Hops+1))
 				} else {
 					// Gateway isn't in our overlay network, ignore
-					t.l.Debug("Ignoring route update, gateway is not in our network", "route", r)
+					t.l.WithField("route", r).Debug("Ignoring route update, gateway is not in our network")
 				}
 			} else {
-				t.l.Debug("Ignoring route update, invalid gateway or via address", "route", r)
+				t.l.WithField("route", r).Debug("Ignoring route update, invalid gateway or via address")
 			}
 		}
 	}
@@ -892,18 +734,18 @@ func (t *tun) updateRoutes(r netlink.RouteUpdate) {
 	gateways := t.getGatewaysFromRoute(&r.Route)
 	if len(gateways) == 0 {
 		// No gateways relevant to our network, no routing changes required.
-		t.l.Debug("Ignoring route update, no gateways", "route", r)
+		t.l.WithField("route", r).Debug("Ignoring route update, no gateways")
 		return
 	}
 
 	if r.Dst == nil {
-		t.l.Debug("Ignoring route update, no destination address", "route", r)
+		t.l.WithField("route", r).Debug("Ignoring route update, no destination address")
 		return
 	}
 
 	dstAddr, ok := netip.AddrFromSlice(r.Dst.IP)
 	if !ok {
-		t.l.Debug("Ignoring route update, invalid destination address", "route", r)
+		t.l.WithField("route", r).Debug("Ignoring route update, invalid destination address")
 		return
 	}
 
@@ -914,12 +756,12 @@ func (t *tun) updateRoutes(r netlink.RouteUpdate) {
 
 	t.routesFromSystemLock.Lock()
 	if r.Type == unix.RTM_NEWROUTE {
-		t.l.Info("Adding route", "destination", dst, "via", gateways)
+		t.l.WithField("destination", dst).WithField("via", gateways).Info("Adding route")
 		t.routesFromSystem[dst] = gateways
 		newTree.Insert(dst, gateways)
 
 	} else {
-		t.l.Info("Removing route", "destination", dst, "via", gateways)
+		t.l.WithField("destination", dst).WithField("via", gateways).Info("Removing route")
 		delete(t.routesFromSystem, dst)
 		newTree.Delete(dst)
 	}
@@ -928,40 +770,18 @@ func (t *tun) updateRoutes(r netlink.RouteUpdate) {
 }
 
 func (t *tun) Close() error {
-	t.closeLock.Lock()
-	defer t.closeLock.Unlock()
-
 	if t.routeChan != nil {
 		close(t.routeChan)
-		t.routeChan = nil
 	}
 
-	// Signal all readers blocked in poll to wake up and exit
-	_ = t.tunFile.wakeForShutdown()
+	if t.ReadWriteCloser != nil {
+		_ = t.ReadWriteCloser.Close()
+	}
 
 	if t.ioctlFd > 0 {
-		_ = unix.Close(int(t.ioctlFd))
+		_ = os.NewFile(t.ioctlFd, "ioctlFd").Close()
 		t.ioctlFd = 0
 	}
 
-	for i := range t.readers {
-		if i == 0 {
-			continue //we want to close the zeroth reader last
-		}
-		err := t.readers[i].Close()
-		if err != nil {
-			t.l.Error("error closing tun reader", "reader", i, "error", err)
-		} else {
-			t.l.Info("closed tun reader", "reader", i)
-		}
-	}
-
-	//this is t.readers[0] too
-	err := t.tunFile.Close()
-	if err != nil {
-		t.l.Error("error closing tun reader", "reader", 0, "error", err)
-	} else {
-		t.l.Info("closed tun reader", "reader", 0)
-	}
-	return err
+	return nil
 }

overlay/tun_netbsd.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"os"
 	"regexp"
@@ -16,6 +15,7 @@ import (
 	"unsafe"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
@@ -58,23 +58,25 @@ type addrLifetime struct {
 }
 
 type tun struct {
-	Device      string
-	vpnNetworks []netip.Prefix
-	MTU         int
-	Routes      atomic.Pointer[[]Route]
-	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	l           *slog.Logger
-	f           *os.File
-	fd          int
+	Device           string
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	MTU              int
+	Routes           atomic.Pointer[[]Route]
+	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	l                *logrus.Logger
+	f                *os.File
+	fd               int
 }
 
 var deviceNameRE = regexp.MustCompile(`^tun[0-9]+$`)
 
-func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (*tun, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported in NetBSD")
 }
 
-func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*tun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
 	// Try to open tun device
 	var err error
 	deviceName := c.GetString("tun.dev", "")
@@ -92,7 +94,7 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*t
 
 	err = unix.SetNonblock(fd, true)
 	if err != nil {
-		l.Warn("Failed to set the tun device as nonblocking", "error", err)
+		l.WithError(err).Warn("Failed to set the tun device as nonblocking")
 	}
 
 	t := &tun{
@@ -350,6 +352,10 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	if initial {
+		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
+	}
+
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -386,18 +392,22 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *tun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *tun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (t *tun) Name() string {
 	return t.Device
 }
 
