try to fix windows?

it is about 4.4% better on the bench-cpu-long cpu usage test

.github/workflows/gofmt.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - uses: actions/setup-go@v6
       with:

.github/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
     name: Build Linux/BSD All
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-go@v6
         with:
@@ -24,7 +24,7 @@ jobs:
           mv build/*.tar.gz release
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: linux-latest
           path: release
@@ -33,7 +33,7 @@ jobs:
     name: Build Windows
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-go@v6
         with:
@@ -55,7 +55,7 @@ jobs:
           mv dist\windows\wintun build\dist\windows\
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: windows-latest
           path: build
@@ -66,7 +66,7 @@ jobs:
       HAS_SIGNING_CREDS: ${{ secrets.AC_USERNAME != '' }}
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-go@v6
         with:
@@ -75,7 +75,7 @@ jobs:
 
       - name: Import certificates
         if: env.HAS_SIGNING_CREDS == 'true'
-        uses: Apple-Actions/import-codesign-certs@v6
+        uses: Apple-Actions/import-codesign-certs@v5
         with:
           p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
           p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
@@ -104,7 +104,7 @@ jobs:
           fi
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
         with:
           name: darwin-latest
           path: ./release/*
@@ -124,11 +124,11 @@ jobs:
       # be overwritten
       - name: Checkout code
         if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Download artifacts
         if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
         with:
           name: linux-latest
           path: artifacts
@@ -160,10 +160,10 @@ jobs:
     needs: [build-linux, build-darwin, build-windows]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Download artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v4
         with:
           path: artifacts
 

.github/workflows/smoke-extra.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - uses: actions/setup-go@v6
       with:
@@ -30,9 +30,6 @@ jobs:
     - name: add hashicorp source
       run: wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg && echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
 
-    - name: workaround AMD-V issue  # https://github.com/cri-o/packaging/pull/306
-      run: sudo rmmod kvm_amd
-
     - name: install vagrant
       run: sudo apt-get update && sudo apt-get install -y vagrant virtualbox
 

.github/workflows/smoke.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - uses: actions/setup-go@v6
       with:

.github/workflows/smoke/smoke.sh

@@ -37,18 +37,17 @@ docker run --name host4 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN -
 sleep 1
 
 # grab tcpdump pcaps for debugging
-docker exec lighthouse1 tcpdump -i tun0 -q -w - -U 2>logs/lighthouse1.inside.log >logs/lighthouse1.inside.pcap &
+docker exec lighthouse1 tcpdump -i nebula1 -q -w - -U 2>logs/lighthouse1.inside.log >logs/lighthouse1.inside.pcap &
 docker exec lighthouse1 tcpdump -i eth0 -q -w - -U 2>logs/lighthouse1.outside.log >logs/lighthouse1.outside.pcap &
-docker exec host2 tcpdump -i tun0 -q -w - -U 2>logs/host2.inside.log >logs/host2.inside.pcap &
+docker exec host2 tcpdump -i nebula1 -q -w - -U 2>logs/host2.inside.log >logs/host2.inside.pcap &
 docker exec host2 tcpdump -i eth0 -q -w - -U 2>logs/host2.outside.log >logs/host2.outside.pcap &
-docker exec host3 tcpdump -i tun0 -q -w - -U 2>logs/host3.inside.log >logs/host3.inside.pcap &
+docker exec host3 tcpdump -i nebula1 -q -w - -U 2>logs/host3.inside.log >logs/host3.inside.pcap &
 docker exec host3 tcpdump -i eth0 -q -w - -U 2>logs/host3.outside.log >logs/host3.outside.pcap &
-docker exec host4 tcpdump -i tun0 -q -w - -U 2>logs/host4.inside.log >logs/host4.inside.pcap &
+docker exec host4 tcpdump -i nebula1 -q -w - -U 2>logs/host4.inside.log >logs/host4.inside.pcap &
 docker exec host4 tcpdump -i eth0 -q -w - -U 2>logs/host4.outside.log >logs/host4.outside.pcap &
 
 docker exec host2 ncat -nklv 0.0.0.0 2000 &
 docker exec host3 ncat -nklv 0.0.0.0 2000 &
-docker exec host4 ncat -nkluv 0.0.0.0 4000 &
 docker exec host2 ncat -e '/usr/bin/echo host2' -nkluv 0.0.0.0 3000 &
 docker exec host3 ncat -e '/usr/bin/echo host3' -nkluv 0.0.0.0 3000 &
 
@@ -120,11 +119,11 @@ echo
 echo " *** Testing conntrack"
 echo
 set -x
-
+# host2 can ping host3 now that host3 pinged it first
-# host2 speaking to host4 on UDP 4000 should allow it to reply, when firewall rules would normally not permit this
+docker exec host2 ping -c1 192.168.100.3
-docker exec host2 sh -c "/usr/bin/echo host2 | ncat -nuv 192.168.100.4 4000"
+# host4 can ping host2 once conntrack established
-docker exec host2 ncat -e '/usr/bin/echo helloagainfromhost2' -nkluv 0.0.0.0 4000 &
+docker exec host2 ping -c1 192.168.100.4
-docker exec host4 sh -c "/usr/bin/echo host4 | ncat -nuv 192.168.100.2 4000"
+docker exec host4 ping -c1 192.168.100.2
 
 docker exec host4 sh -c 'kill 1'
 docker exec host3 sh -c 'kill 1'

.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - uses: actions/setup-go@v6
       with:
@@ -32,7 +32,7 @@ jobs:
       run: make vet
 
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@v9
+      uses: golangci/golangci-lint-action@v8
       with:
         version: v2.5
 
@@ -45,7 +45,7 @@ jobs:
     - name: Build test mobile
       run: make build-test-mobile
 
-    - uses: actions/upload-artifact@v6
+    - uses: actions/upload-artifact@v4
       with:
         name: e2e packet flow linux-latest
         path: e2e/mermaid/linux-latest
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - uses: actions/setup-go@v6
       with:
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - uses: actions/setup-go@v6
       with:
@@ -98,7 +98,7 @@ jobs:
         os: [windows-latest, macos-latest]
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
 
     - uses: actions/setup-go@v6
       with:
@@ -115,7 +115,7 @@ jobs:
       run: make vet
 
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@v9
+      uses: golangci/golangci-lint-action@v8
       with:
         version: v2.5
 
@@ -125,7 +125,7 @@ jobs:
     - name: End 2 end
       run: make e2evv
 
-    - uses: actions/upload-artifact@v6
+    - uses: actions/upload-artifact@v4
       with:
         name: e2e packet flow ${{ matrix.os }}
         path: e2e/mermaid/${{ matrix.os }}

CHANGELOG.md

@@ -7,129 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [1.10.3] - 2026-02-06
-
-### Security
-
-- Fix an issue where blocklist bypass is possible when using curve P256 since the signature can have 2 valid representations.
-  Both fingerprint representations will be tested against the blocklist.
-  Any newly issued P256 based certificates will have their signature clamped to the low-s form.
-  Nebula will assert the low-s signature form when validating certificates in a future version. [GHSA-69x3-g4r3-p962](https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962)
-
 ### Changed
 
-- Improve error reporting if nebula fails to start due to a tun device naming issue. (#1588)
+- `default_local_cidr_any` now defaults to false, meaning that any firewall rule
-
-## [1.10.2] - 2026-01-21
-
-### Fixed
-
-- Fix panic when using `use_system_route_table` that was introduced in v1.10.1. (#1580)
-
-### Changed
-
-- Fix some typos in comments. (#1582)
-- Dependency updates. (#1581)
-
-## [1.10.1] - 2026-01-16
-
-See the [v1.10.1](https://github.com/slackhq/nebula/milestone/26?closed=1) milestone for a complete list of changes.
-
-### Fixed
-
-- Fix a bug where an unsafe route derived from the system route table could be lost on a config reload. (#1573)
-- Fix the PEM banner for ECDSA P256 public keys. (#1552)
-- Fix a regression on Windows from 1.9.x where nebula could fall back to a less performant UDP listener if 
-  non-critical ioctls failed. (#1568)
-- Fix a bug in handshake processing when a peer sends an unexpected public key. (#1566)
-
-### Added
-
-- Add a config option to control accepting `recv_error` packets which defaults to `always`. (#1569)
-
-### Changed
-
-- Various dependency updates. (#1541, #1549, #1550, #1557, #1558, #1560, #1561, #1570, #1571)
-
-## [1.10.0] - 2025-12-04
-
-See the [v1.10.0](https://github.com/slackhq/nebula/milestone/16?closed=1) milestone for a complete list of changes.
-
-### Added
-
-- Support for ipv6 and multiple ipv4/6 addresses in the overlay.
-  A new v2 ASN.1 based certificate format.
-  Certificates now have a unified interface for external implementations.
-  (#1212, #1216, #1345, #1359, #1381, #1419, #1464, #1466, #1451, #1476, #1467, #1481, #1399, #1488, #1492, #1495, #1468, #1521, #1535, #1538)
-- Add the ability to mark packets on linux to better target nebula packets in iptables/nftables. (#1331)
-- Add ECMP support for `unsafe_routes`. (#1332)
-- PKCS11 support for P256 keys when built with `pkcs11` tag (#1153, #1482)
-
-### Changed
-
-- **NOTE**: `default_local_cidr_any` now defaults to false, meaning that any firewall rule
   intended to target an `unsafe_routes` entry must explicitly declare it via the
   `local_cidr` field. This is almost always the intended behavior. This flag is
-  deprecated and will be removed in a future release. (#1373)
+  deprecated and will be removed in a future release.
-- Improve logging when a relay is in use on an inbound packet. (#1533)
-- Avoid fatal errors if `rountines` is > 1 on systems that don't support more than 1 routine. (#1531)
-- Log a warning if a firewall rule contains an `any` that negates a more restrictive filter. (#1513)
-- Accept encrypted CA passphrase from an environment variable. (#1421)
-- Allow handshaking with any trusted remote. (#1509)
-- Log only the count of blocklisted certificate fingerprints instead of the entire list. (#1525)
-- Don't fatal when the ssh server is unable to be configured successfully. (#1520)
-- Update to build against go v1.25. (#1483)
-- Allow projects using `nebula` as a library with userspace networking to configure the `logger` and build version. (#1239) 
-- Upgrade to `yaml.v3`. (#1148, #1371, #1438, #1478)
-
-### Fixed
-
-- Fix a potential bug with udp ipv4 only on darwin. (#1532)
-- Improve lost packet statistics. (#1441, #1537)
-- Honor `remote_allow_list` in hole punch response. (#1186)
-- Fix a panic when `tun.use_system_route_table` is `true` and a route lacks a destination. (#1437) 
-- Fix an issue when `tun.use_system_route_table: true` could result in heavy CPU utilization when many thousands of routes
-  are present. (#1326) 
-- Fix tests for 32 bit machines. (#1394)
-- Fix a possible 32bit integer underflow in config handling. (#1353)
-- Fix moving a udp address from one vpn address to another in the `static_host_map`
-  which could cause rapid re-handshaking with an incorrect remote. (#1259)
-- Improve smoke tests in environments where the docker network is not the default. (#1347)
-
-## [1.9.7] - 2025-10-10
-
-### Security
-
-- Fix an issue where Nebula could incorrectly accept and process a packet from an erroneous source IP when the sender's
-  certificate is configured with unsafe_routes (cert v1/v2) or multiple IPs (cert v2). (#1494)
-
-### Changed
-
-- Disable sending `recv_error` messages when a packet is received outside the allowable counter window. (#1459)
-- Improve error messages and remove some unnecessary fatal conditions in the Windows and generic udp listener. (#1453)
-
-## [1.9.6] - 2025-7-15
-
-### Added
-
-- Support dropping inactive tunnels. This is disabled by default in this release but can be enabled with `tunnels.drop_inactive`. See example config for more details. (#1413)
-
-### Fixed
-
-- Fix Darwin freeze due to presence of some Network Extensions (#1426)
-- Ensure the same relay tunnel is always used when multiple relay tunnels are present (#1422)
-- Fix Windows freeze due to ICMP error handling (#1412)
-- Fix relay migration panic (#1403)
-
-## [1.9.5] - 2024-12-05
-
-### Added
-
-- Gracefully ignore v2 certificates. (#1282)
-
-### Fixed
-
-- Fix relays that refuse to re-establish after one of the remote tunnel pairs breaks. (#1277)
 
 ## [1.9.4] - 2024-09-09
 
@@ -788,14 +671,7 @@ created.)
 
 - Initial public release.
 
-[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.3...HEAD
+[Unreleased]: https://github.com/slackhq/nebula/compare/v1.9.4...HEAD
-[1.10.3]: https://github.com/slackhq/nebula/releases/tag/v1.10.3
-[1.10.2]: https://github.com/slackhq/nebula/releases/tag/v1.10.2
-[1.10.1]: https://github.com/slackhq/nebula/releases/tag/v1.10.1
-[1.10.0]: https://github.com/slackhq/nebula/releases/tag/v1.10.0
-[1.9.7]: https://github.com/slackhq/nebula/releases/tag/v1.9.7
-[1.9.6]: https://github.com/slackhq/nebula/releases/tag/v1.9.6
-[1.9.5]: https://github.com/slackhq/nebula/releases/tag/v1.9.5
 [1.9.4]: https://github.com/slackhq/nebula/releases/tag/v1.9.4
 [1.9.3]: https://github.com/slackhq/nebula/releases/tag/v1.9.3
 [1.9.2]: https://github.com/slackhq/nebula/releases/tag/v1.9.2

bits.go

@@ -9,13 +9,14 @@ type Bits struct {
 	length             uint64
 	current            uint64
 	bits               []bool
+	firstSeen          bool
 	lostCounter        metrics.Counter
 	dupeCounter        metrics.Counter
 	outOfWindowCounter metrics.Counter
 }
 
 func NewBits(bits uint64) *Bits {
-	b := &Bits{
+	return &Bits{
 		length:             bits,
 		bits:               make([]bool, bits, bits),
 		current:            0,
@@ -23,37 +24,34 @@ func NewBits(bits uint64) *Bits {
 		dupeCounter:        metrics.GetOrRegisterCounter("network.packets.duplicate", nil),
 		outOfWindowCounter: metrics.GetOrRegisterCounter("network.packets.out_of_window", nil),
 	}
-
-	// There is no counter value 0, mark it to avoid counting a lost packet later.
-	b.bits[0] = true
-	b.current = 0
-	return b
 }
 
-func (b *Bits) Check(l *logrus.Logger, i uint64) bool {
+func (b *Bits) Check(l logrus.FieldLogger, i uint64) bool {
 	// If i is the next number, return true.
-	if i > b.current {
+	if i > b.current || (i == 0 && b.firstSeen == false && b.current < b.length) {
 		return true
 	}
 
-	// If i is within the window, check if it's been set already.
+	// If i is within the window, check if it's been set already. The first window will fail this check
-	if i > b.current-b.length || i < b.length && b.current < b.length {
+	if i > b.current-b.length {
+		return !b.bits[i%b.length]
+	}
+
+	// If i is within the first window
+	if i < b.length {
 		return !b.bits[i%b.length]
 	}
 
 	// Not within the window
-	if l.Level >= logrus.DebugLevel {
+	l.Debugf("rejected a packet (top) %d %d\n", b.current, i)
-		l.Debugf("rejected a packet (top) %d %d\n", b.current, i)
-	}
 	return false
 }
 
 func (b *Bits) Update(l *logrus.Logger, i uint64) bool {
 	// If i is the next number, return true and update current.
 	if i == b.current+1 {
-		// Check if the oldest bit was lost since we are shifting the window by 1 and occupying it with this counter
+		// Report missed packets, we can only understand what was missed after the first window has been gone through
-		// The very first window can only be tracked as lost once we are on the 2nd window or greater
+		if i > b.length && b.bits[i%b.length] == false {
-		if b.bits[i%b.length] == false && i > b.length {
 			b.lostCounter.Inc(1)
 		}
 		b.bits[i%b.length] = true
@@ -61,32 +59,61 @@ func (b *Bits) Update(l *logrus.Logger, i uint64) bool {
 		return true
 	}
 
-	// If i is a jump, adjust the window, record lost, update current, and return true
+	// If i packet is greater than current but less than the maximum length of our bitmap,
-	if i > b.current {
+	// flip everything in between to false and move ahead.
-		lost := int64(0)
+	if i > b.current && i < b.current+b.length {
-		// Zero out the bits between the current and the new counter value, limited by the window size,
+		// In between current and i need to be zero'd to allow those packets to come in later
-		// since the window is shifting
+		for n := b.current + 1; n < i; n++ {
-		for n := b.current + 1; n <= min(i, b.current+b.length); n++ {
-			if b.bits[n%b.length] == false && n > b.length {
-				lost++
-			}
 			b.bits[n%b.length] = false
 		}
 
-		// Only record any skipped packets as a result of the window moving further than the window length
+		b.bits[i%b.length] = true
-		// Any loss within the new window will be accounted for in future calls
+		b.current = i
-		lost += max(0, int64(i-b.current-b.length))
+		//l.Debugf("missed %d packets between %d and %d\n", i-b.current, i, b.current)
+		return true
+	}
+
+	// If i is greater than the delta between current and the total length of our bitmap,
+	// just flip everything in the map and move ahead.
+	if i >= b.current+b.length {
+		// The current window loss will be accounted for later, only record the jump as loss up until then
+		lost := maxInt64(0, int64(i-b.current-b.length))
+		//TODO: explain this
+		if b.current == 0 {
+			lost++
+		}
+
+		for n := range b.bits {
+			// Don't want to count the first window as a loss
+			//TODO: this is likely wrong, we are wanting to track only the bit slots that we aren't going to track anymore and this is marking everything as missed
+			//if b.bits[n] == false {
+			//	lost++
+			//}
+			b.bits[n] = false
+		}
+
 		b.lostCounter.Inc(lost)
 
+		if l.Level >= logrus.DebugLevel {
+			l.WithField("receiveWindow", m{"accepted": true, "currentCounter": b.current, "incomingCounter": i, "reason": "window shifting"}).
+				Debug("Receive window")
+		}
 		b.bits[i%b.length] = true
 		b.current = i
 		return true
 	}
 
-	// If i is within the current window but below the current counter,
+	// Allow for the 0 packet to come in within the first window
-	// Check to see if it's a duplicate
+	if i == 0 && b.firstSeen == false && b.current < b.length {
-	if i > b.current-b.length || i < b.length && b.current < b.length {
+		b.firstSeen = true
-		if b.current == i || b.bits[i%b.length] == true {
+		b.bits[i%b.length] = true
+		return true
+	}
+
+	// If i is within the window of current minus length (the total pat window size),
+	// allow it and flip to true but to NOT change current. We also have to account for the first window
+	if ((b.current >= b.length && i > b.current-b.length) || (b.current < b.length && i < b.length)) && i <= b.current {
+		if b.current == i {
 			if l.Level >= logrus.DebugLevel {
 				l.WithField("receiveWindow", m{"accepted": false, "currentCounter": b.current, "incomingCounter": i, "reason": "duplicate"}).
 					Debug("Receive window")
@@ -95,8 +122,18 @@ func (b *Bits) Update(l *logrus.Logger, i uint64) bool {
 			return false
 		}
 
+		if b.bits[i%b.length] == true {
+			if l.Level >= logrus.DebugLevel {
+				l.WithField("receiveWindow", m{"accepted": false, "currentCounter": b.current, "incomingCounter": i, "reason": "old duplicate"}).
+					Debug("Receive window")
+			}
+			b.dupeCounter.Inc(1)
+			return false
+		}
+
 		b.bits[i%b.length] = true
 		return true
+
 	}
 
 	// In all other cases, fail and don't change current.
@@ -110,3 +147,11 @@ func (b *Bits) Update(l *logrus.Logger, i uint64) bool {
 	}
 	return false
 }
+
+func maxInt64(a, b int64) int64 {
+	if a > b {
+		return a
+	}
+
+	return b
+}

bits_test.go

@@ -15,41 +15,48 @@ func TestBits(t *testing.T) {
 	assert.Len(t, b.bits, 10)
 
 	// This is initialized to zero - receive one. This should work.
+
 	assert.True(t, b.Check(l, 1))
-	assert.True(t, b.Update(l, 1))
+	u := b.Update(l, 1)
+	assert.True(t, u)
 	assert.EqualValues(t, 1, b.current)
-	g := []bool{true, true, false, false, false, false, false, false, false, false}
+	g := []bool{false, true, false, false, false, false, false, false, false, false}
 	assert.Equal(t, g, b.bits)
 
 	// Receive two
 	assert.True(t, b.Check(l, 2))
-	assert.True(t, b.Update(l, 2))
+	u = b.Update(l, 2)
+	assert.True(t, u)
 	assert.EqualValues(t, 2, b.current)
-	g = []bool{true, true, true, false, false, false, false, false, false, false}
+	g = []bool{false, true, true, false, false, false, false, false, false, false}
 	assert.Equal(t, g, b.bits)
 
 	// Receive two again - it will fail
 	assert.False(t, b.Check(l, 2))
-	assert.False(t, b.Update(l, 2))
+	u = b.Update(l, 2)
+	assert.False(t, u)
 	assert.EqualValues(t, 2, b.current)
 
 	// Jump ahead to 15, which should clear everything and set the 6th element
 	assert.True(t, b.Check(l, 15))
-	assert.True(t, b.Update(l, 15))
+	u = b.Update(l, 15)
+	assert.True(t, u)
 	assert.EqualValues(t, 15, b.current)
 	g = []bool{false, false, false, false, false, true, false, false, false, false}
 	assert.Equal(t, g, b.bits)
 
 	// Mark 14, which is allowed because it is in the window
 	assert.True(t, b.Check(l, 14))
-	assert.True(t, b.Update(l, 14))
+	u = b.Update(l, 14)
+	assert.True(t, u)
 	assert.EqualValues(t, 15, b.current)
 	g = []bool{false, false, false, false, true, true, false, false, false, false}
 	assert.Equal(t, g, b.bits)
 
 	// Mark 5, which is not allowed because it is not in the window
 	assert.False(t, b.Check(l, 5))
-	assert.False(t, b.Update(l, 5))
+	u = b.Update(l, 5)
+	assert.False(t, u)
 	assert.EqualValues(t, 15, b.current)
 	g = []bool{false, false, false, false, true, true, false, false, false, false}
 	assert.Equal(t, g, b.bits)
@@ -62,29 +69,10 @@ func TestBits(t *testing.T) {
 
 	// Walk through a few windows in order
 	b = NewBits(10)
-	for i := uint64(1); i <= 100; i++ {
+	for i := uint64(0); i <= 100; i++ {
 		assert.True(t, b.Check(l, i), "Error while checking %v", i)
 		assert.True(t, b.Update(l, i), "Error while updating %v", i)
 	}
-
-	assert.False(t, b.Check(l, 1), "Out of window check")
-}
-
-func TestBitsLargeJumps(t *testing.T) {
-	l := test.NewLogger()
-	b := NewBits(10)
-	b.lostCounter.Clear()
-
-	b = NewBits(10)
-	b.lostCounter.Clear()
-	assert.True(t, b.Update(l, 55)) // We saw packet 55 and can still track 45,46,47,48,49,50,51,52,53,54
-	assert.Equal(t, int64(45), b.lostCounter.Count())
-
-	assert.True(t, b.Update(l, 100)) // We saw packet 55 and 100 and can still track 90,91,92,93,94,95,96,97,98,99
-	assert.Equal(t, int64(89), b.lostCounter.Count())
-
-	assert.True(t, b.Update(l, 200)) // We saw packet 55, 100, and 200 and can still track 190,191,192,193,194,195,196,197,198,199
-	assert.Equal(t, int64(188), b.lostCounter.Count())
 }
 
 func TestBitsDupeCounter(t *testing.T) {
@@ -136,7 +124,8 @@ func TestBitsOutOfWindowCounter(t *testing.T) {
 	assert.False(t, b.Update(l, 0))
 	assert.Equal(t, int64(1), b.outOfWindowCounter.Count())
 
-	assert.Equal(t, int64(19), b.lostCounter.Count()) // packet 0 wasn't lost
+	//tODO: make sure lostcounter doesn't increase in orderly increment
+	assert.Equal(t, int64(20), b.lostCounter.Count())
 	assert.Equal(t, int64(0), b.dupeCounter.Count())
 	assert.Equal(t, int64(1), b.outOfWindowCounter.Count())
 }
@@ -148,6 +137,8 @@ func TestBitsLostCounter(t *testing.T) {
 	b.dupeCounter.Clear()
 	b.outOfWindowCounter.Clear()
 
+	//assert.True(t, b.Update(0))
+	assert.True(t, b.Update(l, 0))
 	assert.True(t, b.Update(l, 20))
 	assert.True(t, b.Update(l, 21))
 	assert.True(t, b.Update(l, 22))
@@ -158,7 +149,7 @@ func TestBitsLostCounter(t *testing.T) {
 	assert.True(t, b.Update(l, 27))
 	assert.True(t, b.Update(l, 28))
 	assert.True(t, b.Update(l, 29))
-	assert.Equal(t, int64(19), b.lostCounter.Count()) // packet 0 wasn't lost
+	assert.Equal(t, int64(20), b.lostCounter.Count())
 	assert.Equal(t, int64(0), b.dupeCounter.Count())
 	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
 
@@ -167,6 +158,8 @@ func TestBitsLostCounter(t *testing.T) {
 	b.dupeCounter.Clear()
 	b.outOfWindowCounter.Clear()
 
+	assert.True(t, b.Update(l, 0))
+	assert.Equal(t, int64(0), b.lostCounter.Count())
 	assert.True(t, b.Update(l, 9))
 	assert.Equal(t, int64(0), b.lostCounter.Count())
 	// 10 will set 0 index, 0 was already set, no lost packets
@@ -221,62 +214,6 @@ func TestBitsLostCounter(t *testing.T) {
 	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
 }
 
-func TestBitsLostCounterIssue1(t *testing.T) {
-	l := test.NewLogger()
-	b := NewBits(10)
-	b.lostCounter.Clear()
-	b.dupeCounter.Clear()
-	b.outOfWindowCounter.Clear()
-
-	assert.True(t, b.Update(l, 4))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 1))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 9))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 2))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 3))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 5))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 6))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 7))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	// assert.True(t, b.Update(l, 8))
-	assert.True(t, b.Update(l, 10))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 11))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-
-	assert.True(t, b.Update(l, 14))
-	assert.Equal(t, int64(0), b.lostCounter.Count())
-	// Issue seems to be here, we reset missing packet 8 to false here and don't increment the lost counter
-	assert.True(t, b.Update(l, 19))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 12))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 13))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 15))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 16))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 17))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 18))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 20))
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.True(t, b.Update(l, 21))
-
-	// We missed packet 8 above
-	assert.Equal(t, int64(1), b.lostCounter.Count())
-	assert.Equal(t, int64(0), b.dupeCounter.Count())
-	assert.Equal(t, int64(0), b.outOfWindowCounter.Count())
-}
-
 func BenchmarkBits(b *testing.B) {
 	z := NewBits(10)
 	for n := 0; n < b.N; n++ {

boring.go

@@ -1,4 +1,5 @@
 //go:build boringcrypto
+// +build boringcrypto
 
 package nebula
 

cert/ca_pool.go

@@ -141,23 +141,10 @@ func (ncp *CAPool) VerifyCertificate(now time.Time, c Certificate) (*CachedCerti
 		return nil, err
 	}
 
-	// Pre nebula v1.10.3 could generate signatures in either high or low s form and validation
-	// of signatures allowed for either. Nebula v1.10.3 and beyond clamps signature generation to low-s form
-	// but validation still allows for either. Since a change in the signature bytes affects the fingerprint, we
-	// need to test both forms until such a time comes that we enforce low-s form on signature validation.
-	fp2, err := CalculateAlternateFingerprint(c)
-	if err != nil {
-		return nil, fmt.Errorf("could not calculate alternate fingerprint to verify: %w", err)
-	}
-	if fp2 != "" && ncp.IsBlocklisted(fp2) {
-		return nil, ErrBlockListed
-	}
-
 	cc := CachedCertificate{
 		Certificate:       c,
 		InvertedGroups:    make(map[string]struct{}),
 		Fingerprint:       fp,
-		fingerprint2:      fp2,
 		signerFingerprint: signer.Fingerprint,
 	}
 
@@ -171,11 +158,6 @@ func (ncp *CAPool) VerifyCertificate(now time.Time, c Certificate) (*CachedCerti
 // VerifyCachedCertificate is the same as VerifyCertificate other than it operates on a pre-verified structure and
 // is a cheaper operation to perform as a result.
 func (ncp *CAPool) VerifyCachedCertificate(now time.Time, c *CachedCertificate) error {
-	// Check any available alternate fingerprint forms for this certificate, re P256 high-s/low-s
-	if c.fingerprint2 != "" && ncp.IsBlocklisted(c.fingerprint2) {
-		return ErrBlockListed
-	}
-
 	_, err := ncp.verify(c.Certificate, now, c.Fingerprint, c.signerFingerprint)
 	return err
 }

cert/ca_pool_test.go

@@ -5,7 +5,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/slackhq/nebula/cert/p256"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -171,15 +170,6 @@ func TestCertificateV1_VerifyP256(t *testing.T) {
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.EqualError(t, err, "certificate is in the block list")
 
-	// Create a copy of the cert and swap to the alternate form for the signature
-	nc := c.Copy()
-	b, err := p256.Swap(c.Signature())
-	require.NoError(t, err)
-	require.NoError(t, nc.(*certificateV1).setSignature(b))
-
-	_, err = caPool.VerifyCertificate(time.Now(), nc)
-	require.EqualError(t, err, "certificate is in the block list")
-
 	caPool.ResetCertBlocklist()
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.NoError(t, err)
@@ -197,7 +187,7 @@ func TestCertificateV1_VerifyP256(t *testing.T) {
 	require.NoError(t, err)
 
 	caPool = NewCAPool()
-	b, err = caPool.AddCAFromPEM(caPem)
+	b, err := caPool.AddCAFromPEM(caPem)
 	require.NoError(t, err)
 	assert.Empty(t, b)
 
@@ -206,17 +196,7 @@ func TestCertificateV1_VerifyP256(t *testing.T) {
 	})
 
 	c, _, _, _ = NewTestCert(Version1, Curve_P256, ca, caKey, "test", time.Now(), time.Now().Add(5*time.Minute), nil, nil, []string{"test1"})
-	cc, err := caPool.VerifyCertificate(time.Now(), c)
+	_, err = caPool.VerifyCertificate(time.Now(), c)
-	require.NoError(t, err)
-
-	// Reset the blocklist and block the alternate form fingerprint
-	caPool.ResetCertBlocklist()
-	caPool.BlocklistFingerprint(cc.fingerprint2)
-	err = caPool.VerifyCachedCertificate(time.Now(), cc)
-	require.EqualError(t, err, "certificate is in the block list")
-
-	caPool.ResetCertBlocklist()
-	err = caPool.VerifyCachedCertificate(time.Now(), cc)
 	require.NoError(t, err)
 }
 
@@ -414,15 +394,6 @@ func TestCertificateV2_VerifyP256(t *testing.T) {
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.EqualError(t, err, "certificate is in the block list")
 
-	// Create a copy of the cert and swap to the alternate form for the signature
-	nc := c.Copy()
-	b, err := p256.Swap(c.Signature())
-	require.NoError(t, err)
-	require.NoError(t, nc.(*certificateV2).setSignature(b))
-
-	_, err = caPool.VerifyCertificate(time.Now(), nc)
-	require.EqualError(t, err, "certificate is in the block list")
-
 	caPool.ResetCertBlocklist()
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.NoError(t, err)
@@ -440,7 +411,7 @@ func TestCertificateV2_VerifyP256(t *testing.T) {
 	require.NoError(t, err)
 
 	caPool = NewCAPool()
-	b, err = caPool.AddCAFromPEM(caPem)
+	b, err := caPool.AddCAFromPEM(caPem)
 	require.NoError(t, err)
 	assert.Empty(t, b)
 
@@ -449,17 +420,7 @@ func TestCertificateV2_VerifyP256(t *testing.T) {
 	})
 
 	c, _, _, _ = NewTestCert(Version2, Curve_P256, ca, caKey, "test", time.Now(), time.Now().Add(5*time.Minute), nil, nil, []string{"test1"})
-	cc, err := caPool.VerifyCertificate(time.Now(), c)
+	_, err = caPool.VerifyCertificate(time.Now(), c)
-	require.NoError(t, err)
-
-	// Reset the blocklist and block the alternate form fingerprint
-	caPool.ResetCertBlocklist()
-	caPool.BlocklistFingerprint(cc.fingerprint2)
-	err = caPool.VerifyCachedCertificate(time.Now(), cc)
-	require.EqualError(t, err, "certificate is in the block list")
-
-	caPool.ResetCertBlocklist()
-	err = caPool.VerifyCachedCertificate(time.Now(), cc)
 	require.NoError(t, err)
 }
 

cert/cert.go

@@ -4,8 +4,6 @@ import (
 	"fmt"
 	"net/netip"
 	"time"
-
-	"github.com/slackhq/nebula/cert/p256"
 )
 
 type Version uint8
@@ -112,9 +110,6 @@ type CachedCertificate struct {
 	InvertedGroups    map[string]struct{}
 	Fingerprint       string
 	signerFingerprint string
-
-	// A place to store a 2nd fingerprint if the certificate could have one, such as with P256
-	fingerprint2 string
 }
 
 func (cc *CachedCertificate) String() string {
@@ -124,7 +119,6 @@ func (cc *CachedCertificate) String() string {
 // Recombine will attempt to unmarshal a certificate received in a handshake.
 // Handshakes save space by placing the peers public key in a different part of the packet, we have to
 // reassemble the actual certificate structure with that in mind.
-// Implementations MUST assert the public key is not in the raw certificate bytes if the passed in public key is not empty.
 func Recombine(v Version, rawCertBytes, publicKey []byte, curve Curve) (Certificate, error) {
 	if publicKey == nil {
 		return nil, ErrNoPeerStaticKey
@@ -157,31 +151,3 @@ func Recombine(v Version, rawCertBytes, publicKey []byte, curve Curve) (Certific
 
 	return c, nil
 }
-
-// CalculateAlternateFingerprint calculates a 2nd fingerprint representation for P256 certificates
-// CAPool blocklist testing through `VerifyCertificate` and `VerifyCachedCertificate` automatically performs this step.
-func CalculateAlternateFingerprint(c Certificate) (string, error) {
-	if c.Curve() != Curve_P256 {
-		return "", nil
-	}
-
-	nc := c.Copy()
-	b, err := p256.Swap(nc.Signature())
-	if err != nil {
-		return "", err
-	}
-
-	switch v := nc.(type) {
-	case *certificateV1:
-		err = v.setSignature(b)
-	case *certificateV2:
-		err = v.setSignature(b)
-	default:
-		return "", ErrUnknownVersion
-	}
-
-	if err != nil {
-		return "", err
-	}
-	return nc.Fingerprint()
-}

cert/cert_v1.go

@@ -426,7 +426,7 @@ func unmarshalCertificateV1(b []byte, publicKey []byte) (*certificateV1, error)
 			unsafeNetworks: make([]netip.Prefix, len(rc.Details.Subnets)/2),
 			notBefore:      time.Unix(rc.Details.NotBefore, 0),
 			notAfter:       time.Unix(rc.Details.NotAfter, 0),
-			publicKey:      nil,
+			publicKey:      make([]byte, len(rc.Details.PublicKey)),
 			isCA:           rc.Details.IsCA,
 			curve:          rc.Details.Curve,
 		},
@@ -437,19 +437,12 @@ func unmarshalCertificateV1(b []byte, publicKey []byte) (*certificateV1, error)
 	copy(nc.details.groups, rc.Details.Groups)
 	nc.details.issuer = hex.EncodeToString(rc.Details.Issuer)
 
-	// If a public key is passed in as an argument, the certificate pubkey must be empty
-	// and the passed-in pubkey copied into the cert.
 	if len(publicKey) > 0 {
-		if len(rc.Details.PublicKey) != 0 {
+		nc.details.publicKey = publicKey
-			return nil, ErrCertPubkeyPresent
-		}
-		nc.details.publicKey = make([]byte, len(publicKey))
-		copy(nc.details.publicKey, publicKey)
-	} else {
-		nc.details.publicKey = make([]byte, len(rc.Details.PublicKey))
-		copy(nc.details.publicKey, rc.Details.PublicKey)
 	}
 
+	copy(nc.details.publicKey, rc.Details.PublicKey)
+
 	var ip netip.Addr
 	for i, rawIp := range rc.Details.Ips {
 		if i%2 == 0 {

cert/cert_v1_test.go

@@ -62,62 +62,6 @@ func TestCertificateV1_Marshal(t *testing.T) {
 	assert.Equal(t, nc.Groups(), nc2.Groups())
 }
 
-func TestCertificateV1_Unmarshal(t *testing.T) {
-	t.Parallel()
-	before := time.Now().Add(time.Second * -60).Round(time.Second)
-	after := time.Now().Add(time.Second * 60).Round(time.Second)
-	pubKey := []byte("1234567890abcedfghij1234567890ab")
-	invalidPubkey := []byte("00000000000000000000000000000000")
-
-	nc := certificateV1{
-		details: detailsV1{
-			name: "testing",
-			networks: []netip.Prefix{
-				mustParsePrefixUnmapped("10.1.1.1/24"),
-				mustParsePrefixUnmapped("10.1.1.2/16"),
-			},
-			unsafeNetworks: []netip.Prefix{
-				mustParsePrefixUnmapped("9.1.1.2/24"),
-				mustParsePrefixUnmapped("9.1.1.3/16"),
-			},
-			groups:    []string{"test-group1", "test-group2", "test-group3"},
-			notBefore: before,
-			notAfter:  after,
-			publicKey: pubKey,
-			isCA:      false,
-			issuer:    "1234567890abcedfghij1234567890ab",
-		},
-		signature: []byte("1234567890abcedfghij1234567890ab"),
-	}
-
-	// This certificate has a pubkey included
-	certWithPubkey, err := nc.Marshal()
-	require.NoError(t, err)
-
-	// This certificate is missing the pubkey section
-	certWithoutPubkey, err := nc.MarshalForHandshakes()
-	require.NoError(t, err)
-
-	// Cert has no pubkey and no pubkey passed in must fail to validate
-	isNil, err := unmarshalCertificateV1(certWithoutPubkey, nil)
-	require.Error(t, err)
-
-	// Cert has different pubkey than one passed in must fail
-	isNil, err = unmarshalCertificateV1(certWithPubkey, invalidPubkey)
-	require.Nil(t, isNil)
-	require.Error(t, err)
-
-	// Cert has pubkey and no pubkey argument works ok
-	_, err = unmarshalCertificateV1(certWithPubkey, nil)
-	require.NoError(t, err)
-
-	// Cert has no pubkey and valid, correctly signed pubkey passed in
-	nc2, err := unmarshalCertificateV1(certWithoutPubkey, pubKey)
-	require.NoError(t, err)
-
-	assert.Equal(t, pubKey, nc2.PublicKey())
-}
-
 func TestCertificateV1_PublicKeyPem(t *testing.T) {
 	t.Parallel()
 	before := time.Now().Add(time.Second * -60).Round(time.Second)
@@ -155,19 +99,13 @@ func TestCertificateV1_PublicKeyPem(t *testing.T) {
 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA P256 PUBLIC KEY-----
-`)
-
-	pubP256KeyPemCA := []byte(`-----BEGIN NEBULA ECDSA P256 PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAA=
------END NEBULA ECDSA P256 PUBLIC KEY-----
 `)
 	pubP256Key, _, _, err := UnmarshalPublicKeyFromPEM(pubP256KeyPem)
 	require.NoError(t, err)
 	nc.details.curve = Curve_P256
 	nc.details.publicKey = pubP256Key
 	assert.Equal(t, Curve_P256, nc.Curve())
-	assert.Equal(t, string(nc.MarshalPublicKeyPEM()), string(pubP256KeyPemCA))
+	assert.Equal(t, string(nc.MarshalPublicKeyPEM()), string(pubP256KeyPem))
 	assert.True(t, nc.IsCA())
 
 	nc.details.isCA = false

cert/cert_v2.go

@@ -439,7 +439,11 @@ func (c *certificateV2) validate() error {
 				if !hasV6Networks {
 					return NewErrInvalidCertificateProperties("IPv6 unsafe networks require an IPv6 address assignment: %s", network)
 				}
-			} // as long as we have any IP address, IPv4 UnsafeNetworks are allowed
+			} else if network.Addr().Is4() {
+				if !hasV4Networks {
+					return NewErrInvalidCertificateProperties("IPv4 unsafe networks require an IPv4 address assignment: %s", network)
+				}
+			}
 		}
 	}
 
@@ -588,13 +592,7 @@ func unmarshalCertificateV2(b []byte, publicKey []byte, curve Curve) (*certifica
 	// Maybe grab the public key
 	var rawPublicKey cryptobyte.String
 	if len(publicKey) > 0 {
-		// If a public key is passed in, then the handshake certificate must
+		rawPublicKey = publicKey
-		// not have a public key present
-		if input.PeekASN1Tag(TagCertPublicKey) {
-			return nil, ErrCertPubkeyPresent
-		}
-		rawPublicKey = make(cryptobyte.String, len(publicKey))
-		copy(rawPublicKey, publicKey)
 	} else if !input.ReadOptionalASN1(&rawPublicKey, nil, TagCertPublicKey) {
 		return nil, ErrBadFormat
 	}

cert/cert_v2_test.go

@@ -76,58 +76,6 @@ func TestCertificateV2_Marshal(t *testing.T) {
 	assert.Equal(t, nc.Groups(), nc2.Groups())
 }
 
-func TestCertificateV2_Unmarshal(t *testing.T) {
-	t.Parallel()
-	before := time.Now().Add(time.Second * -60).Round(time.Second)
-	after := time.Now().Add(time.Second * 60).Round(time.Second)
-	pubKey := []byte("1234567890abcedfghij1234567890ab")
-
-	nc := certificateV2{
-		details: detailsV2{
-			name: "testing",
-			networks: []netip.Prefix{
-				mustParsePrefixUnmapped("10.1.1.2/16"),
-				mustParsePrefixUnmapped("10.1.1.1/24"),
-			},
-			unsafeNetworks: []netip.Prefix{
-				mustParsePrefixUnmapped("9.1.1.3/16"),
-				mustParsePrefixUnmapped("9.1.1.2/24"),
-			},
-			groups:    []string{"test-group1", "test-group2", "test-group3"},
-			notBefore: before,
-			notAfter:  after,
-			isCA:      false,
-			issuer:    "1234567890abcdef1234567890abcdef",
-		},
-		signature: []byte("1234567890abcdef1234567890abcdef"),
-		publicKey: pubKey,
-	}
-
-	db, err := nc.details.Marshal()
-	require.NoError(t, err)
-	nc.rawDetails = db
-
-	certWithPubkey, err := nc.Marshal()
-	require.NoError(t, err)
-	//t.Log("Cert size:", len(b))
-	certWithoutPubkey, err := nc.MarshalForHandshakes()
-	require.NoError(t, err)
-
-	// Cert must not have a pubkey if one is passed in as an argument
-	_, err = unmarshalCertificateV2(certWithPubkey, pubKey, Curve_CURVE25519)
-	require.ErrorIs(t, err, ErrCertPubkeyPresent)
-
-	// Certs must have pubkeys
-	_, err = unmarshalCertificateV2(certWithoutPubkey, nil, Curve_CURVE25519)
-	require.ErrorIs(t, err, ErrBadFormat)
-
-	// Ensure proper unmarshal if a pubkey is passed in
-	nc2, err := unmarshalCertificateV2(certWithoutPubkey, pubKey, Curve_CURVE25519)
-	require.NoError(t, err)
-
-	assert.Equal(t, nc.PublicKey(), nc2.PublicKey())
-}
-
 func TestCertificateV2_PublicKeyPem(t *testing.T) {
 	t.Parallel()
 	before := time.Now().Add(time.Second * -60).Round(time.Second)
@@ -166,19 +114,12 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 AAAAAAAAAAAAAAAAAAAAAAA=
 -----END NEBULA P256 PUBLIC KEY-----
 `)
-
-	pubP256KeyPemCA := []byte(`-----BEGIN NEBULA ECDSA P256 PUBLIC KEY-----
-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-AAAAAAAAAAAAAAAAAAAAAAA=
------END NEBULA ECDSA P256 PUBLIC KEY-----
-`)
-
 	pubP256Key, _, _, err := UnmarshalPublicKeyFromPEM(pubP256KeyPem)
 	require.NoError(t, err)
 	nc.curve = Curve_P256
 	nc.publicKey = pubP256Key
 	assert.Equal(t, Curve_P256, nc.Curve())
-	assert.Equal(t, string(nc.MarshalPublicKeyPEM()), string(pubP256KeyPemCA))
+	assert.Equal(t, string(nc.MarshalPublicKeyPEM()), string(pubP256KeyPem))
 	assert.True(t, nc.IsCA())
 
 	nc.details.isCA = false

cert/crypto_test.go

@@ -79,7 +79,7 @@ qrlJ69wer3ZUHFXA
 	assert.Nil(t, k)
 	assert.Equal(t, rest, invalidPem)
 
-	// Fail due to invalid PEM format, because
+	// Fail due to ivalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	curve, k, rest, err = DecryptAndUnmarshalSigningPrivateKey(passphrase, rest)
 	require.EqualError(t, err, "input did not contain a valid PEM encoded block")

cert/errors.go

@@ -21,7 +21,6 @@ var (
 	ErrPrivateKeyEncrypted        = errors.New("private key must be decrypted")
 	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
 	ErrUnknownVersion             = errors.New("certificate version unrecognized")
-	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
 
 	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
 	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")

cert/p256/p256.go

@@ -1,122 +0,0 @@
-package p256
-
-import (
-	"crypto/elliptic"
-	"errors"
-	"math/big"
-
-	"filippo.io/bigmod"
-
-	"golang.org/x/crypto/cryptobyte"
-	"golang.org/x/crypto/cryptobyte/asn1"
-)
-
-var halfN = new(big.Int).Rsh(elliptic.P256().Params().N, 1)
-var nMod *bigmod.Modulus
-
-func init() {
-	n, err := bigmod.NewModulus(elliptic.P256().Params().N.Bytes())
-	if err != nil {
-		panic(err)
-	}
-	nMod = n
-}
-
-func IsNormalized(sig []byte) (bool, error) {
-	r, s, err := parseSignature(sig)
-	if err != nil {
-		return false, err
-	}
-	return checkLowS(r, s), nil
-}
-
-func checkLowS(_, s []byte) bool {
-	bigS := new(big.Int).SetBytes(s)
-	// Check if S <= (N/2), because we want to include the midpoint in the set of low-s
-	return bigS.Cmp(halfN) <= 0
-}
-
-func swap(r, s []byte) ([]byte, []byte, error) {
-	var err error
-	bigS, err := bigmod.NewNat().SetBytes(s, nMod)
-	if err != nil {
-		return nil, nil, err
-	}
-	sNormalized := nMod.Nat().Sub(bigS, nMod)
-
-	return r, sNormalized.Bytes(nMod), nil
-}
-
-func Normalize(sig []byte) ([]byte, error) {
-	r, s, err := parseSignature(sig)
-	if err != nil {
-		return nil, err
-	}
-
-	if checkLowS(r, s) {
-		return sig, nil
-	}
-
-	newR, newS, err := swap(r, s)
-	if err != nil {
-		return nil, err
-	}
-
-	return encodeSignature(newR, newS)
-}
-
-// Swap will change sig between its current form to the opposite high or low form.
-func Swap(sig []byte) ([]byte, error) {
-	r, s, err := parseSignature(sig)
-	if err != nil {
-		return nil, err
-	}
-
-	newR, newS, err := swap(r, s)
-	if err != nil {
-		return nil, err
-	}
-
-	return encodeSignature(newR, newS)
-}
-
-// parseSignature taken exactly from crypto/ecdsa/ecdsa.go
-func parseSignature(sig []byte) (r, s []byte, err error) {
-	var inner cryptobyte.String
-	input := cryptobyte.String(sig)
-	if !input.ReadASN1(&inner, asn1.SEQUENCE) ||
-		!input.Empty() ||
-		!inner.ReadASN1Integer(&r) ||
-		!inner.ReadASN1Integer(&s) ||
-		!inner.Empty() {
-		return nil, nil, errors.New("invalid ASN.1")
-	}
-	return r, s, nil
-}
-
-func encodeSignature(r, s []byte) ([]byte, error) {
-	var b cryptobyte.Builder
-	b.AddASN1(asn1.SEQUENCE, func(b *cryptobyte.Builder) {
-		addASN1IntBytes(b, r)
-		addASN1IntBytes(b, s)
-	})
-	return b.Bytes()
-}
-
-// addASN1IntBytes encodes in ASN.1 a positive integer represented as
-// a big-endian byte slice with zero or more leading zeroes.
-func addASN1IntBytes(b *cryptobyte.Builder, bytes []byte) {
-	for len(bytes) > 0 && bytes[0] == 0 {
-		bytes = bytes[1:]
-	}
-	if len(bytes) == 0 {
-		b.SetError(errors.New("invalid integer"))
-		return
-	}
-	b.AddASN1(asn1.INTEGER, func(c *cryptobyte.Builder) {
-		if bytes[0]&0x80 != 0 {
-			c.AddUint8(0)
-		}
-		c.AddBytes(bytes)
-	})
-}

cert/p256/p256_test.go

@@ -1,28 +0,0 @@
-package p256
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestFlipping(t *testing.T) {
-	priv, err1 := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	require.NoError(t, err1)
-
-	out, err := ecdsa.SignASN1(rand.Reader, priv, []byte("big chungus"))
-	require.NoError(t, err)
-
-	r, s, err := parseSignature(out)
-	require.NoError(t, err)
-
-	r, s1, err := swap(r, s)
-	require.NoError(t, err)
-	r, s2, err := swap(r, s1)
-	require.NoError(t, err)
-	require.Equal(t, s, s2)
-	require.NotEqual(t, s, s1)
-}

cert/pem.go

@@ -86,7 +86,7 @@ func MarshalSigningPublicKeyToPEM(curve Curve, b []byte) []byte {
 	case Curve_CURVE25519:
 		return pem.EncodeToMemory(&pem.Block{Type: Ed25519PublicKeyBanner, Bytes: b})
 	case Curve_P256:
-		return pem.EncodeToMemory(&pem.Block{Type: ECDSAP256PublicKeyBanner, Bytes: b})
+		return pem.EncodeToMemory(&pem.Block{Type: P256PublicKeyBanner, Bytes: b})
 	default:
 		return nil
 	}

cert/pem_test.go

@@ -44,7 +44,7 @@ bzBEr00kERQxxTzTsH8cpYEgRoipvmExvg8WP8NdAJEYJosB
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "bytes did not contain a proper certificate banner")
 