-func (t *tun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *tun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
@@ -424,7 +434,7 @@ func (t *tun) addRoutes(logErrors bool) error {
 				return retErr
 			}
 		} else {
-			t.l.Info("Added route", "route", r)
+			t.l.WithField("route", r).Info("Added route")
 		}
 	}
 
@@ -439,9 +449,9 @@ func (t *tun) removeRoutes(routes []Route) error {
 
 		err := delRoute(r.Cidr, t.vpnNetworks)
 		if err != nil {
-			t.l.Error("Failed to remove route", "error", err, "route", r)
+			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
-			t.l.Info("Removed route", "route", r)
+			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
 	return nil

overlay/tun_openbsd.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"os"
 	"regexp"
@@ -16,6 +15,7 @@ import (
 	"unsafe"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
@@ -49,25 +49,27 @@ type ifreq struct {
 }
 
 type tun struct {
-	Device      string
-	vpnNetworks []netip.Prefix
-	MTU         int
-	Routes      atomic.Pointer[[]Route]
-	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	l           *slog.Logger
-	f           *os.File
-	fd          int
+	Device           string
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	MTU              int
+	Routes           atomic.Pointer[[]Route]
+	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	l                *logrus.Logger
+	f                *os.File
+	fd               int
 	// cache out buffer since we need to prepend 4 bytes for tun metadata
 	out []byte
 }
 
 var deviceNameRE = regexp.MustCompile(`^tun[0-9]+$`)
 
-func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (*tun, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported in openbsd")
 }
 
-func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*tun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
 	// Try to open tun device
 	var err error
 	deviceName := c.GetString("tun.dev", "")
@@ -85,16 +87,17 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*t
 
 	err = unix.SetNonblock(fd, true)
 	if err != nil {
-		l.Warn("Failed to set the tun device as nonblocking", "error", err)
+		l.WithError(err).Warn("Failed to set the tun device as nonblocking")
 	}
 
 	t := &tun{
-		f:           os.NewFile(uintptr(fd), ""),
-		fd:          fd,
-		Device:      deviceName,
-		vpnNetworks: vpnNetworks,
-		MTU:         c.GetInt("tun.mtu", DefaultMTU),
-		l:           l,
+		f:              os.NewFile(uintptr(fd), ""),
+		fd:             fd,
+		Device:         deviceName,
+		vpnNetworks:    vpnNetworks,
+		unsafeNetworks: unsafeNetworks,
+		MTU:            c.GetInt("tun.mtu", DefaultMTU),
+		l:              l,
 	}
 
 	err = t.reload(c, true)
@@ -270,6 +273,10 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	if initial {
+		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
+	}
+
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -306,18 +313,22 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *tun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *tun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (t *tun) Name() string {
 	return t.Device
 }
 
-func (t *tun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *tun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *tun) SupportsMultiqueue() bool {
 	return false
 }
@@ -344,7 +355,7 @@ func (t *tun) addRoutes(logErrors bool) error {
 				return retErr
 			}
 		} else {
-			t.l.Info("Added route", "route", r)
+			t.l.WithField("route", r).Info("Added route")
 		}
 	}
 
@@ -359,9 +370,9 @@ func (t *tun) removeRoutes(routes []Route) error {
 
 		err := delRoute(r.Cidr, t.vpnNetworks)
 		if err != nil {
-			t.l.Error("Failed to remove route", "error", err, "route", r)
+			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
-			t.l.Info("Removed route", "route", r)
+			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
 	return nil

overlay/tun_snat_test.go

@@ -0,0 +1,179 @@
+package overlay
+
+import (
+	"io"
+	"net/netip"
+	"testing"
+
+	"github.com/sirupsen/logrus"
+	"github.com/slackhq/nebula/config"
+	"github.com/slackhq/nebula/routing"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// mockDevice is a minimal Device implementation for testing prepareUnsafeOriginAddr.
+type mockDevice struct {
+	networks       []netip.Prefix
+	unsafeNetworks []netip.Prefix
+	snatAddr       netip.Prefix
+	unsafeSnatAddr netip.Prefix
+}
+
+func (d *mockDevice) Read([]byte) (int, error)                         { return 0, nil }
+func (d *mockDevice) Write([]byte) (int, error)                        { return 0, nil }
+func (d *mockDevice) Close() error                                     { return nil }
+func (d *mockDevice) Activate() error                                  { return nil }
+func (d *mockDevice) Networks() []netip.Prefix                         { return d.networks }
+func (d *mockDevice) UnsafeNetworks() []netip.Prefix                   { return d.unsafeNetworks }
+func (d *mockDevice) SNATAddress() netip.Prefix                        { return d.snatAddr }
+func (d *mockDevice) UnsafeIPv4OriginAddress() netip.Prefix            { return d.unsafeSnatAddr }
+func (d *mockDevice) Name() string                                     { return "mock" }
+func (d *mockDevice) RoutesFor(netip.Addr) routing.Gateways            { return routing.Gateways{} }
+func (d *mockDevice) SupportsMultiqueue() bool                         { return false }
+func (d *mockDevice) NewMultiQueueReader() (io.ReadWriteCloser, error) { return nil, nil }
+
+func TestPrepareSnatAddr_V4Primary_NoSnat(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+
+	// If the device has an IPv4 primary address, no SNAT needed
+	d := &mockDevice{
+		networks: []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")},
+	}
+	result := prepareUnsafeOriginAddr(d, l, c, nil)
+	assert.Equal(t, netip.Prefix{}, result, "should not assign SNAT addr when device has IPv4 primary")
+}
+
+func TestPrepareSnatAddr_V6Primary_NoUnsafeOrRoutes(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+
+	// IPv6 primary but no unsafe networks or IPv4 routes
+	d := &mockDevice{
+		networks: []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
+	}
+	result := prepareUnsafeOriginAddr(d, l, c, nil)
+	assert.Equal(t, netip.Prefix{}, result, "should not assign SNAT addr without IPv4 unsafe networks or routes")
+}
+
+func TestPrepareSnatAddr_V6Primary_WithV4Unsafe(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+
+	// IPv6 primary with IPv4 unsafe network -> should get SNAT addr
+	d := &mockDevice{
+		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
+		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
+	}
+	result := prepareSnatAddr(d, l, c)
+	require.True(t, result.IsValid(), "should assign SNAT addr")
+	assert.True(t, result.Addr().Is4(), "SNAT addr should be IPv4")
+	assert.True(t, result.Addr().IsLinkLocalUnicast(), "SNAT addr should be link-local")
+	assert.Equal(t, 32, result.Bits(), "SNAT addr should be /32")
+
+	result = prepareUnsafeOriginAddr(d, l, c, nil)
+	require.False(t, result.IsValid(), "no routes = no origin addr needed")
+}
+
+func TestPrepareUnsafeOriginAddr_V6Primary_WithV4Route(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+
+	// IPv6 primary with IPv4 route -> should get SNAT addr
+	d := &mockDevice{
+		networks: []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
+	}
+	routes := []Route{
+		{Cidr: netip.MustParsePrefix("10.0.0.0/8")},
+	}
+	result := prepareUnsafeOriginAddr(d, l, c, routes)
+	require.True(t, result.IsValid(), "should assign SNAT addr when IPv4 route exists")
+	assert.True(t, result.Addr().Is4())
+	assert.True(t, result.Addr().IsLinkLocalUnicast())
+
+	result = prepareSnatAddr(d, l, c)
+	require.False(t, result.IsValid(), "no UnsafeNetworks = no snat addr needed")
+}
+
+func TestPrepareSnatAddr_V6Primary_V6UnsafeOnly(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+
+	// IPv6 primary with only IPv6 unsafe network -> no SNAT needed
+	d := &mockDevice{
+		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
+		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("fd01::/64")},
+	}
+	result := prepareUnsafeOriginAddr(d, l, c, nil)
+	assert.Equal(t, netip.Prefix{}, result, "should not assign SNAT addr for IPv6-only unsafe networks")
+}
+
+func TestPrepareSnatAddr_ManualAddress(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+	c.Settings["tun"] = map[string]any{
+		"snat_address_for_4over6": "169.254.42.42",
+	}
+
+	d := &mockDevice{
+		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
+		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
+	}
+	result := prepareSnatAddr(d, l, c)
+	require.True(t, result.IsValid())
+	assert.Equal(t, netip.MustParseAddr("169.254.42.42"), result.Addr())
+	assert.Equal(t, 32, result.Bits())
+}
+
+func TestPrepareSnatAddr_InvalidManualAddress_Fallback(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+	c.Settings["tun"] = map[string]any{
+		"snat_address_for_4over6": "not-an-ip",
+	}
+
+	d := &mockDevice{
+		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
+		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
+	}
+	result := prepareSnatAddr(d, l, c)
+	// Should fall back to auto-assignment
+	require.True(t, result.IsValid(), "should fall back to auto-assigned address")
+	assert.True(t, result.Addr().Is4())
+	assert.True(t, result.Addr().IsLinkLocalUnicast())
+}
+
+func TestPrepareSnatAddr_AutoGenerated_Range(t *testing.T) {
+	l := logrus.New()
+	l.SetLevel(logrus.PanicLevel)
+	c := config.NewC(l)
+
+	d := &mockDevice{
+		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
+		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
+	}
+
+	// Generate several addresses and verify they're all in the expected range
+	for i := 0; i < 100; i++ {
+		result := prepareSnatAddr(d, l, c)
+		require.True(t, result.IsValid())
+		addr := result.Addr()
+		octets := addr.As4()
+		assert.Equal(t, byte(169), octets[0], "first octet should be 169")
+		assert.Equal(t, byte(254), octets[1], "second octet should be 254")
+		// Should not have .0 in the last octet
+		assert.NotEqual(t, byte(0), octets[3], "last octet should not be 0")
+		// Should not be 169.254.255.255 (broadcast)
+		if octets[2] == 255 {
+			assert.NotEqual(t, byte(255), octets[3], "should not be broadcast address")
+		}
+	}
+}