-	// Fail due to invalid PEM format, because
+	// Fail due to ivalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	cert, rest, err = UnmarshalCertificateFromPEM(rest)
 	assert.Nil(t, cert)
@@ -106,7 +106,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "bytes did not contain a proper Ed25519/ECDSA private key banner")
 
-	// Fail due to invalid PEM format, because
+	// Fail due to ivalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalSigningPrivateKeyFromPEM(rest)
 	assert.Nil(t, k)
@@ -168,7 +168,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "bytes did not contain a proper private key banner")
 
-	// Fail due to invalid PEM format, because
+	// Fail due to ivalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalPrivateKeyFromPEM(rest)
 	assert.Nil(t, k)
@@ -221,7 +221,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)
 
-	// Fail due to invalid PEM format, because
+	// Fail due to ivalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
@@ -299,7 +299,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)
 
-	// Fail due to invalid PEM format, because
+	// Fail due to ivalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)

cert/sign.go

@@ -9,8 +9,6 @@ import (
 	"fmt"
 	"net/netip"
 	"time"
-
-	"github.com/slackhq/nebula/cert/p256"
 )
 
 // TBSCertificate represents a certificate intended to be signed.
@@ -128,13 +126,6 @@ func (t *TBSCertificate) SignWith(signer Certificate, curve Curve, sp SignerLamb
 		return nil, err
 	}
 
-	if curve == Curve_P256 {
-		sig, err = p256.Normalize(sig)
-		if err != nil {
-			return nil, err
-		}
-	}
-
 	err = c.setSignature(sig)
 	if err != nil {
 		return nil, err

cert/sign_test.go

@@ -9,7 +9,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/slackhq/nebula/cert/p256"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -90,48 +89,3 @@ func TestCertificateV1_SignP256(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, uc)
 }
-
-func TestCertificate_SignP256_AlwaysNormalized(t *testing.T) {
-	before := time.Now().Add(time.Second * -60).Round(time.Second)
-	after := time.Now().Add(time.Second * 60).Round(time.Second)
-	pubKey := []byte("01234567890abcedfghij1234567890ab1234567890abcedfghij1234567890ab")
-
-	tbs := TBSCertificate{
-		Version: Version1,
-		Name:    "testing",
-		Networks: []netip.Prefix{
-			mustParsePrefixUnmapped("10.1.1.1/24"),
-			mustParsePrefixUnmapped("10.1.1.2/16"),
-		},
-		UnsafeNetworks: []netip.Prefix{
-			mustParsePrefixUnmapped("9.1.1.2/24"),
-			mustParsePrefixUnmapped("9.1.1.3/16"),
-		},
-		Groups:    []string{"test-group1", "test-group2", "test-group3"},
-		NotBefore: before,
-		NotAfter:  after,
-		PublicKey: pubKey,
-		IsCA:      true,
-		Curve:     Curve_P256,
-	}
-
-	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	require.NoError(t, err)
-	pub := elliptic.Marshal(elliptic.P256(), priv.PublicKey.X, priv.PublicKey.Y)
-	rawPriv := priv.D.FillBytes(make([]byte, 32))
-
-	for i := 0; i < 1000; i++ {
-		if i&1 == 1 {
-			tbs.Version = Version1
-		} else {
-			tbs.Version = Version2
-		}
-		c, err := tbs.Sign(nil, Curve_P256, rawPriv)
-		require.NoError(t, err)
-		assert.NotNil(t, c)
-		assert.True(t, c.CheckSignature(pub))
-		normie, err := p256.IsNormalized(c.Signature())
-		require.NoError(t, err)
-		assert.True(t, normie)
-	}
-}

cert_test/cert.go

@@ -114,33 +114,6 @@ func NewTestCert(v cert.Version, curve cert.Curve, ca cert.Certificate, key []by
 	return c, pub, cert.MarshalPrivateKeyToPEM(curve, priv), pem
 }
 
-func NewTestCertDifferentVersion(c cert.Certificate, v cert.Version, ca cert.Certificate, key []byte) (cert.Certificate, []byte) {
-	nc := &cert.TBSCertificate{
-		Version:        v,
-		Curve:          c.Curve(),
-		Name:           c.Name(),
-		Networks:       c.Networks(),
-		UnsafeNetworks: c.UnsafeNetworks(),
-		Groups:         c.Groups(),
-		NotBefore:      time.Unix(c.NotBefore().Unix(), 0),
-		NotAfter:       time.Unix(c.NotAfter().Unix(), 0),
-		PublicKey:      c.PublicKey(),
-		IsCA:           false,
-	}
-
-	c, err := nc.Sign(ca, ca.Curve(), key)
-	if err != nil {
-		panic(err)
-	}
-
-	pem, err := c.MarshalPEM()
-	if err != nil {
-		panic(err)
-	}
-
-	return c, pem
-}
-
 func X25519Keypair() ([]byte, []byte) {
 	privkey := make([]byte, 32)
 	if _, err := io.ReadFull(rand.Reader, privkey); err != nil {

cmd/nebula-cert/ca.go

@@ -173,26 +173,23 @@ func ca(args []string, out io.Writer, errOut io.Writer, pr PasswordReader) error
 
 	var passphrase []byte
 	if !isP11 && *cf.encryption {
-		passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
+		for i := 0; i < 5; i++ {
+			out.Write([]byte("Enter passphrase: "))
+			passphrase, err = pr.ReadPassword()
+
+			if err == ErrNoTerminal {
+				return fmt.Errorf("out-key must be encrypted interactively")
+			} else if err != nil {
+				return fmt.Errorf("error reading passphrase: %s", err)
+			}
+
+			if len(passphrase) > 0 {
+				break
+			}
+		}
+
 		if len(passphrase) == 0 {
-			for i := 0; i < 5; i++ {
+			return fmt.Errorf("no passphrase specified, remove -encrypt flag to write out-key in plaintext")
-				out.Write([]byte("Enter passphrase: "))
-				passphrase, err = pr.ReadPassword()
-
-				if err == ErrNoTerminal {
-					return fmt.Errorf("out-key must be encrypted interactively")
-				} else if err != nil {
-					return fmt.Errorf("error reading passphrase: %s", err)
-				}
-
-				if len(passphrase) > 0 {
-					break
-				}
-			}
-
-			if len(passphrase) == 0 {
-				return fmt.Errorf("no passphrase specified, remove -encrypt flag to write out-key in plaintext")
-			}
 		}
 	}
 

cmd/nebula-cert/ca_test.go

@@ -171,17 +171,6 @@ func Test_ca(t *testing.T) {
 	assert.Equal(t, pwPromptOb, ob.String())
 	assert.Empty(t, eb.String())
 
-	// test encrypted key with passphrase environment variable
-	os.Remove(keyF.Name())
-	os.Remove(crtF.Name())
-	ob.Reset()
-	eb.Reset()
-	args = []string{"-version", "1", "-encrypt", "-name", "test", "-duration", "100m", "-groups", "1,2,3,4,5", "-out-crt", crtF.Name(), "-out-key", keyF.Name()}
-	os.Setenv("NEBULA_CA_PASSPHRASE", string(passphrase))
-	require.NoError(t, ca(args, ob, eb, testpw))
-	assert.Empty(t, eb.String())
-	os.Setenv("NEBULA_CA_PASSPHRASE", "")
-
 	// read encrypted key file and verify default params
 	rb, _ = os.ReadFile(keyF.Name())
 	k, _ := pem.Decode(rb)
@@ -200,7 +189,7 @@ func Test_ca(t *testing.T) {
 	assert.Empty(t, b)
 	assert.Len(t, lKey, 64)
 
-	// test when reading password results in an error
+	// test when reading passsword results in an error
 	os.Remove(keyF.Name())
 	os.Remove(crtF.Name())
 	ob.Reset()

cmd/nebula-cert/main.go

@@ -5,28 +5,10 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"runtime/debug"
-	"strings"
 )
 
-// A version string that can be set with
-//
-//	-ldflags "-X main.Build=SOMEVERSION"
-//
-// at compile-time.
 var Build string
 
-func init() {
-	if Build == "" {
-		info, ok := debug.ReadBuildInfo()
-		if !ok {
-			return
-		}
-
-		Build = strings.TrimPrefix(info.Main.Version, "v")
-	}
-}
-
 type helpError struct {
 	s string
 }

cmd/nebula-cert/sign.go

@@ -43,7 +43,7 @@ type signFlags struct {
 func newSignFlags() *signFlags {
 	sf := signFlags{set: flag.NewFlagSet("sign", flag.ContinueOnError)}
 	sf.set.Usage = func() {}
-	sf.version = sf.set.Uint("version", 0, "Optional: version of the certificate format to use. The default is to match the version of the signing CA")
+	sf.version = sf.set.Uint("version", 0, "Optional: version of the certificate format to use, the default is to create both v1 and v2 certificates.")
 	sf.caKeyPath = sf.set.String("ca-key", "ca.key", "Optional: path to the signing CA key")
 	sf.caCertPath = sf.set.String("ca-crt", "ca.crt", "Optional: path to the signing CA cert")
 	sf.name = sf.set.String("name", "", "Required: name of the cert, usually a hostname")
@@ -116,28 +116,26 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		// naively attempt to decode the private key as though it is not encrypted
 		caKey, _, curve, err = cert.UnmarshalSigningPrivateKeyFromPEM(rawCAKey)
 		if errors.Is(err, cert.ErrPrivateKeyEncrypted) {
+			// ask for a passphrase until we get one
 			var passphrase []byte
-			passphrase = []byte(os.Getenv("NEBULA_CA_PASSPHRASE"))
+			for i := 0; i < 5; i++ {
-			if len(passphrase) == 0 {
+				out.Write([]byte("Enter passphrase: "))
-				// ask for a passphrase until we get one
+				passphrase, err = pr.ReadPassword()
-				for i := 0; i < 5; i++ {
-					out.Write([]byte("Enter passphrase: "))
-					passphrase, err = pr.ReadPassword()
 
-					if errors.Is(err, ErrNoTerminal) {
+				if errors.Is(err, ErrNoTerminal) {
-						return fmt.Errorf("ca-key is encrypted and must be decrypted interactively")
+					return fmt.Errorf("ca-key is encrypted and must be decrypted interactively")
-					} else if err != nil {
+				} else if err != nil {
-						return fmt.Errorf("error reading password: %s", err)
+					return fmt.Errorf("error reading password: %s", err)
-					}
-
-					if len(passphrase) > 0 {
-						break
-					}
 				}
-				if len(passphrase) == 0 {
+
-					return fmt.Errorf("cannot open encrypted ca-key without passphrase")
+				if len(passphrase) > 0 {
+					break
 				}
 			}
+			if len(passphrase) == 0 {
+				return fmt.Errorf("cannot open encrypted ca-key without passphrase")
+			}
+
 			curve, caKey, _, err = cert.DecryptAndUnmarshalSigningPrivateKey(passphrase, rawCAKey)
 			if err != nil {
 				return fmt.Errorf("error while parsing encrypted ca-key: %s", err)
@@ -167,10 +165,6 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		return fmt.Errorf("ca certificate is expired")
 	}
 
-	if version == 0 {
-		version = caCert.Version()
-	}
-
 	// if no duration is given, expire one second before the root expires
 	if *sf.duration <= 0 {
 		*sf.duration = time.Until(caCert.NotAfter()) - time.Second*1
@@ -283,19 +277,21 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 	notBefore := time.Now()
 	notAfter := notBefore.Add(*sf.duration)
 
-	switch version {
+	if version == 0 || version == cert.Version1 {
-	case cert.Version1:
+		// Make sure we at least have an ip
-		// Make sure we have only one ipv4 address
 		if len(v4Networks) != 1 {
 			return newHelpErrorf("invalid -networks definition: v1 certificates can only have a single ipv4 address")
 		}
 
-		if len(v6Networks) > 0 {
+		if version == cert.Version1 {
-			return newHelpErrorf("invalid -networks definition: v1 certificates can only contain ipv4 addresses")
+			// If we are asked to mint a v1 certificate only then we cant just ignore any v6 addresses
-		}
+			if len(v6Networks) > 0 {
+				return newHelpErrorf("invalid -networks definition: v1 certificates can only be ipv4")
+			}
 
-		if len(v6UnsafeNetworks) > 0 {
+			if len(v6UnsafeNetworks) > 0 {
-			return newHelpErrorf("invalid -unsafe-networks definition: v1 certificates can only contain ipv4 addresses")
+				return newHelpErrorf("invalid -unsafe-networks definition: v1 certificates can only be ipv4")
+			}
 		}
 
 		t := &cert.TBSCertificate{
@@ -325,8 +321,9 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		}
 
 		crts = append(crts, nc)
+	}
 
-	case cert.Version2:
+	if version == 0 || version == cert.Version2 {
 		t := &cert.TBSCertificate{
 			Version:        cert.Version2,
 			Name:           *sf.name,
@@ -354,9 +351,6 @@ func signCert(args []string, out io.Writer, errOut io.Writer, pr PasswordReader)
 		}
 
 		crts = append(crts, nc)
-	default:
-		// this should be unreachable
-		return fmt.Errorf("invalid version: %d", version)
 	}
 
 	if !isP11 && *sf.inPubPath == "" {

cmd/nebula-cert/sign_test.go

@@ -55,7 +55,7 @@ func Test_signHelp(t *testing.T) {
 			"  -unsafe-networks string\n"+
 			"    \tOptional: comma separated list of ip address and network in CIDR notation. Unsafe networks this cert can route for\n"+
 			"  -version uint\n"+
-			"    \tOptional: version of the certificate format to use. The default is to match the version of the signing CA\n",
+			"    \tOptional: version of the certificate format to use, the default is to create both v1 and v2 certificates.\n",
 		ob.String(),
 	)
 }
@@ -204,7 +204,7 @@ func Test_signCert(t *testing.T) {
 	ob.Reset()
 	eb.Reset()
 	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", "nope", "-out-key", "nope", "-duration", "100m", "-subnets", "100::100/100"}
-	assertHelpError(t, signCert(args, ob, eb, nopw), "invalid -unsafe-networks definition: v1 certificates can only contain ipv4 addresses")
+	assertHelpError(t, signCert(args, ob, eb, nopw), "invalid -unsafe-networks definition: v1 certificates can only be ipv4")
 	assert.Empty(t, ob.String())
 	assert.Empty(t, eb.String())
 
@@ -379,15 +379,6 @@ func Test_signCert(t *testing.T) {
 	assert.Equal(t, "Enter passphrase: ", ob.String())
 	assert.Empty(t, eb.String())
 
-	// test with the proper password in the environment
-	os.Remove(crtF.Name())
-	os.Remove(keyF.Name())
-	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
-	os.Setenv("NEBULA_CA_PASSPHRASE", string(passphrase))
-	require.NoError(t, signCert(args, ob, eb, testpw))
-	assert.Empty(t, eb.String())
-	os.Setenv("NEBULA_CA_PASSPHRASE", "")
-
 	// test with the wrong password
 	ob.Reset()
 	eb.Reset()
@@ -398,17 +389,6 @@ func Test_signCert(t *testing.T) {
 	assert.Equal(t, "Enter passphrase: ", ob.String())
 	assert.Empty(t, eb.String())
 
-	// test with the wrong password in environment
-	ob.Reset()
-	eb.Reset()
-
-	os.Setenv("NEBULA_CA_PASSPHRASE", "invalid password")
-	args = []string{"-version", "1", "-ca-crt", caCrtF.Name(), "-ca-key", caKeyF.Name(), "-name", "test", "-ip", "1.1.1.1/24", "-out-crt", crtF.Name(), "-out-key", keyF.Name(), "-duration", "100m", "-subnets", "10.1.1.1/32, ,   10.2.2.2/32   ,   ,  ,, 10.5.5.5/32", "-groups", "1,,   2    ,        ,,,3,4,5"}
-	require.EqualError(t, signCert(args, ob, eb, nopw), "error while parsing encrypted ca-key: invalid passphrase or corrupt private key")
-	assert.Empty(t, ob.String())
-	assert.Empty(t, eb.String())
-	os.Setenv("NEBULA_CA_PASSPHRASE", "")
-
 	// test with the user not entering a password
 	ob.Reset()
 	eb.Reset()

cmd/nebula-service/main.go

@@ -4,8 +4,6 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"runtime/debug"
-	"strings"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
@@ -20,17 +18,6 @@ import (
 // at compile-time.
 var Build string
 
-func init() {
-	if Build == "" {
-		info, ok := debug.ReadBuildInfo()
-		if !ok {
-			return
-		}
-
-		Build = strings.TrimPrefix(info.Main.Version, "v")
-	}
-}
-
 func main() {
 	serviceFlag := flag.String("service", "", "Control the system service.")
 	configPath := flag.String("config", "", "Path to either a file or directory to load configuration from")

cmd/nebula/main.go

@@ -4,8 +4,6 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"runtime/debug"
-	"strings"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
@@ -20,17 +18,6 @@ import (
 // at compile-time.
 var Build string
 
-func init() {
-	if Build == "" {
-		info, ok := debug.ReadBuildInfo()
-		if !ok {
-			return
-		}
-
-		Build = strings.TrimPrefix(info.Main.Version, "v")
-	}
-}
-
 func main() {
 	configPath := flag.String("config", "", "Path to either a file or directory to load configuration from")
 	configTest := flag.Bool("test", false, "Test the config and print the end result. Non zero exit indicates a faulty config")

config/config.go

@@ -17,7 +17,7 @@ import (
 
 	"dario.cat/mergo"
 	"github.com/sirupsen/logrus"
-	"go.yaml.in/yaml/v3"
+	"gopkg.in/yaml.v3"
 )
 
 type C struct {

config/config_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v3"
+	"gopkg.in/yaml.v3"
 )
 
 func TestConfig_Load(t *testing.T) {

connection_manager.go

@@ -354,6 +354,7 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 
 		if mainHostInfo {
 			decision = tryRehandshake
+
 		} else {
 			if cm.shouldSwapPrimary(hostinfo) {
 				decision = swapPrimary
@@ -460,10 +461,6 @@ func (cm *connectionManager) shouldSwapPrimary(current *HostInfo) bool {
 	}
 
 	crt := cm.intf.pki.getCertState().getCertificate(current.ConnectionState.myCert.Version())
-	if crt == nil {
-		//my cert was reloaded away. We should definitely swap from this tunnel
-		return true
-	}
 	// If this tunnel is using the latest certificate then we should swap it to primary for a bit and see if things
 	// settle down.
 	return bytes.Equal(current.ConnectionState.myCert.Signature(), crt.Signature())
@@ -478,34 +475,31 @@ func (cm *connectionManager) swapPrimary(current, primary *HostInfo) {
 	cm.hostMap.Unlock()
 }
 
-// isInvalidCertificate decides if we should destroy a tunnel.
+// isInvalidCertificate will check if we should destroy a tunnel if pki.disconnect_invalid is true and
-// returns true if pki.disconnect_invalid is true and the certificate is no longer valid.
+// the certificate is no longer valid. Block listed certificates will skip the pki.disconnect_invalid
-// Blocklisted certificates will skip the pki.disconnect_invalid check and return true.
+// check and return true.
 func (cm *connectionManager) isInvalidCertificate(now time.Time, hostinfo *HostInfo) bool {
 	remoteCert := hostinfo.GetCert()
 	if remoteCert == nil {
-		return false //don't tear down tunnels for handshakes in progress
+		return false
 	}
 
 	caPool := cm.intf.pki.GetCAPool()
 	err := caPool.VerifyCachedCertificate(now, remoteCert)
 	if err == nil {
-		return false //cert is still valid! yay!
-	} else if err == cert.ErrBlockListed { //avoiding errors.Is for speed
-		// Block listed certificates should always be disconnected
-		hostinfo.logger(cm.l).WithError(err).
-			WithField("fingerprint", remoteCert.Fingerprint).
-			Info("Remote certificate is blocked, tearing down the tunnel")
-		return true
-	} else if cm.intf.disconnectInvalid.Load() {
-		hostinfo.logger(cm.l).WithError(err).
-			WithField("fingerprint", remoteCert.Fingerprint).
-			Info("Remote certificate is no longer valid, tearing down the tunnel")
-		return true
-	} else {
-		//if we reach here, the cert is no longer valid, but we're configured to keep tunnels from now-invalid certs open
 		return false
 	}
+
+	if !cm.intf.disconnectInvalid.Load() && err != cert.ErrBlockListed {
+		// Block listed certificates should always be disconnected
+		return false
+	}
+
+	hostinfo.logger(cm.l).WithError(err).
+		WithField("fingerprint", remoteCert.Fingerprint).
+		Info("Remote certificate is no longer valid, tearing down the tunnel")
+
+	return true
 }
 
 func (cm *connectionManager) sendPunch(hostinfo *HostInfo) {
@@ -536,45 +530,15 @@ func (cm *connectionManager) sendPunch(hostinfo *HostInfo) {
 func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 	cs := cm.intf.pki.getCertState()
 	curCrt := hostinfo.ConnectionState.myCert
-	curCrtVersion := curCrt.Version()
+	myCrt := cs.getCertificate(curCrt.Version())
-	myCrt := cs.getCertificate(curCrtVersion)
+	if curCrt.Version() >= cs.initiatingVersion && bytes.Equal(curCrt.Signature(), myCrt.Signature()) == true {
-	if myCrt == nil {
+		// The current tunnel is using the latest certificate and version, no need to rehandshake.
-		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-			WithField("version", curCrtVersion).
-			WithField("reason", "local certificate removed").
-			Info("Re-handshaking with remote")
-		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}
-	peerCrt := hostinfo.ConnectionState.peerCert
-	if peerCrt != nil && curCrtVersion < peerCrt.Certificate.Version() {
-		// if our certificate version is less than theirs, and we have a matching version available, rehandshake?
-		if cs.getCertificate(peerCrt.Certificate.Version()) != nil {
-			cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-				WithField("version", curCrtVersion).
-				WithField("peerVersion", peerCrt.Certificate.Version()).
-				WithField("reason", "local certificate version lower than peer, attempting to correct").
-				Info("Re-handshaking with remote")
-			cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], func(hh *HandshakeHostInfo) {
-				hh.initiatingVersionOverride = peerCrt.Certificate.Version()
-			})
-			return
-		}
-	}
-	if !bytes.Equal(curCrt.Signature(), myCrt.Signature()) {
-		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-			WithField("reason", "local certificate is not current").
-			Info("Re-handshaking with remote")
 
-		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
+	cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-		return
+		WithField("reason", "local certificate is not current").
-	}
+		Info("Re-handshaking with remote")
-	if curCrtVersion < cs.initiatingVersion {
-		cm.l.WithField("vpnAddrs", hostinfo.vpnAddrs).
-			WithField("reason", "current cert version < pki.initiatingVersion").
-			Info("Re-handshaking with remote")
 
-		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
+	cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
-		return
-	}
 }

connection_state.go

@@ -50,6 +50,11 @@ func NewConnectionState(l *logrus.Logger, cs *CertState, crt cert.Certificate, i
 	}
 
 	static := noise.DHKey{Private: cs.privateKey, Public: crt.PublicKey()}
+
+	b := NewBits(ReplayWindow)
+	// Clear out bit 0, we never transmit it, and we don't want it showing as packet loss
+	b.Update(l, 0)
+
 	hs, err := noise.NewHandshakeState(noise.Config{
 		CipherSuite:   ncs,
 		Random:        rand.Reader,
@@ -69,7 +74,7 @@ func NewConnectionState(l *logrus.Logger, cs *CertState, crt cert.Certificate, i
 	ci := &ConnectionState{
 		H:         hs,
 		initiator: initiator,
-		window:    NewBits(ReplayWindow),
+		window:    b,
 		myCert:    crt,
 	}
 	// always start the counter from 2, as packet 1 and packet 2 are handshake packets.

control_tester.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package nebula
 
@@ -173,10 +174,6 @@ func (c *Control) GetHostmap() *HostMap {
 	return c.f.hostMap
 }
 
-func (c *Control) GetF() *Interface {
-	return c.f
-}
-
 func (c *Control) GetCertState() *CertState {
 	return c.f.pki.getCertState()
 }

e2e/handshakes_test.go

@@ -20,17 +20,16 @@ import (
 	"github.com/slackhq/nebula/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v3"
+	"gopkg.in/yaml.v3"
 )
 
 func BenchmarkHotPath(b *testing.B) {
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
+	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
 	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them", "10.128.0.2/24", nil)
 
 	// Put their info in our lighthouse
 	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
 
 	// Start the servers
 	myControl.Start()
@@ -39,9 +38,6 @@ func BenchmarkHotPath(b *testing.B) {
 	r := router.NewR(b, myControl, theirControl)
 	r.CancelFlowLogs()
 
-	assertTunnel(b, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-	b.ResetTimer()
-
 	for n := 0; n < b.N; n++ {
 		myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
 		_ = r.RouteForAllUntilTxTun(theirControl)
@@ -51,39 +47,6 @@ func BenchmarkHotPath(b *testing.B) {
 	theirControl.Stop()
 }
 
-func BenchmarkHotPathRelay(b *testing.B) {
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "relay  ", "10.128.0.128/24", m{"relay": m{"am_relay": true}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "them   ", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
-
-	// Teach my how to get to the relay and that their can be reached via the relay
-	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	// Build a router so we don't have to reason who gets which packet
-	r := router.NewR(b, myControl, relayControl, theirControl)
-	r.CancelFlowLogs()
-
-	// Start the servers
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	assertTunnel(b, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
-	b.ResetTimer()
-
-	for n := 0; n < b.N; n++ {
-		myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-		_ = r.RouteForAllUntilTxTun(theirControl)
-	}
-
-	myControl.Stop()
-	theirControl.Stop()
-	relayControl.Stop()
-}
-
 func TestGoodHandshake(t *testing.T) {
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version1, ca, caKey, "me", "10.128.0.1/24", nil)
@@ -134,41 +97,6 @@ func TestGoodHandshake(t *testing.T) {
 	theirControl.Stop()
 }
 
-func TestGoodHandshakeNoOverlap(t *testing.T) {
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, myUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24", nil)
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "2001::69/24", nil) //look ma, cross-stack!
-
-	// Put their info in our lighthouse
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	// Start the servers
-	myControl.Start()
-	theirControl.Start()
-
-	empty := []byte{}
-	t.Log("do something to cause a handshake")
-	myControl.GetF().SendMessageToVpnAddr(header.Test, header.MessageNone, theirVpnIpNet[0].Addr(), empty, empty, empty)
-
-	t.Log("Have them consume my stage 0 packet. They have a tunnel now")
-	theirControl.InjectUDPPacket(myControl.GetFromUDP(true))
-
-	t.Log("Get their stage 1 packet")
-	stage1Packet := theirControl.GetFromUDP(true)
-
-	t.Log("Have me consume their stage 1 packet. I have a tunnel now")
-	myControl.InjectUDPPacket(stage1Packet)
-
-	t.Log("Wait until we see a test packet come through to make sure we give the tunnel time to complete")
-	myControl.WaitForType(header.Test, 0, theirControl)
-
-	t.Log("Make sure our host infos are correct")
-	assertHostInfoPair(t, myUdpAddr, theirUdpAddr, myVpnIpNet, theirVpnIpNet, myControl, theirControl)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
 func TestWrongResponderHandshake(t *testing.T) {
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 
@@ -536,35 +464,6 @@ func TestRelays(t *testing.T) {
 	r.RenderHostmaps("Final hostmaps", myControl, relayControl, theirControl)
 }
 
-func TestRelaysDontCareAboutIps(t *testing.T) {
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "2001::9999/24", m{"relay": m{"am_relay": true}})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them   ", "10.128.0.2/24", m{"relay": m{"use_relays": true}})
-
-	// Teach my how to get to the relay and that their can be reached via the relay
-	myControl.InjectLightHouseAddr(relayVpnIpNet[0].Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnIpNet[0].Addr(), []netip.Addr{relayVpnIpNet[0].Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	// Build a router so we don't have to reason who gets which packet
-	r := router.NewR(t, myControl, relayControl, theirControl)
-	defer r.RenderFlow()
-
-	// Start the servers
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-
-	p := r.RouteForAllUntilTxTun(theirControl)
-	r.Log("Assert the tunnel works")
-	assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
-	r.RenderHostmaps("Final hostmaps", myControl, relayControl, theirControl)
-}
-
 func TestReestablishRelays(t *testing.T) {
 	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
 	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version1, ca, caKey, "me     ", "10.128.0.1/24", m{"relay": m{"use_relays": true}})
@@ -1328,109 +1227,3 @@ func TestV2NonPrimaryWithLighthouse(t *testing.T) {
 	myControl.Stop()
 	theirControl.Stop()
 }
-
-func TestV2NonPrimaryWithOffNetLighthouse(t *testing.T) {
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	lhControl, lhVpnIpNet, lhUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "lh  ", "2001::1/64", m{"lighthouse": m{"am_lighthouse": true}})
-
-	o := m{
-		"static_host_map": m{
-			lhVpnIpNet[0].Addr().String(): []string{lhUdpAddr.String()},
-		},
-		"lighthouse": m{
-			"hosts": []string{lhVpnIpNet[0].Addr().String()},
-			"local_allow_list": m{
-				// Try and block our lighthouse updates from using the actual addresses assigned to this computer
-				// If we start discovering addresses the test router doesn't know about then test traffic cant flow
-				"10.0.0.0/24": true,
-				"::/0":        false,
-			},
-		},
-	}
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me  ", "10.128.0.2/24, ff::2/64", o)
-	theirControl, theirVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.3/24, ff::3/64", o)
-
-	// Build a router so we don't have to reason who gets which packet
-	r := router.NewR(t, lhControl, myControl, theirControl)
-	defer r.RenderFlow()
-
-	// Start the servers
-	lhControl.Start()
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Stand up an ipv6 tunnel between me and them")
-	assert.True(t, myVpnIpNet[1].Addr().Is6())
-	assert.True(t, theirVpnIpNet[1].Addr().Is6())
-	assertTunnel(t, myVpnIpNet[1].Addr(), theirVpnIpNet[1].Addr(), myControl, theirControl, r)
-
-	lhControl.Stop()
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestGoodHandshakeUnsafeDest(t *testing.T) {
-	unsafePrefix := "192.168.6.0/24"
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(cert.Version2, ca, caKey, "spooky", "10.128.0.2/24", netip.MustParseAddrPort("10.64.0.2:4242"), unsafePrefix, nil)
-	route := m{"route": unsafePrefix, "via": theirVpnIpNet[0].Addr().String()}
-	myCfg := m{
-		"tun": m{
-			"unsafe_routes": []m{route},
-		},
-	}
-	myControl, myVpnIpNet, myUdpAddr, myConfig := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24", myCfg)
-	t.Logf("my config %v", myConfig)
-	// Put their info in our lighthouse
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-
-	spookyDest := netip.MustParseAddr("192.168.6.4")
-
-	// Start the servers
-	myControl.Start()
-	theirControl.Start()
-
-	t.Log("Send a udp packet through to begin standing up the tunnel, this should come out the other side")
-	myControl.InjectTunUDPPacket(spookyDest, 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me"))
-
-	t.Log("Have them consume my stage 0 packet. They have a tunnel now")
-	theirControl.InjectUDPPacket(myControl.GetFromUDP(true))
-
-	t.Log("Get their stage 1 packet so that we can play with it")
-	stage1Packet := theirControl.GetFromUDP(true)
-
-	t.Log("I consume a garbage packet with a proper nebula header for our tunnel")
-	// this should log a statement and get ignored, allowing the real handshake packet to complete the tunnel
-	badPacket := stage1Packet.Copy()
-	badPacket.Data = badPacket.Data[:len(badPacket.Data)-header.Len]
-	myControl.InjectUDPPacket(badPacket)
-
-	t.Log("Have me consume their real stage 1 packet. I have a tunnel now")
-	myControl.InjectUDPPacket(stage1Packet)
-
-	t.Log("Wait until we see my cached packet come through")
-	myControl.WaitForType(1, 0, theirControl)
-
-	t.Log("Make sure our host infos are correct")
-	assertHostInfoPair(t, myUdpAddr, theirUdpAddr, myVpnIpNet, theirVpnIpNet, myControl, theirControl)
-
-	t.Log("Get that cached packet and make sure it looks right")
-	myCachedPacket := theirControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi from me"), myCachedPacket, myVpnIpNet[0].Addr(), spookyDest, 80, 80)
-
-	//reply
-	theirControl.InjectTunUDPPacket(myVpnIpNet[0].Addr(), 80, spookyDest, 80, []byte("Hi from the spookyman"))
-	//wait for reply
-	theirControl.WaitForType(1, 0, myControl)
-	theirCachedPacket := myControl.GetFromTun(true)
-	assertUdpPacket(t, []byte("Hi from the spookyman"), theirCachedPacket, spookyDest, myVpnIpNet[0].Addr(), 80, 80)
-
-	t.Log("Do a bidirectional tunnel test")
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-
-	r.RenderHostmaps("Final hostmaps", myControl, theirControl)
-	myControl.Stop()
-	theirControl.Stop()
-}

e2e/helpers_test.go

@@ -22,14 +22,15 @@ import (
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/e2e/router"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
-	"go.yaml.in/yaml/v3"
 )
 
 type m = map[string]any
 
 // newSimpleServer creates a nebula instance with many assumptions
 func newSimpleServer(v cert.Version, caCrt cert.Certificate, caKey []byte, name string, sVpnNetworks string, overrides m) (*nebula.Control, []netip.Prefix, netip.AddrPort, *config.C) {
+	l := NewTestLogger()
+
 	var vpnNetworks []netip.Prefix
 	for _, sn := range strings.Split(sVpnNetworks, ",") {
 		vpnIpNet, err := netip.ParsePrefix(strings.TrimSpace(sn))
@@ -55,54 +56,7 @@ func newSimpleServer(v cert.Version, caCrt cert.Certificate, caKey []byte, name
 		budpIp[3] = 239
 		udpAddr = netip.AddrPortFrom(netip.AddrFrom16(budpIp), 4242)
 	}
-	return newSimpleServerWithUdp(v, caCrt, caKey, name, sVpnNetworks, udpAddr, overrides)
+	_, _, myPrivKey, myPEM := cert_test.NewTestCert(v, cert.Curve_CURVE25519, caCrt, caKey, name, time.Now(), time.Now().Add(5*time.Minute), vpnNetworks, nil, []string{})
-}
-
-func newSimpleServerWithUdp(v cert.Version, caCrt cert.Certificate, caKey []byte, name string, sVpnNetworks string, udpAddr netip.AddrPort, overrides m) (*nebula.Control, []netip.Prefix, netip.AddrPort, *config.C) {
-	return newSimpleServerWithUdpAndUnsafeNetworks(v, caCrt, caKey, name, sVpnNetworks, udpAddr, "", overrides)
-}
-
-func newSimpleServerWithUdpAndUnsafeNetworks(v cert.Version, caCrt cert.Certificate, caKey []byte, name string, sVpnNetworks string, udpAddr netip.AddrPort, sUnsafeNetworks string, overrides m) (*nebula.Control, []netip.Prefix, netip.AddrPort, *config.C) {
-	l := NewTestLogger()
-
-	var vpnNetworks []netip.Prefix
-	for _, sn := range strings.Split(sVpnNetworks, ",") {
-		vpnIpNet, err := netip.ParsePrefix(strings.TrimSpace(sn))
-		if err != nil {
-			panic(err)
-		}
-		vpnNetworks = append(vpnNetworks, vpnIpNet)
-	}
-
-	if len(vpnNetworks) == 0 {
-		panic("no vpn networks")
-	}
-
-	firewallInbound := []m{{
-		"proto": "any",
-		"port":  "any",
-		"host":  "any",
-	}}
-
-	var unsafeNetworks []netip.Prefix
-	if sUnsafeNetworks != "" {
-		firewallInbound = []m{{
-			"proto":      "any",
-			"port":       "any",
-			"host":       "any",
-			"local_cidr": "0.0.0.0/0",
-		}}
-
-		for _, sn := range strings.Split(sUnsafeNetworks, ",") {
-			x, err := netip.ParsePrefix(strings.TrimSpace(sn))
-			if err != nil {
-				panic(err)
-			}
-			unsafeNetworks = append(unsafeNetworks, x)
-		}
-	}
-
-	_, _, myPrivKey, myPEM := cert_test.NewTestCert(v, cert.Curve_CURVE25519, caCrt, caKey, name, time.Now(), time.Now().Add(5*time.Minute), vpnNetworks, unsafeNetworks, []string{})
 
 	caB, err := caCrt.MarshalPEM()
 	if err != nil {
@@ -122,7 +76,11 @@ func newSimpleServerWithUdpAndUnsafeNetworks(v cert.Version, caCrt cert.Certific
 				"port":  "any",
 				"host":  "any",
 			}},
-			"inbound": firewallInbound,
+			"inbound": []m{{
+				"proto": "any",
+				"port":  "any",
+				"host":  "any",
+			}},
 		},
 		//"handshakes": m{
 		//	"try_interval": "1s",
@@ -171,109 +129,6 @@ func newSimpleServerWithUdpAndUnsafeNetworks(v cert.Version, caCrt cert.Certific
 	return control, vpnNetworks, udpAddr, c
 }
 
-// newServer creates a nebula instance with fewer assumptions
-func newServer(caCrt []cert.Certificate, certs []cert.Certificate, key []byte, overrides m) (*nebula.Control, []netip.Prefix, netip.AddrPort, *config.C) {
-	l := NewTestLogger()
-
-	vpnNetworks := certs[len(certs)-1].Networks()
-
-	var udpAddr netip.AddrPort
-	if vpnNetworks[0].Addr().Is4() {
-		budpIp := vpnNetworks[0].Addr().As4()
-		budpIp[1] -= 128
-		udpAddr = netip.AddrPortFrom(netip.AddrFrom4(budpIp), 4242)
-	} else {
-		budpIp := vpnNetworks[0].Addr().As16()
-		// beef for funsies
-		budpIp[2] = 190
-		budpIp[3] = 239
-		udpAddr = netip.AddrPortFrom(netip.AddrFrom16(budpIp), 4242)
-	}
-
-	caStr := ""
-	for _, ca := range caCrt {
-		x, err := ca.MarshalPEM()
-		if err != nil {
-			panic(err)
-		}
-		caStr += string(x)
-	}
-	certStr := ""
-	for _, c := range certs {
-		x, err := c.MarshalPEM()
-		if err != nil {
-			panic(err)
-		}
-		certStr += string(x)
-	}
-
-	mc := m{
-		"pki": m{
-			"ca":   caStr,
-			"cert": certStr,
-			"key":  string(key),
-		},
-		//"tun": m{"disabled": true},
-		"firewall": m{
-			"outbound": []m{{
-				"proto": "any",
-				"port":  "any",
-				"host":  "any",
-			}},
-			"inbound": []m{{
-				"proto": "any",
-				"port":  "any",
-				"host":  "any",
-			}},
-		},
-		//"handshakes": m{
-		//	"try_interval": "1s",
-		//},
-		"listen": m{
-			"host": udpAddr.Addr().String(),
-			"port": udpAddr.Port(),
-		},
-		"logging": m{
-			"timestamp_format": fmt.Sprintf("%v 15:04:05.000000", certs[0].Name()),
-			"level":            l.Level.String(),
-		},
-		"timers": m{
-			"pending_deletion_interval": 2,
-			"connection_alive_interval": 2,
-		},
-	}
-
-	if overrides != nil {
-		final := m{}
-		err := mergo.Merge(&final, overrides, mergo.WithAppendSlice)
-		if err != nil {
-			panic(err)
-		}
-		err = mergo.Merge(&final, mc, mergo.WithAppendSlice)
-		if err != nil {
-			panic(err)
-		}
-		mc = final
-	}
-
-	cb, err := yaml.Marshal(mc)
-	if err != nil {
-		panic(err)
-	}
-
-	c := config.NewC(l)
-	cStr := string(cb)
-	c.LoadString(cStr)
-
-	control, err := nebula.Main(c, false, "e2e-test", l, nil)
-
-	if err != nil {
-		panic(err)
-	}
-
-	return control, vpnNetworks, udpAddr, c
-}
-
 type doneCb func()
 
 func deadline(t *testing.T, seconds time.Duration) doneCb {
@@ -292,7 +147,7 @@ func deadline(t *testing.T, seconds time.Duration) doneCb {
 	}
 }
 
-func assertTunnel(t testing.TB, vpnIpA, vpnIpB netip.Addr, controlA, controlB *nebula.Control, r *router.R) {
+func assertTunnel(t *testing.T, vpnIpA, vpnIpB netip.Addr, controlA, controlB *nebula.Control, r *router.R) {
 	// Send a packet from them to me
 	controlB.InjectTunUDPPacket(vpnIpA, 80, vpnIpB, 90, []byte("Hi from B"))
 	bPacket := r.RouteForAllUntilTxTun(controlA)
@@ -304,14 +159,14 @@ func assertTunnel(t testing.TB, vpnIpA, vpnIpB netip.Addr, controlA, controlB *n
 	assertUdpPacket(t, []byte("Hello from A"), aPacket, vpnIpA, vpnIpB, 90, 80)
 }
 
-func assertHostInfoPair(t testing.TB, addrA, addrB netip.AddrPort, vpnNetsA, vpnNetsB []netip.Prefix, controlA, controlB *nebula.Control) {
+func assertHostInfoPair(t *testing.T, addrA, addrB netip.AddrPort, vpnNetsA, vpnNetsB []netip.Prefix, controlA, controlB *nebula.Control) {
 	// Get both host infos
 	//TODO: CERT-V2 we may want to loop over each vpnAddr and assert all the things
 	hBinA := controlA.GetHostInfoByVpnAddr(vpnNetsB[0].Addr(), false)
-	require.NotNil(t, hBinA, "Host B was not found by vpnAddr in controlA")
+	assert.NotNil(t, hBinA, "Host B was not found by vpnAddr in controlA")
 
 	hAinB := controlB.GetHostInfoByVpnAddr(vpnNetsA[0].Addr(), false)
-	require.NotNil(t, hAinB, "Host A was not found by vpnAddr in controlB")
+	assert.NotNil(t, hAinB, "Host A was not found by vpnAddr in controlB")
 
 	// Check that both vpn and real addr are correct
 	assert.EqualValues(t, getAddrs(vpnNetsB), hBinA.VpnAddrs, "Host B VpnIp is wrong in control A")
@@ -325,7 +180,7 @@ func assertHostInfoPair(t testing.TB, addrA, addrB netip.AddrPort, vpnNetsA, vpn
 	assert.Equal(t, hBinA.RemoteIndex, hAinB.LocalIndex, "Host B remote index does not match host A local index")
 }
 
-func assertUdpPacket(t testing.TB, expected, b []byte, fromIp, toIp netip.Addr, fromPort, toPort uint16) {
+func assertUdpPacket(t *testing.T, expected, b []byte, fromIp, toIp netip.Addr, fromPort, toPort uint16) {
 	if toIp.Is6() {
 		assertUdpPacket6(t, expected, b, fromIp, toIp, fromPort, toPort)
 	} else {
@@ -333,7 +188,7 @@ func assertUdpPacket(t testing.TB, expected, b []byte, fromIp, toIp netip.Addr,
 	}
 }
 
-func assertUdpPacket6(t testing.TB, expected, b []byte, fromIp, toIp netip.Addr, fromPort, toPort uint16) {
+func assertUdpPacket6(t *testing.T, expected, b []byte, fromIp, toIp netip.Addr, fromPort, toPort uint16) {
 	packet := gopacket.NewPacket(b, layers.LayerTypeIPv6, gopacket.Lazy)
 	v6 := packet.Layer(layers.LayerTypeIPv6).(*layers.IPv6)
 	assert.NotNil(t, v6, "No ipv6 data found")
@@ -352,7 +207,7 @@ func assertUdpPacket6(t testing.TB, expected, b []byte, fromIp, toIp netip.Addr,
 	assert.Equal(t, expected, data.Payload(), "Data was incorrect")
 }
 