overlay/tun_test.go

@@ -0,0 +1,37 @@
+package overlay
+
+import (
+	"bytes"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLinkLocal(t *testing.T) {
+	r := bytes.NewReader([]byte{42, 99})
+	result := genLinkLocal(r)
+	assert.Equal(t, netip.MustParsePrefix("169.254.42.99/32"), result, "genLinkLocal with a deterministic randomizer")
+
+	result = genLinkLocal(nil)
+	assert.True(t, result.IsValid(), "genLinkLocal with nil randomizer should be valid")
+	assert.True(t, result.Addr().IsLinkLocalUnicast(), "genLinkLocal with nil randomizer should be link-local")
+
+	result = coerceLinkLocal([]byte{169, 254, 100, 50})
+	assert.Equal(t, netip.MustParsePrefix("169.254.100.50/32"), result, "coerceLinkLocal should pass through normal values")
+
+	result = coerceLinkLocal([]byte{169, 254, 0, 0})
+	assert.Equal(t, netip.MustParsePrefix("169.254.0.1/32"), result, "coerceLinkLocal should bump .0 last octet to .1")
+
+	result = coerceLinkLocal([]byte{169, 254, 255, 255})
+	assert.Equal(t, netip.MustParsePrefix("169.254.255.254/32"), result, "coerceLinkLocal should bump broadcast 255.255 to 255.254")
+
+	result = coerceLinkLocal([]byte{169, 254, 0, 1})
+	assert.Equal(t, netip.MustParsePrefix("169.254.0.1/32"), result, "coerceLinkLocal should leave .1 last octet unchanged")
+
+	result = coerceLinkLocal([]byte{169, 254, 255, 254})
+	assert.Equal(t, netip.MustParsePrefix("169.254.255.254/32"), result, "coerceLinkLocal should leave 255.254 unchanged")
+
+	result = coerceLinkLocal([]byte{169, 254, 255, 100})
+	assert.Equal(t, netip.MustParsePrefix("169.254.255.100/32"), result, "coerceLinkLocal should leave 255.100 unchanged")
+}

overlay/tun_tester.go

@@ -4,32 +4,34 @@
 package overlay
 
 import (
-	"context"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"os"
 	"sync/atomic"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 )
 
 type TestTun struct {
-	Device      string
-	vpnNetworks []netip.Prefix
-	Routes      []Route
-	routeTree   *bart.Table[routing.Gateways]
-	l           *slog.Logger
+	Device           string
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	snatAddr         netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	Routes           []Route
+	routeTree        *bart.Table[routing.Gateways]
+	l                *logrus.Logger
 
 	closed    atomic.Bool
 	rxPackets chan []byte // Packets to receive into nebula
 	TxPackets chan []byte // Packets transmitted outside by nebula
 }
 
-func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*TestTun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*TestTun, error) {
 	_, routes, err := getAllRoutesFromConfig(c, vpnNetworks, true)
 	if err != nil {
 		return nil, err
@@ -39,18 +41,22 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*T
 		return nil, err
 	}
 
-	return &TestTun{
-		Device:      c.GetString("tun.dev", ""),
-		vpnNetworks: vpnNetworks,
-		Routes:      routes,
-		routeTree:   routeTree,
-		l:           l,
-		rxPackets:   make(chan []byte, 10),
-		TxPackets:   make(chan []byte, 10),
-	}, nil
+	tt := &TestTun{
+		Device:         c.GetString("tun.dev", ""),
+		vpnNetworks:    vpnNetworks,
+		unsafeNetworks: unsafeNetworks,
+		Routes:         routes,
+		routeTree:      routeTree,
+		l:              l,
+		rxPackets:      make(chan []byte, 10),
+		TxPackets:      make(chan []byte, 10),
+	}
+	tt.unsafeIPv4Origin = prepareUnsafeOriginAddr(tt, l, c, routes)
+	tt.snatAddr = prepareSnatAddr(tt, tt.l, c)
+	return tt, nil
 }
 
-func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (*TestTun, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*TestTun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported")
 }
 
@@ -62,8 +68,8 @@ func (t *TestTun) Send(packet []byte) {
 		return
 	}
 
-	if t.l.Enabled(context.Background(), slog.LevelDebug) {
-		t.l.Debug("Tun receiving injected packet", "dataLen", len(packet))
+	if t.l.Level >= logrus.DebugLevel {
+		t.l.WithField("dataLen", len(packet)).Debug("Tun receiving injected packet")
 	}
 	t.rxPackets <- packet
 }
@@ -105,14 +111,6 @@ func (t *TestTun) Name() string {
 	return t.Device
 }
 
-func (t *TestTun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *TestTun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *TestTun) Write(b []byte) (n int, err error) {
 	if t.closed.Load() {
 		return 0, io.ErrClosedPipe
@@ -148,3 +146,15 @@ func (t *TestTun) SupportsMultiqueue() bool {
 func (t *TestTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented")
 }
+
+func (t *TestTun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *TestTun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *TestTun) SNATAddress() netip.Prefix {
+	return t.snatAddr
+}

overlay/tun_windows.go

@@ -7,7 +7,6 @@ import (
 	"crypto"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/netip"
 	"os"
 	"path/filepath"
@@ -17,6 +16,7 @@ import (
 	"unsafe"
 
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
@@ -28,21 +28,23 @@ import (
 const tunGUIDLabel = "Fixed Nebula Windows GUID v1"
 
 type winTun struct {
-	Device      string
-	vpnNetworks []netip.Prefix
-	MTU         int
-	Routes      atomic.Pointer[[]Route]
-	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	l           *slog.Logger
+	Device           string
+	vpnNetworks      []netip.Prefix
+	unsafeNetworks   []netip.Prefix
+	unsafeIPv4Origin netip.Prefix
+	MTU              int
+	Routes           atomic.Pointer[[]Route]
+	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	l                *logrus.Logger
 
 	tun *wintun.NativeTun
 }
 
-func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (Device, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (Device, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported in Windows")
 }
 
-func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*winTun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*winTun, error) {
 	err := checkWinTunExists()
 	if err != nil {
 		return nil, fmt.Errorf("can not load the wintun driver: %w", err)
@@ -55,10 +57,11 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*w
 	}
 
 	t := &winTun{
-		Device:      deviceName,
-		vpnNetworks: vpnNetworks,
-		MTU:         c.GetInt("tun.mtu", DefaultMTU),
-		l:           l,
+		Device:         deviceName,
+		vpnNetworks:    vpnNetworks,
+		unsafeNetworks: unsafeNetworks,
+		MTU:            c.GetInt("tun.mtu", DefaultMTU),
+		l:              l,
 	}
 
 	err = t.reload(c, true)
@@ -71,7 +74,7 @@ func newTun(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, _ bool) (*w
 	if err != nil {
 		// Windows 10 has an issue with unclean shutdowns not fully cleaning up the wintun device.
 		// Trying a second time resolves the issue.
-		l.Debug("Failed to create wintun device, retrying", "error", err)
+		l.WithError(err).Debug("Failed to create wintun device, retrying")
 		tunDevice, err = wintun.CreateTUNWithRequestedGUID(deviceName, guid, t.MTU)
 		if err != nil {
 			return nil, &NameError{
@@ -102,6 +105,10 @@ func (t *winTun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
+	if initial {
+		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
+	}
+
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -132,7 +139,12 @@ func (t *winTun) reload(c *config.C, initial bool) error {
 func (t *winTun) Activate() error {
 	luid := winipcfg.LUID(t.tun.LUID())
 
-	err := luid.SetIPAddresses(t.vpnNetworks)
+	prefixes := t.vpnNetworks
+	if t.unsafeIPv4Origin.IsValid() {
+		prefixes = append(prefixes, t.unsafeIPv4Origin)
+	}
+
+	err := luid.SetIPAddresses(prefixes)
 	if err != nil {
 		return fmt.Errorf("failed to set address: %w", err)
 	}
@@ -170,7 +182,7 @@ func (t *winTun) addRoutes(logErrors bool) error {
 				return retErr
 			}
 		} else {
-			t.l.Info("Added route", "route", r)
+			t.l.WithField("route", r).Info("Added route")
 		}
 
 		if !foundDefault4 {
@@ -208,9 +220,9 @@ func (t *winTun) removeRoutes(routes []Route) error {
 		// See comment on luid.AddRoute
 		err := luid.DeleteRoute(r.Cidr, r.Via[0].Addr())
 		if err != nil {
-			t.l.Error("Failed to remove route", "error", err, "route", r)
+			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
-			t.l.Info("Removed route", "route", r)
+			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
 	return nil
@@ -225,18 +237,22 @@ func (t *winTun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
+func (t *winTun) UnsafeNetworks() []netip.Prefix {
+	return t.unsafeNetworks
+}
+
+func (t *winTun) UnsafeIPv4OriginAddress() netip.Prefix {
+	return t.unsafeIPv4Origin
+}
+
+func (t *winTun) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (t *winTun) Name() string {
 	return t.Device
 }
 
-func (t *winTun) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (t *winTun) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (t *winTun) Read(b []byte) (int, error) {
 	return t.tun.Read(b, 0)
 }

overlay/user.go

@@ -2,14 +2,14 @@ package overlay
 
 import (
 	"io"
-	"log/slog"
 	"net/netip"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 )
 