-func assertUdpPacket4(t testing.TB, expected, b []byte, fromIp, toIp netip.Addr, fromPort, toPort uint16) {
+func assertUdpPacket4(t *testing.T, expected, b []byte, fromIp, toIp netip.Addr, fromPort, toPort uint16) {
 	packet := gopacket.NewPacket(b, layers.LayerTypeIPv4, gopacket.Lazy)
 	v4 := packet.Layer(layers.LayerTypeIPv4).(*layers.IPv4)
 	assert.NotNil(t, v4, "No ipv4 data found")

e2e/snat_test.go

@@ -1,400 +0,0 @@
-//go:build e2e_testing
-// +build e2e_testing
-
-package e2e
-
-import (
-	"encoding/binary"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/e2e/router"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// parseIPv4UDPPacket extracts source/dest IPs, ports, and payload from an IPv4 UDP packet.
-func parseIPv4UDPPacket(t testing.TB, pkt []byte) (srcIP, dstIP netip.Addr, srcPort, dstPort uint16, payload []byte) {
-	t.Helper()
-	require.True(t, len(pkt) >= 28, "packet too short for IPv4+UDP header")
-	require.Equal(t, byte(0x45), pkt[0]&0xF0|pkt[0]&0x0F, "not a simple IPv4 packet (IHL!=5)")
-
-	srcIP, _ = netip.AddrFromSlice(pkt[12:16])
-	dstIP, _ = netip.AddrFromSlice(pkt[16:20])
-
-	ihl := int(pkt[0]&0x0F) * 4
-	require.True(t, len(pkt) >= ihl+8, "packet too short for UDP header")
-	srcPort = binary.BigEndian.Uint16(pkt[ihl : ihl+2])
-	dstPort = binary.BigEndian.Uint16(pkt[ihl+2 : ihl+4])
-	udpLen := binary.BigEndian.Uint16(pkt[ihl+4 : ihl+6])
-	payload = pkt[ihl+8 : ihl+int(udpLen)]
-	return
-}
-
-func TestSNAT_IPv6OnlyPeer_IPv4UnsafeTraffic(t *testing.T) {
-	// Scenario: Two IPv6-only VPN nodes. The "router" node has unsafe networks
-	// (192.168.0.0/16) in its cert and a configured SNAT address. The "sender"
-	// node has an unsafe route for 192.168.0.0/16 via the router.
-	//
-	// When sender injects an IPv4 packet destined for the unsafe network, it
-	// gets tunneled to the router. The router's firewall detects this is IPv4
-	// from an IPv6-only peer and applies SNAT, rewriting the source IP to the
-	// SNAT address before delivering it to TUN.
-	//
-	// When a reply comes back from TUN addressed to the SNAT address, the
-	// router un-SNATs it (restoring the original destination) and tunnels it
-	// back to the sender.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	unsafePrefix := "192.168.0.0/16"
-	snatAddr := netip.MustParseAddr("169.254.42.42")
-
-	// Router: IPv6-only with unsafe networks and a manual SNAT address.
-	// Override inbound firewall with local_cidr: "any" so both IPv4 (unsafe)
-	// and IPv6 (VPN) traffic is accepted.
-	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
-		cert.Version2, ca, caKey, "router", "ff::1/64",
-		netip.MustParseAddrPort("[beef::1]:4242"),
-		unsafePrefix,
-		m{
-			"firewall": m{
-				"inbound": []m{{
-					"proto":      "any",
-					"port":       "any",
-					"host":       "any",
-					"local_cidr": "any",
-				}},
-			},
-			"tun": m{
-				"snat_address_for_4over6": snatAddr.String(),
-			},
-		},
-	)
-
-	// Sender: IPv6-only with an unsafe route via the router
-	senderControl, _, _, _ := newSimpleServerWithUdp(
-		cert.Version2, ca, caKey, "sender", "ff::2/64",
-		netip.MustParseAddrPort("[beef::2]:4242"),
-		m{
-			"tun": m{
-				"unsafe_routes": []m{
-					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
-				},
-			},
-		},
-	)
-
-	// Tell sender where the router lives
-	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
-
-	// Build the router and start both nodes
-	r := router.NewR(t, routerControl, senderControl)
-	defer r.RenderFlow()
-
-	routerControl.Start()
-	senderControl.Start()
-
-	// --- Outbound: sender -> IPv4 unsafe dest (via router with SNAT) ---
-
-	origSrcIP := netip.MustParseAddr("10.0.0.1")
-	unsafeDest := netip.MustParseAddr("192.168.1.1")
-	var origSrcPort uint16 = 12345
-	var dstPort uint16 = 80
-
-	t.Log("Sender injects an IPv4 packet to the unsafe network")
-	senderControl.InjectTunUDPPacket(unsafeDest, dstPort, origSrcIP, origSrcPort, []byte("snat me"))
-
-	t.Log("Route packets (handshake + data) until the router gets the packet on TUN")
-	snatPkt := r.RouteForAllUntilTxTun(routerControl)
-
-	t.Log("Verify the packet was SNATted")
-	gotSrcIP, gotDstIP, gotSrcPort, gotDstPort, gotPayload := parseIPv4UDPPacket(t, snatPkt)
-	assert.Equal(t, snatAddr, gotSrcIP, "source IP should be rewritten to the SNAT address")
-	assert.Equal(t, unsafeDest, gotDstIP, "destination IP should be unchanged")
-	assert.Equal(t, dstPort, gotDstPort, "destination port should be unchanged")
-	assert.Equal(t, []byte("snat me"), gotPayload, "payload should be unchanged")
-
-	// Capture the SNAT port (may differ from original if port was remapped)
-	snatPort := gotSrcPort
-	t.Logf("SNAT port: %d (original: %d)", snatPort, origSrcPort)
-
-	// --- Return: reply from unsafe dest -> un-SNATted back to sender ---
-
-	t.Log("Router injects a reply packet from the unsafe dest to the SNAT address")
-	routerControl.InjectTunUDPPacket(snatAddr, snatPort, unsafeDest, dstPort, []byte("reply from unsafe"))
-
-	t.Log("Route until sender gets the reply on TUN")
-	replyPkt := r.RouteForAllUntilTxTun(senderControl)
-
-	t.Log("Verify the reply was un-SNATted")
-	replySrcIP, replyDstIP, replySrcPort, replyDstPort, replyPayload := parseIPv4UDPPacket(t, replyPkt)
-	assert.Equal(t, unsafeDest, replySrcIP, "reply source should be the unsafe dest")
-	assert.Equal(t, origSrcIP, replyDstIP, "reply dest should be the original source IP (un-SNATted)")
-	assert.Equal(t, dstPort, replySrcPort, "reply source port should be the unsafe dest port")
-	assert.Equal(t, origSrcPort, replyDstPort, "reply dest port should be the original source port (un-SNATted)")
-	assert.Equal(t, []byte("reply from unsafe"), replyPayload, "payload should be unchanged")
-
-	r.RenderHostmaps("Final hostmaps", routerControl, senderControl)
-
-	// Also verify normal IPv6 VPN traffic still works between the nodes
-	t.Log("Verify normal IPv6 VPN tunnel still works")
-	assertTunnel(t, routerVpnIpNet[0].Addr(), senderControl.GetVpnAddrs()[0], routerControl, senderControl, r)
-
-	routerControl.Stop()
-	senderControl.Stop()
-}
-
-func TestSNAT_MultipleFlows(t *testing.T) {
-	// Test that multiple distinct IPv4 flows from the same IPv6-only peer
-	// are tracked independently through SNAT.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	unsafePrefix := "192.168.0.0/16"
-	snatAddr := netip.MustParseAddr("169.254.42.42")
-
-	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
-		cert.Version2, ca, caKey, "router", "ff::1/64",
-		netip.MustParseAddrPort("[beef::1]:4242"),
-		unsafePrefix,
-		m{
-			"firewall": m{
-				"inbound": []m{{
-					"proto":      "any",
-					"port":       "any",
-					"host":       "any",
-					"local_cidr": "any",
-				}},
-			},
-			"tun": m{
-				"snat_address_for_4over6": snatAddr.String(),
-			},
-		},
-	)
-
-	senderControl, _, _, _ := newSimpleServerWithUdp(
-		cert.Version2, ca, caKey, "sender", "ff::2/64",
-		netip.MustParseAddrPort("[beef::2]:4242"),
-		m{
-			"tun": m{
-				"unsafe_routes": []m{
-					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
-				},
-			},
-		},
-	)
-
-	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
-
-	r := router.NewR(t, routerControl, senderControl)
-	defer r.RenderFlow()
-	r.CancelFlowLogs()
-
-	routerControl.Start()
-	senderControl.Start()
-
-	unsafeDest := netip.MustParseAddr("192.168.1.1")
-
-	// Send first flow
-	senderControl.InjectTunUDPPacket(unsafeDest, 80, netip.MustParseAddr("10.0.0.1"), 1111, []byte("flow1"))
-	pkt1 := r.RouteForAllUntilTxTun(routerControl)
-	srcIP1, _, srcPort1, _, payload1 := parseIPv4UDPPacket(t, pkt1)
-	assert.Equal(t, snatAddr, srcIP1)
-	assert.Equal(t, []byte("flow1"), payload1)
-
-	// Send second flow (different source port)
-	senderControl.InjectTunUDPPacket(unsafeDest, 80, netip.MustParseAddr("10.0.0.1"), 2222, []byte("flow2"))
-	pkt2 := r.RouteForAllUntilTxTun(routerControl)
-	srcIP2, _, srcPort2, _, payload2 := parseIPv4UDPPacket(t, pkt2)
-	assert.Equal(t, snatAddr, srcIP2)
-	assert.Equal(t, []byte("flow2"), payload2)
-
-	// The two flows should have different SNAT ports (since they're different conntracks)
-	t.Logf("Flow 1 SNAT port: %d, Flow 2 SNAT port: %d", srcPort1, srcPort2)
-
-	// Reply to flow 2 first (out of order)
-	routerControl.InjectTunUDPPacket(snatAddr, srcPort2, unsafeDest, 80, []byte("reply2"))
-	reply2 := r.RouteForAllUntilTxTun(senderControl)
-	_, replyDst2, _, replyDstPort2, replyPayload2 := parseIPv4UDPPacket(t, reply2)
-	assert.Equal(t, netip.MustParseAddr("10.0.0.1"), replyDst2)
-	assert.Equal(t, uint16(2222), replyDstPort2, "reply to flow 2 should restore original port 2222")
-	assert.Equal(t, []byte("reply2"), replyPayload2)
-
-	// Reply to flow 1
-	routerControl.InjectTunUDPPacket(snatAddr, srcPort1, unsafeDest, 80, []byte("reply1"))
-	reply1 := r.RouteForAllUntilTxTun(senderControl)
-	_, replyDst1, _, replyDstPort1, replyPayload1 := parseIPv4UDPPacket(t, reply1)
-	assert.Equal(t, netip.MustParseAddr("10.0.0.1"), replyDst1)
-	assert.Equal(t, uint16(1111), replyDstPort1, "reply to flow 1 should restore original port 1111")
-	assert.Equal(t, []byte("reply1"), replyPayload1)
-
-	routerControl.Stop()
-	senderControl.Stop()
-}
-
-// --- Adversarial SNAT E2E Tests ---
-
-func TestSNAT_UnsolicitedReplyDropped(t *testing.T) {
-	// Without any outbound SNAT traffic, inject a packet from the router's TUN
-	// addressed to the SNAT address. The sender must never receive it because
-	// there's no conntrack entry to un-SNAT through.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	unsafePrefix := "192.168.0.0/16"
-	snatAddr := netip.MustParseAddr("169.254.42.42")
-
-	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
-		cert.Version2, ca, caKey, "router", "ff::1/64",
-		netip.MustParseAddrPort("[beef::1]:4242"),
-		unsafePrefix,
-		m{
-			"firewall": m{
-				"inbound": []m{{
-					"proto":      "any",
-					"port":       "any",
-					"host":       "any",
-					"local_cidr": "any",
-				}},
-			},
-			"tun": m{
-				"snat_address_for_4over6": snatAddr.String(),
-			},
-		},
-	)
-
-	senderControl, _, _, _ := newSimpleServerWithUdp(
-		cert.Version2, ca, caKey, "sender", "ff::2/64",
-		netip.MustParseAddrPort("[beef::2]:4242"),
-		m{
-			"tun": m{
-				"unsafe_routes": []m{
-					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
-				},
-			},
-		},
-	)
-
-	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
-
-	r := router.NewR(t, routerControl, senderControl)
-	defer r.RenderFlow()
-	r.CancelFlowLogs()
-
-	routerControl.Start()
-	senderControl.Start()
-
-	// First establish the tunnel with normal IPv6 traffic so handshake completes
-	assertTunnel(t, routerVpnIpNet[0].Addr(), senderControl.GetVpnAddrs()[0], routerControl, senderControl, r)
-
-	// Inject the unsolicited reply from router's TUN to the SNAT address.
-	// There is NO prior outbound SNAT flow, so no conntrack entry exists.
-	// The router should silently drop this because unSnat finds no matching conntrack.
-	routerControl.InjectTunUDPPacket(snatAddr, 55555, netip.MustParseAddr("192.168.1.1"), 80, []byte("unsolicited"))
-
-	// Send a canary IPv6 VPN packet after the bad one. Since the router processes
-	// TUN packets sequentially, the canary arriving proves the bad packet was processed first.
-	senderVpnAddr := senderControl.GetVpnAddrs()[0]
-	routerControl.InjectTunUDPPacket(senderVpnAddr, 90, routerVpnIpNet[0].Addr(), 80, []byte("canary"))
-	canaryPkt := r.RouteForAllUntilTxTun(senderControl)
-	assertUdpPacket(t, []byte("canary"), canaryPkt, routerVpnIpNet[0].Addr(), senderVpnAddr, 80, 90)
-
-	// The unsolicited packet should have been dropped — nothing else on sender's TUN
-	got := senderControl.GetFromTun(false)
-	assert.Nil(t, got, "sender should not receive unsolicited packet to SNAT address with no conntrack entry")
-
-	routerControl.Stop()
-	senderControl.Stop()
-}
-
-func TestSNAT_NonUnsafeDestDropped(t *testing.T) {
-	// An IPv6-only sender sends IPv4 traffic to a destination outside the router's
-	// unsafe networks (172.16.0.1 when unsafe is 192.168.0.0/16). The router should
-	// reject this because the local address is not routable. This verifies that
-	// willingToHandleLocalAddr enforces boundaries on what SNAT traffic can reach.
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	unsafePrefix := "192.168.0.0/16"
-	snatAddr := netip.MustParseAddr("169.254.42.42")
-
-	routerControl, routerVpnIpNet, routerUdpAddr, _ := newSimpleServerWithUdpAndUnsafeNetworks(
-		cert.Version2, ca, caKey, "router", "ff::1/64",
-		netip.MustParseAddrPort("[beef::1]:4242"),
-		unsafePrefix,
-		m{
-			"firewall": m{
-				"inbound": []m{{
-					"proto":      "any",
-					"port":       "any",
-					"host":       "any",
-					"local_cidr": "any",
-				}},
-			},
-			"tun": m{
-				"snat_address_for_4over6": snatAddr.String(),
-			},
-		},
-	)
-
-	// Sender has unsafe routes for BOTH 192.168.0.0/16 AND 172.16.0.0/12 via router.
-	// This means the sender will route 172.16.0.1 through the tunnel to the router.
-	// But the router should reject it because 172.16.0.0/12 is NOT in its unsafe networks.
-	senderControl, _, _, _ := newSimpleServerWithUdp(
-		cert.Version2, ca, caKey, "sender", "ff::2/64",
-		netip.MustParseAddrPort("[beef::2]:4242"),
-		m{
-			"tun": m{
-				"unsafe_routes": []m{
-					{"route": unsafePrefix, "via": routerVpnIpNet[0].Addr().String()},
-					{"route": "172.16.0.0/12", "via": routerVpnIpNet[0].Addr().String()},
-				},
-			},
-		},
-	)
-
-	senderControl.InjectLightHouseAddr(routerVpnIpNet[0].Addr(), routerUdpAddr)
-
-	r := router.NewR(t, routerControl, senderControl)
-	defer r.RenderFlow()
-	r.CancelFlowLogs()
-
-	routerControl.Start()
-	senderControl.Start()
-
-	// Establish the tunnel first
-	assertTunnel(t, routerVpnIpNet[0].Addr(), senderControl.GetVpnAddrs()[0], routerControl, senderControl, r)
-
-	// Send to 172.16.0.1 (NOT in router's unsafe networks 192.168.0.0/16).
-	// The router should reject this at willingToHandleLocalAddr.
-	senderControl.InjectTunUDPPacket(
-		netip.MustParseAddr("172.16.0.1"), 80,
-		netip.MustParseAddr("10.0.0.1"), 12345,
-		[]byte("wrong dest"),
-	)
-
-	// Send a canary to a valid unsafe destination to prove the bad packet was processed
-	senderControl.InjectTunUDPPacket(
-		netip.MustParseAddr("192.168.1.1"), 80,
-		netip.MustParseAddr("10.0.0.1"), 33333,
-		[]byte("canary"),
-	)
-
-	// Route until the canary arrives — the 172.16.0.1 packet should have been
-	// processed and dropped before the canary gets through
-	canaryPkt := r.RouteForAllUntilTxTun(routerControl)
-	_, canaryDst, _, _, canaryPayload := parseIPv4UDPPacket(t, canaryPkt)
-	assert.Equal(t, netip.MustParseAddr("192.168.1.1"), canaryDst, "canary should arrive at the valid unsafe dest")
-	assert.Equal(t, []byte("canary"), canaryPayload)
-
-	// No more packets — the 172.16.0.1 packet was dropped
-	got := routerControl.GetFromTun(false)
-	assert.Nil(t, got, "packet to non-unsafe destination 172.16.0.1 should be dropped by the router")
-
-	routerControl.Stop()
-	senderControl.Stop()
-}

e2e/tunnels_test.go

@@ -4,16 +4,12 @@
 package e2e
 
 import (
-	"fmt"
-	"net/netip"
 	"testing"
 	"time"
 
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/e2e/router"
-	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
 )
 
 func TestDropInactiveTunnels(t *testing.T) {
@@ -59,309 +55,3 @@ func TestDropInactiveTunnels(t *testing.T) {
 	myControl.Stop()
 	theirControl.Stop()
 }
-
-func TestCertUpgrade(t *testing.T) {
-	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
-	// under ideal conditions
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	caB, err := ca.MarshalPEM()
-	if err != nil {
-		panic(err)
-	}
-	ca2, _, caKey2, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	ca2B, err := ca2.MarshalPEM()
-	if err != nil {
-		panic(err)
-	}
-	caStr := fmt.Sprintf("%s\n%s", caB, ca2B)
-
-	myCert, _, myPrivKey, _ := cert_test.NewTestCert(cert.Version1, cert.Curve_CURVE25519, ca, caKey, "me", time.Now(), time.Now().Add(5*time.Minute), []netip.Prefix{netip.MustParsePrefix("10.128.0.1/24")}, nil, []string{})
-	_, myCert2Pem := cert_test.NewTestCertDifferentVersion(myCert, cert.Version2, ca2, caKey2)
-
-	theirCert, _, theirPrivKey, _ := cert_test.NewTestCert(cert.Version1, cert.Curve_CURVE25519, ca, caKey, "them", time.Now(), time.Now().Add(5*time.Minute), []netip.Prefix{netip.MustParsePrefix("10.128.0.2/24")}, nil, []string{})
-	theirCert2, _ := cert_test.NewTestCertDifferentVersion(theirCert, cert.Version2, ca2, caKey2)
-
-	myControl, myVpnIpNet, myUdpAddr, myC := newServer([]cert.Certificate{ca, ca2}, []cert.Certificate{myCert}, myPrivKey, m{})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newServer([]cert.Certificate{ca, ca2}, []cert.Certificate{theirCert, theirCert2}, theirPrivKey, m{})
-
-	// Share our underlay information
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	// Start the servers
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	r.Log("Assert the tunnel between me and them works")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-	r.Log("yay")
-	//todo ???
-	time.Sleep(1 * time.Second)
-	r.FlushAll()
-
-	mc := m{
-		"pki": m{
-			"ca":   caStr,
-			"cert": string(myCert2Pem),
-			"key":  string(myPrivKey),
-		},
-		//"tun": m{"disabled": true},
-		"firewall": myC.Settings["firewall"],
-		//"handshakes": m{
-		//	"try_interval": "1s",
-		//},
-		"listen":  myC.Settings["listen"],
-		"logging": myC.Settings["logging"],
-		"timers":  myC.Settings["timers"],
-	}
-
-	cb, err := yaml.Marshal(mc)
-	if err != nil {
-		panic(err)
-	}
-
-	r.Logf("reload new v2-only config")
-	err = myC.ReloadConfigString(string(cb))
-	assert.NoError(t, err)
-	r.Log("yay, spin until their sees it")
-	waitStart := time.Now()
-	for {
-		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-		c := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-		if c == nil {
-			r.Log("nil")
-		} else {
-			version := c.Cert.Version()
-			r.Logf("version %d", version)
-			if version == cert.Version2 {
-				break
-			}
-		}
-		since := time.Since(waitStart)
-		if since > time.Second*10 {
-			t.Fatal("Cert should be new by now")
-		}
-		time.Sleep(time.Second)
-	}
-
-	r.RenderHostmaps("Final hostmaps", myControl, theirControl)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestCertDowngrade(t *testing.T) {
-	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
-	// under ideal conditions
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	caB, err := ca.MarshalPEM()
-	if err != nil {
-		panic(err)
-	}
-	ca2, _, caKey2, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	ca2B, err := ca2.MarshalPEM()
-	if err != nil {
-		panic(err)
-	}
-	caStr := fmt.Sprintf("%s\n%s", caB, ca2B)
-
-	myCert, _, myPrivKey, myCertPem := cert_test.NewTestCert(cert.Version1, cert.Curve_CURVE25519, ca, caKey, "me", time.Now(), time.Now().Add(5*time.Minute), []netip.Prefix{netip.MustParsePrefix("10.128.0.1/24")}, nil, []string{})
-	myCert2, _ := cert_test.NewTestCertDifferentVersion(myCert, cert.Version2, ca2, caKey2)
-
-	theirCert, _, theirPrivKey, _ := cert_test.NewTestCert(cert.Version1, cert.Curve_CURVE25519, ca, caKey, "them", time.Now(), time.Now().Add(5*time.Minute), []netip.Prefix{netip.MustParsePrefix("10.128.0.2/24")}, nil, []string{})
-	theirCert2, _ := cert_test.NewTestCertDifferentVersion(theirCert, cert.Version2, ca2, caKey2)
-
-	myControl, myVpnIpNet, myUdpAddr, myC := newServer([]cert.Certificate{ca, ca2}, []cert.Certificate{myCert2}, myPrivKey, m{})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newServer([]cert.Certificate{ca, ca2}, []cert.Certificate{theirCert, theirCert2}, theirPrivKey, m{})
-
-	// Share our underlay information
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	// Start the servers
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	r.Log("Assert the tunnel between me and them works")
-	//assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
-	//r.Log("yay")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-	r.Log("yay")
-	//todo ???
-	time.Sleep(1 * time.Second)
-	r.FlushAll()
-
-	mc := m{
-		"pki": m{
-			"ca":   caStr,
-			"cert": string(myCertPem),
-			"key":  string(myPrivKey),
-		},
-		"firewall": myC.Settings["firewall"],
-		"listen":   myC.Settings["listen"],
-		"logging":  myC.Settings["logging"],
-		"timers":   myC.Settings["timers"],
-	}
-
-	cb, err := yaml.Marshal(mc)
-	if err != nil {
-		panic(err)
-	}
-
-	r.Logf("reload new v1-only config")
-	err = myC.ReloadConfigString(string(cb))
-	assert.NoError(t, err)
-	r.Log("yay, spin until their sees it")
-	waitStart := time.Now()
-	for {
-		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-		c := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-		c2 := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-		if c == nil || c2 == nil {
-			r.Log("nil")
-		} else {
-			version := c.Cert.Version()
-			theirVersion := c2.Cert.Version()
-			r.Logf("version %d,%d", version, theirVersion)
-			if version == cert.Version1 {
-				break
-			}
-		}
-		since := time.Since(waitStart)
-		if since > time.Second*5 {
-			r.Log("it is unusual that the cert is not new yet, but not a failure yet")
-		}
-		if since > time.Second*10 {
-			r.Log("wtf")
-			t.Fatal("Cert should be new by now")
-		}
-		time.Sleep(time.Second)
-	}
-
-	r.RenderHostmaps("Final hostmaps", myControl, theirControl)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestCertMismatchCorrection(t *testing.T) {
-	// The goal of this test is to ensure the shortest inactivity timeout will close the tunnel on both sides
-	// under ideal conditions
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version1, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	ca2, _, caKey2, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-
-	myCert, _, myPrivKey, _ := cert_test.NewTestCert(cert.Version1, cert.Curve_CURVE25519, ca, caKey, "me", time.Now(), time.Now().Add(5*time.Minute), []netip.Prefix{netip.MustParsePrefix("10.128.0.1/24")}, nil, []string{})
-	myCert2, _ := cert_test.NewTestCertDifferentVersion(myCert, cert.Version2, ca2, caKey2)
-
-	theirCert, _, theirPrivKey, _ := cert_test.NewTestCert(cert.Version1, cert.Curve_CURVE25519, ca, caKey, "them", time.Now(), time.Now().Add(5*time.Minute), []netip.Prefix{netip.MustParsePrefix("10.128.0.2/24")}, nil, []string{})
-	theirCert2, _ := cert_test.NewTestCertDifferentVersion(theirCert, cert.Version2, ca2, caKey2)
-
-	myControl, myVpnIpNet, myUdpAddr, _ := newServer([]cert.Certificate{ca, ca2}, []cert.Certificate{myCert2}, myPrivKey, m{})
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newServer([]cert.Certificate{ca, ca2}, []cert.Certificate{theirCert, theirCert2}, theirPrivKey, m{})
-
-	// Share our underlay information
-	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
-	theirControl.InjectLightHouseAddr(myVpnIpNet[0].Addr(), myUdpAddr)
-
-	// Start the servers
-	myControl.Start()
-	theirControl.Start()
-
-	r := router.NewR(t, myControl, theirControl)
-	defer r.RenderFlow()
-
-	r.Log("Assert the tunnel between me and them works")
-	//assertTunnel(t, theirVpnIpNet[0].Addr(), myVpnIpNet[0].Addr(), theirControl, myControl, r)
-	//r.Log("yay")
-	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-	r.Log("yay")
-	//todo ???
-	time.Sleep(1 * time.Second)
-	r.FlushAll()
-
-	waitStart := time.Now()
-	for {
-		assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
-		c := theirControl.GetHostInfoByVpnAddr(myVpnIpNet[0].Addr(), false)
-		c2 := myControl.GetHostInfoByVpnAddr(theirVpnIpNet[0].Addr(), false)
-		if c == nil || c2 == nil {
-			r.Log("nil")
-		} else {
-			version := c.Cert.Version()
-			theirVersion := c2.Cert.Version()
-			r.Logf("version %d,%d", version, theirVersion)
-			if version == theirVersion {
-				break
-			}
-		}
-		since := time.Since(waitStart)
-		if since > time.Second*5 {
-			r.Log("wtf")
-		}
-		if since > time.Second*10 {
-			r.Log("wtf")
-			t.Fatal("Cert should be new by now")
-		}
-		time.Sleep(time.Second)
-	}
-
-	r.RenderHostmaps("Final hostmaps", myControl, theirControl)
-
-	myControl.Stop()
-	theirControl.Stop()
-}
-
-func TestCrossStackRelaysWork(t *testing.T) {
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
-	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me     ", "10.128.0.1/24,fc00::1/64", m{"relay": m{"use_relays": true}})
-	relayControl, relayVpnIpNet, relayUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "relay  ", "10.128.0.128/24,fc00::128/64", m{"relay": m{"am_relay": true}})
-	theirUdp := netip.MustParseAddrPort("10.0.0.2:4242")
-	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServerWithUdp(cert.Version2, ca, caKey, "them   ", "fc00::2/64", theirUdp, m{"relay": m{"use_relays": true}})
-
-	//myVpnV4 := myVpnIpNet[0]
-	myVpnV6 := myVpnIpNet[1]
-	relayVpnV4 := relayVpnIpNet[0]
-	relayVpnV6 := relayVpnIpNet[1]
-	theirVpnV6 := theirVpnIpNet[0]
-
-	// Teach my how to get to the relay and that their can be reached via the relay
-	myControl.InjectLightHouseAddr(relayVpnV4.Addr(), relayUdpAddr)
-	myControl.InjectLightHouseAddr(relayVpnV6.Addr(), relayUdpAddr)
-	myControl.InjectRelays(theirVpnV6.Addr(), []netip.Addr{relayVpnV6.Addr()})
-	relayControl.InjectLightHouseAddr(theirVpnV6.Addr(), theirUdpAddr)
-
-	// Build a router so we don't have to reason who gets which packet
-	r := router.NewR(t, myControl, relayControl, theirControl)
-	defer r.RenderFlow()
-
-	// Start the servers
-	myControl.Start()
-	relayControl.Start()
-	theirControl.Start()
-
-	t.Log("Trigger a handshake from me to them via the relay")
-	myControl.InjectTunUDPPacket(theirVpnV6.Addr(), 80, myVpnV6.Addr(), 80, []byte("Hi from me"))
-
-	p := r.RouteForAllUntilTxTun(theirControl)
-	r.Log("Assert the tunnel works")
-	assertUdpPacket(t, []byte("Hi from me"), p, myVpnV6.Addr(), theirVpnV6.Addr(), 80, 80)
-
-	t.Log("reply?")
-	theirControl.InjectTunUDPPacket(myVpnV6.Addr(), 80, theirVpnV6.Addr(), 80, []byte("Hi from them"))
-	p = r.RouteForAllUntilTxTun(myControl)
-	assertUdpPacket(t, []byte("Hi from them"), p, theirVpnV6.Addr(), myVpnV6.Addr(), 80, 80)
-
-	r.RenderHostmaps("Final hostmaps", myControl, relayControl, theirControl)
-	//t.Log("finish up")
-	//myControl.Stop()
-	//theirControl.Stop()
-	//relayControl.Stop()
-}

examples/config.yml

@@ -144,10 +144,6 @@ listen:
   # valid values: always, never, private
   # This setting is reloadable.
   #send_recv_error: always
-  # Similar to send_recv_error, this option lets you configure if you want to accept "recv_error" packets from remote hosts.
-  # valid values: always, never, private
-  # This setting is reloadable.
-  #accept_recv_error: always
   # The so_sock option is a Linux-specific feature that allows all outgoing Nebula packets to be tagged with a specific identifier.
   # This tagging enables IP rule-based filtering. For example, it supports 0.0.0.0/0 unsafe_routes,
   # allowing for more precise routing decisions based on the packet tags. Default is 0 meaning no mark is set.
@@ -283,15 +279,6 @@ tun:
   # If using massive routes updates, for example BGP, you may need to increase this value to avoid packet loss.
   # SO_RCVBUFFORCE is used to avoid having to raise the system wide max
   #use_system_route_table_buffer_size: 0
-  #
-  # When using the feature to carry IPv4 unsafe_routes through a IPv6-only overlay network (4over6),
-  # the system still needs to use IPv4 addresses to pass that traffic. 
-  # By default, they are randomly chosen out of 169.254.0.0/16 at startup, but if you need them to be static, you can set them here.
-  # Setting these options is not required for use of the 4over6 feature.
-  # this is the address that a client will use as a source IP for packets sent to the router
-  #unsafe_origin_address_for_4over6: 169.254.55.96
-  # this is the IP the router will use internally to hairpin-NAT 4over6 traffic before it hits the operating system.
-  #snat_address_for_4over6: 169.254.12.34
 
 # Configure logging level
 logging:
@@ -391,14 +378,13 @@ firewall:
   # Rules are comprised of a protocol, port, and one or more of host, group, or CIDR
   # Logical evaluation is roughly: port AND proto AND (ca_sha OR ca_name) AND (host OR group OR groups OR cidr) AND (local cidr)
   # - port: Takes `0` or `any` as any, a single number `80`, a range `200-901`, or `fragment` to match second and further fragments of fragmented packets (since there is no port available).
+  #   code: same as port but makes more sense when talking about ICMP, TODO: this is not currently implemented in a way that works, use `any`
   #   proto: `any`, `tcp`, `udp`, or `icmp`
-  #          a port specification is ignored if proto is `icmp`
   #   host: `any` or a literal hostname, ie `test-host`
   #   group: `any` or a literal group name, ie `default-group`
   #   groups: Same as group but accepts a list of values. Multiple values are AND'd together and a certificate would have to contain all groups to pass
-  #   cidr: a remote CIDR, `0.0.0.0/0` is any ipv4 and `::/0` is any ipv6. `any` means any ip family and address.
+  #   cidr: a remote CIDR, `0.0.0.0/0` is any ipv4 and `::/0` is any ipv6.
-  #   local_cidr: a local CIDR, `0.0.0.0/0` is any ipv4 and `::/0` is any ipv6. `any` means any ip family and address.
+  #   local_cidr: a local CIDR, `0.0.0.0/0` is any ipv4 and `::/0` is any ipv6. This can be used to filter destinations when using unsafe_routes.
-  #     This can be used to filter destinations when using unsafe_routes.
   #     By default, this is set to only the VPN (overlay) networks assigned via the certificate networks field unless `default_local_cidr_any` is set to true.
   #     If there are unsafe_routes present in this config file, `local_cidr` should be set appropriately for the intended us case.
   #   ca_name: An issuing CA name

firewall.go

@@ -2,14 +2,12 @@ package nebula
 
 import (
 	"crypto/sha256"
-	"encoding/binary"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"hash/fnv"
 	"net/netip"
 	"reflect"
-	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -23,33 +21,8 @@ import (
 	"github.com/slackhq/nebula/firewall"
 )
 
-var ErrCannotSNAT = errors.New("cannot SNAT this packet")
-var ErrSNATIdentityMismatch = errors.New("refusing to SNAT for mismatched host")
-var ErrSNATAddressCollision = errors.New("refusing to accept an incoming packet with my SNAT address")
-
-const ipv4SourcePosition = 12
-const ipv4DestinationPosition = 16
-const sourcePortOffset = 0
-const destinationPortOffset = 2
-
 type FirewallInterface interface {
-	AddRule(incoming bool, proto uint8, startPort int32, endPort int32, groups []string, host string, cidr, localCidr string, caName string, caSha string) error
+	AddRule(incoming bool, proto uint8, startPort int32, endPort int32, groups []string, host string, addr, localAddr netip.Prefix, caName string, caSha string) error
-}
-
-type snatInfo struct {
-	//Src is the source IP+port to write into unsafe-route-bound packet
-	Src netip.AddrPort
-	//SrcVpnIp is the overlay IP associated with this flow. It's needed to associate reply traffic so we can get it back to the right host.
-	SrcVpnIp netip.Addr
-	//SnatPort is the port to rewrite into an overlay-bound packet
-	SnatPort uint16
-}
-
-func (s *snatInfo) Valid() bool {
-	if s == nil {
-		return false
-	}
-	return s.Src.IsValid()
 }
 
 type conn struct {
@@ -60,9 +33,6 @@ type conn struct {
 	// fields pack for free after the uint32 above
 	incoming     bool
 	rulesVersion uint16
-
-	//for SNAT support
-	snat *snatInfo
 }
 
 // TODO: need conntrack max tracked connections handling
@@ -95,8 +65,6 @@ type Firewall struct {
 	defaultLocalCIDRAny bool
 	incomingMetrics     firewallMetrics
 	outgoingMetrics     firewallMetrics
-	unsafeIPv4Origin    netip.Addr
-	snatAddr            netip.Addr
 
 	l *logrus.Logger
 }
@@ -224,12 +192,12 @@ func NewFirewall(l *logrus.Logger, tcpTimeout, UDPTimeout, defaultTimeout time.D
 
 func NewFirewallFromConfig(l *logrus.Logger, cs *CertState, c *config.C) (*Firewall, error) {
 	certificate := cs.getCertificate(cert.Version2)
-	if certificate == nil { //todo if config.initiating_version is set to 1, and unsafe_networks differ, things will suck
+	if certificate == nil {
 		certificate = cs.getCertificate(cert.Version1)
 	}
 
 	if certificate == nil {
-		return nil, errors.New("no certificate available to reconfigure the firewall")
+		panic("No certificate available to reconfigure the firewall")
 	}
 
 	fw := NewFirewall(
@@ -238,6 +206,7 @@ func NewFirewallFromConfig(l *logrus.Logger, cs *CertState, c *config.C) (*Firew
 		c.GetDuration("firewall.conntrack.udp_timeout", time.Minute*3),
 		c.GetDuration("firewall.conntrack.default_timeout", time.Minute*10),
 		certificate,
+		//TODO: max_connections
 	)
 
 	fw.defaultLocalCIDRAny = c.GetBool("firewall.default_local_cidr_any", false)
@@ -278,7 +247,32 @@ func NewFirewallFromConfig(l *logrus.Logger, cs *CertState, c *config.C) (*Firew
 }
 
 // AddRule properly creates the in memory rule structure for a firewall table.
-func (f *Firewall) AddRule(incoming bool, proto uint8, startPort int32, endPort int32, groups []string, host string, cidr, localCidr, caName string, caSha string) error {
+func (f *Firewall) AddRule(incoming bool, proto uint8, startPort int32, endPort int32, groups []string, host string, ip, localIp netip.Prefix, caName string, caSha string) error {
+	// Under gomobile, stringing a nil pointer with fmt causes an abort in debug mode for iOS
+	// https://github.com/golang/go/issues/14131
+	sIp := ""
+	if ip.IsValid() {
+		sIp = ip.String()
+	}
+	lIp := ""
+	if localIp.IsValid() {
+		lIp = localIp.String()
+	}
+
+	// We need this rule string because we generate a hash. Removing this will break firewall reload.
+	ruleString := fmt.Sprintf(
+		"incoming: %v, proto: %v, startPort: %v, endPort: %v, groups: %v, host: %v, ip: %v, localIp: %v, caName: %v, caSha: %s",
+		incoming, proto, startPort, endPort, groups, host, sIp, lIp, caName, caSha,
+	)
+	f.rules += ruleString + "\n"
+
+	direction := "incoming"
+	if !incoming {
+		direction = "outgoing"
+	}
+	f.l.WithField("firewallRule", m{"direction": direction, "proto": proto, "startPort": startPort, "endPort": endPort, "groups": groups, "host": host, "ip": sIp, "localIp": lIp, "caName": caName, "caSha": caSha}).
+		Info("Firewall rule added")
+
 	var (
 		ft *FirewallTable
 		fp firewallPort
@@ -296,12 +290,6 @@ func (f *Firewall) AddRule(incoming bool, proto uint8, startPort int32, endPort
 	case firewall.ProtoUDP:
 		fp = ft.UDP
 	case firewall.ProtoICMP, firewall.ProtoICMPv6:
-		//ICMP traffic doesn't have ports, so we always coerce to "any", even if a value is provided
-		if startPort != firewall.PortAny {
-			f.l.WithField("startPort", startPort).Warn("ignoring port specification for ICMP firewall rule")
-		}
-		startPort = firewall.PortAny
-		endPort = firewall.PortAny
 		fp = ft.ICMP
 	case firewall.ProtoAny:
 		fp = ft.AnyProto
@@ -309,21 +297,7 @@ func (f *Firewall) AddRule(incoming bool, proto uint8, startPort int32, endPort
 		return fmt.Errorf("unknown protocol %v", proto)
 	}
 
-	// We need this rule string because we generate a hash. Removing this will break firewall reload.
+	return fp.addRule(f, startPort, endPort, groups, host, ip, localIp, caName, caSha)
-	ruleString := fmt.Sprintf(
-		"incoming: %v, proto: %v, startPort: %v, endPort: %v, groups: %v, host: %v, ip: %v, localIp: %v, caName: %v, caSha: %s",
-		incoming, proto, startPort, endPort, groups, host, cidr, localCidr, caName, caSha,
-	)
-	f.rules += ruleString + "\n"
-
-	direction := "incoming"
-	if !incoming {
-		direction = "outgoing"
-	}
-	f.l.WithField("firewallRule", m{"direction": direction, "proto": proto, "startPort": startPort, "endPort": endPort, "groups": groups, "host": host, "cidr": cidr, "localCidr": localCidr, "caName": caName, "caSha": caSha}).
-		Info("Firewall rule added")
-
-	return fp.addRule(f, startPort, endPort, groups, host, cidr, localCidr, caName, caSha)
 }
 
 // GetRuleHash returns a hash representation of all inbound and outbound rules
@@ -344,18 +318,6 @@ func (f *Firewall) GetRuleHashes() string {
 	return "SHA:" + f.GetRuleHash() + ",FNV:" + strconv.FormatUint(uint64(f.GetRuleHashFNV()), 10)
 }
 
-func (f *Firewall) SetSNATAddressFromInterface(i *Interface) {
-	//address-mutation-avoidance is done inside Interface, the firewall doesn't need to care
-	//todo should snatted conntracks get expired out? Probably not needed until if/when we allow reload
-	f.snatAddr = i.inside.SNATAddress().Addr()
-	f.unsafeIPv4Origin = i.inside.UnsafeIPv4OriginAddress().Addr()
-}
-
-func (f *Firewall) ShouldUnSNAT(fp *firewall.Packet) bool {
-	// f.snatAddr is only valid if we're a snat-capable router
-	return f.snatAddr.IsValid() && fp.RemoteAddr == f.snatAddr
-}
-
 func AddFirewallRulesFromConfig(l *logrus.Logger, inbound bool, c *config.C, fw FirewallInterface) error {
 	var table string
 	if inbound {
@@ -375,6 +337,7 @@ func AddFirewallRulesFromConfig(l *logrus.Logger, inbound bool, c *config.C, fw
 	}
 
 	for i, t := range rs {
+		var groups []string
 		r, err := convertRule(l, t, table, i)
 		if err != nil {
 			return fmt.Errorf("%s rule #%v; %s", table, i, err)
@@ -384,10 +347,23 @@ func AddFirewallRulesFromConfig(l *logrus.Logger, inbound bool, c *config.C, fw
 			return fmt.Errorf("%s rule #%v; only one of port or code should be provided", table, i)
 		}
 
-		if r.Host == "" && len(r.Groups) == 0 && r.Cidr == "" && r.LocalCidr == "" && r.CAName == "" && r.CASha == "" {
+		if r.Host == "" && len(r.Groups) == 0 && r.Group == "" && r.Cidr == "" && r.LocalCidr == "" && r.CAName == "" && r.CASha == "" {
 			return fmt.Errorf("%s rule #%v; at least one of host, group, cidr, local_cidr, ca_name, or ca_sha must be provided", table, i)
 		}
 
+		if len(r.Groups) > 0 {
+			groups = r.Groups
+		}
+
+		if r.Group != "" {
+			// Check if we have both groups and group provided in the rule config
+			if len(groups) > 0 {
+				return fmt.Errorf("%s rule #%v; only one of group or groups should be defined, both provided", table, i)
+			}
+
+			groups = []string{r.Group}
+		}
+
 		var sPort, errPort string
 		if r.Code != "" {
 			errPort = "code"
@@ -397,51 +373,42 @@ func AddFirewallRulesFromConfig(l *logrus.Logger, inbound bool, c *config.C, fw
 			sPort = r.Port
 		}
 
-		var proto uint8
+		startPort, endPort, err := parsePort(sPort)
-		var startPort, endPort int32
-		switch r.Proto {
-		case "any":
-			proto = firewall.ProtoAny
-			startPort, endPort, err = parsePort(sPort)
-		case "tcp":
-			proto = firewall.ProtoTCP
-			startPort, endPort, err = parsePort(sPort)
-		case "udp":
-			proto = firewall.ProtoUDP
-			startPort, endPort, err = parsePort(sPort)
-		case "icmp":
-			proto = firewall.ProtoICMP
-			startPort = firewall.PortAny
-			endPort = firewall.PortAny
-			if sPort != "" {
-				l.WithField("port", sPort).Warn("ignoring port specification for ICMP firewall rule")
-			}
-		default:
-			return fmt.Errorf("%s rule #%v; proto was not understood; `%s`", table, i, r.Proto)
-		}
 		if err != nil {
 			return fmt.Errorf("%s rule #%v; %s %s", table, i, errPort, err)
 		}
 
-		if r.Cidr != "" && r.Cidr != "any" {
+		var proto uint8
-			_, err = netip.ParsePrefix(r.Cidr)
+		switch r.Proto {
+		case "any":
+			proto = firewall.ProtoAny
+		case "tcp":
+			proto = firewall.ProtoTCP
+		case "udp":
+			proto = firewall.ProtoUDP
+		case "icmp":
+			proto = firewall.ProtoICMP
+		default:
+			return fmt.Errorf("%s rule #%v; proto was not understood; `%s`", table, i, r.Proto)
+		}
+
+		var cidr netip.Prefix
+		if r.Cidr != "" {
+			cidr, err = netip.ParsePrefix(r.Cidr)
 			if err != nil {
 				return fmt.Errorf("%s rule #%v; cidr did not parse; %s", table, i, err)
 			}
 		}
 
-		if r.LocalCidr != "" && r.LocalCidr != "any" {
+		var localCidr netip.Prefix
-			_, err = netip.ParsePrefix(r.LocalCidr)
+		if r.LocalCidr != "" {
+			localCidr, err = netip.ParsePrefix(r.LocalCidr)
 			if err != nil {
 				return fmt.Errorf("%s rule #%v; local_cidr did not parse; %s", table, i, err)
 			}
 		}
 
-		if warning := r.sanity(); warning != nil {
+		err = fw.AddRule(inbound, proto, startPort, endPort, groups, r.Host, cidr, localCidr, r.CAName, r.CASha)
-			l.Warnf("%s rule #%v; %s", table, i, warning)
-		}
-
-		err = fw.AddRule(inbound, proto, startPort, endPort, r.Groups, r.Host, r.Cidr, r.LocalCidr, r.CAName, r.CASha)
 		if err != nil {
 			return fmt.Errorf("%s rule #%v; `%s`", table, i, err)
 		}
@@ -450,213 +417,41 @@ func AddFirewallRulesFromConfig(l *logrus.Logger, inbound bool, c *config.C, fw
 	return nil
 }
 
-var ErrUnknownNetworkType = errors.New("unknown network type")
+var ErrInvalidRemoteIP = errors.New("remote IP is not in remote certificate subnets")
-var ErrPeerRejected = errors.New("remote address is not within a network that we handle")
+var ErrInvalidLocalIP = errors.New("local IP is not in list of handled local IPs")
-var ErrInvalidRemoteIP = errors.New("remote address is not in remote certificate networks")
-var ErrInvalidLocalIP = errors.New("local address is not in list of handled local addresses")
 var ErrNoMatchingRule = errors.New("no matching rule in firewall table")
 
-func (f *Firewall) unSnat(data []byte, fp *firewall.Packet) netip.Addr {
-	c := f.peek(*fp) //unfortunately this needs to lock. Surely there's a better way.
-	if c == nil {
-		return netip.Addr{}
-	}
-	if !c.snat.Valid() {
-		return netip.Addr{}
-	}
-	oldIP := netip.AddrPortFrom(f.snatAddr, fp.RemotePort)
-	rewritePacket(data, fp, oldIP, c.snat.Src, ipv4DestinationPosition, destinationPortOffset)
-	return c.snat.SrcVpnIp
-}
-
-func rewritePacket(data []byte, fp *firewall.Packet, oldIP netip.AddrPort, newIP netip.AddrPort, ipOffset int, portOffset int) {
-	//change address
-	copy(data[ipOffset:], newIP.Addr().AsSlice())
-	recalcIPv4Checksum(data, oldIP.Addr(), newIP.Addr())
-	ipHeaderLen := int(data[0]&0x0F) * 4
-
-	switch fp.Protocol {
-	case firewall.ProtoICMP:
-		binary.BigEndian.PutUint16(data[ipHeaderLen+4:ipHeaderLen+6], newIP.Port()) //we use the ID field as a "port" for ICMP
-		icmpCode := uint16(data[ipHeaderLen+1])                                     //todo not snatting on code yet (but Linux would)
-		recalcICMPv4Checksum(data, icmpCode, icmpCode, oldIP.Port(), newIP.Port())
-	case firewall.ProtoUDP:
-		dstport := ipHeaderLen + portOffset
-		binary.BigEndian.PutUint16(data[dstport:dstport+2], newIP.Port())
-		recalcUDPv4Checksum(data, oldIP, newIP)
-	case firewall.ProtoTCP:
-		dstport := ipHeaderLen + portOffset
-		binary.BigEndian.PutUint16(data[dstport:dstport+2], newIP.Port())
-		recalcTCPv4Checksum(data, oldIP, newIP)
-	}
-}
-
-func (f *Firewall) findUsableSNATPort(fp *firewall.Packet, c *conn) error {
-	const halfThePorts = 0x7fff
-	oldPort := fp.RemotePort
-	conntrack := f.Conntrack
-	conntrack.Lock()
-	defer conntrack.Unlock()
-	for numPortsChecked := 0; numPortsChecked < halfThePorts; numPortsChecked++ {
-		_, ok := conntrack.Conns[*fp]
-		if !ok {
-			//yay, we can use this port
-			//track the snatted flow with the same expiration as the unsnatted version
-			c.snat.SnatPort = fp.RemotePort
-			conntrack.Conns[*fp] = c
-			return nil
-		}
-		//increment and retry. There's probably better strategies out there
-		fp.RemotePort++
-		if fp.RemotePort < halfThePorts {
-			fp.RemotePort += halfThePorts // keep it ephemeral for now
-		}
-	}
-
-	//if we made it here, we failed
-	fp.RemotePort = oldPort
-	return ErrCannotSNAT
-}
-
-func (f *Firewall) applySnat(data []byte, fp *firewall.Packet, c *conn, hostinfo *HostInfo) error {
-	if !f.snatAddr.IsValid() {
-		return ErrCannotSNAT
-	}
-	if f.snatAddr == fp.LocalAddr { //a packet that came from UDP (incoming) should never ever have our snat address on it
-		return ErrSNATAddressCollision
-	}
-	if c.snat.Valid() {
-		//old flow: make sure it came from the right place
-		if !slices.Contains(hostinfo.vpnAddrs, c.snat.SrcVpnIp) {
-			return ErrSNATIdentityMismatch
-		}
-		fp.RemoteAddr = f.snatAddr
-		fp.RemotePort = c.snat.SnatPort
-	} else if hostinfo.vpnAddrs[0].Is6() {
-		//we got a new flow
-		c.snat = &snatInfo{
-			Src:      netip.AddrPortFrom(fp.RemoteAddr, fp.RemotePort),
-			SrcVpnIp: hostinfo.vpnAddrs[0],
-		}
-		fp.RemoteAddr = f.snatAddr
-		//find a new port to use, if needed
-		err := f.findUsableSNATPort(fp, c)
-		if err != nil {
-			c.snat = nil
-			return err
-		}
-	} else {
-		return ErrCannotSNAT
-	}
-
-	newIP := netip.AddrPortFrom(f.snatAddr, c.snat.SnatPort)
-	rewritePacket(data, fp, c.snat.Src, newIP, ipv4SourcePosition, sourcePortOffset)
-	return nil
-}
-
-func (f *Firewall) identifyRemoteNetworkType(h *HostInfo, fp firewall.Packet) NetworkType {
-	if h.networks == nil {
-		// Simple case: Certificate has one address and no unsafe networks
-		if h.vpnAddrs[0] == fp.RemoteAddr {
-			return NetworkTypeVPN
-		} //else, fallthrough
-	} else if nwType, ok := h.networks.Lookup(fp.RemoteAddr); ok {
-		return nwType //will return NetworkTypeVPN or NetworkTypeUnsafe
-	}
-
-	//RemoteAddr not in our networks table
-	if f.snatAddr.IsValid() && fp.IsIPv4() && h.HasOnlyV6Addresses() {
-		return NetworkTypeUnverifiedSNATPeer
-	} else {
-		return NetworkTypeInvalidPeer
-	}
-}
-
-func (f *Firewall) allowRemoteNetworkType(nwType NetworkType, fp firewall.Packet) error {
-	switch nwType {
-	case NetworkTypeVPN:
-		return nil
-	case NetworkTypeInvalidPeer:
-		return ErrInvalidRemoteIP
-	case NetworkTypeVPNPeer:
-		//one day we might need a specialSnatMode case in here to handle routers with v4 addresses when we don't also have a v4 address?
-		return ErrPeerRejected // reject for now, one day this may have different FW rules
-	case NetworkTypeUnsafe:
-		return nil // nothing special, one day this may have different FW rules
-	case NetworkTypeUnverifiedSNATPeer:
-		if f.unsafeIPv4Origin.IsValid() && fp.LocalAddr == f.unsafeIPv4Origin {
-			return nil //the client case
-		}
-		if f.snatAddr.IsValid() {
-			if fp.RemoteAddr == f.snatAddr {
-				return ErrInvalidRemoteIP //we should never get a packet with our SNAT addr as the destination, or "from" our SNAT addr
-			}
-			return nil
-		} else {
-			return ErrInvalidRemoteIP
-		}
-	default:
-		return ErrUnknownNetworkType //should never happen
-	}
-}
-
-func (f *Firewall) willingToHandleLocalAddr(incoming bool, fp firewall.Packet, remoteNwType NetworkType) error {
-	if f.routableNetworks.Contains(fp.LocalAddr) {
-		return nil //easy, this should handle NetworkTypeVPN in all cases, and NetworkTypeUnsafe on the router side
-	}
-	if incoming { //at least for now, reject all traffic other than what we've already decided is locally routable
-		return ErrInvalidLocalIP
-	}
-
-	//below this line, all traffic is outgoing. Outgoing traffic to NetworkTypeUnsafe is not required to be considered inbound-routable
-	if remoteNwType == NetworkTypeUnsafe {
-		return nil
-	}
-
-	return ErrInvalidLocalIP
-}
-
 // Drop returns an error if the packet should be dropped, explaining why. It
 // returns nil if the packet should not be dropped.
-func (f *Firewall) Drop(fp firewall.Packet, pkt []byte, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {
+func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {
-	table := f.OutRules
-	if incoming {
-		table = f.InRules
-	}
-
-	snatmode := fp.IsIPv4() && h.HasOnlyV6Addresses() && f.snatAddr.IsValid()
-	if snatmode {
-		//if this is an IPv4 packet from a V6 only host, and we're configured to snat that kind of traffic, it must be snatted,
-		//so it can never be in the localcache, which lacks SNAT data
-		//nil out the pointer to avoid ever using it
-		localCache = nil
-	}
-
 	// Check if we spoke to this tuple, if we did then allow this packet
-	if localCache != nil {
+	if f.inConns(fp, h, caPool, localCache) {
-		if _, ok := localCache[fp]; ok {
-			return nil //packet matched the cache, we're not snatting, we can return early
-		}
-	}
-	c := f.inConns(fp, h, caPool, localCache)
-	if c != nil {
-		if incoming && snatmode {
-			return f.applySnat(pkt, &fp, c, h)
-		}
 		return nil
 	}
 