-func NewUserDeviceFromConfig(c *config.C, l *slog.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
+func NewUserDeviceFromConfig(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error) {
 	return NewUserDevice(vpnNetworks)
 }
 
@@ -36,6 +36,17 @@ type UserDevice struct {
 	inboundWriter *io.PipeWriter
 }
 
+func (d *UserDevice) UnsafeNetworks() []netip.Prefix {
+	return nil
+}
+
+func (d *UserDevice) SNATAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+func (d *UserDevice) UnsafeIPv4OriginAddress() netip.Prefix {
+	return netip.Prefix{}
+}
+
 func (d *UserDevice) Activate() error {
 	return nil
 }
@@ -46,14 +57,6 @@ func (d *UserDevice) RoutesFor(ip netip.Addr) routing.Gateways {
 	return routing.Gateways{routing.NewGateway(ip, 1)}
 }
 
-func (d *UserDevice) SupportsPerPeerMTU() bool {
-	return false
-}
-
-func (d *UserDevice) SetPeerMTU(addr netip.Addr, mtu int) error {
-	return nil
-}
-
 func (d *UserDevice) SupportsMultiqueue() bool {
 	return true
 }

pki.go

@@ -5,8 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
-	"log/slog"
 	"net"
 	"net/netip"
 	"os"
@@ -15,27 +13,25 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/flynn/noise"
 	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/handshake"
-	"github.com/slackhq/nebula/noiseutil"
 	"github.com/slackhq/nebula/util"
 )
 
 type PKI struct {
 	cs     atomic.Pointer[CertState]
 	caPool atomic.Pointer[cert.CAPool]
-	l      *slog.Logger
+	l      *logrus.Logger
 }
 
 type CertState struct {
-	v1Cert       cert.Certificate
-	v1Credential *handshake.Credential
+	v1Cert           cert.Certificate
+	v1HandshakeBytes []byte
 
-	v2Cert       cert.Certificate
-	v2Credential *handshake.Credential
+	v2Cert           cert.Certificate
+	v2HandshakeBytes []byte
 
 	initiatingVersion cert.Version
 	privateKey        []byte
@@ -49,7 +45,7 @@ type CertState struct {
 	myVpnBroadcastAddrsTable *bart.Lite
 }
 
-func NewPKIFromConfig(l *slog.Logger, c *config.C) (*PKI, error) {
+func NewPKIFromConfig(l *logrus.Logger, c *config.C) (*PKI, error) {
 	pki := &PKI{l: l}
 	err := pki.reload(c, true)
 	if err != nil {
@@ -95,40 +91,18 @@ func (p *PKI) reload(c *config.C, initial bool) error {
 }
 
 func (p *PKI) reloadCerts(c *config.C, initial bool) *util.ContextualError {
-	var cipher string
-	var currentState *CertState
-	if initial {
-		cipher = c.GetString("cipher", "aes")
-		//TODO: this sucks and we should make it not a global
-		switch cipher {
-		case "aes":
-			noiseEndianness = binary.BigEndian
-		case "chachapoly":
-			noiseEndianness = binary.LittleEndian
-		default:
-			return util.NewContextualError(
-				"unknown cipher",
-				m{"cipher": cipher},
-				nil,
-			)
-		}
-	} else {
-		// Cipher cant be hot swapped so just leave it at what it was before
-		currentState = p.cs.Load()
-		cipher = currentState.cipher
-	}
-
-	newState, err := newCertStateFromConfig(c, cipher)
+	newState, err := newCertStateFromConfig(c, p.l)
 	if err != nil {
 		return util.NewContextualError("Could not load client cert", nil, err)
 	}
 
-	if currentState != nil {
+	if !initial {
+		currentState := p.cs.Load()
 		if newState.v1Cert != nil {
 			if currentState.v1Cert == nil {
 				//adding certs is fine, actually. Networks-in-common confirmed in newCertState().
 			} else {
-				// did IP in cert change? if so, don't set
+				// did IP in cert change? if so, don't set. If we ever allow this, need to set p.firewallReloadNeeded
 				if !slices.Equal(currentState.v1Cert.Networks(), newState.v1Cert.Networks()) {
 					return util.NewContextualError(
 						"Networks in new cert was different from old",
@@ -183,14 +157,41 @@ func (p *PKI) reloadCerts(c *config.C, initial bool) *util.ContextualError {
 				)
 			}
 		}
+
+		newUN := newState.GetDefaultCertificate().UnsafeNetworks()
+		oldUN := currentState.GetDefaultCertificate().UnsafeNetworks()
+		if !slices.Equal(newUN, oldUN) {
+			//todo I don't love this, because other clients will see the new assignments and act on them, but we will not be able to.
+			//I think we need to wire this into the firewall reload.
+			p.l.WithFields(m{"previous": oldUN, "new": newUN}).Warning("UnsafeNetworks assignments differ. A restart is required in order for this to take effect.")
+		}
+
+		// Cipher cant be hot swapped so just leave it at what it was before
+		newState.cipher = currentState.cipher
+
+	} else {
+		newState.cipher = c.GetString("cipher", "aes")
+		//TODO: this sucks and we should make it not a global
+		switch newState.cipher {
+		case "aes":
+			noiseEndianness = binary.BigEndian
+		case "chachapoly":
+			noiseEndianness = binary.LittleEndian
+		default:
+			return util.NewContextualError(
+				"unknown cipher",
+				m{"cipher": newState.cipher},
+				nil,
+			)
+		}
 	}
 