-	// Make sure remote address matches nebula certificate, and determine how to treat it
+	// Make sure remote address matches nebula certificate
-	remoteNetworkType := f.identifyRemoteNetworkType(h, fp)
+	if h.networks != nil {
-	if err := f.allowRemoteNetworkType(remoteNetworkType, fp); err != nil {
+		if !h.networks.Contains(fp.RemoteAddr) {
-		f.metrics(incoming).droppedRemoteAddr.Inc(1)
+			f.metrics(incoming).droppedRemoteAddr.Inc(1)
-		return err
+			return ErrInvalidRemoteIP
+		}
+	} else {
+		// Simple case: Certificate has one address and no unsafe networks
+		if h.vpnAddrs[0] != fp.RemoteAddr {
+			f.metrics(incoming).droppedRemoteAddr.Inc(1)
+			return ErrInvalidRemoteIP
+		}
 	}
 
 	// Make sure we are supposed to be handling this local ip address
-	if err := f.willingToHandleLocalAddr(incoming, fp, remoteNetworkType); err != nil {
+	if !f.routableNetworks.Contains(fp.LocalAddr) {
 		f.metrics(incoming).droppedLocalAddr.Inc(1)
-		return err
+		return ErrInvalidLocalIP
+	}
+
+	table := f.OutRules
+	if incoming {
+		table = f.InRules
 	}
 
 	// We now know which firewall table to check against
@@ -666,14 +461,9 @@ func (f *Firewall) Drop(fp firewall.Packet, pkt []byte, incoming bool, h *HostIn
 	}
 
 	// We always want to conntrack since it is a faster operation
-	c = f.addConn(fp, incoming)
+	f.addConn(fp, incoming)
 
-	if incoming && remoteNetworkType == NetworkTypeUnverifiedSNATPeer {
+	return nil
-		return f.applySnat(pkt, &fp, c, h)
-	} else {
-		//outgoing snat is handled before this function is called
-		return nil
-	}
 }
 
 func (f *Firewall) metrics(incoming bool) firewallMetrics {
@@ -684,7 +474,7 @@ func (f *Firewall) metrics(incoming bool) firewallMetrics {
 	}
 }
 
-// Destroy cleans up any known cyclical references so the object can be freed by GC. This should be called if a new
+// Destroy cleans up any known cyclical references so the object can be free'd my GC. This should be called if a new
 // firewall object is created
 func (f *Firewall) Destroy() {
 	//TODO: clean references if/when needed
@@ -700,14 +490,12 @@ func (f *Firewall) EmitStats() {
 	metrics.GetOrRegisterGauge("firewall.rules.hash", nil).Update(int64(f.GetRuleHashFNV()))
 }
 
-func (f *Firewall) peek(fp firewall.Packet) *conn {
+func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) bool {
-	f.Conntrack.Lock()
+	if localCache != nil {
-	c := f.Conntrack.Conns[fp]
+		if _, ok := localCache[fp]; ok {
-	f.Conntrack.Unlock()
+			return true
-	return c
+		}
-}
+	}
-
-func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) *conn {
 	conntrack := f.Conntrack
 	conntrack.Lock()
 
@@ -721,7 +509,7 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 
 	if !ok {
 		conntrack.Unlock()
-		return nil
+		return false
 	}
 
 	if c.rulesVersion != f.rulesVersion {
@@ -744,7 +532,7 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 			}
 			delete(conntrack.Conns, fp)
 			conntrack.Unlock()
-			return nil
+			return false
 		}
 
 		if f.l.Level >= logrus.DebugLevel {
@@ -774,11 +562,12 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 		localCache[fp] = struct{}{}
 	}
 
-	return c
+	return true
 }
 
-func (f *Firewall) packetTimeout(fp firewall.Packet) time.Duration {
+func (f *Firewall) addConn(fp firewall.Packet, incoming bool) {
 	var timeout time.Duration
+	c := &conn{}
 
 	switch fp.Protocol {
 	case firewall.ProtoTCP:
@@ -788,13 +577,7 @@ func (f *Firewall) packetTimeout(fp firewall.Packet) time.Duration {
 	default:
 		timeout = f.DefaultTimeout
 	}
-	return timeout
-}
 
-func (f *Firewall) addConn(fp firewall.Packet, incoming bool) *conn {
-	c := &conn{}
-
-	timeout := f.packetTimeout(fp)
 	conntrack := f.Conntrack
 	conntrack.Lock()
 	if _, ok := conntrack.Conns[fp]; !ok {
@@ -808,9 +591,7 @@ func (f *Firewall) addConn(fp firewall.Packet, incoming bool) *conn {
 	c.rulesVersion = f.rulesVersion
 	c.Expires = time.Now().Add(timeout)
 	conntrack.Conns[fp] = c
-
 	conntrack.Unlock()
-	return c
 }
 
 // Evict checks if a conntrack entry has expired, if so it is removed, if not it is re-added to the wheel
@@ -859,7 +640,7 @@ func (ft *FirewallTable) match(p firewall.Packet, incoming bool, c *cert.CachedC
 	return false
 }
 
-func (fp firewallPort) addRule(f *Firewall, startPort int32, endPort int32, groups []string, host string, cidr, localCidr, caName string, caSha string) error {
+func (fp firewallPort) addRule(f *Firewall, startPort int32, endPort int32, groups []string, host string, ip, localIp netip.Prefix, caName string, caSha string) error {
 	if startPort > endPort {
 		return fmt.Errorf("start port was lower than end port")
 	}
@@ -872,7 +653,7 @@ func (fp firewallPort) addRule(f *Firewall, startPort int32, endPort int32, grou
 			}
 		}
 
-		if err := fp[i].addRule(f, groups, host, cidr, localCidr, caName, caSha); err != nil {
+		if err := fp[i].addRule(f, groups, host, ip, localIp, caName, caSha); err != nil {
 			return err
 		}
 	}
@@ -886,13 +667,6 @@ func (fp firewallPort) match(p firewall.Packet, incoming bool, c *cert.CachedCer
 		return false
 	}
 
-	// this branch is here to catch traffic from FirewallTable.Any.match and FirewallTable.ICMP.match
-	if p.Protocol == firewall.ProtoICMP || p.Protocol == firewall.ProtoICMPv6 {
-		// port numbers are re-used for connection tracking of ICMP,
-		// but we don't want to actually filter on them.
-		return fp[firewall.PortAny].match(p, c, caPool)
-	}
-
 	var port int32
 
 	if p.Fragment {
@@ -910,7 +684,7 @@ func (fp firewallPort) match(p firewall.Packet, incoming bool, c *cert.CachedCer
 	return fp[firewall.PortAny].match(p, c, caPool)
 }
 
-func (fc *FirewallCA) addRule(f *Firewall, groups []string, host string, cidr, localCidr, caName, caSha string) error {
+func (fc *FirewallCA) addRule(f *Firewall, groups []string, host string, ip, localIp netip.Prefix, caName, caSha string) error {
 	fr := func() *FirewallRule {
 		return &FirewallRule{
 			Hosts:  make(map[string]*firewallLocalCIDR),
@@ -924,14 +698,14 @@ func (fc *FirewallCA) addRule(f *Firewall, groups []string, host string, cidr, l
 			fc.Any = fr()
 		}
 
-		return fc.Any.addRule(f, groups, host, cidr, localCidr)
+		return fc.Any.addRule(f, groups, host, ip, localIp)
 	}
 
 	if caSha != "" {
 		if _, ok := fc.CAShas[caSha]; !ok {
 			fc.CAShas[caSha] = fr()
 		}
-		err := fc.CAShas[caSha].addRule(f, groups, host, cidr, localCidr)
+		err := fc.CAShas[caSha].addRule(f, groups, host, ip, localIp)
 		if err != nil {
 			return err
 		}
@@ -941,7 +715,7 @@ func (fc *FirewallCA) addRule(f *Firewall, groups []string, host string, cidr, l
 		if _, ok := fc.CANames[caName]; !ok {
 			fc.CANames[caName] = fr()
 		}
-		err := fc.CANames[caName].addRule(f, groups, host, cidr, localCidr)
+		err := fc.CANames[caName].addRule(f, groups, host, ip, localIp)
 		if err != nil {
 			return err
 		}
@@ -973,24 +747,24 @@ func (fc *FirewallCA) match(p firewall.Packet, c *cert.CachedCertificate, caPool
 	return fc.CANames[s.Certificate.Name()].match(p, c)
 }
 
-func (fr *FirewallRule) addRule(f *Firewall, groups []string, host, cidr, localCidr string) error {
+func (fr *FirewallRule) addRule(f *Firewall, groups []string, host string, ip, localCIDR netip.Prefix) error {
 	flc := func() *firewallLocalCIDR {
 		return &firewallLocalCIDR{
 			LocalCIDR: new(bart.Lite),
 		}
 	}
 
-	if fr.isAny(groups, host, cidr) {
+	if fr.isAny(groups, host, ip) {
 		if fr.Any == nil {
 			fr.Any = flc()
 		}
 
-		return fr.Any.addRule(f, localCidr)
+		return fr.Any.addRule(f, localCIDR)
 	}
 
 	if len(groups) > 0 {
 		nlc := flc()
-		err := nlc.addRule(f, localCidr)
+		err := nlc.addRule(f, localCIDR)
 		if err != nil {
 			return err
 		}
@@ -1006,46 +780,44 @@ func (fr *FirewallRule) addRule(f *Firewall, groups []string, host, cidr, localC
 		if nlc == nil {
 			nlc = flc()
 		}
-		err := nlc.addRule(f, localCidr)
+		err := nlc.addRule(f, localCIDR)
 		if err != nil {
 			return err
 		}
 		fr.Hosts[host] = nlc
 	}
 
-	if cidr != "" {
+	if ip.IsValid() {
-		c, err := netip.ParsePrefix(cidr)
+		nlc, _ := fr.CIDR.Get(ip)
-		if err != nil {
-			return err
-		}
-		nlc, _ := fr.CIDR.Get(c)
 		if nlc == nil {
 			nlc = flc()
 		}
-		err = nlc.addRule(f, localCidr)
+		err := nlc.addRule(f, localCIDR)
 		if err != nil {
 			return err
 		}
-		fr.CIDR.Insert(c, nlc)
+		fr.CIDR.Insert(ip, nlc)
 	}
 
 	return nil
 }
 
-func (fr *FirewallRule) isAny(groups []string, host string, cidr string) bool {
+func (fr *FirewallRule) isAny(groups []string, host string, ip netip.Prefix) bool {
-	if len(groups) == 0 && host == "" && cidr == "" {
+	if len(groups) == 0 && host == "" && !ip.IsValid() {
 		return true
 	}
 
-	if slices.Contains(groups, "any") {
+	for _, group := range groups {
-		return true
+		if group == "any" {
+			return true
+		}
 	}
 
 	if host == "any" {
 		return true
 	}
 
-	if cidr == "any" {
+	if ip.IsValid() && ip.Bits() == 0 {
 		return true
 	}
 
@@ -1097,13 +869,8 @@ func (fr *FirewallRule) match(p firewall.Packet, c *cert.CachedCertificate) bool
 	return false
 }
 
-func (flc *firewallLocalCIDR) addRule(f *Firewall, localCidr string) error {
+func (flc *firewallLocalCIDR) addRule(f *Firewall, localIp netip.Prefix) error {
-	if localCidr == "any" {
+	if !localIp.IsValid() {
-		flc.Any = true
-		return nil
-	}
-
-	if localCidr == "" {
 		if !f.hasUnsafeNetworks || f.defaultLocalCIDRAny {
 			flc.Any = true
 			return nil
@@ -1114,13 +881,12 @@ func (flc *firewallLocalCIDR) addRule(f *Firewall, localCidr string) error {
 		}
 		return nil
 
+	} else if localIp.Bits() == 0 {
+		flc.Any = true
+		return nil
 	}
 
-	c, err := netip.ParsePrefix(localCidr)
+	flc.LocalCIDR.Insert(localIp)
-	if err != nil {
-		return err
-	}
-	flc.LocalCIDR.Insert(c)
 	return nil
 }
 
@@ -1141,6 +907,7 @@ type rule struct {
 	Code      string
 	Proto     string
 	Host      string
+	Group     string
 	Groups    []string
 	Cidr      string
 	LocalCidr string
@@ -1182,8 +949,7 @@ func convertRule(l *logrus.Logger, p any, table string, i int) (rule, error) {
 		l.Warnf("%s rule #%v; group was an array with a single value, converting to simple value", table, i)
 		m["group"] = v[0]
 	}
-
+	r.Group = toString("group", m)
-	singleGroup := toString("group", m)
 
 	if rg, ok := m["groups"]; ok {
 		switch reflect.TypeOf(rg).Kind() {
@@ -1200,105 +966,52 @@ func convertRule(l *logrus.Logger, p any, table string, i int) (rule, error) {
 		}
 	}
 
-	//flatten group vs groups
-	if singleGroup != "" {
-		// Check if we have both groups and group provided in the rule config
-		if len(r.Groups) > 0 {
-			return r, fmt.Errorf("only one of group or groups should be defined, both provided")
-		}
-		r.Groups = []string{singleGroup}
-	}
-
 	return r, nil
 }
 
-// sanity returns an error if the rule would be evaluated in a way that would short-circuit a configured check on a wildcard value
+func parsePort(s string) (startPort, endPort int32, err error) {
-// rules are evaluated as "port AND proto AND (ca_sha OR ca_name) AND (host OR group OR groups OR cidr) AND local_cidr"
-func (r *rule) sanity() error {
-	//port, proto, local_cidr are AND, no need to check here
-	//ca_sha and ca_name don't have a wildcard value, no need to check here
-	groupsEmpty := len(r.Groups) == 0
-	hostEmpty := r.Host == ""
-	cidrEmpty := r.Cidr == ""
-
-	if (groupsEmpty && hostEmpty && cidrEmpty) == true {
-		return nil //no content!
-	}
-
-	groupsHasAny := slices.Contains(r.Groups, "any")
-	if groupsHasAny && len(r.Groups) > 1 {
-		return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the other groups specified", r.Groups)
-	}
-
-	if r.Host == "any" {
-		if !groupsEmpty {
-			return fmt.Errorf("groups specified as %s, but host=any will match any host, regardless of groups", r.Groups)
-		}
-
-		if !cidrEmpty {
-			return fmt.Errorf("cidr specified as %s, but host=any will match any host, regardless of cidr", r.Cidr)
-		}
-	}
-
-	if groupsHasAny {
-		if !hostEmpty && r.Host != "any" {
-			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s", r.Groups, r.Host)
-		}
-		if !cidrEmpty {
-			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s", r.Groups, r.Cidr)
-		}
-	}
-
-	if r.Code != "" {
-		return fmt.Errorf("code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional", r.Code)
-	}
-
-	//todo alert on cidr-any
-
-	return nil
-}
-
-func parsePort(s string) (int32, int32, error) {
-	var err error
-	const notAPort int32 = -2
 	if s == "any" {
-		return firewall.PortAny, firewall.PortAny, nil
+		startPort = firewall.PortAny
-	}
+		endPort = firewall.PortAny
-	if s == "fragment" {
+
-		return firewall.PortFragment, firewall.PortFragment, nil
+	} else if s == "fragment" {
-	}
+		startPort = firewall.PortFragment
-	if !strings.Contains(s, `-`) {
+		endPort = firewall.PortFragment
+
+	} else if strings.Contains(s, `-`) {
+		sPorts := strings.SplitN(s, `-`, 2)
+		sPorts[0] = strings.Trim(sPorts[0], " ")
+		sPorts[1] = strings.Trim(sPorts[1], " ")
+
+		if len(sPorts) != 2 || sPorts[0] == "" || sPorts[1] == "" {
+			return 0, 0, fmt.Errorf("appears to be a range but could not be parsed; `%s`", s)
+		}
+
+		rStartPort, err := strconv.Atoi(sPorts[0])
+		if err != nil {
+			return 0, 0, fmt.Errorf("beginning range was not a number; `%s`", sPorts[0])
+		}
+
+		rEndPort, err := strconv.Atoi(sPorts[1])
+		if err != nil {
+			return 0, 0, fmt.Errorf("ending range was not a number; `%s`", sPorts[1])
+		}
+
+		startPort = int32(rStartPort)
+		endPort = int32(rEndPort)
+
+		if startPort == firewall.PortAny {
+			endPort = firewall.PortAny
+		}
+
+	} else {
 		rPort, err := strconv.Atoi(s)
 		if err != nil {
-			return notAPort, notAPort, fmt.Errorf("was not a number; `%s`", s)
+			return 0, 0, fmt.Errorf("was not a number; `%s`", s)
 		}
-		return int32(rPort), int32(rPort), nil
+		startPort = int32(rPort)
+		endPort = startPort
 	}
 
-	sPorts := strings.SplitN(s, `-`, 2)
+	return
-	for i := range sPorts {
-		sPorts[i] = strings.Trim(sPorts[i], " ")
-	}
-	if len(sPorts) != 2 || sPorts[0] == "" || sPorts[1] == "" {
-		return notAPort, notAPort, fmt.Errorf("appears to be a range but could not be parsed; `%s`", s)
-	}
-
-	rStartPort, err := strconv.Atoi(sPorts[0])
-	if err != nil {
-		return notAPort, notAPort, fmt.Errorf("beginning range was not a number; `%s`", sPorts[0])
-	}
-
-	rEndPort, err := strconv.Atoi(sPorts[1])
-	if err != nil {
-		return notAPort, notAPort, fmt.Errorf("ending range was not a number; `%s`", sPorts[1])
-	}
-
-	startPort := int32(rStartPort)
-	endPort := int32(rEndPort)
-
-	if startPort == firewall.PortAny {
-		endPort = firewall.PortAny
-	}
-
-	return startPort, endPort, nil
 }

firewall/packet.go

@@ -22,19 +22,12 @@ const (
 type Packet struct {
 	LocalAddr  netip.Addr
 	RemoteAddr netip.Addr
-	// LocalPort is the destination port for incoming traffic, or the source port for outgoing. Zero for ICMP.
+	LocalPort  uint16
-	LocalPort uint16
-	// RemotePort is the source port for incoming traffic, or the destination port for outgoing.
-	// For ICMP, it's the "identifier". This is only used for connection tracking, actual firewall rules will not filter on ICMP identifier
 	RemotePort uint16
 	Protocol   uint8
 	Fragment   bool
 }
 
-func (fp *Packet) IsIPv4() bool {
-	return fp.LocalAddr.Is4() && fp.RemoteAddr.Is4()
-}
-
 func (fp *Packet) Copy() *Packet {
 	return &Packet{
 		LocalAddr:  fp.LocalAddr,
@@ -53,8 +46,6 @@ func (fp Packet) MarshalJSON() ([]byte, error) {
 		proto = "tcp"
 	case ProtoICMP:
 		proto = "icmp"
-	case ProtoICMPv6:
-		proto = "icmpv6"
 	case ProtoUDP:
 		proto = "udp"
 	default:

go.mod

@@ -4,38 +4,36 @@ go 1.25
 
 require (
 	dario.cat/mergo v1.0.2
-	filippo.io/bigmod v0.1.0
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/armon/go-radix v1.0.0
 	github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432
 	github.com/flynn/noise v1.1.0
-	github.com/gaissmai/bart v0.26.0
+	github.com/gaissmai/bart v0.25.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
 	github.com/kardianos/service v1.2.4
-	github.com/miekg/dns v1.1.70
+	github.com/miekg/dns v1.1.68
 	github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b
 	github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
-	github.com/sirupsen/logrus v1.9.4
+	github.com/sirupsen/logrus v1.9.3
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
 	github.com/stretchr/testify v1.11.1
 	github.com/vishvananda/netlink v1.3.1
-	go.yaml.in/yaml/v3 v3.0.4
+	golang.org/x/crypto v0.43.0
-	golang.org/x/crypto v0.47.0
 	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
-	golang.org/x/net v0.49.0
+	golang.org/x/net v0.45.0
-	golang.org/x/sync v0.19.0
+	golang.org/x/sync v0.17.0
-	golang.org/x/sys v0.40.0
+	golang.org/x/sys v0.37.0
-	golang.org/x/term v0.39.0
+	golang.org/x/term v0.36.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
-	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
+	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/windows v0.5.3
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/protobuf v1.36.8
 	gopkg.in/yaml.v3 v3.0.1
-	gvisor.dev/gvisor v0.0.0-20240423190808-9d7a357edefe
+	gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c
 )
 
 require (
@@ -50,7 +48,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/mod v0.31.0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/time v0.7.0 // indirect
-	golang.org/x/tools v0.40.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
 )

go.sum

@@ -1,8 +1,6 @@
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
-filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -26,8 +24,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg=
 github.com/flynn/noise v1.1.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
-github.com/gaissmai/bart v0.26.0 h1:xOZ57E9hJLBiQaSyeZa9wgWhGuzfGACgqp4BE77OkO0=
+github.com/gaissmai/bart v0.25.0 h1:eqiokVPqM3F94vJ0bTHXHtH91S8zkKL+bKh+BsGOsJM=
-github.com/gaissmai/bart v0.26.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
+github.com/gaissmai/bart v0.25.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -85,8 +83,8 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
+github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
-github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
+github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
 github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b h1:J/AzCvg5z0Hn1rqZUJjpbzALUmkKX0Zwbc/i4fw7Sfk=
 github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -133,8 +131,8 @@ github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncj
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
@@ -157,23 +155,21 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
 go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 h1:Di6/M8l0O2lCLc6VVRWhgCiApHV8MnQurBnFSHsQtNY=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -184,8 +180,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -193,8 +189,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -208,33 +204,34 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
+golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
-golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
-golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
-golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
-golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -245,8 +242,8 @@ google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miE
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -260,5 +257,5 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gvisor.dev/gvisor v0.0.0-20240423190808-9d7a357edefe h1:fre4i6mv4iBuz5lCMOzHD1rH1ljqHWSICFmZRbbgp3g=
+gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c h1:m/r7OM+Y2Ty1sgBQ7Qb27VgIMBW8ZZhT4gLnUyDIhzI=
-gvisor.dev/gvisor v0.0.0-20240423190808-9d7a357edefe/go.mod h1:sxc3Uvk/vHcd3tj7/DHVBoR5wvWT/MmRq2pj7HRJnwU=
+gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=

handshake_ix.go

@@ -1,8 +1,8 @@
 package nebula
 
 import (
-	"bytes"
 	"net/netip"
+	"slices"
 	"time"
 
 	"github.com/flynn/noise"
@@ -23,17 +23,13 @@ func ixHandshakeStage0(f *Interface, hh *HandshakeHostInfo) bool {
 		return false
 	}
 
+	// If we're connecting to a v6 address we must use a v2 cert
 	cs := f.pki.getCertState()
 	v := cs.initiatingVersion
-	if hh.initiatingVersionOverride != cert.VersionPre1 {
+	for _, a := range hh.hostinfo.vpnAddrs {
-		v = hh.initiatingVersionOverride
+		if a.Is6() {
-	} else if v < cert.Version2 {
+			v = cert.Version2
-		// If we're connecting to a v6 address we should encourage use of a V2 cert
+			break
-		for _, a := range hh.hostinfo.vpnAddrs {
-			if a.Is6() {
-				v = cert.Version2
-				break
-			}
 		}
 	}
 
@@ -52,7 +48,6 @@ func ixHandshakeStage0(f *Interface, hh *HandshakeHostInfo) bool {
 			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).
 			WithField("certVersion", v).
 			Error("Unable to handshake with host because no certificate handshake bytes is available")
-		return false
 	}
 
 	ci, err := NewConnectionState(f.l, cs, crt, true, noise.HandshakeIX)
@@ -100,20 +95,19 @@ func ixHandshakeStage0(f *Interface, hh *HandshakeHostInfo) bool {
 	return true
 }
 
-func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H) {
+func ixHandshakeStage1(f *Interface, addr netip.AddrPort, via *ViaSender, packet []byte, h *header.H) {
 	cs := f.pki.getCertState()
 	crt := cs.GetDefaultCertificate()
 	if crt == nil {
-		f.l.WithField("from", via).
+		f.l.WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 0, "style": "ix_psk0"}).
 			WithField("certVersion", cs.initiatingVersion).
 			Error("Unable to handshake with host because no certificate is available")
-		return
 	}
 
 	ci, err := NewConnectionState(f.l, cs, crt, false, noise.HandshakeIX)
 	if err != nil {
-		f.l.WithError(err).WithField("from", via).
+		f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
 			Error("Failed to create connection state")
 		return
@@ -124,7 +118,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 
 	msg, _, _, err := ci.H.ReadMessage(nil, packet[header.Len:])
 	if err != nil {
-		f.l.WithError(err).WithField("from", via).
+		f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
 			Error("Failed to call noise.ReadMessage")
 		return
@@ -133,7 +127,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 	hs := &NebulaHandshake{}
 	err = hs.Unmarshal(msg)
 	if err != nil || hs.Details == nil {
-		f.l.WithError(err).WithField("from", via).
+		f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
 			Error("Failed unmarshal handshake message")
 		return
@@ -141,7 +135,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 
 	rc, err := cert.Recombine(cert.Version(hs.Details.CertVersion), hs.Details.Cert, ci.H.PeerStatic(), ci.Curve())
 	if err != nil {
-		f.l.WithError(err).WithField("from", via).
+		f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
 			Info("Handshake did not contain a certificate")
 		return
@@ -149,12 +143,12 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 
 	remoteCert, err := f.pki.GetCAPool().VerifyCertificate(time.Now(), rc)
 	if err != nil {
-		fp, fperr := rc.Fingerprint()
+		fp, err := rc.Fingerprint()
-		if fperr != nil {
+		if err != nil {
 			fp = "<error generating certificate fingerprint>"
 		}
 
-		e := f.l.WithError(err).WithField("from", via).
+		e := f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
 			WithField("certVpnNetworks", rc.Networks()).
 			WithField("certFingerprint", fp)
@@ -167,49 +161,39 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 		return
 	}
 
-	if !bytes.Equal(remoteCert.Certificate.PublicKey(), ci.H.PeerStatic()) {
-		f.l.WithField("from", via).
-			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
-			WithField("cert", remoteCert).Info("public key mismatch between certificate and handshake")
-		return
-	}
-
 	if remoteCert.Certificate.Version() != ci.myCert.Version() {
 		// We started off using the wrong certificate version, lets see if we can match the version that was sent to us
-		myCertOtherVersion := cs.getCertificate(remoteCert.Certificate.Version())
+		rc := cs.getCertificate(remoteCert.Certificate.Version())
-		if myCertOtherVersion == nil {
+		if rc == nil {
-			if f.l.Level >= logrus.DebugLevel {
+			f.l.WithError(err).WithField("udpAddr", addr).
-				f.l.WithError(err).WithFields(m{
+				WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).WithField("cert", remoteCert).
-					"from":      via,
+				Info("Unable to handshake with host due to missing certificate version")
-					"handshake": m{"stage": 1, "style": "ix_psk0"},
+			return
-					"cert":      remoteCert,
-				}).Debug("Might be unable to handshake with host due to missing certificate version")
-			}
-		} else {
-			// Record the certificate we are actually using
-			ci.myCert = myCertOtherVersion
 		}
+
+		// Record the certificate we are actually using
+		ci.myCert = rc
 	}
 
 	if len(remoteCert.Certificate.Networks()) == 0 {
-		f.l.WithError(err).WithField("from", via).
+		f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("cert", remoteCert).
 			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
 			Info("No networks in certificate")
 		return
 	}
 
+	var vpnAddrs []netip.Addr
+	var filteredNetworks []netip.Prefix
 	certName := remoteCert.Certificate.Name()
 	certVersion := remoteCert.Certificate.Version()
 	fingerprint := remoteCert.Fingerprint
 	issuer := remoteCert.Certificate.Issuer()
-	vpnNetworks := remoteCert.Certificate.Networks()
 
-	anyVpnAddrsInCommon := false
+	for _, network := range remoteCert.Certificate.Networks() {
-	vpnAddrs := make([]netip.Addr, len(vpnNetworks))
+		vpnAddr := network.Addr()
-	for i, network := range vpnNetworks {
+		if f.myVpnAddrsTable.Contains(vpnAddr) {
-		if f.myVpnAddrsTable.Contains(network.Addr()) {
+			f.l.WithField("vpnAddr", vpnAddr).WithField("udpAddr", addr).
-			f.l.WithField("vpnNetworks", vpnNetworks).WithField("from", via).
 				WithField("certName", certName).
 				WithField("certVersion", certVersion).
 				WithField("fingerprint", fingerprint).
@@ -217,24 +201,38 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 				WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("Refusing to handshake with myself")
 			return
 		}
-		vpnAddrs[i] = network.Addr()
+
-		if f.myVpnNetworksTable.Contains(network.Addr()) {
+		// vpnAddrs outside our vpn networks are of no use to us, filter them out
-			anyVpnAddrsInCommon = true
+		if !f.myVpnNetworksTable.Contains(vpnAddr) {
+			continue
 		}
+
+		filteredNetworks = append(filteredNetworks, network)
+		vpnAddrs = append(vpnAddrs, vpnAddr)
 	}
 
-	if !via.IsRelayed {
+	if len(vpnAddrs) == 0 {
+		f.l.WithError(err).WithField("udpAddr", addr).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("No usable vpn addresses from host, refusing handshake")
+		return
+	}
+
+	if addr.IsValid() {
+		// addr can be invalid when the tunnel is being relayed.
 		// We only want to apply the remote allow list for direct tunnels here
-		if !f.lightHouse.GetRemoteAllowList().AllowAll(vpnAddrs, via.UdpAddr.Addr()) {
+		if !f.lightHouse.GetRemoteAllowList().AllowAll(vpnAddrs, addr.Addr()) {
-			f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).Debug("lighthouse.remote_allow_list denied incoming handshake")
-				Debug("lighthouse.remote_allow_list denied incoming handshake")
 			return
 		}
 	}
 
 	myIndex, err := generateIndex(f.l)
 	if err != nil {
-		f.l.WithError(err).WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+		f.l.WithError(err).WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
 			WithField("certName", certName).
 			WithField("certVersion", certVersion).
 			WithField("fingerprint", fingerprint).
@@ -257,30 +255,26 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 		},
 	}
 
-	msgRxL := f.l.WithFields(m{
+	f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
-		"vpnAddrs":       vpnAddrs,
+		WithField("certName", certName).
-		"from":           via,
+		WithField("certVersion", certVersion).
-		"certName":       certName,
+		WithField("fingerprint", fingerprint).
-		"certVersion":    certVersion,
+		WithField("issuer", issuer).
-		"fingerprint":    fingerprint,
+		WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
-		"issuer":         issuer,
+		WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
-		"initiatorIndex": hs.Details.InitiatorIndex,
+		Info("Handshake message received")
-		"responderIndex": hs.Details.ResponderIndex,
-		"remoteIndex":    h.RemoteIndex,
-		"handshake":      m{"stage": 1, "style": "ix_psk0"},
-	})
-
-	if anyVpnAddrsInCommon {
-		msgRxL.Info("Handshake message received")
-	} else {
-		//todo warn if not lighthouse or relay?
-		msgRxL.Info("Handshake message received, but no vpnNetworks in common.")
-	}
 
 	hs.Details.ResponderIndex = myIndex
 	hs.Details.Cert = cs.getHandshakeBytes(ci.myCert.Version())
 	if hs.Details.Cert == nil {
-		msgRxL.WithField("myCertVersion", ci.myCert.Version()).
+		f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+			WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			WithField("certVersion", ci.myCert.Version()).
 			Error("Unable to handshake with host because no certificate handshake bytes is available")
 		return
 	}
@@ -291,7 +285,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 
 	hsBytes, err := hs.Marshal()
 	if err != nil {
-		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("udpAddr", addr).
 			WithField("certName", certName).
 			WithField("certVersion", certVersion).
 			WithField("fingerprint", fingerprint).
@@ -303,7 +297,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 	nh := header.Encode(make([]byte, header.Len), header.Version, header.Handshake, header.HandshakeIXPSK0, hs.Details.InitiatorIndex, 2)
 	msg, dKey, eKey, err := ci.H.WriteMessage(nh, hsBytes)
 	if err != nil {
-		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("udpAddr", addr).
 			WithField("certName", certName).
 			WithField("certVersion", certVersion).
 			WithField("fingerprint", fingerprint).
@@ -311,7 +305,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).Error("Failed to call noise.WriteMessage")
 		return
 	} else if dKey == nil || eKey == nil {
-		f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+		f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("udpAddr", addr).
 			WithField("certName", certName).
 			WithField("certVersion", certVersion).
 			WithField("fingerprint", fingerprint).
@@ -337,17 +331,15 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 	ci.eKey = NewNebulaCipherState(eKey)
 
 	hostinfo.remotes = f.lightHouse.QueryCache(vpnAddrs)
-	if !via.IsRelayed {
+	hostinfo.SetRemote(addr)
-		hostinfo.SetRemote(via.UdpAddr)
+	hostinfo.buildNetworks(filteredNetworks, remoteCert.Certificate.UnsafeNetworks())
-	}
-	hostinfo.buildNetworks(f.myVpnNetworksTable, remoteCert.Certificate)
 
 	existing, err := f.handshakeManager.CheckAndComplete(hostinfo, 0, f)
 	if err != nil {
 		switch err {
 		case ErrAlreadySeen:
 			// Update remote if preferred
-			if existing.SetRemoteIfPreferred(f.hostMap, via) {
+			if existing.SetRemoteIfPreferred(f.hostMap, addr) {
 				// Send a test packet to ensure the other side has also switched to
 				// the preferred remote
 				f.SendMessageToVpnAddr(header.Test, header.TestRequest, vpnAddrs[0], []byte(""), make([]byte, 12, 12), make([]byte, mtu))
@@ -355,21 +347,21 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 
 			msg = existing.HandshakePacket[2]
 			f.messageMetrics.Tx(header.Handshake, header.MessageSubType(msg[1]), 1)
-			if !via.IsRelayed {
+			if addr.IsValid() {
-				err := f.outside.WriteTo(msg, via.UdpAddr)
+				err := f.outside.WriteTo(msg, addr)
 				if err != nil {
-					f.l.WithField("vpnAddrs", existing.vpnAddrs).WithField("from", via).
+					f.l.WithField("vpnAddrs", existing.vpnAddrs).WithField("udpAddr", addr).
 						WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).WithField("cached", true).
 						WithError(err).Error("Failed to send handshake message")
 				} else {
-					f.l.WithField("vpnAddrs", existing.vpnAddrs).WithField("from", via).
+					f.l.WithField("vpnAddrs", existing.vpnAddrs).WithField("udpAddr", addr).
 						WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).WithField("cached", true).
 						Info("Handshake message sent")
 				}
 				return
 			} else {
-				if via.relay == nil {
+				if via == nil {
-					f.l.Error("Handshake send failed: both addr and via.relay are nil.")
+					f.l.Error("Handshake send failed: both addr and via are nil.")
 					return
 				}
 				hostinfo.relayState.InsertRelayTo(via.relayHI.vpnAddrs[0])
@@ -381,7 +373,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 			}
 		case ErrExistingHostInfo:
 			// This means there was an existing tunnel and this handshake was older than the one we are currently based on
-			f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
 				WithField("certName", certName).
 				WithField("certVersion", certVersion).
 				WithField("oldHandshakeTime", existing.lastHandshakeTime).
@@ -397,7 +389,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 			return
 		case ErrLocalIndexCollision:
 			// This means we failed to insert because of collision on localIndexId. Just let the next handshake packet retry
-			f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
 				WithField("certName", certName).
 				WithField("certVersion", certVersion).
 				WithField("fingerprint", fingerprint).
@@ -410,7 +402,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 		default:
 			// Shouldn't happen, but just in case someone adds a new error type to CheckAndComplete
 			// And we forget to update it here
-			f.l.WithError(err).WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+			f.l.WithError(err).WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
 				WithField("certName", certName).
 				WithField("certVersion", certVersion).
 				WithField("fingerprint", fingerprint).
@@ -424,23 +416,30 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 
 	// Do the send
 	f.messageMetrics.Tx(header.Handshake, header.MessageSubType(msg[1]), 1)
-	if !via.IsRelayed {
+	if addr.IsValid() {
-		err = f.outside.WriteTo(msg, via.UdpAddr)
+		err = f.outside.WriteTo(msg, addr)
-		log := f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
-			WithField("certName", certName).
-			WithField("certVersion", certVersion).
-			WithField("fingerprint", fingerprint).
-			WithField("issuer", issuer).
-			WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
-			WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 2, "style": "ix_psk0"})
 		if err != nil {
-			log.WithError(err).Error("Failed to send handshake")
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
+				WithField("certName", certName).
+				WithField("certVersion", certVersion).
+				WithField("fingerprint", fingerprint).
+				WithField("issuer", issuer).
+				WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+				WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+				WithError(err).Error("Failed to send handshake")
 		} else {
-			log.Info("Handshake message sent")
+			f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
+				WithField("certName", certName).
+				WithField("certVersion", certVersion).
+				WithField("fingerprint", fingerprint).
+				WithField("issuer", issuer).
+				WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
+				WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+				Info("Handshake message sent")
 		}
 	} else {
-		if via.relay == nil {
+		if via == nil {
-			f.l.Error("Handshake send failed: both addr and via.relay are nil.")
+			f.l.Error("Handshake send failed: both addr and via are nil.")
 			return
 		}
 		hostinfo.relayState.InsertRelayTo(via.relayHI.vpnAddrs[0])
@@ -465,7 +464,7 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 	return
 }
 
-func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packet []byte, h *header.H) bool {
+func ixHandshakeStage2(f *Interface, addr netip.AddrPort, via *ViaSender, hh *HandshakeHostInfo, packet []byte, h *header.H) bool {
 	if hh == nil {
 		// Nothing here to tear down, got a bogus stage 2 packet
 		return true
@@ -475,10 +474,10 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 	defer hh.Unlock()
 
 	hostinfo := hh.hostinfo
-	if !via.IsRelayed {
+	if addr.IsValid() {
 		// The vpnAddr we know about is the one we tried to handshake with, use it to apply the remote allow list.
-		if !f.lightHouse.GetRemoteAllowList().AllowAll(hostinfo.vpnAddrs, via.UdpAddr.Addr()) {
+		if !f.lightHouse.GetRemoteAllowList().AllowAll(hostinfo.vpnAddrs, addr.Addr()) {
-			f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).Debug("lighthouse.remote_allow_list denied incoming handshake")
+			f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("udpAddr", addr).Debug("lighthouse.remote_allow_list denied incoming handshake")
 			return false
 		}
 	}
@@ -486,7 +485,7 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 	ci := hostinfo.ConnectionState
 	msg, eKey, dKey, err := ci.H.ReadMessage(nil, packet[header.Len:])
 	if err != nil {
-		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).WithField("header", h).
 			Error("Failed to call noise.ReadMessage")
 
@@ -495,7 +494,7 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 		// near future
 		return false
 	} else if dKey == nil || eKey == nil {
-		f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+		f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
 			Error("Noise did not arrive at a key")
 
@@ -507,7 +506,7 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 	hs := &NebulaHandshake{}
 	err = hs.Unmarshal(msg)
 	if err != nil || hs.Details == nil {
-		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("from", via).
+		f.l.WithError(err).WithField("vpnAddrs", hostinfo.vpnAddrs).WithField("udpAddr", addr).
 			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).Error("Failed unmarshal handshake message")
 
 		// The handshake state machine is complete, if things break now there is no chance to recover. Tear down and start again
@@ -516,7 +515,7 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 
 	rc, err := cert.Recombine(cert.Version(hs.Details.CertVersion), hs.Details.Cert, ci.H.PeerStatic(), ci.Curve())
 	if err != nil {
-		f.l.WithError(err).WithField("from", via).
+		f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("vpnAddrs", hostinfo.vpnAddrs).
 			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
 			Info("Handshake did not contain a certificate")
@@ -530,7 +529,7 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 			fp = "<error generating certificate fingerprint>"
 		}
 
-		e := f.l.WithError(err).WithField("from", via).
+		e := f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("vpnAddrs", hostinfo.vpnAddrs).
 			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
 			WithField("certFingerprint", fp).
@@ -543,15 +542,9 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 		e.Info("Invalid certificate from host")
 		return true
 	}
-	if !bytes.Equal(remoteCert.Certificate.PublicKey(), ci.H.PeerStatic()) {
-		f.l.WithField("from", via).
-			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
-			WithField("cert", remoteCert).Info("public key mismatch between certificate and handshake")
-		return true
-	}
 
 	if len(remoteCert.Certificate.Networks()) == 0 {
-		f.l.WithError(err).WithField("from", via).
+		f.l.WithError(err).WithField("udpAddr", addr).
 			WithField("vpnAddrs", hostinfo.vpnAddrs).
 			WithField("cert", remoteCert).
 			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
@@ -574,30 +567,39 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 	ci.eKey = NewNebulaCipherState(eKey)
 
 	// Make sure the current udpAddr being used is set for responding
-	if !via.IsRelayed {
+	if addr.IsValid() {
-		hostinfo.SetRemote(via.UdpAddr)
+		hostinfo.SetRemote(addr)
 	} else {
 		hostinfo.relayState.InsertRelayTo(via.relayHI.vpnAddrs[0])
 	}
 
-	correctHostResponded := false
+	var vpnAddrs []netip.Addr
-	anyVpnAddrsInCommon := false
+	var filteredNetworks []netip.Prefix
-	vpnAddrs := make([]netip.Addr, len(vpnNetworks))
+	for _, network := range vpnNetworks {
-	for i, network := range vpnNetworks {
+		// vpnAddrs outside our vpn networks are of no use to us, filter them out
-		vpnAddrs[i] = network.Addr()
+		vpnAddr := network.Addr()
-		if f.myVpnNetworksTable.Contains(network.Addr()) {
+		if !f.myVpnNetworksTable.Contains(vpnAddr) {
-			anyVpnAddrsInCommon = true
+			continue
-		}
-		if hostinfo.vpnAddrs[0] == network.Addr() {
-			// todo is it more correct to see if any of hostinfo.vpnAddrs are in the cert? it should have len==1, but one day it might not?
-			correctHostResponded = true
 		}
+
+		filteredNetworks = append(filteredNetworks, network)
+		vpnAddrs = append(vpnAddrs, vpnAddr)
+	}
+
+	if len(vpnAddrs) == 0 {
+		f.l.WithError(err).WithField("udpAddr", addr).
+			WithField("certName", certName).
+			WithField("certVersion", certVersion).
+			WithField("fingerprint", fingerprint).
+			WithField("issuer", issuer).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).Error("No usable vpn addresses from host, refusing handshake")
+		return true
 	}
 
 	// Ensure the right host responded
-	if !correctHostResponded {
+	if !slices.Contains(vpnAddrs, hostinfo.vpnAddrs[0]) {
 		f.l.WithField("intendedVpnAddrs", hostinfo.vpnAddrs).WithField("haveVpnNetworks", vpnNetworks).
-			WithField("from", via).
+			WithField("udpAddr", addr).
 			WithField("certName", certName).
 			WithField("certVersion", certVersion).
 			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
@@ -607,11 +609,10 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 		f.handshakeManager.DeleteHostInfo(hostinfo)
 
 		// Create a new hostinfo/handshake for the intended vpn ip
-		//TODO is hostinfo.vpnAddrs[0] always the address to use?
 		f.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], func(newHH *HandshakeHostInfo) {
 			// Block the current used address
 			newHH.hostinfo.remotes = hostinfo.remotes
-			newHH.hostinfo.remotes.BlockRemote(via)
+			newHH.hostinfo.remotes.BlockRemote(addr)
 
 			f.l.WithField("blockedUdpAddrs", newHH.hostinfo.remotes.CopyBlockedRemotes()).
 				WithField("vpnNetworks", vpnNetworks).
@@ -634,7 +635,7 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 	ci.window.Update(f.l, 2)
 
 	duration := time.Since(hh.startTime).Nanoseconds()
-	msgRxL := f.l.WithField("vpnAddrs", vpnAddrs).WithField("from", via).
+	f.l.WithField("vpnAddrs", vpnAddrs).WithField("udpAddr", addr).
 		WithField("certName", certName).
 		WithField("certVersion", certVersion).
 		WithField("fingerprint", fingerprint).
@@ -642,17 +643,12 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 		WithField("initiatorIndex", hs.Details.InitiatorIndex).WithField("responderIndex", hs.Details.ResponderIndex).
 		WithField("remoteIndex", h.RemoteIndex).WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
 		WithField("durationNs", duration).
-		WithField("sentCachedPackets", len(hh.packetStore))
+		WithField("sentCachedPackets", len(hh.packetStore)).
-	if anyVpnAddrsInCommon {
+		Info("Handshake message received")
-		msgRxL.Info("Handshake message received")
-	} else {
-		//todo warn if not lighthouse or relay?
-		msgRxL.Info("Handshake message received, but no vpnNetworks in common.")
-	}
 
 	// Build up the radix for the firewall if we have subnets in the cert
 	hostinfo.vpnAddrs = vpnAddrs
-	hostinfo.buildNetworks(f.myVpnNetworksTable, remoteCert.Certificate)
+	hostinfo.buildNetworks(filteredNetworks, remoteCert.Certificate.UnsafeNetworks())
 
 	// Complete our handshake and update metrics, this will replace any existing tunnels for the vpnAddrs here
 	f.handshakeManager.Complete(hostinfo, f)

handshake_manager.go

@@ -68,12 +68,11 @@ type HandshakeManager struct {
 type HandshakeHostInfo struct {
 	sync.Mutex
 
-	startTime                 time.Time        // Time that we first started trying with this handshake
+	startTime   time.Time        // Time that we first started trying with this handshake
-	ready                     bool             // Is the handshake ready
+	ready       bool             // Is the handshake ready
-	initiatingVersionOverride cert.Version     // Should we use a non-default cert version for this handshake?
+	counter     int64            // How many attempts have we made so far
-	counter                   int64            // How many attempts have we made so far
+	lastRemotes []netip.AddrPort // Remotes that we sent to during the previous attempt
-	lastRemotes               []netip.AddrPort // Remotes that we sent to during the previous attempt
+	packetStore []*cachedPacket  // A set of packets to be transmitted once the handshake completes
-	packetStore               []*cachedPacket  // A set of packets to be transmitted once the handshake completes
 
 	hostinfo *HostInfo
 }
@@ -136,11 +135,11 @@ func (hm *HandshakeManager) Run(ctx context.Context) {
 	}
 }
 
-func (hm *HandshakeManager) HandleIncoming(via ViaSender, packet []byte, h *header.H) {
+func (hm *HandshakeManager) HandleIncoming(addr netip.AddrPort, via *ViaSender, packet []byte, h *header.H) {
 	// First remote allow list check before we know the vpnIp
-	if !via.IsRelayed {
+	if addr.IsValid() {
-		if !hm.lightHouse.GetRemoteAllowList().AllowUnknownVpnAddr(via.UdpAddr.Addr()) {
+		if !hm.lightHouse.GetRemoteAllowList().AllowUnknownVpnAddr(addr.Addr()) {
-			hm.l.WithField("from", via).Debug("lighthouse.remote_allow_list denied incoming handshake")
+			hm.l.WithField("udpAddr", addr).Debug("lighthouse.remote_allow_list denied incoming handshake")
 			return
 		}
 	}
@@ -149,11 +148,11 @@ func (hm *HandshakeManager) HandleIncoming(via ViaSender, packet []byte, h *head
 	case header.HandshakeIXPSK0:
 		switch h.MessageCounter {
 		case 1:
-			ixHandshakeStage1(hm.f, via, packet, h)
+			ixHandshakeStage1(hm.f, addr, via, packet, h)
 
 		case 2:
 			newHostinfo := hm.queryIndex(h.RemoteIndex)
-			tearDown := ixHandshakeStage2(hm.f, via, newHostinfo, packet, h)
+			tearDown := ixHandshakeStage2(hm.f, addr, via, newHostinfo, packet, h)
 			if tearDown && newHostinfo != nil {
 				hm.DeleteHostInfo(newHostinfo.hostinfo)
 			}
@@ -269,12 +268,12 @@ func (hm *HandshakeManager) handleOutbound(vpnIp netip.Addr, lighthouseTriggered
 		hostinfo.logger(hm.l).WithField("relays", hostinfo.remotes.relays).Info("Attempt to relay through hosts")
 		// Send a RelayRequest to all known Relay IP's
 		for _, relay := range hostinfo.remotes.relays {
-			// Don't relay through the host I'm trying to connect to
+			// Don't relay to myself
 			if relay == vpnIp {
 				continue
 			}
 
-			// Don't relay to myself
+			// Don't relay through the host I'm trying to connect to
 			if hm.f.myVpnAddrsTable.Contains(relay) {
 				continue
 			}
@@ -590,7 +589,7 @@ func (hm *HandshakeManager) allocateIndex(hh *HandshakeHostInfo) error {
 	hm.Lock()
 	defer hm.Unlock()
 
-	for range 32 {
+	for i := 0; i < 32; i++ {
 		index, err := generateIndex(hm.l)
 		if err != nil {
 			return err

hostmap.go

@@ -1,9 +1,7 @@
 package nebula
 
 import (
-	"encoding/json"
 	"errors"
-	"fmt"
 	"net"
 	"net/netip"
 	"slices"
@@ -214,21 +212,6 @@ func (rs *RelayState) InsertRelay(ip netip.Addr, idx uint32, r *Relay) {
 	rs.relayForByIdx[idx] = r
 }
 
-type NetworkType uint8
-
-const (
-	NetworkTypeUnknown NetworkType = iota
-	// NetworkTypeVPN is a network that overlaps one or more of the vpnNetworks in our certificate
-	NetworkTypeVPN
-	// NetworkTypeVPNPeer is a network that does not overlap one of our networks
-	NetworkTypeVPNPeer
-	// NetworkTypeUnsafe is a network from Certificate.UnsafeNetworks()
-	NetworkTypeUnsafe
-	// NetworkTypeUnverifiedSNATPeer is used to indicate traffic we're willing to route, but never deliver to a NetworkTypeVPN
-	NetworkTypeUnverifiedSNATPeer
-	NetworkTypeInvalidPeer
-)
-
 type HostInfo struct {
 	remote          netip.AddrPort
 	remotes         *RemoteList
@@ -242,8 +225,8 @@ type HostInfo struct {
 	// vpn networks but were removed because they are not usable
 	vpnAddrs []netip.Addr
 
-	// networks is a combination of specific vpn addresses (not prefixes!) and full unsafe networks assigned to this host.
+	// networks are both all vpn and unsafe networks assigned to this host
-	networks   *bart.Table[NetworkType]
+	networks   *bart.Lite
 	relayState RelayState
 
 	// HandshakePacket records the packets used to create this hostinfo
@@ -280,35 +263,10 @@ type HostInfo struct {
 	lastUsed time.Time
 }
 
-func (i *HostInfo) HasOnlyV6Addresses() bool {
-	for _, vpnIp := range i.vpnAddrs {
-		if !vpnIp.Is6() {
-			return false
-		}
-	}
-	return true
-}
-
 type ViaSender struct {
-	UdpAddr   netip.AddrPort
 	relayHI   *HostInfo // relayHI is the host info object of the relay
 	remoteIdx uint32    // remoteIdx is the index included in the header of the received packet
 	relay     *Relay    // relay contains the rest of the relay information, including the PeerIP of the host trying to communicate with us.
-	IsRelayed bool      // IsRelayed is true if the packet was sent through a relay
-}
-
-func (v ViaSender) String() string {
-	if v.IsRelayed {
-		return fmt.Sprintf("%s (relayed)", v.UdpAddr)
-	}
-	return v.UdpAddr.String()
-}
-
-func (v ViaSender) MarshalJSON() ([]byte, error) {
-	if v.IsRelayed {
-		return json.Marshal(m{"relay": v.UdpAddr})
-	}
-	return json.Marshal(m{"direct": v.UdpAddr})
 }
 
 type cachedPacket struct {
@@ -724,7 +682,6 @@ func (i *HostInfo) GetCert() *cert.CachedCertificate {
 	return nil
 }
 
-// TODO: Maybe use ViaSender here?
 func (i *HostInfo) SetRemote(remote netip.AddrPort) {
 	// We copy here because we likely got this remote from a source that reuses the object
 	if i.remote != remote {
@@ -735,14 +692,14 @@ func (i *HostInfo) SetRemote(remote netip.AddrPort) {
 
 // SetRemoteIfPreferred returns true if the remote was changed. The lastRoam
 // time on the HostInfo will also be updated.
-func (i *HostInfo) SetRemoteIfPreferred(hm *HostMap, via ViaSender) bool {
+func (i *HostInfo) SetRemoteIfPreferred(hm *HostMap, newRemote netip.AddrPort) bool {
-	if via.IsRelayed {
+	if !newRemote.IsValid() {
+		// relays have nil udp Addrs
 		return false
 	}
-
 	currentRemote := i.remote
 	if !currentRemote.IsValid() {
-		i.SetRemote(via.UdpAddr)
+		i.SetRemote(newRemote)
 		return true
 	}
 
@@ -755,7 +712,7 @@ func (i *HostInfo) SetRemoteIfPreferred(hm *HostMap, via ViaSender) bool {
 			return false
 		}
 
-		if l.Contains(via.UdpAddr.Addr()) {
+		if l.Contains(newRemote.Addr()) {
 			newIsPreferred = true
 		}
 	}
@@ -765,7 +722,7 @@ func (i *HostInfo) SetRemoteIfPreferred(hm *HostMap, via ViaSender) bool {
 		i.lastRoam = time.Now()
 		i.lastRoamRemote = currentRemote
 
-		i.SetRemote(via.UdpAddr)
+		i.SetRemote(newRemote)
 
 		return true
 	}
@@ -773,26 +730,20 @@ func (i *HostInfo) SetRemoteIfPreferred(hm *HostMap, via ViaSender) bool {
 	return false
 }
 
-// buildNetworks fills in the networks field of HostInfo. It accepts a cert.Certificate so you never ever mix the network types up.
+func (i *HostInfo) buildNetworks(networks, unsafeNetworks []netip.Prefix) {
-func (i *HostInfo) buildNetworks(myVpnNetworksTable *bart.Lite, c cert.Certificate) {
+	if len(networks) == 1 && len(unsafeNetworks) == 0 {
-	if len(c.Networks()) == 1 && len(c.UnsafeNetworks()) == 0 {
+		// Simple case, no CIDRTree needed
-		if myVpnNetworksTable.Contains(c.Networks()[0].Addr()) {
+		return
-			return // Simple case, no BART needed
-		}
 	}
 
-	i.networks = new(bart.Table[NetworkType])
+	i.networks = new(bart.Lite)
-	for _, network := range c.Networks() {
+	for _, network := range networks {
 		nprefix := netip.PrefixFrom(network.Addr(), network.Addr().BitLen())
-		if myVpnNetworksTable.Contains(network.Addr()) {
+		i.networks.Insert(nprefix)
-			i.networks.Insert(nprefix, NetworkTypeVPN)
-		} else {
-			i.networks.Insert(nprefix, NetworkTypeVPNPeer)
-		}
 	}
 
-	for _, network := range c.UnsafeNetworks() {
+	for _, network := range unsafeNetworks {
-		i.networks.Insert(network, NetworkTypeUnsafe)
+		i.networks.Insert(network)
 	}
 }
 

hostmap_tester.go

@@ -1,4 +1,5 @@
 //go:build e2e_testing
+// +build e2e_testing
 
 package nebula
 

inside.go

@@ -33,8 +33,7 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		// routes packets from the Nebula addr to the Nebula addr through the Nebula
 		// TUN device.
 		if immediatelyForwardToSelf {
-			_, err := f.readers[q].Write(packet)
+			if err := f.writeTun(q, packet); err != nil {
-			if err != nil {
 				f.l.WithError(err).Error("Failed to forward to tun")
 			}
 		}
@@ -48,7 +47,9 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		return
 	}
 
-	hostinfo, ready := f.getHostinfo(packet, fwPacket)
+	hostinfo, ready := f.getOrHandshakeConsiderRouting(fwPacket, func(hh *HandshakeHostInfo) {
+		hh.cachePacket(f.l, header.Message, 0, packet, f.sendMessageNow, f.cachedPacketMetrics)
+	})
 
 	if hostinfo == nil {
 		f.rejectInside(packet, out, q)
@@ -64,9 +65,10 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		return
 	}
 
-	dropReason := f.firewall.Drop(*fwPacket, packet, false, hostinfo, f.pki.GetCAPool(), localCache)
+	dropReason := f.firewall.Drop(*fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason == nil {
 		f.sendNoMetrics(header.Message, 0, hostinfo.ConnectionState, hostinfo, netip.AddrPort{}, packet, nb, out, q)
+
 	} else {
 		f.rejectInside(packet, out, q)
 		if f.l.Level >= logrus.DebugLevel {
@@ -78,26 +80,6 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 	}
 }
 
-func (f *Interface) getHostinfo(packet []byte, fwPacket *firewall.Packet) (*HostInfo, bool) {
-	if f.firewall.ShouldUnSNAT(fwPacket) {
-		//unsnat packet re-writing also happens here, would be nice to not,
-		//but we need to do the unsnat lookup to find the hostinfo so we can run the firewall checks
-		destVpnAddr := f.firewall.unSnat(packet, fwPacket)
-		if destVpnAddr.IsValid() {
-			//because this was a snatted packet, we know it has an on-overlay destination, so no routing should be required.
-			return f.getOrHandshakeNoRouting(destVpnAddr, func(hh *HandshakeHostInfo) {
-				hh.cachePacket(f.l, header.Message, 0, packet, f.sendMessageNow, f.cachedPacketMetrics)
-			})
-		} else {
-			return nil, false
-		}
-	} else { //if we didn't need to unsnat
-		return f.getOrHandshakeConsiderRouting(fwPacket, func(hh *HandshakeHostInfo) {
-			hh.cachePacket(f.l, header.Message, 0, packet, f.sendMessageNow, f.cachedPacketMetrics)
-		})
-	}
-}
-
 func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
 	if !f.firewall.InSendReject {
 		return
@@ -108,8 +90,7 @@ func (f *Interface) rejectInside(packet []byte, out []byte, q int) {
 		return
 	}
 
-	_, err := f.readers[q].Write(out)
+	if err := f.writeTun(q, out); err != nil {
-	if err != nil {
 		f.l.WithError(err).Error("Failed to write to tun")
 	}
 }
@@ -137,10 +118,9 @@ func (f *Interface) rejectOutside(packet []byte, ci *ConnectionState, hostinfo *
 	f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, out, nb, packet, q)
 }
 
-// Handshake will attempt to initiate a tunnel with the provided vpn address. This is a no-op if the tunnel is already established or being established
+// Handshake will attempt to initiate a tunnel with the provided vpn address if it is within our vpn networks. This is a no-op if the tunnel is already established or being established
-// it does not check if it is within our vpn networks!
 func (f *Interface) Handshake(vpnAddr netip.Addr) {
-	f.handshakeManager.GetOrHandshake(vpnAddr, nil)
+	f.getOrHandshakeNoRouting(vpnAddr, nil)
 }
 
 // getOrHandshakeNoRouting returns nil if the vpnAddr is not routable.
@@ -156,6 +136,7 @@ func (f *Interface) getOrHandshakeNoRouting(vpnAddr netip.Addr, cacheCallback fu
 // getOrHandshakeConsiderRouting will try to find the HostInfo to handle this packet, starting a handshake if necessary.
 // If the 2nd return var is false then the hostinfo is not ready to be used in a tunnel.
 func (f *Interface) getOrHandshakeConsiderRouting(fwPacket *firewall.Packet, cacheCallback func(*HandshakeHostInfo)) (*HostInfo, bool) {
+
 	destinationAddr := fwPacket.RemoteAddr
 
 	hostinfo, ready := f.getOrHandshakeNoRouting(destinationAddr, cacheCallback)
@@ -235,7 +216,7 @@ func (f *Interface) sendMessageNow(t header.MessageType, st header.MessageSubTyp
 	}
 
 	// check if packet is in outbound fw rules
-	dropReason := f.firewall.Drop(*fp, p, false, hostinfo, f.pki.GetCAPool(), nil)
+	dropReason := f.firewall.Drop(*fp, false, hostinfo, f.pki.GetCAPool(), nil)
 	if dropReason != nil {
 		if f.l.Level >= logrus.DebugLevel {
 			f.l.WithField("fwPacket", fp).
@@ -248,10 +229,9 @@ func (f *Interface) sendMessageNow(t header.MessageType, st header.MessageSubTyp
 	f.sendNoMetrics(header.Message, st, hostinfo.ConnectionState, hostinfo, netip.AddrPort{}, p, nb, out, 0)
 }
 
-// SendMessageToVpnAddr handles real addr:port lookup and sends to the current best known address for vpnAddr.
+// SendMessageToVpnAddr handles real addr:port lookup and sends to the current best known address for vpnAddr
-// This function ignores myVpnNetworksTable, and will always attempt to treat the address as a vpnAddr
 func (f *Interface) SendMessageToVpnAddr(t header.MessageType, st header.MessageSubType, vpnAddr netip.Addr, p, nb, out []byte) {
-	hostInfo, ready := f.handshakeManager.GetOrHandshake(vpnAddr, func(hh *HandshakeHostInfo) {
+	hostInfo, ready := f.getOrHandshakeNoRouting(vpnAddr, func(hh *HandshakeHostInfo) {
 		hh.cachePacket(f.l, t, st, p, f.SendMessageToHostInfo, f.cachedPacketMetrics)
 	})
 

inside_bsd.go

@@ -1,4 +1,5 @@
 //go:build darwin || dragonfly || freebsd || netbsd || openbsd
+// +build darwin dragonfly freebsd netbsd openbsd
 
 package nebula
 

inside_generic.go

@@ -1,4 +1,5 @@
 //go:build !darwin && !dragonfly && !freebsd && !netbsd && !openbsd
+// +build !darwin,!dragonfly,!freebsd,!netbsd,!openbsd
 
 package nebula
 

interface.go

@@ -47,6 +47,7 @@ type InterfaceConfig struct {
 	reQueryWait     time.Duration
 
 	ConntrackCacheTimeout time.Duration
+	batchSize             int
 	l                     *logrus.Logger
 }
 
@@ -77,14 +78,14 @@ type Interface struct {
 	reQueryEvery    atomic.Uint32
 	reQueryWait     atomic.Int64
 
-	sendRecvErrorConfig   recvErrorConfig
+	sendRecvErrorConfig sendRecvErrorConfig
-	acceptRecvErrorConfig recvErrorConfig
 
 	// rebindCount is used to decide if an active tunnel should trigger a punch notification through a lighthouse
 	rebindCount int8
 	version     string
 
 	conntrackCacheTimeout time.Duration
+	batchSize             int
 
 	writers []udp.Conn
 	readers []io.ReadWriteCloser
@@ -111,34 +112,44 @@ type EncWriter interface {
 	GetCertState() *CertState
 }
 
-type recvErrorConfig uint8
+// BatchReader is an interface for readers that support vectorized packet reading
+type BatchReader interface {
+	BatchRead(buffers [][]byte, sizes []int) (int, error)
+}
+
+// BatchWriter is an interface for writers that support vectorized packet writing
+type BatchWriter interface {
+	BatchWrite([][]byte) (int, error)
+}
+
+type sendRecvErrorConfig uint8
 
 const (
-	recvErrorAlways recvErrorConfig = iota
+	sendRecvErrorAlways sendRecvErrorConfig = iota
-	recvErrorNever
+	sendRecvErrorNever
-	recvErrorPrivate
+	sendRecvErrorPrivate
 )
 
-func (s recvErrorConfig) ShouldRecvError(endpoint netip.AddrPort) bool {
+func (s sendRecvErrorConfig) ShouldSendRecvError(endpoint netip.AddrPort) bool {
 	switch s {
-	case recvErrorPrivate:
+	case sendRecvErrorPrivate:
 		return endpoint.Addr().IsPrivate()
-	case recvErrorAlways:
+	case sendRecvErrorAlways:
 		return true
-	case recvErrorNever:
+	case sendRecvErrorNever:
 		return false
 	default:
-		panic(fmt.Errorf("invalid recvErrorConfig value: %d", s))
+		panic(fmt.Errorf("invalid sendRecvErrorConfig value: %d", s))
 	}
 }
 
-func (s recvErrorConfig) String() string {
+func (s sendRecvErrorConfig) String() string {
 	switch s {
-	case recvErrorAlways:
+	case sendRecvErrorAlways:
 		return "always"
-	case recvErrorNever:
+	case sendRecvErrorNever:
 		return "never"
-	case recvErrorPrivate:
+	case sendRecvErrorPrivate:
 		return "private"
 	default:
 		return fmt.Sprintf("invalid(%d)", s)
@@ -187,6 +198,7 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		relayManager:          c.relayManager,
 		connectionManager:     c.connectionManager,
 		conntrackCacheTimeout: c.ConntrackCacheTimeout,
+		batchSize:             c.batchSize,
 
 		metricHandshakes: metrics.GetOrRegisterHistogram("handshakes", nil, metrics.NewExpDecaySample(1028, 0.015)),
 		messageMetrics:   c.MessageMetrics,
@@ -223,13 +235,6 @@ func (f *Interface) activate() {
 		WithField("boringcrypto", boringEnabled()).
 		Info("Nebula interface is active")
 
-	if f.routines > 1 {
-		if !f.inside.SupportsMultiqueue() || !f.outside.SupportsMultipleReaders() {
-			f.routines = 1
-			f.l.Warn("routines is not supported on this platform, falling back to a single routine")
-		}
-	}
-
 	metrics.GetOrRegisterGauge("routines", nil).Update(int64(f.routines))
 
 	// Prepare n tun queues
@@ -248,7 +253,6 @@ func (f *Interface) activate() {
 		f.inside.Close()
 		f.l.Fatal(err)
 	}
-	f.firewall.SetSNATAddressFromInterface(f)
 }
 
 func (f *Interface) run() {
@@ -278,16 +282,26 @@ func (f *Interface) listenOut(i int) {
 	plaintext := make([]byte, udp.MTU)
 	h := &header.H{}
 	fwPacket := &firewall.Packet{}
-	nb := make([]byte, 12, 12)
+	nb := make([]byte, 12)
 
 	li.ListenOut(func(fromUdpAddr netip.AddrPort, payload []byte) {
-		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr}, plaintext[:0], payload, h, fwPacket, lhh, nb, i, ctCache.Get(f.l))
+		f.readOutsidePackets(fromUdpAddr, nil, plaintext[:0], payload, h, fwPacket, lhh, nb, i, ctCache.Get(f.l))
 	})
 }
 
 func (f *Interface) listenIn(reader io.ReadWriteCloser, i int) {
 	runtime.LockOSThread()
 
+	// Check if reader supports batch operations
+	if batchReader, ok := reader.(BatchReader); ok {
+		err := f.listenInBatch(batchReader, i)
+		if err != nil {
+			f.l.WithError(err).Error("Fatal error in batch packet reader, exiting goroutine")
+		}
+		return
+	}
+
+	// Fall back to single-packet mode
 	packet := make([]byte, mtu)
 	out := make([]byte, mtu)
 	fwPacket := &firewall.Packet{}
@@ -302,19 +316,88 @@ func (f *Interface) listenIn(reader io.ReadWriteCloser, i int) {
 				return
 			}
 
-			f.l.WithError(err).Error("Error while reading outbound packet")
+			f.l.WithError(err).Error("Fatal error while reading outbound packet, exiting goroutine")
-			// This only seems to happen when something fatal happens to the fd, so exit.
+			return
-			os.Exit(2)
 		}
 
 		f.consumeInsidePacket(packet[:n], fwPacket, nb, out, i, conntrackCache.Get(f.l))
 	}
 }
 
+// listenInBatch handles vectorized packet reading for improved performance
+func (f *Interface) listenInBatch(reader BatchReader, i int) error {
+	// Allocate per-packet state and buffers for batch reading
+	batchSize := f.batchSize
+	if batchSize <= 0 {
+		batchSize = 64 // Fallback to default if not configured
+	}
+	fwPackets := make([]*firewall.Packet, batchSize)
+	outBuffers := make([][]byte, batchSize)
+	nbBuffers := make([][]byte, batchSize)
+	packets := make([][]byte, batchSize)
+	sizes := make([]int, batchSize)
+
+	for j := 0; j < batchSize; j++ {
+		fwPackets[j] = &firewall.Packet{}
+		outBuffers[j] = make([]byte, mtu)
+		nbBuffers[j] = make([]byte, 12)
+		packets[j] = make([]byte, mtu)
+	}
+
+	conntrackCache := firewall.NewConntrackCacheTicker(f.conntrackCacheTimeout)
+
+	for {
+		n, err := reader.BatchRead(packets, sizes)
+		if err != nil {
+			if errors.Is(err, os.ErrClosed) && f.closed.Load() {
+				return nil
+			}
+
+			return fmt.Errorf("error while batch reading outbound packets: %w", err)
+		}
+
+		// Process each packet in the batch
+		cache := conntrackCache.Get(f.l)
+		for idx := 0; idx < n; idx++ {
+			if sizes[idx] > 0 {
+				// Use modulo to reuse fw packet state if batch is larger than our pre-allocated state
+				stateIdx := idx % len(fwPackets)
+				f.consumeInsidePacket(packets[idx][:sizes[idx]], fwPackets[stateIdx], nbBuffers[stateIdx], outBuffers[stateIdx], i, cache)
+			}
+		}
+	}
+}
+
+// writeTunBatch attempts to write multiple packets to the TUN device using batch operations if supported
+func (f *Interface) writeTunBatch(q int, packets [][]byte) error {
+	if len(packets) == 0 {
+		return nil
+	}
+
+	// Check if the reader/writer supports batch operations
+	if batchWriter, ok := f.readers[q].(BatchWriter); ok {
+		_, err := batchWriter.BatchWrite(packets)
+		return err
+	}
+
+	// Fall back to writing packets individually
+	for _, packet := range packets {
+		if _, err := f.readers[q].Write(packet); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// writeTun writes a single packet to the TUN device
+func (f *Interface) writeTun(q int, packet []byte) error {
+	_, err := f.readers[q].Write(packet)
+	return err
+}
+
 func (f *Interface) RegisterConfigChangeCallbacks(c *config.C) {
 	c.RegisterReloadCallback(f.reloadFirewall)
 	c.RegisterReloadCallback(f.reloadSendRecvError)
-	c.RegisterReloadCallback(f.reloadAcceptRecvError)
 	c.RegisterReloadCallback(f.reloadDisconnectInvalid)
 	c.RegisterReloadCallback(f.reloadMisc)
 
@@ -345,7 +428,6 @@ func (f *Interface) reloadFirewall(c *config.C) {
 		f.l.WithError(err).Error("Error while creating firewall during reload")
 		return
 	}
-	fw.SetSNATAddressFromInterface(f)
 
 	oldFw := f.firewall
 	conntrack := oldFw.Conntrack
@@ -379,16 +461,16 @@ func (f *Interface) reloadSendRecvError(c *config.C) {
 
 		switch stringValue {
 		case "always":
-			f.sendRecvErrorConfig = recvErrorAlways
+			f.sendRecvErrorConfig = sendRecvErrorAlways
 		case "never":
-			f.sendRecvErrorConfig = recvErrorNever
+			f.sendRecvErrorConfig = sendRecvErrorNever
 		case "private":
-			f.sendRecvErrorConfig = recvErrorPrivate
+			f.sendRecvErrorConfig = sendRecvErrorPrivate
 		default:
 			if c.GetBool("listen.send_recv_error", true) {
-				f.sendRecvErrorConfig = recvErrorAlways
+				f.sendRecvErrorConfig = sendRecvErrorAlways
 			} else {
-				f.sendRecvErrorConfig = recvErrorNever
+				f.sendRecvErrorConfig = sendRecvErrorNever
 			}
 		}
 
@@ -397,30 +479,6 @@ func (f *Interface) reloadSendRecvError(c *config.C) {
 	}
 }
 
-func (f *Interface) reloadAcceptRecvError(c *config.C) {
-	if c.InitialLoad() || c.HasChanged("listen.accept_recv_error") {
-		stringValue := c.GetString("listen.accept_recv_error", "always")
-
-		switch stringValue {
-		case "always":
-			f.acceptRecvErrorConfig = recvErrorAlways
-		case "never":
-			f.acceptRecvErrorConfig = recvErrorNever
-		case "private":
-			f.acceptRecvErrorConfig = recvErrorPrivate
-		default:
-			if c.GetBool("listen.accept_recv_error", true) {
-				f.acceptRecvErrorConfig = recvErrorAlways
-			} else {
-				f.acceptRecvErrorConfig = recvErrorNever
-			}
-		}
-
-		f.l.WithField("acceptRecvError", f.acceptRecvErrorConfig.String()).
-			Info("Loaded accept_recv_error config")
-	}
-}
-
 func (f *Interface) reloadMisc(c *config.C) {
 	if c.HasChanged("counters.try_promote") {
 		n := c.GetUint32("counters.try_promote", defaultPromoteEvery)
@@ -492,14 +550,6 @@ func (f *Interface) Close() error {
 			f.l.WithError(err).Error("Error while closing udp socket")
 		}
 	}
-	for i, r := range f.readers {
-		if i == 0 {
-			continue // f.readers[0] is f.inside, which we want to save for last
-		}
-		if err := r.Close(); err != nil {
-			f.l.WithError(err).Error("Error while closing tun reader")
-		}
-	}
 
 	// Release the tun device
 	return f.inside.Close()

lighthouse.go

@@ -360,8 +360,7 @@ func (lh *LightHouse) parseLighthouses(c *config.C) ([]netip.Addr, error) {
 		}
 
 		if !lh.myVpnNetworksTable.Contains(addr) {
-			lh.l.WithFields(m{"vpnAddr": addr, "networks": lh.myVpnNetworks}).
+			return nil, util.NewContextualError("lighthouse host is not in our networks, invalid", m{"vpnAddr": addr, "networks": lh.myVpnNetworks}, nil)
-				Warn("lighthouse host is not within our networks, lighthouse functionality will work but layer 3 network traffic to the lighthouse will not")
 		}
 		out[i] = addr
 	}
@@ -432,8 +431,7 @@ func (lh *LightHouse) loadStaticMap(c *config.C, staticList map[netip.Addr]struc
 		}
 
 		if !lh.myVpnNetworksTable.Contains(vpnAddr) {
-			lh.l.WithFields(m{"vpnAddr": vpnAddr, "networks": lh.myVpnNetworks, "entry": i + 1}).
+			return util.NewContextualError("static_host_map key is not in our network, invalid", m{"vpnAddr": vpnAddr, "networks": lh.myVpnNetworks, "entry": i + 1}, nil)
-				Warn("static_host_map key is not within our networks, layer 3 network traffic to this host will not work")
 		}
 
 		vals, ok := v.([]any)
@@ -713,14 +711,21 @@ func (lh *LightHouse) unlockedShouldAddV6(vpnAddr netip.Addr, to *V6AddrPort) bo
 
 func (lh *LightHouse) IsLighthouseAddr(vpnAddr netip.Addr) bool {
 	l := lh.GetLighthouses()
-	return slices.Contains(l, vpnAddr)
+	for i := range l {
+		if l[i] == vpnAddr {
+			return true
+		}
+	}
+	return false
 }
 
 func (lh *LightHouse) IsAnyLighthouseAddr(vpnAddrs []netip.Addr) bool {
 	l := lh.GetLighthouses()
 	for i := range vpnAddrs {
-		if slices.Contains(l, vpnAddrs[i]) {
+		for j := range l {
-			return true
+			if l[j] == vpnAddrs[i] {
+				return true
+			}
 		}
 	}
 	return false
@@ -1332,19 +1337,12 @@ func (lhh *LightHouseHandler) handleHostPunchNotification(n *NebulaMeta, fromVpn
 		}
 	}
 
-	remoteAllowList := lhh.lh.GetRemoteAllowList()
 	for _, a := range n.Details.V4AddrPorts {
-		b := protoV4AddrPortToNetAddrPort(a)
+		punch(protoV4AddrPortToNetAddrPort(a), detailsVpnAddr)
-		if remoteAllowList.Allow(detailsVpnAddr, b.Addr()) {
-			punch(b, detailsVpnAddr)
-		}
 	}
 
 	for _, a := range n.Details.V6AddrPorts {
-		b := protoV6AddrPortToNetAddrPort(a)
+		punch(protoV6AddrPortToNetAddrPort(a), detailsVpnAddr)
-		if remoteAllowList.Allow(detailsVpnAddr, b.Addr()) {
-			punch(b, detailsVpnAddr)
-		}
 	}
 
 	// This sends a nebula test packet to the host trying to contact us. In the case

lighthouse_test.go

@@ -1,6 +1,7 @@
 package nebula
 
 import (
+	"context"
 	"encoding/binary"
 	"fmt"
 	"net/netip"
@@ -13,7 +14,7 @@ import (
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.yaml.in/yaml/v3"
+	"gopkg.in/yaml.v3"
 )
 
 func TestOldIPv4Only(t *testing.T) {
@@ -41,14 +42,14 @@ func Test_lhStaticMapping(t *testing.T) {
 	c := config.NewC(l)
 	c.Settings["lighthouse"] = map[string]any{"hosts": []any{lh1}}
 	c.Settings["static_host_map"] = map[string]any{lh1: []any{"1.1.1.1:4242"}}
-	_, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
+	_, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 
 	lh2 := "10.128.0.3"
 	c = config.NewC(l)
 	c.Settings["lighthouse"] = map[string]any{"hosts": []any{lh1, lh2}}
 	c.Settings["static_host_map"] = map[string]any{lh1: []any{"100.1.1.1:4242"}}
-	_, err = NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
+	_, err = NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	require.EqualError(t, err, "lighthouse 10.128.0.3 does not have a static_host_map entry")
 }
 
@@ -70,7 +71,7 @@ func TestReloadLighthouseInterval(t *testing.T) {
 	}
 
 	c.Settings["static_host_map"] = map[string]any{lh1: []any{"1.1.1.1:4242"}}
-	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}
 
@@ -98,7 +99,7 @@ func BenchmarkLighthouseHandleRequest(b *testing.B) {
 	}
 
 	c := config.NewC(l)
-	lh, err := NewLightHouseFromConfig(b.Context(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	require.NoError(b, err)
 
 	hAddr := netip.MustParseAddrPort("4.5.6.7:12345")
@@ -201,7 +202,7 @@ func TestLighthouse_Memory(t *testing.T) {
 		myVpnNetworks:      []netip.Prefix{myVpnNet},
 		myVpnNetworksTable: nt,
 	}
-	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	lh.ifce = &mockEncWriter{}
 	require.NoError(t, err)
 	lhh := lh.NewRequestHandler()
@@ -287,7 +288,7 @@ func TestLighthouse_reload(t *testing.T) {
 		myVpnNetworksTable: nt,
 	}
 
-	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 
 	nc := map[string]any{
@@ -522,7 +523,7 @@ func TestLighthouse_Dont_Delete_Static_Hosts(t *testing.T) {
 		myVpnNetworks:      []netip.Prefix{myVpnNet},
 		myVpnNetworksTable: nt,
 	}
-	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}
 
@@ -588,7 +589,7 @@ func TestLighthouse_DeletesWork(t *testing.T) {
 		myVpnNetworks:      []netip.Prefix{myVpnNet},
 		myVpnNetworksTable: nt,
 	}
-	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}
 

main.go

@@ -5,8 +5,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"runtime/debug"
-	"strings"
 	"time"
 
 	"github.com/sirupsen/logrus"
@@ -15,7 +13,7 @@ import (
 	"github.com/slackhq/nebula/sshd"
 	"github.com/slackhq/nebula/udp"
 	"github.com/slackhq/nebula/util"
-	"go.yaml.in/yaml/v3"
+	"gopkg.in/yaml.v3"
 )
 
 type m = map[string]any
@@ -29,10 +27,6 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 		}
 	}()
 
-	if buildVersion == "" {
-		buildVersion = moduleVersion()
-	}
-
 	l := logger
 	l.Formatter = &logrus.TextFormatter{
 		FullTimestamp: true,
@@ -81,8 +75,7 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 	if c.GetBool("sshd.enabled", false) {
 		sshStart, err = configSSH(l, ssh, c)
 		if err != nil {
-			l.WithError(err).Warn("Failed to configure sshd, ssh debugging will not be available")
+			return nil, util.ContextualizeIfNeeded("Error while configuring the sshd", err)
-			sshStart = nil
 		}
 	}
 
@@ -105,7 +98,11 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 		// deprecated and undocumented
 		tunQueues := c.GetInt("tun.routines", 1)
 		udpQueues := c.GetInt("listen.routines", 1)
-		routines = max(tunQueues, udpQueues)
+		if tunQueues > udpQueues {
+			routines = tunQueues
+		} else {
+			routines = udpQueues
+		}
 		if routines != 1 {
 			l.WithField("routines", routines).Warn("Setting tun.routines and listen.routines is deprecated. Use `routines` instead")
 		}
@@ -131,8 +128,7 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 			deviceFactory = overlay.NewDeviceFromConfig
 		}
 
-		cs := pki.getCertState()
+		tun, err = deviceFactory(c, l, pki.getCertState().myVpnNetworks, routines)
-		tun, err = deviceFactory(c, l, cs.myVpnNetworks, cs.GetDefaultCertificate().UnsafeNetworks(), routines)
 		if err != nil {
 			return nil, util.ContextualizeIfNeeded("Failed to get a tun/tap device", err)
 		}
@@ -246,6 +242,7 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 		relayManager:          NewRelayManager(ctx, l, hostMap, c),
 		punchy:                punchy,
 		ConntrackCacheTimeout: conntrackCacheTimeout,
+		batchSize:             c.GetInt("tun.batch_size", 64),
 		l:                     l,
 	}
 
@@ -262,7 +259,6 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 		ifce.RegisterConfigChangeCallbacks(c)
 		ifce.reloadDisconnectInvalid(c)
 		ifce.reloadSendRecvError(c)
-		ifce.reloadAcceptRecvError(c)
 
 		handshakeManager.f = ifce
 		go handshakeManager.Run(ctx)
@@ -300,18 +296,3 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 		connManager.Start,
 	}, nil
 }
-
-func moduleVersion() string {
-	info, ok := debug.ReadBuildInfo()
-	if !ok {
-		return ""
-	}
-
-	for _, dep := range info.Deps {
-		if dep.Path == "github.com/slackhq/nebula" {
-			return strings.TrimPrefix(dep.Version, "v")
-		}
-	}
-
-	return ""
-}

noiseutil/boring.go

@@ -22,7 +22,7 @@ const EncryptLockNeeded = true
 // NewGCMTLS is no longer exposed in go1.19+, so we need to link it in
 // See: https://github.com/golang/go/issues/56326
 //
-// NewGCMTLS is the internal method used with boringcrypto that provides a
+// NewGCMTLS is the internal method used with boringcrypto that provices a
 // validated mode of AES-GCM which enforces the nonce is strictly
 // monotonically increasing.  This is the TLS 1.2 specification for nonce
 // generation (which also matches the method used by the Noise Protocol)

notboring.go

@@ -1,4 +1,5 @@
 //go:build !boringcrypto
+// +build !boringcrypto
 
 package nebula
 

outside.go

@@ -19,21 +19,21 @@ const (
 	minFwPacketLen = 4
 )
 
-func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte, h *header.H, fwPacket *firewall.Packet, lhf *LightHouseHandler, nb []byte, q int, localCache firewall.ConntrackCache) {
+func (f *Interface) readOutsidePackets(ip netip.AddrPort, via *ViaSender, out []byte, packet []byte, h *header.H, fwPacket *firewall.Packet, lhf *LightHouseHandler, nb []byte, q int, localCache firewall.ConntrackCache) {
 	err := h.Parse(packet)
 	if err != nil {
 		// Hole punch packets are 0 or 1 byte big, so lets ignore printing those errors
 		if len(packet) > 1 {
-			f.l.WithField("packet", packet).Infof("Error while parsing inbound packet from %s: %s", via, err)
+			f.l.WithField("packet", packet).Infof("Error while parsing inbound packet from %s: %s", ip, err)
 		}
 		return
 	}
 
 	//l.Error("in packet ", header, packet[HeaderLen:])
-	if !via.IsRelayed {
+	if ip.IsValid() {
-		if f.myVpnNetworksTable.Contains(via.UdpAddr.Addr()) {
+		if f.myVpnNetworksTable.Contains(ip.Addr()) {
 			if f.l.Level >= logrus.DebugLevel {
-				f.l.WithField("from", via).Debug("Refusing to process double encrypted packet")
+				f.l.WithField("udpAddr", ip).Debug("Refusing to process double encrypted packet")
 			}
 			return
 		}
@@ -54,7 +54,8 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 	switch h.Type {
 	case header.Message:
-		if !f.handleEncrypted(ci, via, h) {
+		// TODO handleEncrypted sends directly to addr on error. Handle this in the tunneling case.
+		if !f.handleEncrypted(ci, ip, h) {
 			return
 		}
 
@@ -78,7 +79,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 			// Successfully validated the thing. Get rid of the Relay header.
 			signedPayload = signedPayload[header.Len:]
 			// Pull the Roaming parts up here, and return in all call paths.
-			f.handleHostRoaming(hostinfo, via)
+			f.handleHostRoaming(hostinfo, ip)
 			// Track usage of both the HostInfo and the Relay for the received & authenticated packet
 			f.connectionManager.In(hostinfo)
 			f.connectionManager.RelayUsed(h.RemoteIndex)
@@ -95,14 +96,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 			case TerminalType:
 				// If I am the target of this relay, process the unwrapped packet
 				// From this recursive point, all these variables are 'burned'. We shouldn't rely on them again.
-				via = ViaSender{
+				f.readOutsidePackets(netip.AddrPort{}, &ViaSender{relayHI: hostinfo, remoteIdx: relay.RemoteIndex, relay: relay}, out[:0], signedPayload, h, fwPacket, lhf, nb, q, localCache)
-					UdpAddr:   via.UdpAddr,
-					relayHI:   hostinfo,
-					remoteIdx: relay.RemoteIndex,
-					relay:     relay,
-					IsRelayed: true,
-				}
-				f.readOutsidePackets(via, out[:0], signedPayload, h, fwPacket, lhf, nb, q, localCache)
 				return
 			case ForwardingType:
 				// Find the target HostInfo relay object
@@ -132,32 +126,31 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 	case header.LightHouse:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		if !f.handleEncrypted(ci, via, h) {
+		if !f.handleEncrypted(ci, ip, h) {
 			return
 		}
 
 		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("from", via).
+			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", ip).
 				WithField("packet", packet).
 				Error("Failed to decrypt lighthouse packet")
 			return
 		}
 
-		//TODO: assert via is not relayed
+		lhf.HandleRequest(ip, hostinfo.vpnAddrs, d, f)
-		lhf.HandleRequest(via.UdpAddr, hostinfo.vpnAddrs, d, f)
 
 		// Fallthrough to the bottom to record incoming traffic
 
 	case header.Test:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		if !f.handleEncrypted(ci, via, h) {
+		if !f.handleEncrypted(ci, ip, h) {
 			return
 		}
 
 		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("from", via).
+			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", ip).
 				WithField("packet", packet).
 				Error("Failed to decrypt test packet")
 			return
@@ -166,7 +159,7 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 		if h.Subtype == header.TestRequest {
 			// This testRequest might be from TryPromoteBest, so we should roam
 			// to the new IP address before responding
-			f.handleHostRoaming(hostinfo, via)
+			f.handleHostRoaming(hostinfo, ip)
 			f.send(header.Test, header.TestReply, ci, hostinfo, d, nb, out)
 		}
 
@@ -177,34 +170,34 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 	case header.Handshake:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		f.handshakeManager.HandleIncoming(via, packet, h)
+		f.handshakeManager.HandleIncoming(ip, via, packet, h)
 		return
 
 	case header.RecvError:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		f.handleRecvError(via.UdpAddr, h)
+		f.handleRecvError(ip, h)
 		return
 
 	case header.CloseTunnel:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		if !f.handleEncrypted(ci, via, h) {
+		if !f.handleEncrypted(ci, ip, h) {
 			return
 		}
 
-		hostinfo.logger(f.l).WithField("from", via).
+		hostinfo.logger(f.l).WithField("udpAddr", ip).
 			Info("Close tunnel received, tearing down.")
 
 		f.closeTunnel(hostinfo)
 		return
 
 	case header.Control:
-		if !f.handleEncrypted(ci, via, h) {
+		if !f.handleEncrypted(ci, ip, h) {
 			return
 		}
 
 		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("from", via).
+			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", ip).
 				WithField("packet", packet).
 				Error("Failed to decrypt Control packet")
 			return
@@ -214,11 +207,11 @@ func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte,
 
 	default:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		hostinfo.logger(f.l).Debugf("Unexpected packet received from %s", via)
+		hostinfo.logger(f.l).Debugf("Unexpected packet received from %s", ip)
 		return
 	}
 
-	f.handleHostRoaming(hostinfo, via)
+	f.handleHostRoaming(hostinfo, ip)
 
 	f.connectionManager.In(hostinfo)
 }
@@ -237,36 +230,36 @@ func (f *Interface) sendCloseTunnel(h *HostInfo) {
 	f.send(header.CloseTunnel, 0, h.ConnectionState, h, []byte{}, make([]byte, 12, 12), make([]byte, mtu))
 }
 
-func (f *Interface) handleHostRoaming(hostinfo *HostInfo, via ViaSender) {
+func (f *Interface) handleHostRoaming(hostinfo *HostInfo, udpAddr netip.AddrPort) {
-	if !via.IsRelayed && hostinfo.remote != via.UdpAddr {
+	if udpAddr.IsValid() && hostinfo.remote != udpAddr {
-		if !f.lightHouse.GetRemoteAllowList().AllowAll(hostinfo.vpnAddrs, via.UdpAddr.Addr()) {
+		if !f.lightHouse.GetRemoteAllowList().AllowAll(hostinfo.vpnAddrs, udpAddr.Addr()) {
-			hostinfo.logger(f.l).WithField("newAddr", via.UdpAddr).Debug("lighthouse.remote_allow_list denied roaming")
+			hostinfo.logger(f.l).WithField("newAddr", udpAddr).Debug("lighthouse.remote_allow_list denied roaming")
 			return
 		}
 
-		if !hostinfo.lastRoam.IsZero() && via.UdpAddr == hostinfo.lastRoamRemote && time.Since(hostinfo.lastRoam) < RoamingSuppressSeconds*time.Second {
+		if !hostinfo.lastRoam.IsZero() && udpAddr == hostinfo.lastRoamRemote && time.Since(hostinfo.lastRoam) < RoamingSuppressSeconds*time.Second {
 			if f.l.Level >= logrus.DebugLevel {
-				hostinfo.logger(f.l).WithField("udpAddr", hostinfo.remote).WithField("newAddr", via.UdpAddr).
+				hostinfo.logger(f.l).WithField("udpAddr", hostinfo.remote).WithField("newAddr", udpAddr).
 					Debugf("Suppressing roam back to previous remote for %d seconds", RoamingSuppressSeconds)
 			}
 			return
 		}
 
-		hostinfo.logger(f.l).WithField("udpAddr", hostinfo.remote).WithField("newAddr", via.UdpAddr).
+		hostinfo.logger(f.l).WithField("udpAddr", hostinfo.remote).WithField("newAddr", udpAddr).
 			Info("Host roamed to new udp ip/port.")
 		hostinfo.lastRoam = time.Now()
 		hostinfo.lastRoamRemote = hostinfo.remote
-		hostinfo.SetRemote(via.UdpAddr)
+		hostinfo.SetRemote(udpAddr)
 	}
 
 }
 
 // handleEncrypted returns true if a packet should be processed, false otherwise
-func (f *Interface) handleEncrypted(ci *ConnectionState, via ViaSender, h *header.H) bool {
+func (f *Interface) handleEncrypted(ci *ConnectionState, addr netip.AddrPort, h *header.H) bool {
 	// If connectionstate does not exist, send a recv error, if possible, to encourage a fast reconnect
 	if ci == nil {
-		if !via.IsRelayed {
+		if addr.IsValid() {
-			f.maybeSendRecvError(via.UdpAddr, h.RemoteIndex)
+			f.maybeSendRecvError(addr, h.RemoteIndex)
 		}
 		return false
 	}
@@ -327,41 +320,26 @@ func parseV6(data []byte, incoming bool, fp *firewall.Packet) error {
 		proto := layers.IPProtocol(data[protoAt])
 
 		switch proto {
-		case layers.IPProtocolESP, layers.IPProtocolNoNextHeader:
+		case layers.IPProtocolICMPv6, layers.IPProtocolESP, layers.IPProtocolNoNextHeader:
 			fp.Protocol = uint8(proto)
 			fp.RemotePort = 0
 			fp.LocalPort = 0
 			fp.Fragment = false
 			return nil
 
-		case layers.IPProtocolICMPv6:
-			if dataLen < offset+6 {
-				return ErrIPv6PacketTooShort
-			}
-			fp.Protocol = uint8(proto)
-			fp.LocalPort = 0 //incoming vs outgoing doesn't matter for icmpv6
-			icmptype := data[offset+1]
-			switch icmptype {
-			case layers.ICMPv6TypeEchoRequest, layers.ICMPv6TypeEchoReply:
-				fp.RemotePort = binary.BigEndian.Uint16(data[offset+4 : offset+6]) //identifier
-			default:
-				fp.RemotePort = 0
-			}
-			fp.Fragment = false
-			return nil
-
 		case layers.IPProtocolTCP, layers.IPProtocolUDP:
 			if dataLen < offset+4 {
 				return ErrIPv6PacketTooShort
 			}
 
 			fp.Protocol = uint8(proto)
+			ports := data[offset : offset+4]
 			if incoming {
-				fp.RemotePort = binary.BigEndian.Uint16(data[offset : offset+2])
+				fp.RemotePort = binary.BigEndian.Uint16(ports[0:2])
-				fp.LocalPort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
+				fp.LocalPort = binary.BigEndian.Uint16(ports[2:4])
 			} else {
-				fp.LocalPort = binary.BigEndian.Uint16(data[offset : offset+2])
+				fp.LocalPort = binary.BigEndian.Uint16(ports[0:2])
-				fp.RemotePort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
+				fp.RemotePort = binary.BigEndian.Uint16(ports[2:4])
 			}
 
 			fp.Fragment = false
@@ -439,38 +417,34 @@ func parseV4(data []byte, incoming bool, fp *firewall.Packet) error {
 