 	p.cs.Store(newState)
 
 	if initial {
-		p.l.Debug("Client nebula certificate(s)", "cert", newState)
+		p.l.WithField("cert", newState).Debug("Client nebula certificate(s)")
 	} else {
-		p.l.Info("Client certificate(s) refreshed from disk", "cert", newState)
+		p.l.WithField("cert", newState).Info("Client certificate(s) refreshed from disk")
 	}
 	return nil
 }
@@ -202,7 +203,7 @@ func (p *PKI) reloadCAPool(c *config.C) *util.ContextualError {
 	}
 
 	p.caPool.Store(caPool)
-	p.l.Debug("Trusted CA fingerprints", "fingerprints", caPool.GetFingerprints())
+	p.l.WithField("fingerprints", caPool.GetFingerprints()).Debug("Trusted CA fingerprints")
 	return nil
 }
 
@@ -214,20 +215,6 @@ func (cs *CertState) GetDefaultCertificate() cert.Certificate {
 	return c
 }
 
-// DefaultVersion returns the preferred cert version for initiating handshakes.
-func (cs *CertState) DefaultVersion() cert.Version { return cs.initiatingVersion }
-
-// GetCredential returns the pre-computed handshake credential for the given version, or nil.
-func (cs *CertState) GetCredential(v cert.Version) *handshake.Credential {
-	switch v {
-	case cert.Version1:
-		return cs.v1Credential
-	case cert.Version2:
-		return cs.v2Credential
-	}
-	return nil
-}
-
 func (cs *CertState) getCertificate(v cert.Version) cert.Certificate {
 	switch v {
 	case cert.Version1:
@@ -239,25 +226,17 @@ func (cs *CertState) getCertificate(v cert.Version) cert.Certificate {
 	return nil
 }
 
-func newCipherSuite(curve cert.Curve, pkcs11backed bool, cipher string) (noise.CipherSuite, error) {
-	var dhFunc noise.DHFunc
-	switch curve {
-	case cert.Curve_CURVE25519:
-		dhFunc = noise.DH25519
-	case cert.Curve_P256:
-		if pkcs11backed {
-			dhFunc = noiseutil.DHP256PKCS11
-		} else {
-			dhFunc = noiseutil.DHP256
-		}
+// getHandshakeBytes returns the cached bytes to be used in a handshake message for the requested version.
+// Callers must check if the return []byte is nil.
+func (cs *CertState) getHandshakeBytes(v cert.Version) []byte {
+	switch v {
+	case cert.Version1:
+		return cs.v1HandshakeBytes
+	case cert.Version2:
+		return cs.v2HandshakeBytes
 	default:
-		return nil, fmt.Errorf("unsupported curve: %s", curve)
+		return nil
 	}
-
-	if cipher == "chachapoly" {
-		return noise.NewCipherSuite(dhFunc, noise.CipherChaChaPoly, noise.HashSHA256), nil
-	}
-	return noise.NewCipherSuite(dhFunc, noiseutil.CipherAESGCM, noise.HashSHA256), nil
 }
 
 func (cs *CertState) String() string {
@@ -289,7 +268,7 @@ func (cs *CertState) MarshalJSON() ([]byte, error) {
 	return json.Marshal(msg)
 }
 
-func newCertStateFromConfig(c *config.C, cipher string) (*CertState, error) {
+func newCertStateFromConfig(c *config.C, l *logrus.Logger) (*CertState, error) {
 	var err error
 
 	privPathOrPEM := c.GetString("pki.key", "")
@@ -373,14 +352,36 @@ func newCertStateFromConfig(c *config.C, cipher string) (*CertState, error) {
 		return nil, fmt.Errorf("unknown pki.initiating_version: %v", rawInitiatingVersion)
 	}
 
-	return newCertState(initiatingVersion, v1, v2, isPkcs11, curve, rawKey, cipher)
+	return newCertState(l, initiatingVersion, v1, v2, isPkcs11, curve, rawKey)
 }
 
-func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, privateKeyCurve cert.Curve, privateKey []byte, cipher string) (*CertState, error) {
+func compareUnsafeNetworksAcrossCertVersions(v1, v2 cert.Certificate) error {
+	if v1 == nil || v2 == nil {
+		return nil //can't be a problem if we don't have one of the kinds of cert
+	}
+
+	v4UnsafeNets := 0
+	for _, n := range v2.UnsafeNetworks() {
+		if n.Addr().Is6() {
+			continue // V1 certs can't have IPv6 unsafe networks
+		} else {
+			v4UnsafeNets++
+		}
+		if !slices.Contains(v1.UnsafeNetworks(), n) {
+			return errors.New("UnsafeNetworks mismatch")
+		}
+	}
+	if len(v1.UnsafeNetworks()) != v4UnsafeNets {
+		return errors.New("UnsafeNetworks mismatch")
+	}
+
+	return nil
+}
+
+func newCertState(l *logrus.Logger, dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, privateKeyCurve cert.Curve, privateKey []byte) (*CertState, error) {
 	cs := CertState{
 		privateKey:               privateKey,
 		pkcs11Backed:             pkcs11backed,
-		cipher:                   cipher,
 		myVpnNetworksTable:       new(bart.Lite),
 		myVpnAddrsTable:          new(bart.Lite),
 		myVpnBroadcastAddrsTable: new(bart.Lite),
@@ -400,6 +401,12 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p
 		}
 
 		cs.initiatingVersion = dv
+
+		warn := compareUnsafeNetworksAcrossCertVersions(v1, v2)
+		if warn != nil {
+			l.WithFields(m{"UnsafeNetworksV1": v1.UnsafeNetworks(), "UnsafeNetworksV2": v2.UnsafeNetworks()}).
+				Warning("the IPv4 UnsafeNetworks assigned in the V1 certificate do not match the ones in V2")
+		}
 	}
 
 	if v1 != nil {
@@ -413,14 +420,10 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p
 
 		v1hs, err := v1.MarshalForHandshakes()
 		if err != nil {
-			return nil, fmt.Errorf("error marshalling v1 certificate for handshake: %w", err)
-		}
-		ncs, err := newCipherSuite(v1.Curve(), pkcs11backed, cipher)
-		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("error marshalling certificate for handshake: %w", err)
 		}
 		cs.v1Cert = v1
-		cs.v1Credential = handshake.NewCredential(v1, v1hs, privateKey, ncs)
+		cs.v1HandshakeBytes = v1hs
 
 		if cs.initiatingVersion == 0 {
 			cs.initiatingVersion = cert.Version1
@@ -438,14 +441,10 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p
 
 		v2hs, err := v2.MarshalForHandshakes()
 		if err != nil {
-			return nil, fmt.Errorf("error marshalling v2 certificate for handshake: %w", err)
-		}
-		ncs, err := newCipherSuite(v2.Curve(), pkcs11backed, cipher)
-		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("error marshalling certificate for handshake: %w", err)
 		}
 		cs.v2Cert = v2
-		cs.v2Credential = handshake.NewCredential(v2, v2hs, privateKey, ncs)
+		cs.v2HandshakeBytes = v2hs
 
 		if cs.initiatingVersion == 0 {
 			cs.initiatingVersion = cert.Version2
@@ -524,32 +523,32 @@ func loadCertificate(b []byte) (cert.Certificate, []byte, error) {
 	return c, b, nil
 }
 
-func loadCAPoolFromConfig(l *slog.Logger, c *config.C) (*cert.CAPool, error) {
+func loadCAPoolFromConfig(l *logrus.Logger, c *config.C) (*cert.CAPool, error) {
+	var rawCA []byte
+	var err error
+
 	caPathOrPEM := c.GetString("pki.ca", "")
 	if caPathOrPEM == "" {
 		return nil, errors.New("no pki.ca path or PEM data provided")
 	}
 
-	var caReader io.ReadCloser
-	var err error
-
 	if strings.Contains(caPathOrPEM, "-----BEGIN") {
-		caReader = io.NopCloser(strings.NewReader(caPathOrPEM))
+		rawCA = []byte(caPathOrPEM)
+
 	} else {
-		caReader, err = os.Open(caPathOrPEM)
+		rawCA, err = os.ReadFile(caPathOrPEM)
 		if err != nil {
 			return nil, fmt.Errorf("unable to read pki.ca file %s: %s", caPathOrPEM, err)
 		}
 	}
-	defer caReader.Close()
 
-	caPool, err := cert.NewCAPoolFromPEMReader(caReader)
+	caPool, err := cert.NewCAPoolFromPEM(rawCA)
 	if errors.Is(err, cert.ErrExpired) {
 		var expired int
 		for _, crt := range caPool.CAs {
 			if crt.Certificate.Expired(time.Now()) {
 				expired++
-				l.Warn("expired certificate present in CA pool", "cert", crt)
+				l.WithField("cert", crt).Warn("expired certificate present in CA pool")
 			}
 		}
 
@@ -567,7 +566,7 @@ func loadCAPoolFromConfig(l *slog.Logger, c *config.C) (*cert.CAPool, error) {
 			caPool.BlocklistFingerprint(fp)
 		}
 
-		l.Info("Blocklisted certificates", "fingerprintCount", len(bl))
+		l.WithField("fingerprintCount", len(bl)).Info("Blocklisted certificates")
 	}
 
 	return caPool, nil