 	// Accounting for a variable header length, do we have enough data for our src/dst tuples?
 	minLen := ihl
-	if !fp.Fragment {
+	if !fp.Fragment && fp.Protocol != firewall.ProtoICMP {
-		if fp.Protocol == firewall.ProtoICMP {
+		minLen += minFwPacketLen
-			minLen += minFwPacketLen + 2
-		} else {
-			minLen += minFwPacketLen
-		}
 	}
-
 	if len(data) < minLen {
 		return ErrIPv4InvalidHeaderLength
 	}
 
-	if incoming { // Firewall packets are locally oriented
+	// Firewall packets are locally oriented
+	if incoming {
 		fp.RemoteAddr, _ = netip.AddrFromSlice(data[12:16])
 		fp.LocalAddr, _ = netip.AddrFromSlice(data[16:20])
+		if fp.Fragment || fp.Protocol == firewall.ProtoICMP {
+			fp.RemotePort = 0
+			fp.LocalPort = 0
+		} else {
+			fp.RemotePort = binary.BigEndian.Uint16(data[ihl : ihl+2])
+			fp.LocalPort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
+		}
 	} else {
 		fp.LocalAddr, _ = netip.AddrFromSlice(data[12:16])
 		fp.RemoteAddr, _ = netip.AddrFromSlice(data[16:20])
-	}
+		if fp.Fragment || fp.Protocol == firewall.ProtoICMP {
-
+			fp.RemotePort = 0
-	if fp.Fragment {
+			fp.LocalPort = 0
-		fp.RemotePort = 0
+		} else {
-		fp.LocalPort = 0
+			fp.LocalPort = binary.BigEndian.Uint16(data[ihl : ihl+2])
-	} else if fp.Protocol == firewall.ProtoICMP { //note that orientation doesn't matter on ICMP
+			fp.RemotePort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
-		fp.RemotePort = binary.BigEndian.Uint16(data[ihl+4 : ihl+6]) //identifier
+		}
-		fp.LocalPort = 0                                             //code would be uint16(data[ihl+1])
-	} else if incoming {
-		fp.RemotePort = binary.BigEndian.Uint16(data[ihl : ihl+2])  //src port
-		fp.LocalPort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4]) //dst port
-	} else {
-		fp.LocalPort = binary.BigEndian.Uint16(data[ihl : ihl+2])    //src port
-		fp.RemotePort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4]) //dst port
 	}
 
 	return nil
@@ -514,7 +488,7 @@ func (f *Interface) decryptToTun(hostinfo *HostInfo, messageCounter uint64, out
 		return false
 	}
 
-	dropReason := f.firewall.Drop(*fwPacket, out, true, hostinfo, f.pki.GetCAPool(), localCache)
+	dropReason := f.firewall.Drop(*fwPacket, true, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason != nil {
 		// NOTE: We give `packet` as the `out` here since we already decrypted from it and we don't need it anymore
 		// This gives us a buffer to build the reject packet in
@@ -536,7 +510,7 @@ func (f *Interface) decryptToTun(hostinfo *HostInfo, messageCounter uint64, out
 }
 
 func (f *Interface) maybeSendRecvError(endpoint netip.AddrPort, index uint32) {
-	if f.sendRecvErrorConfig.ShouldRecvError(endpoint) {
+	if f.sendRecvErrorConfig.ShouldSendRecvError(endpoint) {
 		f.sendRecvError(endpoint, index)
 	}
 }
@@ -554,13 +528,6 @@ func (f *Interface) sendRecvError(endpoint netip.AddrPort, index uint32) {
 }
 
 func (f *Interface) handleRecvError(addr netip.AddrPort, h *header.H) {
-	if !f.acceptRecvErrorConfig.ShouldRecvError(addr) {
-		f.l.WithField("index", h.RemoteIndex).
-			WithField("udpAddr", addr).
-			Debug("Recv error received, ignoring")
-		return
-	}
-
 	if f.l.Level >= logrus.DebugLevel {
 		f.l.WithField("index", h.RemoteIndex).
 			WithField("udpAddr", addr).

outside_test.go

@@ -155,7 +155,6 @@ func Test_newPacket_v6(t *testing.T) {
 	// next layer, missing length byte
 	err = newPacket(buffer.Bytes()[:49], true, p)
 	require.ErrorIs(t, err, ErrIPv6CouldNotFindPayload)
-	err = nil
 
 	// A good ICMP packet
 	ip = layers.IPv6{
@@ -166,26 +165,20 @@ func Test_newPacket_v6(t *testing.T) {
 		DstIP:      net.IPv6linklocalallnodes,
 	}
 
-	icmp := layers.ICMPv6{
+	icmp := layers.ICMPv6{}
-		TypeCode: layers.ICMPv6TypeEchoRequest,
-		Checksum: 0x1234,
-	}
 
 	buffer.Clear()
-	require.NoError(t, gopacket.SerializeLayers(buffer, opt, &ip, &icmp))
+	err = gopacket.SerializeLayers(buffer, opt, &ip, &icmp)
-	require.Error(t, newPacket(buffer.Bytes(), true, p))
+	if err != nil {
-
+		panic(err)
-	buffer.Clear()
-	echo := layers.ICMPv6Echo{
-		Identifier: 0xabcd,
-		SeqNumber:  1234,
 	}
-	require.NoError(t, gopacket.SerializeLayers(buffer, opt, &ip, &icmp, &echo))
+
-	require.NoError(t, newPacket(buffer.Bytes(), true, p))
+	err = newPacket(buffer.Bytes(), true, p)
+	require.NoError(t, err)
 	assert.Equal(t, uint8(layers.IPProtocolICMPv6), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
 	assert.Equal(t, netip.MustParseAddr("ff02::1"), p.LocalAddr)
-	assert.Equal(t, uint16(0xabcd), p.RemotePort)
+	assert.Equal(t, uint16(0), p.RemotePort)
 	assert.Equal(t, uint16(0), p.LocalPort)
 	assert.False(t, p.Fragment)
 
@@ -581,7 +574,7 @@ func BenchmarkParseV6(b *testing.B) {
 	}
 
 	evilBytes := buffer.Bytes()
-	for range 200 {
+	for i := 0; i < 200; i++ {
 		evilBytes = append(evilBytes, hopHeader...)
 	}
 	evilBytes = append(evilBytes, lastHopHeader...)

overlay/device.go

@@ -11,11 +11,7 @@ type Device interface {
 	io.ReadWriteCloser
 	Activate() error
 	Networks() []netip.Prefix
-	UnsafeNetworks() []netip.Prefix
-	UnsafeIPv4OriginAddress() netip.Prefix
-	SNATAddress() netip.Prefix
 	Name() string
 	RoutesFor(netip.Addr) routing.Gateways
-	SupportsMultiqueue() bool
 	NewMultiQueueReader() (io.ReadWriteCloser, error)
 }

overlay/route.go

@@ -3,7 +3,6 @@ package overlay
 import (
 	"fmt"
 	"math"
-	"net"
 	"net/netip"
 	"runtime"
 	"strconv"
@@ -305,29 +304,3 @@ func parseUnsafeRoutes(c *config.C, networks []netip.Prefix) ([]Route, error) {
 
 	return routes, nil
 }
-
-func ipWithin(o *net.IPNet, i *net.IPNet) bool {
-	// Make sure o contains the lowest form of i
-	if !o.Contains(i.IP.Mask(i.Mask)) {
-		return false
-	}
-
-	// Find the max ip in i
-	ip4 := i.IP.To4()
-	if ip4 == nil {
-		return false
-	}
-
-	last := make(net.IP, len(ip4))
-	copy(last, ip4)
-	for x := range ip4 {
-		last[x] |= ^i.Mask[x]
-	}
-
-	// Make sure o contains the max
-	if !o.Contains(last) {
-		return false
-	}
-
-	return true
-}

overlay/route_test.go

@@ -225,6 +225,7 @@ func Test_parseUnsafeRoutes(t *testing.T) {
 	// no mtu
 	c.Settings["tun"] = map[string]any{"unsafe_routes": []any{map[string]any{"via": "127.0.0.1", "route": "1.0.0.0/8"}}}
 	routes, err = parseUnsafeRoutes(c, []netip.Prefix{n})
+	require.NoError(t, err)
 	assert.Len(t, routes, 1)
 	assert.Equal(t, 0, routes[0].MTU)
 
@@ -318,7 +319,7 @@ func Test_makeRouteTree(t *testing.T) {
 
 	ip, err = netip.ParseAddr("1.1.0.1")
 	require.NoError(t, err)
-	r, ok = routeTree.Lookup(ip)
+	_, ok = routeTree.Lookup(ip)
 	assert.False(t, ok)
 }
 

overlay/tun.go

@@ -1,10 +1,6 @@
 package overlay
 
 import (
-	"crypto/rand"
-	"fmt"
-	"io"
-	"net"
 	"net/netip"
 
 	"github.com/sirupsen/logrus"
@@ -14,32 +10,23 @@ import (
 
 const DefaultMTU = 1300
 
-type NameError struct {
-	Name       string
-	Underlying error
-}
-
-func (e *NameError) Error() string {
-	return fmt.Sprintf("could not set tun device name: %s because %s", e.Name, e.Underlying)
-}
-
 // TODO: We may be able to remove routines
-type DeviceFactory func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error)
+type DeviceFactory func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error)
 
-func NewDeviceFromConfig(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error) {
+func NewDeviceFromConfig(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
 	switch {
 	case c.GetBool("tun.disabled", false):
 		tun := newDisabledTun(vpnNetworks, c.GetInt("tun.tx_queue", 500), c.GetBool("stats.message_metrics", false), l)
 		return tun, nil
 
 	default:
-		return newTun(c, l, vpnNetworks, unsafeNetworks, routines > 1)
+		return newTun(c, l, vpnNetworks, routines > 1)
 	}
 }
 
 func NewFdDeviceFromConfig(fd *int) DeviceFactory {
-	return func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error) {
+	return func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
-		return newTunFromFd(c, l, *fd, vpnNetworks, unsafeNetworks)
+		return newTunFromFd(c, l, *fd, vpnNetworks)
 	}
 }
 
@@ -83,133 +70,3 @@ func findRemovedRoutes(newRoutes, oldRoutes []Route) []Route {
 
 	return removed
 }
-
-func prefixToMask(prefix netip.Prefix) netip.Addr {
-	pLen := 128
-	if prefix.Addr().Is4() {
-		pLen = 32
-	}
-
-	addr, _ := netip.AddrFromSlice(net.CIDRMask(prefix.Bits(), pLen))
-	return addr
-}
-
-func flipBytes(b []byte) []byte {
-	for i := 0; i < len(b); i++ {
-		b[i] ^= 0xFF
-	}
-	return b
-}
-func orBytes(a []byte, b []byte) []byte {
-	ret := make([]byte, len(a))
-	for i := 0; i < len(a); i++ {
-		ret[i] = a[i] | b[i]
-	}
-	return ret
-}
-
-func getBroadcast(cidr netip.Prefix) netip.Addr {
-	broadcast, _ := netip.AddrFromSlice(
-		orBytes(
-			cidr.Addr().AsSlice(),
-			flipBytes(prefixToMask(cidr).AsSlice()),
-		),
-	)
-	return broadcast
-}
-
-func selectGateway(dest netip.Prefix, gateways []netip.Prefix) (netip.Prefix, error) {
-	for _, gateway := range gateways {
-		if dest.Addr().Is4() && gateway.Addr().Is4() {
-			return gateway, nil
-		}
-
-		if dest.Addr().Is6() && gateway.Addr().Is6() {
-			return gateway, nil
-		}
-	}
-
-	return netip.Prefix{}, fmt.Errorf("no gateway found for %v in the list of vpn networks", dest)
-}
-
-// genLinkLocal generates a random IPv4 link-local address.
-// If randomizer is nil, it uses rand.Reader to find two random bytes
-func genLinkLocal(randomizer io.Reader) netip.Prefix {
-	if randomizer == nil {
-		randomizer = rand.Reader
-	}
-	octets := []byte{169, 254, 0, 0}
-	_, _ = randomizer.Read(octets[2:4])
-	return coerceLinkLocal(octets)
-}
-
-func coerceLinkLocal(octets []byte) netip.Prefix {
-	if octets[3] == 0 {
-		octets[3] = 1 //please no .0 addresses
-	} else if octets[2] == 255 && octets[3] == 255 {
-		octets[3] = 254 //please no broadcast addresses
-	}
-	out, _ := netip.AddrFromSlice(octets)
-	return netip.PrefixFrom(out, 32)
-}
-
-// prepareUnsafeOriginAddr provides the IPv4 address used on IPv6-only clients that need to access IPv4 unsafe routes
-func prepareUnsafeOriginAddr(d Device, l *logrus.Logger, c *config.C, routes []Route) netip.Prefix {
-	if !d.Networks()[0].Addr().Is6() {
-		return netip.Prefix{} //if we have an IPv4 assignment within the overlay, we don't need an unsafe origin address
-	}
-
-	needed := false
-	for _, route := range routes { //or if we have a route defined into an IPv4 range
-		if route.Cidr.Addr().Is4() {
-			needed = true //todo should this only apply to unsafe routes? almost certainly
-			break
-		}
-	}
-	if !needed {
-		return netip.Prefix{}
-	}
-
-	//todo better config name for sure
-	if a := c.GetString("tun.unsafe_origin_address_for_4over6", ""); a != "" {
-		out, err := netip.ParseAddr(a)
-		if err != nil {
-			l.WithField("value", a).WithError(err).Warn("failed to parse tun.unsafe_origin_address_for_4over6, will use a random value")
-		} else if !out.Is4() || !out.IsLinkLocalUnicast() {
-			l.WithField("value", out).Warn("tun.unsafe_origin_address_for_4over6 must be an IPv4 address")
-		} else if out.IsValid() {
-			return netip.PrefixFrom(out, 32)
-		}
-	}
-	return genLinkLocal(nil)
-}
-
-// prepareSnatAddr provides the address that an IPv6-only unsafe router should use to SNAT traffic before handing it to the operating system
-func prepareSnatAddr(d Device, l *logrus.Logger, c *config.C) netip.Prefix {
-	if !d.Networks()[0].Addr().Is6() {
-		return netip.Prefix{} //if we have an IPv4 assignment within the overlay, we don't need a snat address
-	}
-
-	needed := false
-	for _, un := range d.UnsafeNetworks() { //if we are an unsafe router for an IPv4 range
-		if un.Addr().Is4() {
-			needed = true
-			break
-		}
-	}
-	if !needed {
-		return netip.Prefix{}
-	}
-
-	if a := c.GetString("tun.snat_address_for_4over6", ""); a != "" {
-		out, err := netip.ParseAddr(a)
-		if err != nil {
-			l.WithField("value", a).WithError(err).Warn("failed to parse tun.snat_address_for_4over6, will use a random value")
-		} else if !out.Is4() || !out.IsLinkLocalUnicast() {
-			l.WithField("value", out).Warn("tun.snat_address_for_4over6 must be an IPv4 address")
-		} else if out.IsValid() {
-			return netip.PrefixFrom(out, 32)
-		}
-	}
-	return genLinkLocal(nil)
-}

overlay/tun_android.go

@@ -19,16 +19,14 @@ import (
 
 type tun struct {
 	io.ReadWriteCloser
-	fd               int
+	fd          int
-	vpnNetworks      []netip.Prefix
+	vpnNetworks []netip.Prefix
-	unsafeNetworks   []netip.Prefix
+	Routes      atomic.Pointer[[]Route]
-	unsafeIPv4Origin netip.Prefix
+	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	Routes           atomic.Pointer[[]Route]
+	l           *logrus.Logger
-	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
-	l                *logrus.Logger
 }
 
-func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
+func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
 	// XXX Android returns an fd in non-blocking mode which is necessary for shutdown to work properly.
 	// Be sure not to call file.Fd() as it will set the fd to blocking mode.
 	file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
@@ -37,7 +35,6 @@ func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []net
 		ReadWriteCloser: file,
 		fd:              deviceFd,
 		vpnNetworks:     vpnNetworks,
-		unsafeNetworks:  unsafeNetworks,
 		l:               l,
 	}
 
@@ -56,7 +53,7 @@ func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []net
 	return t, nil
 }
 
-func newTun(_ *config.C, _ *logrus.Logger, _ []netip.Prefix, _ []netip.Prefix, _ bool) (*tun, error) {
+func newTun(_ *config.C, _ *logrus.Logger, _ []netip.Prefix, _ bool) (*tun, error) {
 	return nil, fmt.Errorf("newTun not supported in Android")
 }
 
@@ -79,8 +76,6 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
-	t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
-
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -96,26 +91,10 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
-func (t *tun) UnsafeNetworks() []netip.Prefix {
-	return t.unsafeNetworks
-}
-
-func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *tun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
 func (t *tun) Name() string {
 	return "android"
 }
 
-func (t *tun) SupportsMultiqueue() bool {
-	return false
-}
-
 func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for android")
 }

overlay/tun_darwin.go

@@ -1,5 +1,5 @@
-//go:build !ios && !e2e_testing
+//go:build darwin && !ios && !e2e_testing
-// +build !ios,!e2e_testing
+// +build darwin,!ios,!e2e_testing
 
 package overlay
 
@@ -8,50 +8,27 @@ import (
 	"fmt"
 	"io"
 	"net/netip"
-	"os"
-	"sync/atomic"
-	"syscall"
 	"unsafe"
 
-	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	netroute "golang.org/x/net/route"
 	"golang.org/x/sys/unix"
+	wgtun "golang.zx2c4.com/wireguard/tun"
 )
 
 type tun struct {
-	io.ReadWriteCloser
+	linkAddr *netroute.LinkAddr
-	Device           string
-	vpnNetworks      []netip.Prefix
-	unsafeNetworks   []netip.Prefix
-	unsafeIPv4Origin netip.Prefix
-	DefaultMTU       int
-	Routes           atomic.Pointer[[]Route]
-	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
-	linkAddr         *netroute.LinkAddr
-	l                *logrus.Logger
-
-	// cache out buffer since we need to prepend 4 bytes for tun metadata
-	out []byte
 }
 
+// ioctl structures for Darwin network configuration
 type ifReq struct {
 	Name  [unix.IFNAMSIZ]byte
 	Flags uint16
 	pad   [8]byte
 }
 
-const (
-	_SIOCAIFADDR_IN6 = 2155899162
-	_UTUN_OPT_IFNAME = 2
-	_IN6_IFF_NODAD   = 0x0020
-	_IN6_IFF_SECURED = 0x0400
-	utunControlName  = "com.apple.net.utun_control"
-)
-
 type ifreqMTU struct {
 	Name [16]byte
 	MTU  int32
@@ -81,61 +58,61 @@ type ifreqAlias6 struct {
 	Lifetime   addrLifetime
 }
 
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
+const (
+	_SIOCAIFADDR_IN6 = 2155899162
+	_IN6_IFF_NODAD   = 0x0020
+)
+
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (*wgTun, error) {
+	return nil, fmt.Errorf("newTunFromFd not supported on Darwin")
+}
+
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*wgTun, error) {
 	name := c.GetString("tun.dev", "")
-	ifIndex := -1
+	deviceName := "utun"
+
+	// Parse device name to handle utun[0-9]+ format
 	if name != "" && name != "utun" {
+		ifIndex := -1
 		_, err := fmt.Sscanf(name, "utun%d", &ifIndex)
 		if err != nil || ifIndex < 0 {
 			// NOTE: we don't make this error so we don't break existing
 			// configs that set a name before it was used.
 			l.Warn("interface name must be utun[0-9]+ on Darwin, ignoring")
-			ifIndex = -1
+		} else {
+			deviceName = name
 		}
 	}
 
-	fd, err := unix.Socket(unix.AF_SYSTEM, unix.SOCK_DGRAM, unix.AF_SYS_CONTROL)
+	mtu := c.GetInt("tun.mtu", DefaultMTU)
+
+	// Create WireGuard TUN device
+	tunDevice, err := wgtun.CreateTUN(deviceName, mtu)
 	if err != nil {
-		return nil, fmt.Errorf("system socket: %v", err)
+		return nil, fmt.Errorf("failed to create TUN device: %w", err)
 	}
 
-	var ctlInfo = &unix.CtlInfo{}
+	// Get the actual device name
-	copy(ctlInfo.Name[:], utunControlName)
+	actualName, err := tunDevice.Name()
-
-	err = unix.IoctlCtlInfo(fd, ctlInfo)
 	if err != nil {
-		return nil, fmt.Errorf("CTLIOCGINFO: %v", err)
+		tunDevice.Close()
+		return nil, fmt.Errorf("failed to get TUN device name: %w", err)
 	}
 
-	err = unix.Connect(fd, &unix.SockaddrCtl{
+	t := &wgTun{
-		ID:   ctlInfo.Id,
+		tunDevice:   tunDevice,
-		Unit: uint32(ifIndex) + 1,
+		vpnNetworks: vpnNetworks,
-	})
+		MaxMTU:      mtu,
-	if err != nil {
+		DefaultMTU:  mtu,
-		return nil, fmt.Errorf("SYS_CONNECT: %v", err)
+		l:           l,
 	}
 
-	name, err = unix.GetsockoptString(fd, unix.AF_SYS_CONTROL, _UTUN_OPT_IFNAME)
+	// Create Darwin-specific route manager
-	if err != nil {
+	t.routeManager = &tun{}
-		return nil, fmt.Errorf("failed to retrieve tun name: %w", err)
-	}
-
-	err = unix.SetNonblock(fd, true)
-	if err != nil {
-		return nil, fmt.Errorf("SetNonblock: %v", err)
-	}
-
-	t := &tun{
-		ReadWriteCloser: os.NewFile(uintptr(fd), ""),
-		Device:          name,
-		vpnNetworks:     vpnNetworks,
-		unsafeNetworks:  unsafeNetworks,
-		DefaultMTU:      c.GetInt("tun.mtu", DefaultMTU),
-		l:               l,
-	}
 
 	err = t.reload(c, true)
 	if err != nil {
+		tunDevice.Close()
 		return nil, err
 	}
 
@@ -146,224 +123,251 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNet
 		}
 	})
 
+	l.WithField("name", actualName).Info("Created WireGuard TUN device")
+
 	return t, nil
 }
 
-func (t *tun) deviceBytes() (o [16]byte) {
+func (rm *tun) Activate(t *wgTun) error {
-	for i, c := range t.Device {
+	name, err := t.tunDevice.Name()
-		o[i] = byte(c)
-	}
-	return
-}
-
-func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
-	return nil, fmt.Errorf("newTunFromFd not supported in Darwin")
-}
-
-func (t *tun) Close() error {
-	if t.ReadWriteCloser != nil {
-		return t.ReadWriteCloser.Close()
-	}
-	return nil
-}
-
-func (t *tun) Activate() error {
-	devName := t.deviceBytes()
-
-	s, err := unix.Socket(
-		unix.AF_INET,
-		unix.SOCK_DGRAM,
-		unix.IPPROTO_IP,
-	)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get device name: %w", err)
-	}
-	defer unix.Close(s)
-
-	fd := uintptr(s)
-
-	// Set the MTU on the device
-	ifm := ifreqMTU{Name: devName, MTU: int32(t.DefaultMTU)}
-	if err = ioctl(fd, unix.SIOCSIFMTU, uintptr(unsafe.Pointer(&ifm))); err != nil {
-		return fmt.Errorf("failed to set tun mtu: %v", err)
 	}
 
-	// Get the device flags
+	// Set the MTU
-	ifrf := ifReq{Name: devName}
+	rm.SetMTU(t, t.MaxMTU)
-	if err = ioctl(fd, unix.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
-		return fmt.Errorf("failed to get tun flags: %s", err)
-	}
-
-	linkAddr, err := getLinkAddr(t.Device)
-	if err != nil {
-		return err
-	}
-	if linkAddr == nil {
-		return fmt.Errorf("unable to discover link_addr for tun interface")
-	}
-	t.linkAddr = linkAddr
 
+	// Add IP addresses
 	for _, network := range t.vpnNetworks {
-		if network.Addr().Is4() {
+		if err := rm.addIP(t, name, network); err != nil {
-			err = t.activate4(network)
-			if err != nil {
-				return err
-			}
-		} else {
-			err = t.activate6(network)
-			if err != nil {
-				return err
-			}
-		}
-	}
-	if t.unsafeIPv4Origin.IsValid() && t.unsafeIPv4Origin.Addr().Is4() {
-		if err = t.activate4(t.unsafeIPv4Origin); err != nil {
 			return err
 		}
 	}
 
-	// Run the interface
+	// Bring up the interface using ioctl
-	ifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING
+	if err := rm.bringUpInterface(name); err != nil {
-	if err = ioctl(fd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
+		return fmt.Errorf("failed to bring up interface: %w", err)
-		return fmt.Errorf("failed to run tun device: %s", err)
 	}
 
-	// Unsafe path routes
+	// Get the link address for routing
-	return t.addRoutes(false)
+	linkAddr, err := getLinkAddr(name)
+	if err != nil {
+		return fmt.Errorf("failed to get link address: %w", err)
+	}
+	if linkAddr == nil {
+		return fmt.Errorf("unable to discover link_addr for tun interface")
+	}
+	rm.linkAddr = linkAddr
+
+	// Set the routes
+	if err := rm.AddRoutes(t, false); err != nil {
+		return err
+	}
+
+	return nil
 }
 
-func (t *tun) activate4(network netip.Prefix) error {
+func (rm *tun) bringUpInterface(name string) error {
-	s, err := unix.Socket(
+	// Open a socket for ioctl
-		unix.AF_INET,
+	fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
-		unix.SOCK_DGRAM,
-		unix.IPPROTO_IP,
-	)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to create socket: %w", err)
+	}
+	defer unix.Close(fd)
+
+	// Get current flags
+	var ifrf ifReq
+	copy(ifrf.Name[:], name)
+
+	if err := ioctl(uintptr(fd), unix.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
+		return fmt.Errorf("failed to get interface flags: %w", err)
+	}
+
+	// Set IFF_UP and IFF_RUNNING flags
+	ifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING
+
+	if err := ioctl(uintptr(fd), unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
+		return fmt.Errorf("failed to set interface flags: %w", err)
+	}
+
+	return nil
+}
+
+func (rm *tun) SetMTU(t *wgTun, mtu int) {
+	name, err := t.tunDevice.Name()
+	if err != nil {
+		t.l.WithError(err).Error("Failed to get device name for MTU set")
+		return
+	}
+
+	// Open a socket for ioctl
+	fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
+	if err != nil {
+		t.l.WithError(err).Error("Failed to create socket for MTU set")
+		return
+	}
+	defer unix.Close(fd)
+
+	// Prepare the ioctl request
+	var ifr ifreqMTU
+	copy(ifr.Name[:], name)
+	ifr.MTU = int32(mtu)
+
+	// Set the MTU using ioctl
+	if err := ioctl(uintptr(fd), unix.SIOCSIFMTU, uintptr(unsafe.Pointer(&ifr))); err != nil {
+		t.l.WithError(err).Error("Failed to set tun mtu via ioctl")
+	}
+}
+
+func (rm *tun) SetDefaultRoute(t *wgTun, cidr netip.Prefix) error {
+	// On Darwin, routes are set via ifconfig and route commands
+	return nil
+}
+
+func (rm *tun) AddRoutes(t *wgTun, logErrors bool) error {
+	routes := *t.Routes.Load()
+	for _, r := range routes {
+		if !r.Install {
+			continue
+		}
+
+		err := rm.addRoute(r.Cidr)
+		if err != nil {
+			if errors.Is(err, unix.EEXIST) {
+				t.l.WithField("route", r.Cidr).
+					Warnf("unable to add unsafe_route, identical route already exists")
+			} else {
+				retErr := util.NewContextualError("Failed to add route", map[string]any{"route": r}, err)
+				if logErrors {
+					retErr.Log(t.l)
+				} else {
+					return retErr
+				}
+			}
+		} else {
+			t.l.WithField("route", r).Info("Added route")
+		}
+	}
+
+	return nil
+}
+
+func (rm *tun) RemoveRoutes(t *wgTun, routes []Route) {
+	for _, r := range routes {
+		if !r.Install {
+			continue
+		}
+
+		err := rm.delRoute(r.Cidr)
+		if err != nil {
+			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
+		} else {
+			t.l.WithField("route", r).Info("Removed route")
+		}
+	}
+}
+
+func (rm *tun) NewMultiQueueReader(t *wgTun) (io.ReadWriteCloser, error) {
+	// Darwin doesn't support multi-queue TUN devices in the same way as Linux
+	// Return a reader that wraps the same device
+	return &wgTunReader{
+		parent:    t,
+		tunDevice: t.tunDevice,
+		offset:    0,
+		l:         t.l,
+	}, nil
+}
+
+func (rm *tun) addIP(t *wgTun, name string, network netip.Prefix) error {
+	addr := network.Addr()
+
+	if addr.Is4() {
+		return rm.addIPv4(name, network)
+	} else {
+		return rm.addIPv6(name, network)
+	}
+}
+
+func (rm *tun) addIPv4(name string, network netip.Prefix) error {
+	// Open an IPv4 socket for ioctl
+	s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
+	if err != nil {
+		return fmt.Errorf("failed to create IPv4 socket: %w", err)
 	}
 	defer unix.Close(s)
 
-	ifr := ifreqAlias4{
+	var ifr ifreqAlias4
-		Name: t.deviceBytes(),
+	copy(ifr.Name[:], name)
-		Addr: unix.RawSockaddrInet4{
+
-			Len:    unix.SizeofSockaddrInet4,
+	// Set the address
-			Family: unix.AF_INET,
+	ifr.Addr = unix.RawSockaddrInet4{
-			Addr:   network.Addr().As4(),
+		Len:    unix.SizeofSockaddrInet4,
-		},
+		Family: unix.AF_INET,
-		DstAddr: unix.RawSockaddrInet4{
+		Addr:   network.Addr().As4(),
-			Len:    unix.SizeofSockaddrInet4,
+	}
-			Family: unix.AF_INET,
+
-			Addr:   network.Addr().As4(),
+	// Set the destination address (same as address for point-to-point)
-		},
+	ifr.DstAddr = unix.RawSockaddrInet4{
-		MaskAddr: unix.RawSockaddrInet4{
+		Len:    unix.SizeofSockaddrInet4,
-			Len:    unix.SizeofSockaddrInet4,
+		Family: unix.AF_INET,
-			Family: unix.AF_INET,
+		Addr:   network.Addr().As4(),
-			Addr:   prefixToMask(network).As4(),
+	}
-		},
+
+	// Set the netmask
+	ifr.MaskAddr = unix.RawSockaddrInet4{
+		Len:    unix.SizeofSockaddrInet4,
+		Family: unix.AF_INET,
+		Addr:   prefixToMask(network).As4(),
 	}
 
 	if err := ioctl(uintptr(s), unix.SIOCAIFADDR, uintptr(unsafe.Pointer(&ifr))); err != nil {
-		return fmt.Errorf("failed to set tun v4 address: %s", err)
+		return fmt.Errorf("failed to set IPv4 address via ioctl: %w", err)
-	}
-
-	err = addRoute(network, t.linkAddr)
-	if err != nil {
-		return err
 	}
 
 	return nil
 }
 
-func (t *tun) activate6(network netip.Prefix) error {
+func (rm *tun) addIPv6(name string, network netip.Prefix) error {
-	s, err := unix.Socket(
+	// Open an IPv6 socket for ioctl
-		unix.AF_INET6,
+	s, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, unix.IPPROTO_IP)
-		unix.SOCK_DGRAM,
-		unix.IPPROTO_IP,
-	)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to create IPv6 socket: %w", err)
 	}
 	defer unix.Close(s)
 
-	ifr := ifreqAlias6{
+	var ifr ifreqAlias6
-		Name: t.deviceBytes(),
+	copy(ifr.Name[:], name)
-		Addr: unix.RawSockaddrInet6{
+
-			Len:    unix.SizeofSockaddrInet6,
+	// Set the address
-			Family: unix.AF_INET6,
+	ifr.Addr = unix.RawSockaddrInet6{
-			Addr:   network.Addr().As16(),
+		Len:    unix.SizeofSockaddrInet6,
-		},
+		Family: unix.AF_INET6,
-		PrefixMask: unix.RawSockaddrInet6{
+		Addr:   network.Addr().As16(),
-			Len:    unix.SizeofSockaddrInet6,
-			Family: unix.AF_INET6,
-			Addr:   prefixToMask(network).As16(),
-		},
-		Lifetime: addrLifetime{
-			// never expires
-			Vltime: 0xffffffff,
-			Pltime: 0xffffffff,
-		},
-		Flags: _IN6_IFF_NODAD,
 	}
 
+	// Set the prefix mask
+	ifr.PrefixMask = unix.RawSockaddrInet6{
+		Len:    unix.SizeofSockaddrInet6,
+		Family: unix.AF_INET6,
+		Addr:   prefixToMask(network).As16(),
+	}
+
+	// Set lifetime (never expires)
+	ifr.Lifetime = addrLifetime{
+		Vltime: 0xffffffff,
+		Pltime: 0xffffffff,
+	}
+
+	// Set flags (no DAD - Duplicate Address Detection)
+	ifr.Flags = _IN6_IFF_NODAD
+
 	if err := ioctl(uintptr(s), _SIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&ifr))); err != nil {
-		return fmt.Errorf("failed to set tun address: %s", err)
+		return fmt.Errorf("failed to set IPv6 address via ioctl: %w", err)
 	}
 
 	return nil
 }
 
-func (t *tun) reload(c *config.C, initial bool) error {
-	change, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)
-	if err != nil {
-		return err
-	}
-
-	if !initial && !change {
-		return nil
-	}
-
-	if initial {
-		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
-	}
-
-	routeTree, err := makeRouteTree(t.l, routes, false)
-	if err != nil {
-		return err
-	}
-
-	// Teach nebula how to handle the routes before establishing them in the system table
-	oldRoutes := t.Routes.Swap(&routes)
-	t.routeTree.Store(routeTree)
-
-	if !initial {
-		// Remove first, if the system removes a wanted route hopefully it will be re-added next
-		err := t.removeRoutes(findRemovedRoutes(routes, *oldRoutes))
-		if err != nil {
-			util.LogWithContextIfNeeded("Failed to remove routes", err, t.l)
-		}
-
-		// Ensure any routes we actually want are installed
-		err = t.addRoutes(true)
-		if err != nil {
-			// Catch any stray logs
-			util.LogWithContextIfNeeded("Failed to add routes", err, t.l)
-		}
-	}
-
-	return nil
-}
-
-func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
-	r, ok := t.routeTree.Load().Lookup(ip)
-	if ok {
-		return r
-	}
-	return routing.Gateways{}
-}
-
-// Get the LinkAddr for the interface of the given name
-// Is there an easier way to fetch this when we create the interface?
-// Maybe SIOCGIFINDEX? but this doesn't appear to exist in the darwin headers.
 func getLinkAddr(name string) (*netroute.LinkAddr, error) {
 	rib, err := netroute.FetchRIB(unix.AF_UNSPEC, unix.NET_RT_IFLIST, 0)
 	if err != nil {
@@ -389,53 +393,7 @@ func getLinkAddr(name string) (*netroute.LinkAddr, error) {
 	return nil, nil
 }
 
-func (t *tun) addRoutes(logErrors bool) error {
+func (rm *tun) addRoute(prefix netip.Prefix) error {
-	routes := *t.Routes.Load()
-
-	for _, r := range routes {
-		if len(r.Via) == 0 || !r.Install {
-			// We don't allow route MTUs so only install routes with a via
-			continue
-		}
-
-		err := addRoute(r.Cidr, t.linkAddr)
-		if err != nil {
-			if errors.Is(err, unix.EEXIST) {
-				t.l.WithField("route", r.Cidr).
-					Warnf("unable to add unsafe_route, identical route already exists")
-			} else {
-				retErr := util.NewContextualError("Failed to add route", map[string]any{"route": r}, err)
-				if logErrors {
-					retErr.Log(t.l)
-				} else {
-					return retErr
-				}
-			}
-		} else {
-			t.l.WithField("route", r).Info("Added route")
-		}
-	}
-
-	return nil
-}
-
-func (t *tun) removeRoutes(routes []Route) error {
-	for _, r := range routes {
-		if !r.Install {
-			continue
-		}
-
-		err := delRoute(r.Cidr, t.linkAddr)
-		if err != nil {
-			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
-		} else {
-			t.l.WithField("route", r).Info("Removed route")
-		}
-	}
-	return nil
-}
-
-func addRoute(prefix netip.Prefix, gateway netroute.Addr) error {
 	sock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
 	if err != nil {
 		return fmt.Errorf("unable to create AF_ROUTE socket: %v", err)
@@ -453,13 +411,13 @@ func addRoute(prefix netip.Prefix, gateway netroute.Addr) error {
 		route.Addrs = []netroute.Addr{
 			unix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},
 			unix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},
-			unix.RTAX_GATEWAY: gateway,
+			unix.RTAX_GATEWAY: rm.linkAddr,
 		}
 	} else {
 		route.Addrs = []netroute.Addr{
 			unix.RTAX_DST:     &netroute.Inet6Addr{IP: prefix.Masked().Addr().As16()},
 			unix.RTAX_NETMASK: &netroute.Inet6Addr{IP: prefixToMask(prefix).As16()},
-			unix.RTAX_GATEWAY: gateway,
+			unix.RTAX_GATEWAY: rm.linkAddr,
 		}
 	}
 
@@ -476,7 +434,7 @@ func addRoute(prefix netip.Prefix, gateway netroute.Addr) error {
 	return nil
 }
 
-func delRoute(prefix netip.Prefix, gateway netroute.Addr) error {
+func (rm *tun) delRoute(prefix netip.Prefix) error {
 	sock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
 	if err != nil {
 		return fmt.Errorf("unable to create AF_ROUTE socket: %v", err)
@@ -493,13 +451,13 @@ func delRoute(prefix netip.Prefix, gateway netroute.Addr) error {
 		route.Addrs = []netroute.Addr{
 			unix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},
 			unix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},
-			unix.RTAX_GATEWAY: gateway,
+			unix.RTAX_GATEWAY: rm.linkAddr,
 		}
 	} else {
 		route.Addrs = []netroute.Addr{
 			unix.RTAX_DST:     &netroute.Inet6Addr{IP: prefix.Masked().Addr().As16()},
 			unix.RTAX_NETMASK: &netroute.Inet6Addr{IP: prefixToMask(prefix).As16()},
-			unix.RTAX_GATEWAY: gateway,
+			unix.RTAX_GATEWAY: rm.linkAddr,
 		}
 	}
 
@@ -507,6 +465,7 @@ func delRoute(prefix netip.Prefix, gateway netroute.Addr) error {
 	if err != nil {
 		return fmt.Errorf("failed to create route.RouteMessage: %w", err)
 	}
+
 	_, err = unix.Write(sock, data[:])
 	if err != nil {
 		return fmt.Errorf("failed to write route.RouteMessage to socket: %w", err)
@@ -515,68 +474,34 @@ func delRoute(prefix netip.Prefix, gateway netroute.Addr) error {
 	return nil
 }
 
-func (t *tun) Read(to []byte) (int, error) {
+func ioctl(a1, a2, a3 uintptr) error {
-	buf := make([]byte, len(to)+4)
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, a1, a2, a3)
-
+	if errno != 0 {
-	n, err := t.ReadWriteCloser.Read(buf)
+		return errno
-
+	}
-	copy(to, buf[4:])
+	return nil
-	return n - 4, err
 }
 
-// Write is only valid for single threaded use
+func prefixToMask(prefix netip.Prefix) netip.Addr {
-func (t *tun) Write(from []byte) (int, error) {
+	bits := prefix.Bits()
-	buf := t.out
+	if prefix.Addr().Is4() {
-	if cap(buf) < len(from)+4 {
+		// Create IPv4 netmask from prefix length
-		buf = make([]byte, len(from)+4)
+		mask := ^uint32(0) << (32 - bits)
-		t.out = buf
+		return netip.AddrFrom4([4]byte{
-	}
+			byte(mask >> 24),
-	buf = buf[:len(from)+4]
+			byte(mask >> 16),
-
+			byte(mask >> 8),
-	if len(from) == 0 {
+			byte(mask),
-		return 0, syscall.EIO
+		})
-	}
-
-	// Determine the IP Family for the NULL L2 Header
-	ipVer := from[0] >> 4
-	if ipVer == 4 {
-		buf[3] = syscall.AF_INET
-	} else if ipVer == 6 {
-		buf[3] = syscall.AF_INET6
 	} else {
-		return 0, fmt.Errorf("unable to determine IP version from packet")
+		// Create IPv6 netmask from prefix length
+		var mask [16]byte
+		for i := 0; i < bits/8; i++ {
+			mask[i] = 0xff
+		}
+		if bits%8 != 0 {
+			mask[bits/8] = ^byte(0) << (8 - bits%8)
+		}
+		return netip.AddrFrom16(mask)
 	}
-
-	copy(buf[4:], from)
-
-	n, err := t.ReadWriteCloser.Write(buf)
-	return n - 4, err
-}
-
-func (t *tun) Networks() []netip.Prefix {
-	return t.vpnNetworks
-}
-
-func (t *tun) UnsafeNetworks() []netip.Prefix {
-	return t.unsafeNetworks
-}
-
-func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *tun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
-func (t *tun) Name() string {
-	return t.Device
-}
-
-func (t *tun) SupportsMultiqueue() bool {
-	return false
-}
-
-func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	return nil, fmt.Errorf("TODO: multiqueue not implemented for darwin")
 }

overlay/tun_disabled.go

@@ -52,17 +52,6 @@ func (t *disabledTun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
-func (*disabledTun) UnsafeNetworks() []netip.Prefix {
-	return nil
-}
-func (*disabledTun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
-func (*disabledTun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
 func (*disabledTun) Name() string {
 	return "disabled"
 }
@@ -116,10 +105,6 @@ func (t *disabledTun) Write(b []byte) (int, error) {
 	return len(b), nil
 }
 
-func (t *disabledTun) SupportsMultiqueue() bool {
-	return true
-}
-
 func (t *disabledTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return t, nil
 }

overlay/tun_freebsd.go

@@ -1,287 +1,77 @@
-//go:build !e2e_testing
+//go:build freebsd && !e2e_testing
-// +build !e2e_testing
+// +build freebsd,!e2e_testing
 
 package overlay
 
 import (
-	"bytes"
-	"errors"
 	"fmt"
 	"io"
-	"io/fs"
 	"net/netip"
-	"sync/atomic"
+	"os/exec"
+	"strconv"
+	"strings"
 	"syscall"
-	"time"
 	"unsafe"
 
-	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
-	netroute "golang.org/x/net/route"
 	"golang.org/x/sys/unix"
+	wgtun "golang.zx2c4.com/wireguard/tun"
 )
 
-const (
+type tun struct{}
-	// FIODGNAME is defined in sys/sys/filio.h on FreeBSD
-	// For 32-bit systems, use FIODGNAME_32 (not defined in this file: 0x80086678)
-	FIODGNAME        = 0x80106678
-	TUNSIFMODE       = 0x8004745e
-	TUNSIFHEAD       = 0x80047460
-	OSIOCAIFADDR_IN6 = 0x8088691b
-	IN6_IFF_NODAD    = 0x0020
-)
-
-type fiodgnameArg struct {
-	length int32
-	pad    [4]byte
-	buf    unsafe.Pointer
-}
 
+// ifreqRename is used for renaming network interfaces on FreeBSD
 type ifreqRename struct {
 	Name [unix.IFNAMSIZ]byte
 	Data uintptr
 }
 
-type ifreqDestroy struct {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (*wgTun, error) {
-	Name [unix.IFNAMSIZ]byte
+	return nil, fmt.Errorf("newTunFromFd not supported on FreeBSD")
-	pad  [16]byte
 }
 
-type ifReq struct {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*wgTun, error) {
-	Name  [unix.IFNAMSIZ]byte
+	deviceName := c.GetString("tun.dev", "tun")
-	Flags uint16
+	mtu := c.GetInt("tun.mtu", DefaultMTU)
-}
 
-type ifreqMTU struct {
+	// Create WireGuard TUN device
-	Name [unix.IFNAMSIZ]byte
+	tunDevice, err := wgtun.CreateTUN(deviceName, mtu)
-	MTU  int32
-}
-
-type addrLifetime struct {
-	Expire    uint64
-	Preferred uint64
-	Vltime    uint32
-	Pltime    uint32
-}
-
-type ifreqAlias4 struct {
-	Name     [unix.IFNAMSIZ]byte
-	Addr     unix.RawSockaddrInet4
-	DstAddr  unix.RawSockaddrInet4
-	MaskAddr unix.RawSockaddrInet4
-	VHid     uint32
-}
-
-type ifreqAlias6 struct {
-	Name       [unix.IFNAMSIZ]byte
-	Addr       unix.RawSockaddrInet6
-	DstAddr    unix.RawSockaddrInet6
-	PrefixMask unix.RawSockaddrInet6
-	Flags      uint32
-	Lifetime   addrLifetime
-	VHid       uint32
-}
-
-type tun struct {
-	Device           string
-	vpnNetworks      []netip.Prefix
-	unsafeNetworks   []netip.Prefix
-	unsafeIPv4Origin netip.Prefix
-	MTU              int
-	Routes           atomic.Pointer[[]Route]
-	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
-	linkAddr         *netroute.LinkAddr
-	l                *logrus.Logger
-	devFd            int
-}
-
-func (t *tun) Read(to []byte) (int, error) {
-	// use readv() to read from the tunnel device, to eliminate the need for copying the buffer
-	if t.devFd < 0 {
-		return -1, syscall.EINVAL
-	}
-
-	// first 4 bytes is protocol family, in network byte order
-	head := make([]byte, 4)
-
-	iovecs := []syscall.Iovec{
-		{&head[0], 4},
-		{&to[0], uint64(len(to))},
-	}
-
-	n, _, errno := syscall.Syscall(syscall.SYS_READV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))
-
-	var err error
-	if errno != 0 {
-		err = syscall.Errno(errno)
-	} else {
-		err = nil
-	}
-	// fix bytes read number to exclude header
-	bytesRead := int(n)
-	if bytesRead < 0 {
-		return bytesRead, err
-	} else if bytesRead < 4 {
-		return 0, err
-	} else {
-		return bytesRead - 4, err
-	}
-}
-
-// Write is only valid for single threaded use
-func (t *tun) Write(from []byte) (int, error) {
-	// use writev() to write to the tunnel device, to eliminate the need for copying the buffer
-	if t.devFd < 0 {
-		return -1, syscall.EINVAL
-	}
-
-	if len(from) <= 1 {
-		return 0, syscall.EIO
-	}
-	ipVer := from[0] >> 4
-	var head []byte
-	// first 4 bytes is protocol family, in network byte order
-	if ipVer == 4 {
-		head = []byte{0, 0, 0, syscall.AF_INET}
-	} else if ipVer == 6 {
-		head = []byte{0, 0, 0, syscall.AF_INET6}
-	} else {
-		return 0, fmt.Errorf("unable to determine IP version from packet")
-	}
-	iovecs := []syscall.Iovec{
-		{&head[0], 4},
-		{&from[0], uint64(len(from))},
-	}
-
-	n, _, errno := syscall.Syscall(syscall.SYS_WRITEV, uintptr(t.devFd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(2))
-
-	var err error
-	if errno != 0 {
-		err = syscall.Errno(errno)
-	} else {
-		err = nil
-	}
-
-	return int(n) - 4, err
-}
-
-func (t *tun) Close() error {
-	if t.devFd >= 0 {
-		err := syscall.Close(t.devFd)
-		if err != nil {
-			t.l.WithError(err).Error("Error closing device")
-		}
-		t.devFd = -1
-
-		c := make(chan struct{})
-		go func() {
-			// destroying the interface can block if a read() is still pending. Do this asynchronously.
-			defer close(c)
-			s, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, syscall.IPPROTO_IP)
-			if err == nil {
-				defer syscall.Close(s)
-				ifreq := ifreqDestroy{Name: t.deviceBytes()}
-				err = ioctl(uintptr(s), syscall.SIOCIFDESTROY, uintptr(unsafe.Pointer(&ifreq)))
-			}
-			if err != nil {
-				t.l.WithError(err).Error("Error destroying tunnel")
-			}
-		}()
-
-		// wait up to 1 second so we start blocking at the ioctl
-		select {
-		case <-c:
-		case <-time.After(1 * time.Second):
-		}
-	}
-
-	return nil
-}
-
-func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
-	return nil, fmt.Errorf("newTunFromFd not supported in FreeBSD")
-}
-
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
-	// Try to open existing tun device
-	var fd int
-	var err error
-	deviceName := c.GetString("tun.dev", "")
-	if deviceName != "" {
-		fd, err = syscall.Open("/dev/"+deviceName, syscall.O_RDWR, 0)
-	}
-	if errors.Is(err, fs.ErrNotExist) || deviceName == "" {
-		// If the device doesn't already exist, request a new one and rename it
-		fd, err = syscall.Open("/dev/tun", syscall.O_RDWR, 0)
-	}
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create TUN device: %w", err)
 	}
 
-	// Read the name of the interface
+	// Get the actual device name
-	var name [16]byte
+	actualName, err := tunDevice.Name()
-	arg := fiodgnameArg{length: 16, buf: unsafe.Pointer(&name)}
+	if err != nil {
-	ctrlErr := ioctl(uintptr(fd), FIODGNAME, uintptr(unsafe.Pointer(&arg)))
+		tunDevice.Close()
-
+		return nil, fmt.Errorf("failed to get TUN device name: %w", err)
-	if ctrlErr == nil {
-		// set broadcast mode and multicast
-		ifmode := uint32(unix.IFF_BROADCAST | unix.IFF_MULTICAST)
-		ctrlErr = ioctl(uintptr(fd), TUNSIFMODE, uintptr(unsafe.Pointer(&ifmode)))
-	}
-
-	if ctrlErr == nil {
-		// turn on link-layer mode, to support ipv6
-		ifhead := uint32(1)
-		ctrlErr = ioctl(uintptr(fd), TUNSIFHEAD, uintptr(unsafe.Pointer(&ifhead)))
-	}
-
-	if ctrlErr != nil {
-		return nil, err
-	}
-
-	ifName := string(bytes.TrimRight(name[:], "\x00"))
-	if deviceName == "" {
-		deviceName = ifName
 	}
 
 	// If the name doesn't match the desired interface name, rename it now
-	if ifName != deviceName {
+	if actualName != deviceName && deviceName != "" && deviceName != "tun" {
-		s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
+		if err := renameInterface(actualName, deviceName); err != nil {
-		if err != nil {
+			tunDevice.Close()
-			return nil, err
+			return nil, fmt.Errorf("failed to rename interface from %s to %s: %w", actualName, deviceName, err)
 		}
-		defer syscall.Close(s)
+		actualName = deviceName
-
-		fd := uintptr(s)
-
-		var fromName [16]byte
-		var toName [16]byte
-		copy(fromName[:], ifName)
-		copy(toName[:], deviceName)
-
-		ifrr := ifreqRename{
-			Name: fromName,
-			Data: uintptr(unsafe.Pointer(&toName)),
-		}
-
-		// Set the device name
-		_ = ioctl(fd, syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
 	}
 
-	t := &tun{
+	t := &wgTun{
-		Device:         deviceName,
+		tunDevice:   tunDevice,
-		vpnNetworks:    vpnNetworks,
+		vpnNetworks: vpnNetworks,
-		unsafeNetworks: unsafeNetworks,
+		MaxMTU:      mtu,
-		MTU:            c.GetInt("tun.mtu", DefaultMTU),
+		DefaultMTU:  mtu,
-		l:              l,
+		l:           l,
-		devFd:          fd,
 	}
 
+	// Create FreeBSD-specific route manager
+	t.routeManager = &tun{}
+
 	err = t.reload(c, true)
 	if err != nil {
+		tunDevice.Close()
 		return nil, err
 	}
 
@@ -292,200 +82,86 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNet
 		}
 	})
 
+	l.WithField("name", actualName).Info("Created WireGuard TUN device")
+
 	return t, nil
 }
 
-func (t *tun) addIp(cidr netip.Prefix) error {
+func (rm *tun) Activate(t *wgTun) error {
-	if cidr.Addr().Is4() {
+	name, err := t.tunDevice.Name()
-		ifr := ifreqAlias4{
-			Name: t.deviceBytes(),
-			Addr: unix.RawSockaddrInet4{
-				Len:    unix.SizeofSockaddrInet4,
-				Family: unix.AF_INET,
-				Addr:   cidr.Addr().As4(),
-			},
-			DstAddr: unix.RawSockaddrInet4{
-				Len:    unix.SizeofSockaddrInet4,
-				Family: unix.AF_INET,
-				Addr:   getBroadcast(cidr).As4(),
-			},
-			MaskAddr: unix.RawSockaddrInet4{
-				Len:    unix.SizeofSockaddrInet4,
-				Family: unix.AF_INET,
-				Addr:   prefixToMask(cidr).As4(),
-			},
-			VHid: 0,
-		}
-		s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
-		if err != nil {
-			return err
-		}
-		defer syscall.Close(s)
-		// Note: unix.SIOCAIFADDR corresponds to FreeBSD's OSIOCAIFADDR
-		if err := ioctl(uintptr(s), unix.SIOCAIFADDR, uintptr(unsafe.Pointer(&ifr))); err != nil {
-			return fmt.Errorf("failed to set tun address %s: %s", cidr.Addr().String(), err)
-		}
-		return nil
-	}
-
-	if cidr.Addr().Is6() {
-		ifr := ifreqAlias6{
-			Name: t.deviceBytes(),
-			Addr: unix.RawSockaddrInet6{
-				Len:    unix.SizeofSockaddrInet6,
-				Family: unix.AF_INET6,
-				Addr:   cidr.Addr().As16(),
-			},
-			PrefixMask: unix.RawSockaddrInet6{
-				Len:    unix.SizeofSockaddrInet6,
-				Family: unix.AF_INET6,
-				Addr:   prefixToMask(cidr).As16(),
-			},
-			Lifetime: addrLifetime{
-				Expire:    0,
-				Preferred: 0,
-				Vltime:    0xffffffff,
-				Pltime:    0xffffffff,
-			},
-			Flags: IN6_IFF_NODAD,
-		}
-		s, err := syscall.Socket(syscall.AF_INET6, syscall.SOCK_DGRAM, syscall.IPPROTO_IP)
-		if err != nil {
-			return err
-		}
-		defer syscall.Close(s)
-
-		if err := ioctl(uintptr(s), OSIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&ifr))); err != nil {
-			return fmt.Errorf("failed to set tun address %s: %s", cidr.Addr().String(), err)
-		}
-		return nil
-	}
-
-	return fmt.Errorf("unknown address type %v", cidr)
-}
-
-func (t *tun) Activate() error {
-	// Setup our default MTU
-	err := t.setMTU()
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get device name: %w", err)
 	}
 
-	linkAddr, err := getLinkAddr(t.Device)
+	// Set the MTU
-	if err != nil {
+	rm.SetMTU(t, t.MaxMTU)
-		return err
-	}
-	if linkAddr == nil {
-		return fmt.Errorf("unable to discover link_addr for tun interface")
-	}
-	t.linkAddr = linkAddr
 
-	for i := range t.vpnNetworks {
+	// Add IP addresses
-		err := t.addIp(t.vpnNetworks[i])
+	for _, network := range t.vpnNetworks {
-		if err != nil {
+		if err := rm.addIP(t, name, network); err != nil {
 			return err
 		}
 	}
 
-	return t.addRoutes(false)
+	// Bring up the interface
-}
+	if err := runCommandBSD("ifconfig", name, "up"); err != nil {
+		return fmt.Errorf("failed to bring up interface: %w", err)
+	}
 
-func (t *tun) setMTU() error {
+	// Set the routes
-	// Set the MTU on the device
+	if err := rm.AddRoutes(t, false); err != nil {
-	s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
-	if err != nil {
 		return err
 	}
-	defer syscall.Close(s)
-
-	ifm := ifreqMTU{Name: t.deviceBytes(), MTU: int32(t.MTU)}
-	err = ioctl(uintptr(s), unix.SIOCSIFMTU, uintptr(unsafe.Pointer(&ifm)))
-	return err
-}
-
-func (t *tun) reload(c *config.C, initial bool) error {
-	change, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)
-	if err != nil {
-		return err
-	}
-
-	if !initial && !change {
-		return nil
-	}
-
-	if initial {
-		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
-	}
-
-	routeTree, err := makeRouteTree(t.l, routes, false)
-	if err != nil {
-		return err
-	}
-
-	// Teach nebula how to handle the routes before establishing them in the system table
-	oldRoutes := t.Routes.Swap(&routes)
-	t.routeTree.Store(routeTree)
-
-	if !initial {
-		// Remove first, if the system removes a wanted route hopefully it will be re-added next
-		err := t.removeRoutes(findRemovedRoutes(routes, *oldRoutes))
-		if err != nil {
-			util.LogWithContextIfNeeded("Failed to remove routes", err, t.l)
-		}
-
-		// Ensure any routes we actually want are installed
-		err = t.addRoutes(true)
-		if err != nil {
-			// Catch any stray logs
-			util.LogWithContextIfNeeded("Failed to add routes", err, t.l)
-		}
-	}
 
 	return nil
 }
 
-func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
+func (rm *tun) SetMTU(t *wgTun, mtu int) {
-	r, _ := t.routeTree.Load().Lookup(ip)
+	name, err := t.tunDevice.Name()
-	return r
+	if err != nil {
+		t.l.WithError(err).Error("Failed to get device name for MTU set")
+		return
+	}
+
+	if err := runCommandBSD("ifconfig", name, "mtu", strconv.Itoa(mtu)); err != nil {
+		t.l.WithError(err).Error("Failed to set tun mtu")
+	}
 }
 
-func (t *tun) Networks() []netip.Prefix {
+func (rm *tun) SetDefaultRoute(t *wgTun, cidr netip.Prefix) error {
-	return t.vpnNetworks
+	// On FreeBSD, routes are set via ifconfig and route commands
+	return nil
 }
 
-func (t *tun) UnsafeNetworks() []netip.Prefix {
+func (rm *tun) AddRoutes(t *wgTun, logErrors bool) error {
-	return t.unsafeNetworks
+	name, err := t.tunDevice.Name()
-}
+	if err != nil {
+		return fmt.Errorf("failed to get device name: %w", err)
+	}
 
-func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *tun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
-func (t *tun) Name() string {
-	return t.Device
-}
-
-func (t *tun) SupportsMultiqueue() bool {
-	return false
-}
-
-func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	return nil, fmt.Errorf("TODO: multiqueue not implemented for freebsd")
-}
-
-func (t *tun) addRoutes(logErrors bool) error {
 	routes := *t.Routes.Load()
 	for _, r := range routes {
-		if len(r.Via) == 0 || !r.Install {
+		if !r.Install {
-			// We don't allow route MTUs so only install routes with a via
 			continue
 		}
 
-		err := addRoute(r.Cidr, t.linkAddr)
+		// Add route using route command
+		args := []string{"add"}
+
+		if r.Cidr.Addr().Is6() {
+			args = append(args, "-inet6")
+		} else {
+			args = append(args, "-inet")
+		}
+
+		args = append(args, r.Cidr.String(), "-interface", name)
+
+		if r.Metric > 0 {
+			// FreeBSD doesn't support route metrics directly like Linux
+			t.l.WithField("route", r).Warn("Route metrics are not fully supported on FreeBSD")
+		}
+
+		err := runCommandBSD("route", args...)
 		if err != nil {
 			retErr := util.NewContextualError("Failed to add route", map[string]any{"route": r}, err)
 			if logErrors {
@@ -501,142 +177,99 @@ func (t *tun) addRoutes(logErrors bool) error {
 	return nil
 }
 
-func (t *tun) removeRoutes(routes []Route) error {
+func (rm *tun) RemoveRoutes(t *wgTun, routes []Route) {
+	name, err := t.tunDevice.Name()
+	if err != nil {
+		t.l.WithError(err).Error("Failed to get device name for route removal")
+		return
+	}
+
 	for _, r := range routes {
 		if !r.Install {
 			continue
 		}
 
-		err := delRoute(r.Cidr, t.linkAddr)
+		args := []string{"delete"}
+
+		if r.Cidr.Addr().Is6() {
+			args = append(args, "-inet6")
+		} else {
+			args = append(args, "-inet")
+		}
+
+		args = append(args, r.Cidr.String(), "-interface", name)
+
+		err := runCommandBSD("route", args...)
 		if err != nil {
 			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
 			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
-	return nil
 }
 
-func (t *tun) deviceBytes() (o [16]byte) {
+func (rm *tun) NewMultiQueueReader(t *wgTun) (io.ReadWriteCloser, error) {
-	for i, c := range t.Device {
+	// FreeBSD doesn't support multi-queue TUN devices in the same way as Linux
-		o[i] = byte(c)
+	// Return a reader that wraps the same device
-	}
+	return &wgTunReader{
-	return
+		parent:    t,
+		tunDevice: t.tunDevice,
+		offset:    0,
+		l:         t.l,
+	}, nil
 }
 
-func addRoute(prefix netip.Prefix, gateway netroute.Addr) error {
+func (rm *tun) addIP(t *wgTun, name string, network netip.Prefix) error {
-	sock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
+	addr := network.Addr()
-	if err != nil {
-		return fmt.Errorf("unable to create AF_ROUTE socket: %v", err)
-	}
-	defer unix.Close(sock)
 
-	route := &netroute.RouteMessage{
+	if addr.Is4() {
-		Version: unix.RTM_VERSION,
+		// For IPv4: ifconfig tun0 10.0.0.1/24
-		Type:    unix.RTM_ADD,
+		if err := runCommandBSD("ifconfig", name, network.String()); err != nil {
-		Flags:   unix.RTF_UP,
+			return fmt.Errorf("failed to add IPv4 address: %w", err)
-		Seq:     1,
-	}
-
-	if prefix.Addr().Is4() {
-		route.Addrs = []netroute.Addr{
-			unix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},
-			unix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},
-			unix.RTAX_GATEWAY: gateway,
 		}
 	} else {
-		route.Addrs = []netroute.Addr{
+		// For IPv6: ifconfig tun0 inet6 add 2001:db8::1/64
-			unix.RTAX_DST:     &netroute.Inet6Addr{IP: prefix.Masked().Addr().As16()},
+		if err := runCommandBSD("ifconfig", name, "inet6", "add", network.String()); err != nil {
-			unix.RTAX_NETMASK: &netroute.Inet6Addr{IP: prefixToMask(prefix).As16()},
+			return fmt.Errorf("failed to add IPv6 address: %w", err)
-			unix.RTAX_GATEWAY: gateway,
 		}
 	}
 
-	data, err := route.Marshal()
-	if err != nil {
-		return fmt.Errorf("failed to create route.RouteMessage: %w", err)
-	}
-
-	_, err = unix.Write(sock, data[:])
-	if err != nil {
-		if errors.Is(err, unix.EEXIST) {
-			// Try to do a change
-			route.Type = unix.RTM_CHANGE
-			data, err = route.Marshal()
-			if err != nil {
-				return fmt.Errorf("failed to create route.RouteMessage for change: %w", err)
-			}
-			_, err = unix.Write(sock, data[:])
-			fmt.Println("DOING CHANGE")
-			return err
-		}
-		return fmt.Errorf("failed to write route.RouteMessage to socket: %w", err)
-	}
-
 	return nil
 }
 
-func delRoute(prefix netip.Prefix, gateway netroute.Addr) error {
+func runCommandBSD(name string, args ...string) error {
-	sock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
+	cmd := exec.Command(name, args...)
+	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return fmt.Errorf("unable to create AF_ROUTE socket: %v", err)
+		return fmt.Errorf("%s %s failed: %w\nOutput: %s", name, strings.Join(args, " "), err, string(output))
 	}
-	defer unix.Close(sock)
+	return nil
+}
 
-	route := netroute.RouteMessage{
+func renameInterface(fromName, toName string) error {
-		Version: unix.RTM_VERSION,
+	s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
-		Type:    unix.RTM_DELETE,
+	if err != nil {
-		Seq:     1,
+		return fmt.Errorf("failed to create socket: %w", err)
+	}
+	defer syscall.Close(s)
+
+	fd := uintptr(s)
+
+	var fromNameBytes [unix.IFNAMSIZ]byte
+	var toNameBytes [unix.IFNAMSIZ]byte
+	copy(fromNameBytes[:], fromName)
+	copy(toNameBytes[:], toName)
+
+	ifrr := ifreqRename{
+		Name: fromNameBytes,
+		Data: uintptr(unsafe.Pointer(&toNameBytes)),
 	}
 
-	if prefix.Addr().Is4() {
+	// Set the device name using SIOCSIFNAME ioctl
-		route.Addrs = []netroute.Addr{
+	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, fd, syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
-			unix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},
+	if errno != 0 {
-			unix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},
+		return fmt.Errorf("SIOCSIFNAME ioctl failed: %w", errno)
-			unix.RTAX_GATEWAY: gateway,
-		}
-	} else {
-		route.Addrs = []netroute.Addr{
-			unix.RTAX_DST:     &netroute.Inet6Addr{IP: prefix.Masked().Addr().As16()},
-			unix.RTAX_NETMASK: &netroute.Inet6Addr{IP: prefixToMask(prefix).As16()},
-			unix.RTAX_GATEWAY: gateway,
-		}
-	}
-
-	data, err := route.Marshal()
-	if err != nil {
-		return fmt.Errorf("failed to create route.RouteMessage: %w", err)
-	}
-	_, err = unix.Write(sock, data[:])
-	if err != nil {
-		return fmt.Errorf("failed to write route.RouteMessage to socket: %w", err)
 	}
 
 	return nil
 }
-
-// getLinkAddr Gets the link address for the interface of the given name
-func getLinkAddr(name string) (*netroute.LinkAddr, error) {
-	rib, err := netroute.FetchRIB(unix.AF_UNSPEC, unix.NET_RT_IFLIST, 0)
-	if err != nil {
-		return nil, err
-	}
-	msgs, err := netroute.ParseRIB(unix.NET_RT_IFLIST, rib)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, m := range msgs {
-		switch m := m.(type) {
-		case *netroute.InterfaceMessage:
-			if m.Name == name {
-				sa, ok := m.Addrs[unix.RTAX_IFP].(*netroute.LinkAddr)
-				if ok {
-					return sa, nil
-				}
-			}
-		}
-	}
-
-	return nil, nil
-}

overlay/tun_ios.go

@@ -22,23 +22,20 @@ import (
 
 type tun struct {
 	io.ReadWriteCloser
-	vpnNetworks      []netip.Prefix
+	vpnNetworks []netip.Prefix
-	unsafeNetworks   []netip.Prefix
+	Routes      atomic.Pointer[[]Route]
-	unsafeIPv4Origin netip.Prefix
+	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	Routes           atomic.Pointer[[]Route]
+	l           *logrus.Logger
-	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
-	l                *logrus.Logger
 }
 
-func newTun(_ *config.C, _ *logrus.Logger, _ []netip.Prefix, _ []netip.Prefix, _ bool) (*tun, error) {
+func newTun(_ *config.C, _ *logrus.Logger, _ []netip.Prefix, _ bool) (*tun, error) {
 	return nil, fmt.Errorf("newTun not supported in iOS")
 }
 
-func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
+func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
 	file := os.NewFile(uintptr(deviceFd), "/dev/tun")
 	t := &tun{
 		vpnNetworks:     vpnNetworks,
-		unsafeNetworks:  unsafeNetworks,
 		ReadWriteCloser: &tunReadCloser{f: file},
 		l:               l,
 	}
@@ -72,8 +69,6 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
-	t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
-
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -152,26 +147,10 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
-func (t *tun) UnsafeNetworks() []netip.Prefix {
-	return t.unsafeNetworks
-}
-
-func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *tun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
 func (t *tun) Name() string {
 	return "iOS"
 }
 
-func (t *tun) SupportsMultiqueue() bool {
-	return false
-}
-
 func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for ios")
 }

overlay/tun_linux.go

@@ -1,5 +1,5 @@
-//go:build !android && !e2e_testing
+//go:build linux && !android && !e2e_testing
-// +build !android,!e2e_testing
+// +build linux,!android,!e2e_testing
 
 package overlay
 
@@ -9,161 +9,105 @@ import (
 	"net"
 	"net/netip"
 	"os"
-	"strings"
-	"sync"
-	"sync/atomic"
 	"time"
 	"unsafe"
 
-	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
 	"github.com/vishvananda/netlink"
 	"golang.org/x/sys/unix"
+	wgtun "golang.zx2c4.com/wireguard/tun"
 )
 
 type tun struct {
-	io.ReadWriteCloser
+	deviceIndex               int
-	fd             int
+	ioctlFd                   uintptr
-	Device         string
+	txQueueLen                int
-	vpnNetworks    []netip.Prefix
-	unsafeNetworks []netip.Prefix
-	MaxMTU         int
-	DefaultMTU     int
-	TXQueueLen     int
-	deviceIndex    int
-	ioctlFd        uintptr
-
-	Routes                    atomic.Pointer[[]Route]
-	routeTree                 atomic.Pointer[bart.Table[routing.Gateways]]
-	routeChan                 chan struct{}
 	useSystemRoutes           bool
 	useSystemRoutesBufferSize int
-
-	// These are routes learned from `tun.use_system_route_table`
-	// stored here to make it easier to restore them after a reload
-	routesFromSystem     map[netip.Prefix]routing.Gateways
-	routesFromSystemLock sync.Mutex
-
-	snatAddr         netip.Prefix
-	unsafeIPv4Origin netip.Prefix
-
-	l *logrus.Logger
 }
 
-func (t *tun) Networks() []netip.Prefix {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, multiqueue bool) (*wgTun, error) {
-	return t.vpnNetworks
+	deviceName := c.GetString("tun.dev", "")
-}
+	mtu := c.GetInt("tun.mtu", DefaultMTU)
 
-func (t *tun) UnsafeNetworks() []netip.Prefix {
+	// Create WireGuard TUN device
-	return t.unsafeNetworks
+	tunDevice, err := wgtun.CreateTUN(deviceName, mtu)
-}
-
-func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *tun) SNATAddress() netip.Prefix {
-	return t.snatAddr
-}
-
-type ifReq struct {
-	Name  [16]byte
-	Flags uint16
-	pad   [8]byte
-}
-
-type ifreqMTU struct {
-	Name [16]byte
-	MTU  int32
-	pad  [8]byte
-}
-
-type ifreqQLEN struct {
-	Name  [16]byte
-	Value int32
-	pad   [8]byte
-}
-
-func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
-	file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
-
-	t, err := newTunGeneric(c, l, file, vpnNetworks, unsafeNetworks)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create TUN device: %w", err)
 	}
 
-	t.Device = "tun0"
+	// Get the actual device name
-
+	actualName, err := tunDevice.Name()
-	return t, nil
-}
-
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, multiqueue bool) (*tun, error) {
-	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
 	if err != nil {
-		// If /dev/net/tun doesn't exist, try to create it (will happen in docker)
+		tunDevice.Close()
-		if os.IsNotExist(err) {
+		return nil, fmt.Errorf("failed to get TUN device name: %w", err)
-			err = os.MkdirAll("/dev/net", 0755)
-			if err != nil {
-				return nil, fmt.Errorf("/dev/net/tun doesn't exist, failed to mkdir -p /dev/net: %w", err)
-			}
-			err = unix.Mknod("/dev/net/tun", unix.S_IFCHR|0600, int(unix.Mkdev(10, 200)))
-			if err != nil {
-				return nil, fmt.Errorf("failed to create /dev/net/tun: %w", err)
-			}
-
-			fd, err = unix.Open("/dev/net/tun", os.O_RDWR, 0)
-			if err != nil {
-				return nil, fmt.Errorf("created /dev/net/tun, but still failed: %w", err)
-			}
-		} else {
-			return nil, err
-		}
 	}
 
-	var req ifReq
+	t := &wgTun{
-	req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI)
+		tunDevice:   tunDevice,
-	if multiqueue {
+		vpnNetworks: vpnNetworks,
-		req.Flags |= unix.IFF_MULTI_QUEUE
+		MaxMTU:      mtu,
-	}
+		DefaultMTU:  mtu,
-	nameStr := c.GetString("tun.dev", "")
+		l:           l,
-	copy(req.Name[:], nameStr)
-	if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
-		return nil, &NameError{
-			Name:       nameStr,
-			Underlying: err,
-		}
-	}
-	name := strings.Trim(string(req.Name[:]), "\x00")
-
-	file := os.NewFile(uintptr(fd), "/dev/net/tun")
-	t, err := newTunGeneric(c, l, file, vpnNetworks, unsafeNetworks)
-	if err != nil {
-		return nil, err
 	}
 
-	t.Device = name
+	// Create Linux-specific route manager
-
+	routeManager := &tun{
-	return t, nil
+		txQueueLen:                c.GetInt("tun.tx_queue", 500),
-}
-
-func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix) (*tun, error) {
-	t := &tun{
-		ReadWriteCloser:           file,
-		fd:                        int(file.Fd()),
-		vpnNetworks:               vpnNetworks,
-		unsafeNetworks:            unsafeNetworks,
-		TXQueueLen:                c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
 		useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0),
-		routesFromSystem:          map[netip.Prefix]routing.Gateways{},
+	}
-		l:                         l,
+	t.routeManager = routeManager
+
+	err = t.reload(c, true)
+	if err != nil {
+		tunDevice.Close()
+		return nil, err
 	}
 
-	err := t.reload(c, true)
+	c.RegisterReloadCallback(func(c *config.C) {
+		err := t.reload(c, false)
+		if err != nil {
+			util.LogWithContextIfNeeded("failed to reload tun device", err, t.l)
+		}
+	})
+
+	l.WithField("name", actualName).Info("Created WireGuard TUN device")
+
+	return t, nil
+}
+
+func newTunFromFd(c *config.C, l *logrus.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*wgTun, error) {
+	// Create TUN device from file descriptor
+	file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
+	mtu := c.GetInt("tun.mtu", DefaultMTU)
+	tunDevice, err := wgtun.CreateTUNFromFile(file, mtu)
 	if err != nil {
+		return nil, fmt.Errorf("failed to create TUN device from fd: %w", err)
+	}
+
+	t := &wgTun{
+		tunDevice:   tunDevice,
+		vpnNetworks: vpnNetworks,
+		MaxMTU:      mtu,
+		DefaultMTU:  mtu,
+		l:           l,
+	}
+
+	// Create Linux-specific route manager
+	routeManager := &tun{
+		txQueueLen:                c.GetInt("tun.tx_queue", 500),
+		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
+		useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0),
+	}
+	t.routeManager = routeManager
+
+	err = t.reload(c, true)
+	if err != nil {
+		tunDevice.Close()
 		return nil, err
 	}
 
@@ -177,323 +121,105 @@ func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []n
 	return t, nil
 }
 
-func (t *tun) reload(c *config.C, initial bool) error {
+func (rm *tun) Activate(t *wgTun) error {
-	routeChange, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)
+	name, err := t.tunDevice.Name()
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get device name: %w", err)
 	}
 
-	if !initial && !routeChange && !c.HasChanged("tun.mtu") {
+	if t.routeManager.useSystemRoutes {
-		return nil
-	}
-
-	if initial {
-		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes) //todo MUST be different from t.snatAddr!
-		t.snatAddr = prepareSnatAddr(t, t.l, c)
-	}
-
-	routeTree, err := makeRouteTree(t.l, routes, true)
-	if err != nil {
-		return err
-	}
-
-	// Bring along any routes learned from the system route table on reload
-	t.routesFromSystemLock.Lock()
-	for dst, gw := range t.routesFromSystem {
-		routeTree.Insert(dst, gw)
-	}
-	t.routesFromSystemLock.Unlock()
-
-	oldDefaultMTU := t.DefaultMTU
-	oldMaxMTU := t.MaxMTU
-	newDefaultMTU := c.GetInt("tun.mtu", DefaultMTU)
-	newMaxMTU := newDefaultMTU
-	for i, r := range routes {
-		if r.MTU == 0 {
-			routes[i].MTU = newDefaultMTU
-		}
-
-		if r.MTU > t.MaxMTU {
-			newMaxMTU = r.MTU
-		}
-	}
-
-	t.MaxMTU = newMaxMTU
-	t.DefaultMTU = newDefaultMTU
-
-	// Teach nebula how to handle the routes before establishing them in the system table
-	oldRoutes := t.Routes.Swap(&routes)
-	t.routeTree.Store(routeTree)
-
-	if !initial {
-		if oldMaxMTU != newMaxMTU {
-			t.setMTU()
-			t.l.Infof("Set max MTU to %v was %v", t.MaxMTU, oldMaxMTU)
-		}
-
-		if oldDefaultMTU != newDefaultMTU {
-			for i := range t.vpnNetworks {
-				err := t.setDefaultRoute(t.vpnNetworks[i])
-				if err != nil {
-					t.l.Warn(err)
-				} else {
-					t.l.Infof("Set default MTU to %v was %v", t.DefaultMTU, oldDefaultMTU)
-				}
-			}
-		}
-
-		// Remove first, if the system removes a wanted route hopefully it will be re-added next
-		t.removeRoutes(findRemovedRoutes(routes, *oldRoutes))
-
-		// Ensure any routes we actually want are installed
-		err = t.addRoutes(true)
-		if err != nil {
-			// This should never be called since addRoutes should log its own errors in a reload condition
-			util.LogWithContextIfNeeded("Failed to refresh routes", err, t.l)
-		}
-	}
-
-	return nil
-}
-
-func (t *tun) SupportsMultiqueue() bool {
-	return true
-}
-
-func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
-	if err != nil {
-		return nil, err
-	}
-
-	var req ifReq
-	req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI | unix.IFF_MULTI_QUEUE)
-	copy(req.Name[:], t.Device)
-	if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
-		return nil, err
-	}
-
-	file := os.NewFile(uintptr(fd), "/dev/net/tun")
-
-	return file, nil
-}
-
-func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
-	r, _ := t.routeTree.Load().Lookup(ip)
-	return r
-}
-
-func (t *tun) Write(b []byte) (int, error) {
-	var nn int
-	maximum := len(b)
-
-	for {
-		n, err := unix.Write(t.fd, b[nn:maximum])
-		if n > 0 {
-			nn += n
-		}
-		if nn == len(b) {
-			return nn, err
-		}
-
-		if err != nil {
-			return nn, err
-		}
-
-		if n == 0 {
-			return nn, io.ErrUnexpectedEOF
-		}
-	}
-}
-
-func (t *tun) deviceBytes() (o [16]byte) {
-	for i, c := range t.Device {
-		o[i] = byte(c)
-	}
-	return
-}
-
-func hasNetlinkAddr(al []*netlink.Addr, x netlink.Addr) bool {
-	for i := range al {
-		if al[i].Equal(x) {
-			return true
-		}
-	}
-	return false
-}
-
-// addIPs uses netlink to add all addresses that don't exist, then it removes ones that should not be there
-func (t *tun) addIPs(link netlink.Link) error {
-	newAddrs := make([]*netlink.Addr, len(t.vpnNetworks))
-	for i := range t.vpnNetworks {
-		newAddrs[i] = &netlink.Addr{
-			IPNet: &net.IPNet{
-				IP:   t.vpnNetworks[i].Addr().AsSlice(),
-				Mask: net.CIDRMask(t.vpnNetworks[i].Bits(), t.vpnNetworks[i].Addr().BitLen()),
-			},
-			Label: t.vpnNetworks[i].Addr().Zone(),
-		}
-	}
-
-	if t.unsafeIPv4Origin.IsValid() {
-		newAddrs = append(newAddrs, &netlink.Addr{
-			IPNet: &net.IPNet{
-				IP:   t.unsafeIPv4Origin.Addr().AsSlice(),
-				Mask: net.CIDRMask(t.unsafeIPv4Origin.Bits(), t.unsafeIPv4Origin.Addr().BitLen()),
-			},
-			Label: t.unsafeIPv4Origin.Addr().Zone(),
-		})
-		t.l.WithField("address", t.unsafeIPv4Origin).Info("Adding origin address for IPv4 unsafe_routes")
-	}
-
-	//add all new addresses
-	for i := range newAddrs {
-		//AddrReplace still adds new IPs, but if their properties change it will change them as well
-		if err := netlink.AddrReplace(link, newAddrs[i]); err != nil {
-			return err
-		}
-	}
-
-	//iterate over remainder, remove whoever shouldn't be there
-	al, err := netlink.AddrList(link, netlink.FAMILY_ALL)
-	if err != nil {
-		return fmt.Errorf("failed to get tun address list: %s", err)
-	}
-
-	for i := range al {
-		if hasNetlinkAddr(newAddrs, al[i]) {
-			continue
-		}
-		err = netlink.AddrDel(link, &al[i])
-		if err != nil {
-			t.l.WithError(err).Error("failed to remove address from tun address list")
-		} else {
-			t.l.WithField("removed", al[i].String()).Info("removed address not listed in cert(s)")
-		}
-	}
-
-	return nil
-}
-
-func (t *tun) Activate() error {
-	devName := t.deviceBytes()
-
-	if t.useSystemRoutes {
 		t.watchRoutes()
 	}
 
+	// Get the netlink device
+	link, err := netlink.LinkByName(name)
+	if err != nil {
+		return fmt.Errorf("failed to get tun device link: %s", err)
+	}
+
+	rm.deviceIndex = link.Attrs().Index
+
+	// Open socket for ioctl operations
 	s, err := unix.Socket(
-		unix.AF_INET, //because everything we use t.ioctlFd for is address family independent, this is fine
+		unix.AF_INET,
 		unix.SOCK_DGRAM,
 		unix.IPPROTO_IP,
 	)
 	if err != nil {
 		return err
 	}
-	t.ioctlFd = uintptr(s)
+	rm.ioctlFd = uintptr(s)
 
-	// Set the device name
+	rm.SetMTU(t, t.MaxMTU)
-	ifrf := ifReq{Name: devName}
-	if err = ioctl(t.ioctlFd, unix.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
-		return fmt.Errorf("failed to set tun device name: %s", err)
-	}
-
-	link, err := netlink.LinkByName(t.Device)
-	if err != nil {
-		return fmt.Errorf("failed to get tun device link: %s", err)
-	}
-
-	t.deviceIndex = link.Attrs().Index
-
-	// Setup our default MTU
-	t.setMTU()
 
 	// Set the transmit queue length
-	ifrq := ifreqQLEN{Name: devName, Value: int32(t.TXQueueLen)}
+	devName := deviceBytes(name)
-	if err = ioctl(t.ioctlFd, unix.SIOCSIFTXQLEN, uintptr(unsafe.Pointer(&ifrq))); err != nil {
+	ifrq := ifreqQLEN{Name: devName, Value: int32(rm.txQueueLen)}
+	if err = ioctl(t.routeManager.ioctlFd, unix.SIOCSIFTXQLEN, uintptr(unsafe.Pointer(&ifrq))); err != nil {
 		// If we can't set the queue length nebula will still work but it may lead to packet loss
 		t.l.WithError(err).Error("Failed to set tun tx queue length")
 	}
 
+	// Disable IPv6 link-local address generation
 	const modeNone = 1
 	if err = netlink.LinkSetIP6AddrGenMode(link, modeNone); err != nil {
 		t.l.WithError(err).Warn("Failed to disable link local address generation")
 	}
 
-	if err = t.addIPs(link); err != nil {
+	// Add IP addresses
+	if err = t.routeManager.addIPs(t, link); err != nil {
 		return err
 	}
 
 	// Bring up the interface
-	ifrf.Flags = ifrf.Flags | unix.IFF_UP
+	if err = netlink.LinkSetUp(link); err != nil {
-	if err = ioctl(t.ioctlFd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
 		return fmt.Errorf("failed to bring the tun device up: %s", err)
 	}
 
-	//set route MTU
+	// Set route MTU
 	for i := range t.vpnNetworks {
-		if err = t.setDefaultRoute(t.vpnNetworks[i]); err != nil {
+		if err = t.routeManager.SetDefaultRoute(t, t.vpnNetworks[i]); err != nil {
-			return fmt.Errorf("failed to set default route MTU for %s: %w", t.vpnNetworks[i], err)
+			return fmt.Errorf("failed to set default route MTU: %w", err)
-		}
-	}
-
-	if t.unsafeIPv4Origin.IsValid() {
-		if err = t.setDefaultRoute(t.unsafeIPv4Origin); err != nil {
-			return fmt.Errorf("failed to set default route MTU for %s: %w", t.unsafeIPv4Origin, err)
 		}
 	}
 
 	// Set the routes
-	if err = t.addRoutes(false); err != nil {
+	if err = t.routeManager.AddRoutes(t, false); err != nil {
 		return err
 	}
 
-	// Run the interface
-	ifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING
-	if err = ioctl(t.ioctlFd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
-		return fmt.Errorf("failed to run tun device: %s", err)
-	}
-
 	return nil
 }
 
-func (t *tun) setMTU() {
+func (rm *tun) SetMTU(t *wgTun, mtu int) {
-	// Set the MTU on the device
+	name, err := t.tunDevice.Name()
-	ifm := ifreqMTU{Name: t.deviceBytes(), MTU: int32(t.MaxMTU)}
+	if err != nil {
-	if err := ioctl(t.ioctlFd, unix.SIOCSIFMTU, uintptr(unsafe.Pointer(&ifm))); err != nil {
+		t.l.WithError(err).Error("Failed to get device name for MTU set")
-		// This is currently a non fatal condition because the route table must have the MTU set appropriately as well
+		return
+	}
+
+	link, err := netlink.LinkByName(name)
+	if err != nil {
+		t.l.WithError(err).Error("Failed to get link for MTU set")
+		return
+	}
+
+	if err := netlink.LinkSetMTU(link, mtu); err != nil {
 		t.l.WithError(err).Error("Failed to set tun mtu")
 	}
 }
 
-func (t *tun) setSnatRoute() error {
+func (rm *tun) SetDefaultRoute(t *wgTun, cidr netip.Prefix) error {
-	dr := &net.IPNet{
-		IP:   t.snatAddr.Masked().Addr().AsSlice(),
-		Mask: net.CIDRMask(t.snatAddr.Bits(), t.snatAddr.Addr().BitLen()),
-	}
-
-	nr := netlink.Route{
-		LinkIndex: t.deviceIndex,
-		Dst:       dr,
-		Scope:     unix.RT_SCOPE_LINK,
-		//Protocol: unix.RTPROT_KERNEL,
-		Table: unix.RT_TABLE_MAIN,
-		Type:  unix.RTN_UNICAST,
-	}
-	return netlink.RouteReplace(&nr)
-}
-
-func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 	dr := &net.IPNet{
 		IP:   cidr.Masked().Addr().AsSlice(),
 		Mask: net.CIDRMask(cidr.Bits(), cidr.Addr().BitLen()),
 	}
 
 	nr := netlink.Route{
-		LinkIndex: t.deviceIndex,
+		LinkIndex: t.routeManager.deviceIndex,
 		Dst:       dr,
 		MTU:       t.DefaultMTU,
-		AdvMSS:    t.advMSS(Route{}),
+		AdvMSS:    advMSS(Route{}, t.DefaultMTU, t.MaxMTU),
 		Scope:     unix.RT_SCOPE_LINK,
 		Src:       net.IP(cidr.Addr().AsSlice()),
 		Protocol:  unix.RTPROT_KERNEL,
@@ -503,7 +229,7 @@ func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 	err := netlink.RouteReplace(&nr)
 	if err != nil {
 		t.l.WithError(err).WithField("cidr", cidr).Warn("Failed to set default route MTU, retrying")
-		//retry twice more -- on some systems there appears to be a race condition where if we set routes too soon, netlink says `invalid argument`
+		// Retry twice more
 		for i := 0; i < 2; i++ {
 			time.Sleep(100 * time.Millisecond)
 			err = netlink.RouteReplace(&nr)
@@ -521,8 +247,7 @@ func (t *tun) setDefaultRoute(cidr netip.Prefix) error {
 	return nil
 }
 
-func (t *tun) addRoutes(logErrors bool) error {
+func (rm *tun) AddRoutes(t *wgTun, logErrors bool) error {
-	// Path routes
 	routes := *t.Routes.Load()
 	for _, r := range routes {
 		if !r.Install {
@@ -535,10 +260,10 @@ func (t *tun) addRoutes(logErrors bool) error {
 		}
 
 		nr := netlink.Route{
-			LinkIndex: t.deviceIndex,
+			LinkIndex: t.routeManager.deviceIndex,
 			Dst:       dr,
 			MTU:       r.MTU,
-			AdvMSS:    t.advMSS(r),
+			AdvMSS:    advMSS(r, t.DefaultMTU, t.MaxMTU),
 			Scope:     unix.RT_SCOPE_LINK,
 		}
 
@@ -559,17 +284,10 @@ func (t *tun) addRoutes(logErrors bool) error {
 		}
 	}
 
-	if t.snatAddr.IsValid() {
-		//at least for Linux, we need to set a return route for the SNATted traffic in order to satisfy the reverse-path filter,
-		//and to help the kernel deliver our reply traffic to the tun device.
-		//however, it is important that we do not actually /assign/ the SNAT address,
-		//since link-local addresses will not be routed between interfaces without significant trickery.
-		return t.setSnatRoute()
-	}
 	return nil
 }
 
-func (t *tun) removeRoutes(routes []Route) {
+func (rm *tun) RemoveRoutes(t *wgTun, routes []Route) {
 	for _, r := range routes {
 		if !r.Install {
 			continue
@@ -581,10 +299,10 @@ func (t *tun) removeRoutes(routes []Route) {
 		}
 
 		nr := netlink.Route{
-			LinkIndex: t.deviceIndex,
+			LinkIndex: t.routeManager.deviceIndex,
 			Dst:       dr,
 			MTU:       r.MTU,
-			AdvMSS:    t.advMSS(r),
+			AdvMSS:    advMSS(r, t.DefaultMTU, t.MaxMTU),
 			Scope:     unix.RT_SCOPE_LINK,
 		}
 
@@ -601,30 +319,105 @@ func (t *tun) removeRoutes(routes []Route) {
 	}
 }
 
-func (t *tun) Name() string {
+func (rm *tun) NewMultiQueueReader(t *wgTun) (io.ReadWriteCloser, error) {
-	return t.Device
+	// For Linux with WireGuard TUN, we can reuse the same device
+	// The vectorized I/O will handle batching
+	return &wgTunReader{
+		parent:    t,
+		tunDevice: t.tunDevice,
+		offset:    0,
+		l:         t.l,
+	}, nil
 }
 
-func (t *tun) advMSS(r Route) int {
+func deviceBytes(name string) [16]byte {
+	var o [16]byte
+	for i, c := range name {
+		if i >= 16 {
+			break
+		}
+		o[i] = byte(c)
+	}
+	return o
+}
+
+func advMSS(r Route, defaultMTU, maxMTU int) int {
 	mtu := r.MTU
 	if r.MTU == 0 {
-		mtu = t.DefaultMTU
+		mtu = defaultMTU
 	}
 
 	// We only need to set advmss if the route MTU does not match the device MTU
-	if mtu != t.MaxMTU {
+	if mtu != maxMTU {
 		return mtu - 40
 	}
 	return 0
 }
 
-func (t *tun) watchRoutes() {
+type ifreqQLEN struct {
+	Name  [16]byte
+	Value int32
+	pad   [8]byte
+}
+
+func hasNetlinkAddr(al []*netlink.Addr, x netlink.Addr) bool {
+	for i := range al {
+		if al[i].Equal(x) {
+			return true
+		}
+	}
+	return false
+}
+
+func (rm *tun) addIPs(t *wgTun, link netlink.Link) error {
+	newAddrs := make([]*netlink.Addr, len(t.vpnNetworks))
+	for i := range t.vpnNetworks {
+		newAddrs[i] = &netlink.Addr{
+			IPNet: &net.IPNet{
+				IP:   t.vpnNetworks[i].Addr().AsSlice(),
+				Mask: net.CIDRMask(t.vpnNetworks[i].Bits(), t.vpnNetworks[i].Addr().BitLen()),
+			},
+			Label: t.vpnNetworks[i].Addr().Zone(),
+		}
+	}
+
+	// Add all new addresses
+	for i := range newAddrs {
+		if err := netlink.AddrReplace(link, newAddrs[i]); err != nil {
+			return err
+		}
+	}
+
+	// Iterate over remainder, remove whoever shouldn't be there
+	al, err := netlink.AddrList(link, netlink.FAMILY_ALL)
+	if err != nil {
+		return fmt.Errorf("failed to get tun address list: %s", err)
+	}
+
+	for i := range al {
+		if hasNetlinkAddr(newAddrs, al[i]) {
+			continue
+		}
+		err = netlink.AddrDel(link, &al[i])
+		if err != nil {
+			t.l.WithError(err).Error("failed to remove address from tun address list")
+		} else {
+			t.l.WithField("removed", al[i].String()).Info("removed address not listed in cert(s)")
+		}
+	}
+
+	return nil
+}
+
+// watchRoutes monitors system route changes
+func (t *wgTun) watchRoutes() {
+
 	rch := make(chan netlink.RouteUpdate)
 	doneChan := make(chan struct{})
 
 	netlinkOptions := netlink.RouteSubscribeOptions{
-		ReceiveBufferSize:      t.useSystemRoutesBufferSize,
+		ReceiveBufferSize:      t.routeManager.useSystemRoutesBufferSize,
-		ReceiveBufferForceSize: t.useSystemRoutesBufferSize != 0,
+		ReceiveBufferForceSize: t.routeManager.useSystemRoutesBufferSize != 0,
 		ErrorCallback:          func(e error) { t.l.WithError(e).Errorf("netlink error") },
 	}
 
@@ -642,98 +435,19 @@ func (t *tun) watchRoutes() {
 				if ok {
 					t.updateRoutes(r)
 				} else {
-					// may be should do something here as
-					// netlink stops sending updates
 					return
 				}
 			case <-doneChan:
-				// netlink.RouteSubscriber will close the rch for us
 				return
 			}
 		}
 	}()
 }
 
-func (t *tun) isGatewayInVpnNetworks(gwAddr netip.Addr) bool {
+func (t *wgTun) updateRoutes(r netlink.RouteUpdate) {
-	withinNetworks := false
+	gateways := t.getGatewaysFromRoute(&r.Route, t.routeManager.deviceIndex)
-	for i := range t.vpnNetworks {
-		if t.vpnNetworks[i].Contains(gwAddr) {
-			withinNetworks = true
-			break
-		}
-	}
 
-	return withinNetworks
-}
-
-func (t *tun) getGatewaysFromRoute(r *netlink.Route) routing.Gateways {
-	var gateways routing.Gateways
-
-	link, err := netlink.LinkByName(t.Device)
-	if err != nil {
-		t.l.WithField("deviceName", t.Device).Error("Ignoring route update: failed to get link by name")
-		return gateways
-	}
-
-	// If this route is relevant to our interface and there is a gateway then add it
-	if r.LinkIndex == link.Attrs().Index {
-		gwAddr, ok := getGatewayAddr(r.Gw, r.Via)
-		if ok {
-			if t.isGatewayInVpnNetworks(gwAddr) {
-				gateways = append(gateways, routing.NewGateway(gwAddr, 1))
-			} else {
-				// Gateway isn't in our overlay network, ignore
-				t.l.WithField("route", r).Debug("Ignoring route update, gateway is not in our network")
-			}
-		} else {
-			t.l.WithField("route", r).Debug("Ignoring route update, invalid gateway or via address")
-		}
-	}
-
-	for _, p := range r.MultiPath {
-		// If this route is relevant to our interface and there is a gateway then add it
-		if p.LinkIndex == link.Attrs().Index {
-			gwAddr, ok := getGatewayAddr(p.Gw, p.Via)
-			if ok {
-				if t.isGatewayInVpnNetworks(gwAddr) {
-					gateways = append(gateways, routing.NewGateway(gwAddr, p.Hops+1))
-				} else {
-					// Gateway isn't in our overlay network, ignore
-					t.l.WithField("route", r).Debug("Ignoring route update, gateway is not in our network")
-				}
-			} else {
-				t.l.WithField("route", r).Debug("Ignoring route update, invalid gateway or via address")
-			}
-		}
-	}
-
-	routing.CalculateBucketsForGateways(gateways)
-	return gateways
-}
-
-func getGatewayAddr(gw net.IP, via netlink.Destination) (netip.Addr, bool) {
-	// Try to use the old RTA_GATEWAY first
-	gwAddr, ok := netip.AddrFromSlice(gw)
-	if !ok {
-		// Fallback to the new RTA_VIA
-		rVia, ok := via.(*netlink.Via)
-		if ok {
-			gwAddr, ok = netip.AddrFromSlice(rVia.Addr)
-		}
-	}
-
-	if gwAddr.IsValid() {
-		gwAddr = gwAddr.Unmap()
-		return gwAddr, true
-	}
-
-	return netip.Addr{}, false
-}
-
-func (t *tun) updateRoutes(r netlink.RouteUpdate) {
-	gateways := t.getGatewaysFromRoute(&r.Route)
 	if len(gateways) == 0 {
-		// No gateways relevant to our network, no routing changes required.
 		t.l.WithField("route", r).Debug("Ignoring route update, no gateways")
 		return
 	}
@@ -754,34 +468,81 @@ func (t *tun) updateRoutes(r netlink.RouteUpdate) {
 
 	newTree := t.routeTree.Load().Clone()
 
-	t.routesFromSystemLock.Lock()
 	if r.Type == unix.RTM_NEWROUTE {
 		t.l.WithField("destination", dst).WithField("via", gateways).Info("Adding route")
-		t.routesFromSystem[dst] = gateways
 		newTree.Insert(dst, gateways)
-
 	} else {
 		t.l.WithField("destination", dst).WithField("via", gateways).Info("Removing route")
-		delete(t.routesFromSystem, dst)
 		newTree.Delete(dst)
 	}
-	t.routesFromSystemLock.Unlock()
 	t.routeTree.Store(newTree)
 }
 
-func (t *tun) Close() error {
+func (t *wgTun) getGatewaysFromRoute(r *netlink.Route, deviceIndex int) routing.Gateways {
-	if t.routeChan != nil {
+	var gateways routing.Gateways
-		close(t.routeChan)
+
+	name, err := t.tunDevice.Name()
+	if err != nil {
+		t.l.Error("Ignoring route update: failed to get device name")
+		return gateways
 	}
 
-	if t.ReadWriteCloser != nil {
+	link, err := netlink.LinkByName(name)
-		_ = t.ReadWriteCloser.Close()
+	if err != nil {
+		t.l.WithField("DeviceName", name).Error("Ignoring route update: failed to get link by name")
+		return gateways
 	}
 
-	if t.ioctlFd > 0 {
+	// If this route is relevant to our interface and there is a gateway then add it
-		_ = os.NewFile(t.ioctlFd, "ioctlFd").Close()
+	if r.LinkIndex == link.Attrs().Index && len(r.Gw) > 0 {
-		t.ioctlFd = 0
+		gwAddr, ok := netip.AddrFromSlice(r.Gw)
+		if !ok {
+			t.l.WithField("route", r).Debug("Ignoring route update, invalid gateway address")
+		} else {
+			gwAddr = gwAddr.Unmap()
+
+			if !t.isGatewayInVpnNetworks(gwAddr) {
+				t.l.WithField("route", r).Debug("Ignoring route update, not in our network")
+			} else {
+				gateways = append(gateways, routing.NewGateway(gwAddr, 1))
+			}
+		}
 	}
 
+	for _, p := range r.MultiPath {
+		if p.LinkIndex == link.Attrs().Index && len(p.Gw) > 0 {
+			gwAddr, ok := netip.AddrFromSlice(p.Gw)
+			if !ok {
+				t.l.WithField("route", r).Debug("Ignoring multipath route update, invalid gateway address")
+			} else {
+				gwAddr = gwAddr.Unmap()
+
+				if !t.isGatewayInVpnNetworks(gwAddr) {
+					t.l.WithField("route", r).Debug("Ignoring route update, not in our network")
+				} else {
+					gateways = append(gateways, routing.NewGateway(gwAddr, p.Hops+1))
+				}
+			}
+		}
+	}
+
+	routing.CalculateBucketsForGateways(gateways)
+	return gateways
+}
+
+func (t *wgTun) isGatewayInVpnNetworks(gwAddr netip.Addr) bool {
+	for i := range t.vpnNetworks {
+		if t.vpnNetworks[i].Contains(gwAddr) {
+			return true
+		}
+	}
+	return false
+}
+
+func ioctl(a1, a2, a3 uintptr) error {
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, a1, a2, a3)
+	if errno != 0 {
+		return errno
+	}
 	return nil
 }

overlay/tun_linux_test.go

@@ -6,26 +6,27 @@ package overlay
 import "testing"
 
 var runAdvMSSTests = []struct {
-	name     string
+	name       string
-	tun      *tun
+	defaultMTU int
-	r        Route
+	maxMTU     int
-	expected int
+	r          Route
+	expected   int
 }{
 	// Standard case, default MTU is the device max MTU
-	{"default", &tun{DefaultMTU: 1440, MaxMTU: 1440}, Route{}, 0},
+	{"default", 1440, 1440, Route{}, 0},
-	{"default-min", &tun{DefaultMTU: 1440, MaxMTU: 1440}, Route{MTU: 1440}, 0},
+	{"default-min", 1440, 1440, Route{MTU: 1440}, 0},
-	{"default-low", &tun{DefaultMTU: 1440, MaxMTU: 1440}, Route{MTU: 1200}, 1160},
+	{"default-low", 1440, 1440, Route{MTU: 1200}, 1160},
 
 	// Case where we have a route MTU set higher than the default
-	{"route", &tun{DefaultMTU: 1440, MaxMTU: 8941}, Route{}, 1400},
+	{"route", 1440, 8941, Route{}, 1400},
-	{"route-min", &tun{DefaultMTU: 1440, MaxMTU: 8941}, Route{MTU: 1440}, 1400},
+	{"route-min", 1440, 8941, Route{MTU: 1440}, 1400},
-	{"route-high", &tun{DefaultMTU: 1440, MaxMTU: 8941}, Route{MTU: 8941}, 0},
+	{"route-high", 1440, 8941, Route{MTU: 8941}, 0},
 }
 
 func TestTunAdvMSS(t *testing.T) {
 	for _, tt := range runAdvMSSTests {
 		t.Run(tt.name, func(t *testing.T) {
-			o := tt.tun.advMSS(tt.r)
+			o := advMSS(tt.r, tt.defaultMTU, tt.maxMTU)
 			if o != tt.expected {
 				t.Errorf("got %d, want %d", o, tt.expected)
 			}

overlay/tun_netbsd.go

@@ -58,25 +58,23 @@ type addrLifetime struct {
 }
 
 type tun struct {
-	Device           string
+	Device      string
-	vpnNetworks      []netip.Prefix
+	vpnNetworks []netip.Prefix
-	unsafeNetworks   []netip.Prefix
+	MTU         int
-	unsafeIPv4Origin netip.Prefix
+	Routes      atomic.Pointer[[]Route]
-	MTU              int
+	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
-	Routes           atomic.Pointer[[]Route]
+	l           *logrus.Logger
-	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
+	f           *os.File
-	l                *logrus.Logger
+	fd          int
-	f                *os.File
-	fd               int
 }
 
 var deviceNameRE = regexp.MustCompile(`^tun[0-9]+$`)
 
-func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (*tun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported in NetBSD")
 }
 
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*tun, error) {
 	// Try to open tun device
 	var err error
 	deviceName := c.GetString("tun.dev", "")
@@ -352,10 +350,6 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return nil
 	}
 
-	if initial {
-		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
-	}
-
 	routeTree, err := makeRouteTree(t.l, routes, false)
 	if err != nil {
 		return err
@@ -392,26 +386,10 @@ func (t *tun) Networks() []netip.Prefix {
 	return t.vpnNetworks
 }
 
-func (t *tun) UnsafeNetworks() []netip.Prefix {
-	return t.unsafeNetworks
-}
-
-func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *tun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
 func (t *tun) Name() string {
 	return t.Device
 }
 
-func (t *tun) SupportsMultiqueue() bool {
-	return false
-}
-
 func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented for netbsd")
 }
@@ -569,3 +547,41 @@ func delRoute(prefix netip.Prefix, gateways []netip.Prefix) error {
 
 	return nil
 }
+
+func ioctl(a1, a2, a3 uintptr) error {
+	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, a1, a2, a3)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func prefixToMask(prefix netip.Prefix) netip.Addr {
+	bits := prefix.Bits()
+	if prefix.Addr().Is4() {
+		mask := ^uint32(0) << (32 - bits)
+		return netip.AddrFrom4([4]byte{
+			byte(mask >> 24),
+			byte(mask >> 16),
+			byte(mask >> 8),
+			byte(mask),
+		})
+	}
+	var mask [16]byte
+	for i := 0; i < bits/8; i++ {
+		mask[i] = 0xff
+	}
+	if bits%8 != 0 {
+		mask[bits/8] = ^byte(0) << (8 - bits%8)
+	}
+	return netip.AddrFrom16(mask)
+}
+
+func selectGateway(prefix netip.Prefix, gateways []netip.Prefix) (netip.Prefix, error) {
+	for _, gw := range gateways {
+		if prefix.Addr().Is4() == gw.Addr().Is4() {
+			return gw, nil
+		}
+	}
+	return netip.Prefix{}, fmt.Errorf("no suitable gateway found for prefix %v", prefix)
+}

overlay/tun_notwin.go

@@ -1,14 +0,0 @@
-//go:build !windows
-// +build !windows
-
-package overlay
-
-import "syscall"
-
-func ioctl(a1, a2, a3 uintptr) error {
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, a1, a2, a3)
-	if errno != 0 {
-		return errno
-	}
-	return nil
-}

overlay/tun_openbsd.go

@@ -1,107 +1,59 @@
-//go:build !e2e_testing
+//go:build openbsd && !e2e_testing
-// +build !e2e_testing
+// +build openbsd,!e2e_testing
 
 package overlay
 
 import (
-	"errors"
 	"fmt"
 	"io"
 	"net/netip"
-	"os"
+	"os/exec"
-	"regexp"
+	"strconv"
-	"sync/atomic"
+	"strings"
-	"syscall"
-	"unsafe"
 
-	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
-	netroute "golang.org/x/net/route"
+	wgtun "golang.zx2c4.com/wireguard/tun"
-	"golang.org/x/sys/unix"
 )
 
-const (
+type tun struct{}
-	SIOCAIFADDR_IN6 = 0x8080691a
-)
 
-type ifreqAlias4 struct {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (*wgTun, error) {
-	Name     [unix.IFNAMSIZ]byte
+	return nil, fmt.Errorf("newTunFromFd not supported on OpenBSD")
-	Addr     unix.RawSockaddrInet4
-	DstAddr  unix.RawSockaddrInet4
-	MaskAddr unix.RawSockaddrInet4
 }
 
-type ifreqAlias6 struct {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*wgTun, error) {
-	Name       [unix.IFNAMSIZ]byte
+	deviceName := c.GetString("tun.dev", "tun")
-	Addr       unix.RawSockaddrInet6
+	mtu := c.GetInt("tun.mtu", DefaultMTU)
-	DstAddr    unix.RawSockaddrInet6
-	PrefixMask unix.RawSockaddrInet6
-	Flags      uint32
-	Lifetime   [2]uint32
-}
 
-type ifreq struct {
+	// Create WireGuard TUN device
-	Name [unix.IFNAMSIZ]byte
+	tunDevice, err := wgtun.CreateTUN(deviceName, mtu)
-	data int
-}
-
-type tun struct {
-	Device           string
-	vpnNetworks      []netip.Prefix
-	unsafeNetworks   []netip.Prefix
-	unsafeIPv4Origin netip.Prefix
-	MTU              int
-	Routes           atomic.Pointer[[]Route]
-	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
-	l                *logrus.Logger
-	f                *os.File
-	fd               int
-	// cache out buffer since we need to prepend 4 bytes for tun metadata
-	out []byte
-}
-
-var deviceNameRE = regexp.MustCompile(`^tun[0-9]+$`)
-
-func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*tun, error) {
-	return nil, fmt.Errorf("newTunFromFd not supported in openbsd")
-}
-
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*tun, error) {
-	// Try to open tun device
-	var err error
-	deviceName := c.GetString("tun.dev", "")
-	if deviceName == "" {
-		return nil, fmt.Errorf("a device name in the format of /dev/tunN must be specified")
-	}
-	if !deviceNameRE.MatchString(deviceName) {
-		return nil, fmt.Errorf("a device name in the format of /dev/tunN must be specified")
-	}
-
-	fd, err := unix.Open("/dev/"+deviceName, os.O_RDWR, 0)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to create TUN device: %w", err)
 	}
 
-	err = unix.SetNonblock(fd, true)
+	// Get the actual device name
+	actualName, err := tunDevice.Name()
 	if err != nil {
-		l.WithError(err).Warn("Failed to set the tun device as nonblocking")
+		tunDevice.Close()
+		return nil, fmt.Errorf("failed to get TUN device name: %w", err)
 	}
 
-	t := &tun{
+	t := &wgTun{
-		f:              os.NewFile(uintptr(fd), ""),
+		tunDevice:   tunDevice,
-		fd:             fd,
+		vpnNetworks: vpnNetworks,
-		Device:         deviceName,
+		MaxMTU:      mtu,
-		vpnNetworks:    vpnNetworks,
+		DefaultMTU:  mtu,
-		unsafeNetworks: unsafeNetworks,
+		l:           l,
-		MTU:            c.GetInt("tun.mtu", DefaultMTU),
-		l:              l,
 	}
 
+	// Create OpenBSD-specific route manager
+	t.routeManager = &tun{}
+
 	err = t.reload(c, true)
 	if err != nil {
+		tunDevice.Close()
 		return nil, err
 	}
 
@@ -112,241 +64,86 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNet
 		}
 	})
 
+	l.WithField("name", actualName).Info("Created WireGuard TUN device")
+
 	return t, nil
 }
 
-func (t *tun) Close() error {
+func (rm *tun) Activate(t *wgTun) error {
-	if t.f != nil {
+	name, err := t.tunDevice.Name()
-		if err := t.f.Close(); err != nil {
-			return fmt.Errorf("error closing tun file: %w", err)
-		}
-
-		// t.f.Close should have handled it for us but let's be extra sure
-		_ = unix.Close(t.fd)
-	}
-	return nil
-}
-
-func (t *tun) Read(to []byte) (int, error) {
-	buf := make([]byte, len(to)+4)
-
-	n, err := t.f.Read(buf)
-
-	copy(to, buf[4:])
-	return n - 4, err
-}
-
-// Write is only valid for single threaded use
-func (t *tun) Write(from []byte) (int, error) {
-	buf := t.out
-	if cap(buf) < len(from)+4 {
-		buf = make([]byte, len(from)+4)
-		t.out = buf
-	}
-	buf = buf[:len(from)+4]
-
-	if len(from) == 0 {
-		return 0, syscall.EIO
-	}
-
-	// Determine the IP Family for the NULL L2 Header
-	ipVer := from[0] >> 4
-	if ipVer == 4 {
-		buf[3] = syscall.AF_INET
-	} else if ipVer == 6 {
-		buf[3] = syscall.AF_INET6
-	} else {
-		return 0, fmt.Errorf("unable to determine IP version from packet")
-	}
-
-	copy(buf[4:], from)
-
-	n, err := t.f.Write(buf)
-	return n - 4, err
-}
-
-func (t *tun) addIp(cidr netip.Prefix) error {
-	if cidr.Addr().Is4() {
-		var req ifreqAlias4
-		req.Name = t.deviceBytes()
-		req.Addr = unix.RawSockaddrInet4{
-			Len:    unix.SizeofSockaddrInet4,
-			Family: unix.AF_INET,
-			Addr:   cidr.Addr().As4(),
-		}
-		req.DstAddr = unix.RawSockaddrInet4{
-			Len:    unix.SizeofSockaddrInet4,
-			Family: unix.AF_INET,
-			Addr:   cidr.Addr().As4(),
-		}
-		req.MaskAddr = unix.RawSockaddrInet4{
-			Len:    unix.SizeofSockaddrInet4,
-			Family: unix.AF_INET,
-			Addr:   prefixToMask(cidr).As4(),
-		}
-
-		s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
-		if err != nil {
-			return err
-		}
-		defer syscall.Close(s)
-
-		if err := ioctl(uintptr(s), unix.SIOCAIFADDR, uintptr(unsafe.Pointer(&req))); err != nil {
-			return fmt.Errorf("failed to set tun address %s: %s", cidr.Addr(), err)
-		}
-
-		err = addRoute(cidr, t.vpnNetworks)
-		if err != nil {
-			return fmt.Errorf("failed to set route for vpn network %v: %w", cidr, err)
-		}
-
-		return nil
-	}
-
-	if cidr.Addr().Is6() {
-		var req ifreqAlias6
-		req.Name = t.deviceBytes()
-		req.Addr = unix.RawSockaddrInet6{
-			Len:    unix.SizeofSockaddrInet6,
-			Family: unix.AF_INET6,
-			Addr:   cidr.Addr().As16(),
-		}
-		req.PrefixMask = unix.RawSockaddrInet6{
-			Len:    unix.SizeofSockaddrInet6,
-			Family: unix.AF_INET6,
-			Addr:   prefixToMask(cidr).As16(),
-		}
-		req.Lifetime[0] = 0xffffffff
-		req.Lifetime[1] = 0xffffffff
-
-		s, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, unix.IPPROTO_IP)
-		if err != nil {
-			return err
-		}
-		defer syscall.Close(s)
-
-		if err := ioctl(uintptr(s), SIOCAIFADDR_IN6, uintptr(unsafe.Pointer(&req))); err != nil {
-			return fmt.Errorf("failed to set tun address %s: %s", cidr.Addr().String(), err)
-		}
-
-		return nil
-	}
-
-	return fmt.Errorf("unknown address type %v", cidr)
-}
-
-func (t *tun) Activate() error {
-	err := t.doIoctlByName(unix.SIOCSIFMTU, uint32(t.MTU))
 	if err != nil {
-		return fmt.Errorf("failed to set tun mtu: %w", err)
+		return fmt.Errorf("failed to get device name: %w", err)
 	}
 
-	for i := range t.vpnNetworks {
+	// Set the MTU
-		err = t.addIp(t.vpnNetworks[i])
+	rm.SetMTU(t, t.MaxMTU)
-		if err != nil {
+
+	// Add IP addresses
+	for _, network := range t.vpnNetworks {
+		if err := rm.addIP(t, name, network); err != nil {
 			return err
 		}
 	}
 
-	return t.addRoutes(false)
+	// Bring up the interface
-}
+	if err := runCommandBSD("ifconfig", name, "up"); err != nil {
+		return fmt.Errorf("failed to bring up interface: %w", err)
+	}
 
-func (t *tun) doIoctlByName(ctl uintptr, value uint32) error {
+	// Set the routes
-	s, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
+	if err := rm.AddRoutes(t, false); err != nil {
-	if err != nil {
 		return err
 	}
-	defer syscall.Close(s)
-
-	ir := ifreq{Name: t.deviceBytes(), data: int(value)}
-	err = ioctl(uintptr(s), ctl, uintptr(unsafe.Pointer(&ir)))
-	return err
-}
-
-func (t *tun) reload(c *config.C, initial bool) error {
-	change, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)
-	if err != nil {
-		return err
-	}
-
-	if !initial && !change {
-		return nil
-	}
-
-	if initial {
-		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
-	}
-
-	routeTree, err := makeRouteTree(t.l, routes, false)
-	if err != nil {
-		return err
-	}
-
-	// Teach nebula how to handle the routes before establishing them in the system table
-	oldRoutes := t.Routes.Swap(&routes)
-	t.routeTree.Store(routeTree)
-
-	if !initial {
-		// Remove first, if the system removes a wanted route hopefully it will be re-added next
-		err := t.removeRoutes(findRemovedRoutes(routes, *oldRoutes))
-		if err != nil {
-			util.LogWithContextIfNeeded("Failed to remove routes", err, t.l)
-		}
-
-		// Ensure any routes we actually want are installed
-		err = t.addRoutes(true)
-		if err != nil {
-			// Catch any stray logs
-			util.LogWithContextIfNeeded("Failed to add routes", err, t.l)
-		}
-	}
 
 	return nil
 }
 
-func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
+func (rm *tun) SetMTU(t *wgTun, mtu int) {
-	r, _ := t.routeTree.Load().Lookup(ip)
+	name, err := t.tunDevice.Name()
-	return r
+	if err != nil {
+		t.l.WithError(err).Error("Failed to get device name for MTU set")
+		return
+	}
+
+	if err := runCommandBSD("ifconfig", name, "mtu", strconv.Itoa(mtu)); err != nil {
+		t.l.WithError(err).Error("Failed to set tun mtu")
+	}
 }
 
-func (t *tun) Networks() []netip.Prefix {
+func (rm *tun) SetDefaultRoute(t *wgTun, cidr netip.Prefix) error {
-	return t.vpnNetworks
+	// On OpenBSD, routes are set via ifconfig and route commands
+	return nil
 }
 
-func (t *tun) UnsafeNetworks() []netip.Prefix {
+func (rm *tun) AddRoutes(t *wgTun, logErrors bool) error {
-	return t.unsafeNetworks
+	name, err := t.tunDevice.Name()
-}
+	if err != nil {
+		return fmt.Errorf("failed to get device name: %w", err)
+	}
 
-func (t *tun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *tun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
-func (t *tun) Name() string {
-	return t.Device
-}
-
-func (t *tun) SupportsMultiqueue() bool {
-	return false
-}
-
-func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	return nil, fmt.Errorf("TODO: multiqueue not implemented for openbsd")
-}
-
-func (t *tun) addRoutes(logErrors bool) error {
 	routes := *t.Routes.Load()
-
 	for _, r := range routes {
-		if len(r.Via) == 0 || !r.Install {
+		if !r.Install {
-			// We don't allow route MTUs so only install routes with a via
 			continue
 		}
 
-		err := addRoute(r.Cidr, t.vpnNetworks)
+		// Add route using route command
+		args := []string{"add"}
+
+		if r.Cidr.Addr().Is6() {
+			args = append(args, "-inet6")
+		} else {
+			args = append(args, "-inet")
+		}
+
+		args = append(args, r.Cidr.String(), "-interface", name)
+
+		if r.Metric > 0 {
+			// OpenBSD doesn't support route metrics directly like Linux
+			t.l.WithField("route", r).Warn("Route metrics are not fully supported on OpenBSD")
+		}
+
+		err := runCommandBSD("route", args...)
 		if err != nil {
 			retErr := util.NewContextualError("Failed to add route", map[string]any{"route": r}, err)
 			if logErrors {
@@ -362,131 +159,71 @@ func (t *tun) addRoutes(logErrors bool) error {
 	return nil
 }
 
-func (t *tun) removeRoutes(routes []Route) error {
+func (rm *tun) RemoveRoutes(t *wgTun, routes []Route) {
+	name, err := t.tunDevice.Name()
+	if err != nil {
+		t.l.WithError(err).Error("Failed to get device name for route removal")
+		return
+	}
+
 	for _, r := range routes {
 		if !r.Install {
 			continue
 		}
 
-		err := delRoute(r.Cidr, t.vpnNetworks)
+		args := []string{"delete"}
+
+		if r.Cidr.Addr().Is6() {
+			args = append(args, "-inet6")
+		} else {
+			args = append(args, "-inet")
+		}
+
+		args = append(args, r.Cidr.String(), "-interface", name)
+
+		err := runCommandBSD("route", args...)
 		if err != nil {
 			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
 			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
-	return nil
 }
 
-func (t *tun) deviceBytes() (o [16]byte) {
+func (rm *tun) NewMultiQueueReader(t *wgTun) (io.ReadWriteCloser, error) {
-	for i, c := range t.Device {
+	// OpenBSD doesn't support multi-queue TUN devices in the same way as Linux
-		o[i] = byte(c)
+	// Return a reader that wraps the same device
-	}
+	return &wgTunReader{
-	return
+		parent:    t,
+		tunDevice: t.tunDevice,
+		offset:    0,
+		l:         t.l,
+	}, nil
 }
 
-func addRoute(prefix netip.Prefix, gateways []netip.Prefix) error {
+func (rm *tun) addIP(t *wgTun, name string, network netip.Prefix) error {
-	sock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
+	addr := network.Addr()
-	if err != nil {
-		return fmt.Errorf("unable to create AF_ROUTE socket: %v", err)
-	}
-	defer unix.Close(sock)
 
-	route := &netroute.RouteMessage{
+	if addr.Is4() {
-		Version: unix.RTM_VERSION,
+		// For IPv4: ifconfig tun0 10.0.0.1/24
-		Type:    unix.RTM_ADD,
+		if err := runCommandBSD("ifconfig", name, network.String()); err != nil {
-		Flags:   unix.RTF_UP | unix.RTF_GATEWAY,
+			return fmt.Errorf("failed to add IPv4 address: %w", err)
-		Seq:     1,
-	}
-
-	if prefix.Addr().Is4() {
-		gw, err := selectGateway(prefix, gateways)
-		if err != nil {
-			return err
-		}
-		route.Addrs = []netroute.Addr{
-			unix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},
-			unix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},
-			unix.RTAX_GATEWAY: &netroute.Inet4Addr{IP: gw.Addr().As4()},
 		}
 	} else {
-		gw, err := selectGateway(prefix, gateways)
+		// For IPv6: ifconfig tun0 inet6 add 2001:db8::1/64
-		if err != nil {
+		if err := runCommandBSD("ifconfig", name, "inet6", "add", network.String()); err != nil {
-			return err
+			return fmt.Errorf("failed to add IPv6 address: %w", err)
 		}
-		route.Addrs = []netroute.Addr{
-			unix.RTAX_DST:     &netroute.Inet6Addr{IP: prefix.Masked().Addr().As16()},
-			unix.RTAX_NETMASK: &netroute.Inet6Addr{IP: prefixToMask(prefix).As16()},
-			unix.RTAX_GATEWAY: &netroute.Inet6Addr{IP: gw.Addr().As16()},
-		}
-	}
-
-	data, err := route.Marshal()
-	if err != nil {
-		return fmt.Errorf("failed to create route.RouteMessage: %w", err)
-	}
-
-	_, err = unix.Write(sock, data[:])
-	if err != nil {
-		if errors.Is(err, unix.EEXIST) {
-			// Try to do a change
-			route.Type = unix.RTM_CHANGE
-			data, err = route.Marshal()
-			if err != nil {
-				return fmt.Errorf("failed to create route.RouteMessage for change: %w", err)
-			}
-			_, err = unix.Write(sock, data[:])
-			return err
-		}
-		return fmt.Errorf("failed to write route.RouteMessage to socket: %w", err)
 	}
 
 	return nil
 }
 
-func delRoute(prefix netip.Prefix, gateways []netip.Prefix) error {
+func runCommandBSD(name string, args ...string) error {
-	sock, err := unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
+	cmd := exec.Command(name, args...)
+	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return fmt.Errorf("unable to create AF_ROUTE socket: %v", err)
+		return fmt.Errorf("%s %s failed: %w\nOutput: %s", name, strings.Join(args, " "), err, string(output))
 	}
-	defer unix.Close(sock)
-
-	route := netroute.RouteMessage{
-		Version: unix.RTM_VERSION,
-		Type:    unix.RTM_DELETE,
-		Seq:     1,
-	}
-
-	if prefix.Addr().Is4() {
-		gw, err := selectGateway(prefix, gateways)
-		if err != nil {
-			return err
-		}
-		route.Addrs = []netroute.Addr{
-			unix.RTAX_DST:     &netroute.Inet4Addr{IP: prefix.Masked().Addr().As4()},
-			unix.RTAX_NETMASK: &netroute.Inet4Addr{IP: prefixToMask(prefix).As4()},
-			unix.RTAX_GATEWAY: &netroute.Inet4Addr{IP: gw.Addr().As4()},
-		}
-	} else {
-		gw, err := selectGateway(prefix, gateways)
-		if err != nil {
-			return err
-		}
-		route.Addrs = []netroute.Addr{
-			unix.RTAX_DST:     &netroute.Inet6Addr{IP: prefix.Masked().Addr().As16()},
-			unix.RTAX_NETMASK: &netroute.Inet6Addr{IP: prefixToMask(prefix).As16()},
-			unix.RTAX_GATEWAY: &netroute.Inet6Addr{IP: gw.Addr().As16()},
-		}
-	}
-
-	data, err := route.Marshal()
-	if err != nil {
-		return fmt.Errorf("failed to create route.RouteMessage: %w", err)
-	}
-	_, err = unix.Write(sock, data[:])
-	if err != nil {
-		return fmt.Errorf("failed to write route.RouteMessage to socket: %w", err)
-	}
-
 	return nil
 }

overlay/tun_snat_test.go

@@ -1,179 +0,0 @@
-package overlay
-
-import (
-	"io"
-	"net/netip"
-	"testing"
-
-	"github.com/sirupsen/logrus"
-	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/routing"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// mockDevice is a minimal Device implementation for testing prepareUnsafeOriginAddr.
-type mockDevice struct {
-	networks       []netip.Prefix
-	unsafeNetworks []netip.Prefix
-	snatAddr       netip.Prefix
-	unsafeSnatAddr netip.Prefix
-}
-
-func (d *mockDevice) Read([]byte) (int, error)                         { return 0, nil }
-func (d *mockDevice) Write([]byte) (int, error)                        { return 0, nil }
-func (d *mockDevice) Close() error                                     { return nil }
-func (d *mockDevice) Activate() error                                  { return nil }
-func (d *mockDevice) Networks() []netip.Prefix                         { return d.networks }
-func (d *mockDevice) UnsafeNetworks() []netip.Prefix                   { return d.unsafeNetworks }
-func (d *mockDevice) SNATAddress() netip.Prefix                        { return d.snatAddr }
-func (d *mockDevice) UnsafeIPv4OriginAddress() netip.Prefix            { return d.unsafeSnatAddr }
-func (d *mockDevice) Name() string                                     { return "mock" }
-func (d *mockDevice) RoutesFor(netip.Addr) routing.Gateways            { return routing.Gateways{} }
-func (d *mockDevice) SupportsMultiqueue() bool                         { return false }
-func (d *mockDevice) NewMultiQueueReader() (io.ReadWriteCloser, error) { return nil, nil }
-
-func TestPrepareSnatAddr_V4Primary_NoSnat(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-
-	// If the device has an IPv4 primary address, no SNAT needed
-	d := &mockDevice{
-		networks: []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")},
-	}
-	result := prepareUnsafeOriginAddr(d, l, c, nil)
-	assert.Equal(t, netip.Prefix{}, result, "should not assign SNAT addr when device has IPv4 primary")
-}
-
-func TestPrepareSnatAddr_V6Primary_NoUnsafeOrRoutes(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-
-	// IPv6 primary but no unsafe networks or IPv4 routes
-	d := &mockDevice{
-		networks: []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
-	}
-	result := prepareUnsafeOriginAddr(d, l, c, nil)
-	assert.Equal(t, netip.Prefix{}, result, "should not assign SNAT addr without IPv4 unsafe networks or routes")
-}
-
-func TestPrepareSnatAddr_V6Primary_WithV4Unsafe(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-
-	// IPv6 primary with IPv4 unsafe network -> should get SNAT addr
-	d := &mockDevice{
-		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
-		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
-	}
-	result := prepareSnatAddr(d, l, c)
-	require.True(t, result.IsValid(), "should assign SNAT addr")
-	assert.True(t, result.Addr().Is4(), "SNAT addr should be IPv4")
-	assert.True(t, result.Addr().IsLinkLocalUnicast(), "SNAT addr should be link-local")
-	assert.Equal(t, 32, result.Bits(), "SNAT addr should be /32")
-
-	result = prepareUnsafeOriginAddr(d, l, c, nil)
-	require.False(t, result.IsValid(), "no routes = no origin addr needed")
-}
-
-func TestPrepareUnsafeOriginAddr_V6Primary_WithV4Route(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-
-	// IPv6 primary with IPv4 route -> should get SNAT addr
-	d := &mockDevice{
-		networks: []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
-	}
-	routes := []Route{
-		{Cidr: netip.MustParsePrefix("10.0.0.0/8")},
-	}
-	result := prepareUnsafeOriginAddr(d, l, c, routes)
-	require.True(t, result.IsValid(), "should assign SNAT addr when IPv4 route exists")
-	assert.True(t, result.Addr().Is4())
-	assert.True(t, result.Addr().IsLinkLocalUnicast())
-
-	result = prepareSnatAddr(d, l, c)
-	require.False(t, result.IsValid(), "no UnsafeNetworks = no snat addr needed")
-}
-
-func TestPrepareSnatAddr_V6Primary_V6UnsafeOnly(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-
-	// IPv6 primary with only IPv6 unsafe network -> no SNAT needed
-	d := &mockDevice{
-		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
-		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("fd01::/64")},
-	}
-	result := prepareUnsafeOriginAddr(d, l, c, nil)
-	assert.Equal(t, netip.Prefix{}, result, "should not assign SNAT addr for IPv6-only unsafe networks")
-}
-
-func TestPrepareSnatAddr_ManualAddress(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-	c.Settings["tun"] = map[string]any{
-		"snat_address_for_4over6": "169.254.42.42",
-	}
-
-	d := &mockDevice{
-		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
-		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
-	}
-	result := prepareSnatAddr(d, l, c)
-	require.True(t, result.IsValid())
-	assert.Equal(t, netip.MustParseAddr("169.254.42.42"), result.Addr())
-	assert.Equal(t, 32, result.Bits())
-}
-
-func TestPrepareSnatAddr_InvalidManualAddress_Fallback(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-	c.Settings["tun"] = map[string]any{
-		"snat_address_for_4over6": "not-an-ip",
-	}
-
-	d := &mockDevice{
-		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
-		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
-	}
-	result := prepareSnatAddr(d, l, c)
-	// Should fall back to auto-assignment
-	require.True(t, result.IsValid(), "should fall back to auto-assigned address")
-	assert.True(t, result.Addr().Is4())
-	assert.True(t, result.Addr().IsLinkLocalUnicast())
-}
-
-func TestPrepareSnatAddr_AutoGenerated_Range(t *testing.T) {
-	l := logrus.New()
-	l.SetLevel(logrus.PanicLevel)
-	c := config.NewC(l)
-
-	d := &mockDevice{
-		networks:       []netip.Prefix{netip.MustParsePrefix("fd00::1/128")},
-		unsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.0.0/16")},
-	}
-
-	// Generate several addresses and verify they're all in the expected range
-	for i := 0; i < 100; i++ {
-		result := prepareSnatAddr(d, l, c)
-		require.True(t, result.IsValid())
-		addr := result.Addr()
-		octets := addr.As4()
-		assert.Equal(t, byte(169), octets[0], "first octet should be 169")
-		assert.Equal(t, byte(254), octets[1], "second octet should be 254")
-		// Should not have .0 in the last octet
-		assert.NotEqual(t, byte(0), octets[3], "last octet should not be 0")
-		// Should not be 169.254.255.255 (broadcast)
-		if octets[2] == 255 {
-			assert.NotEqual(t, byte(255), octets[3], "should not be broadcast address")
-		}
-	}
-}

overlay/tun_test.go

@@ -1,37 +0,0 @@
-package overlay
-
-import (
-	"bytes"
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestLinkLocal(t *testing.T) {
-	r := bytes.NewReader([]byte{42, 99})
-	result := genLinkLocal(r)
-	assert.Equal(t, netip.MustParsePrefix("169.254.42.99/32"), result, "genLinkLocal with a deterministic randomizer")
-
-	result = genLinkLocal(nil)
-	assert.True(t, result.IsValid(), "genLinkLocal with nil randomizer should be valid")
-	assert.True(t, result.Addr().IsLinkLocalUnicast(), "genLinkLocal with nil randomizer should be link-local")
-
-	result = coerceLinkLocal([]byte{169, 254, 100, 50})
-	assert.Equal(t, netip.MustParsePrefix("169.254.100.50/32"), result, "coerceLinkLocal should pass through normal values")
-
-	result = coerceLinkLocal([]byte{169, 254, 0, 0})
-	assert.Equal(t, netip.MustParsePrefix("169.254.0.1/32"), result, "coerceLinkLocal should bump .0 last octet to .1")
-
-	result = coerceLinkLocal([]byte{169, 254, 255, 255})
-	assert.Equal(t, netip.MustParsePrefix("169.254.255.254/32"), result, "coerceLinkLocal should bump broadcast 255.255 to 255.254")
-
-	result = coerceLinkLocal([]byte{169, 254, 0, 1})
-	assert.Equal(t, netip.MustParsePrefix("169.254.0.1/32"), result, "coerceLinkLocal should leave .1 last octet unchanged")
-
-	result = coerceLinkLocal([]byte{169, 254, 255, 254})
-	assert.Equal(t, netip.MustParsePrefix("169.254.255.254/32"), result, "coerceLinkLocal should leave 255.254 unchanged")
-
-	result = coerceLinkLocal([]byte{169, 254, 255, 100})
-	assert.Equal(t, netip.MustParsePrefix("169.254.255.100/32"), result, "coerceLinkLocal should leave 255.100 unchanged")
-}

overlay/tun_tester.go

@@ -17,21 +17,18 @@ import (
 )
 
 type TestTun struct {
-	Device           string
+	Device      string
-	vpnNetworks      []netip.Prefix
+	vpnNetworks []netip.Prefix
-	unsafeNetworks   []netip.Prefix
+	Routes      []Route
-	snatAddr         netip.Prefix
+	routeTree   *bart.Table[routing.Gateways]
-	unsafeIPv4Origin netip.Prefix
+	l           *logrus.Logger
-	Routes           []Route
-	routeTree        *bart.Table[routing.Gateways]
-	l                *logrus.Logger
 
 	closed    atomic.Bool
 	rxPackets chan []byte // Packets to receive into nebula
 	TxPackets chan []byte // Packets transmitted outside by nebula
 }
 
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*TestTun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*TestTun, error) {
 	_, routes, err := getAllRoutesFromConfig(c, vpnNetworks, true)
 	if err != nil {
 		return nil, err
@@ -41,22 +38,18 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNet
 		return nil, err
 	}
 
-	tt := &TestTun{
+	return &TestTun{
-		Device:         c.GetString("tun.dev", ""),
+		Device:      c.GetString("tun.dev", ""),
-		vpnNetworks:    vpnNetworks,
+		vpnNetworks: vpnNetworks,
-		unsafeNetworks: unsafeNetworks,
+		Routes:      routes,
-		Routes:         routes,
+		routeTree:   routeTree,
-		routeTree:      routeTree,
+		l:           l,
-		l:              l,
+		rxPackets:   make(chan []byte, 10),
-		rxPackets:      make(chan []byte, 10),
+		TxPackets:   make(chan []byte, 10),
-		TxPackets:      make(chan []byte, 10),
+	}, nil
-	}
-	tt.unsafeIPv4Origin = prepareUnsafeOriginAddr(tt, l, c, routes)
-	tt.snatAddr = prepareSnatAddr(tt, tt.l, c)
-	return tt, nil
 }
 
-func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (*TestTun, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (*TestTun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported")
 }
 
@@ -139,22 +132,6 @@ func (t *TestTun) Read(b []byte) (int, error) {
 	return len(p), nil
 }
 
-func (t *TestTun) SupportsMultiqueue() bool {
-	return false
-}
-
 func (t *TestTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented")
 }
-
-func (t *TestTun) UnsafeNetworks() []netip.Prefix {
-	return t.unsafeNetworks
-}
-
-func (t *TestTun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *TestTun) SNATAddress() netip.Prefix {
-	return t.snatAddr
-}

overlay/tun_wg.go

@@ -0,0 +1,242 @@
+//go:build !android && !netbsd && !e2e_testing
+// +build !android,!netbsd,!e2e_testing
+
+package overlay
+
+import (
+	"fmt"
+	"io"
+	"net/netip"
+	"sync/atomic"
+
+	"github.com/gaissmai/bart"
+	"github.com/sirupsen/logrus"
+	"github.com/slackhq/nebula/config"
+	"github.com/slackhq/nebula/routing"
+	"github.com/slackhq/nebula/util"
+	wgtun "golang.zx2c4.com/wireguard/tun"
+)
+
+// wgTun wraps a WireGuard TUN device and implements the overlay.Device interface
+type wgTun struct {
+	tunDevice   wgtun.Device
+	vpnNetworks []netip.Prefix
+	MaxMTU      int
+	DefaultMTU  int
+
+	Routes    atomic.Pointer[[]Route]
+	routeTree atomic.Pointer[bart.Table[routing.Gateways]]
+	routeChan chan struct{}
+
+	// Platform-specific route management
+	routeManager *tun
+
+	l *logrus.Logger
+}
+
+// BatchReader interface for readers that support vectorized I/O
+type BatchReader interface {
+	BatchRead(buffers [][]byte, sizes []int) (int, error)
+}
+
+// BatchWriter interface for writers that support vectorized I/O
+type BatchWriter interface {
+	BatchWrite(packets [][]byte) (int, error)
+}
+
+// wgTunReader wraps a single TUN queue for multi-queue support
+type wgTunReader struct {
+	parent    *wgTun
+	tunDevice wgtun.Device
+	offset    int
+	l         *logrus.Logger
+}
+
+func (t *wgTun) Networks() []netip.Prefix {
+	return t.vpnNetworks
+}
+
+func (t *wgTun) Name() string {
+	name, err := t.tunDevice.Name()
+	if err != nil {
+		t.l.WithError(err).Error("Failed to get TUN device name")
+		return "unknown"
+	}
+	return name
+}
+
+func (t *wgTun) RoutesFor(ip netip.Addr) routing.Gateways {
+	r, _ := t.routeTree.Load().Lookup(ip)
+	return r
+}
+
+func (t *wgTun) Activate() error {
+	if t.routeManager == nil {
+		return fmt.Errorf("route manager not initialized")
+	}
+	return t.routeManager.Activate(t)
+}
+
+// Read implements single-packet read for backward compatibility
+func (t *wgTun) Read(b []byte) (int, error) {
+	bufs := [][]byte{b}
+	sizes := []int{0}
+	n, err := t.tunDevice.Read(bufs, sizes, 0)
+	if err != nil {
+		return 0, err
+	}
+	if n == 0 {
+		return 0, io.ErrNoProgress
+	}
+	return sizes[0], nil
+}
+
+// Write implements single-packet write for backward compatibility
+func (t *wgTun) Write(b []byte) (int, error) {
+	bufs := [][]byte{b}
+	offset := 0
+
+	// WireGuard TUN expects the packet data to start at offset 0
+	n, err := t.tunDevice.Write(bufs, offset)
+	if err != nil {
+		return 0, err
+	}
+	if n == 0 {
+		return 0, io.ErrShortWrite
+	}
+	return len(b), nil
+}
+
+func (t *wgTun) Close() error {
+	if t.routeChan != nil {
+		close(t.routeChan)
+	}
+
+	if t.tunDevice != nil {
+		return t.tunDevice.Close()
+	}
+
+	return nil
+}
+
+func (t *wgTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
+	// For WireGuard TUN, we need to create separate TUN device instances for multi-queue
+	// The platform-specific implementation will handle this
+	if t.routeManager == nil {
+		return nil, fmt.Errorf("route manager not initialized for multi-queue reader")
+	}
+
+	return t.routeManager.NewMultiQueueReader(t)
+}
+
+func (t *wgTun) reload(c *config.C, initial bool) error {
+	routeChange, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)
+	if err != nil {
+		return err
+	}
+
+	if !initial && !routeChange && !c.HasChanged("tun.mtu") {
+		return nil
+	}
+
+	routeTree, err := makeRouteTree(t.l, routes, true)
+	if err != nil {
+		return err
+	}
+
+	oldDefaultMTU := t.DefaultMTU
+	oldMaxMTU := t.MaxMTU
+	newDefaultMTU := c.GetInt("tun.mtu", DefaultMTU)
+	newMaxMTU := newDefaultMTU
+	for i, r := range routes {
+		if r.MTU == 0 {
+			routes[i].MTU = newDefaultMTU
+		}
+
+		if r.MTU > t.MaxMTU {
+			newMaxMTU = r.MTU
+		}
+	}
+
+	t.MaxMTU = newMaxMTU
+	t.DefaultMTU = newDefaultMTU
+
+	// Teach nebula how to handle the routes before establishing them in the system table
+	oldRoutes := t.Routes.Swap(&routes)
+	t.routeTree.Store(routeTree)
+
+	if !initial && t.routeManager != nil {
+		if oldMaxMTU != newMaxMTU {
+			t.routeManager.SetMTU(t, t.MaxMTU)
+			t.l.Infof("Set max MTU to %v was %v", t.MaxMTU, oldMaxMTU)
+		}
+
+		if oldDefaultMTU != newDefaultMTU {
+			for i := range t.vpnNetworks {
+				err := t.routeManager.SetDefaultRoute(t, t.vpnNetworks[i])
+				if err != nil {
+					t.l.Warn(err)
+				} else {
+					t.l.Infof("Set default MTU to %v was %v", t.DefaultMTU, oldDefaultMTU)
+				}
+			}
+		}
+
+		// Remove first, if the system removes a wanted route hopefully it will be re-added next
+		t.routeManager.RemoveRoutes(t, findRemovedRoutes(routes, *oldRoutes))
+
+		// Ensure any routes we actually want are installed
+		err = t.routeManager.AddRoutes(t, true)
+		if err != nil {
+			// This should never be called since AddRoutes should log its own errors in a reload condition
+			util.LogWithContextIfNeeded("Failed to refresh routes", err, t.l)
+		}
+	}
+
+	return nil
+}
+
+// BatchRead reads multiple packets from the TUN device using vectorized I/O
+// The caller provides buffers and sizes slices, and this function returns the number of packets read.
+func (r *wgTunReader) BatchRead(buffers [][]byte, sizes []int) (int, error) {
+	return r.tunDevice.Read(buffers, sizes, r.offset)
+}
+
+// Read implements io.Reader for wgTunReader (single packet for compatibility)
+func (r *wgTunReader) Read(b []byte) (int, error) {
+	bufs := [][]byte{b}
+	sizes := []int{0}
+	n, err := r.tunDevice.Read(bufs, sizes, r.offset)
+	if err != nil {
+		return 0, err
+	}
+	if n == 0 {
+		return 0, io.ErrNoProgress
+	}
+	return sizes[0], nil
+}
+
+// Write implements io.Writer for wgTunReader
+func (r *wgTunReader) Write(b []byte) (int, error) {
+	bufs := [][]byte{b}
+	n, err := r.tunDevice.Write(bufs, r.offset)
+	if err != nil {
+		return 0, err
+	}
+	if n == 0 {
+		return 0, io.ErrShortWrite
+	}
+	return len(b), nil
+}
+
+// BatchWrite writes multiple packets to the TUN device using vectorized I/O
+func (r *wgTunReader) BatchWrite(packets [][]byte) (int, error) {
+	return r.tunDevice.Write(packets, r.offset)
+}
+
+func (r *wgTunReader) Close() error {
+	if r.tunDevice != nil {
+		return r.tunDevice.Close()
+	}
+	return nil
+}

overlay/tun_windows.go

@@ -1,90 +1,77 @@
-//go:build !e2e_testing
+//go:build windows && !e2e_testing
-// +build !e2e_testing
+// +build windows,!e2e_testing
 
 package overlay
 
 import (
 	"crypto"
+	"encoding/binary"
 	"fmt"
 	"io"
 	"net/netip"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sync/atomic"
-	"syscall"
-	"unsafe"
 
-	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
-	"github.com/slackhq/nebula/wintun"
 	"golang.org/x/sys/windows"
+	wgtun "golang.zx2c4.com/wireguard/tun"
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 )
 
 const tunGUIDLabel = "Fixed Nebula Windows GUID v1"
 
-type winTun struct {
+type tun struct {
-	Device           string
+	luid winipcfg.LUID
-	vpnNetworks      []netip.Prefix
-	unsafeNetworks   []netip.Prefix
-	unsafeIPv4Origin netip.Prefix
-	MTU              int
-	Routes           atomic.Pointer[[]Route]
-	routeTree        atomic.Pointer[bart.Table[routing.Gateways]]
-	l                *logrus.Logger
-
-	tun *wintun.NativeTun
 }
 
-func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix, _ []netip.Prefix) (Device, error) {
+func newTunFromFd(_ *config.C, _ *logrus.Logger, _ int, _ []netip.Prefix) (*wgTun, error) {
 	return nil, fmt.Errorf("newTunFromFd not supported in Windows")
 }
 
-func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, _ bool) (*winTun, error) {
+func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*wgTun, error) {
-	err := checkWinTunExists()
+	deviceName := c.GetString("tun.dev", "Nebula")
+	mtu := c.GetInt("tun.mtu", DefaultMTU)
+
+	// Create WireGuard TUN device
+	tunDevice, err := wgtun.CreateTUN(deviceName, mtu)
 	if err != nil {
-		return nil, fmt.Errorf("can not load the wintun driver: %w", err)
+		return nil, fmt.Errorf("failed to create TUN device: %w", err)
 	}
 
-	deviceName := c.GetString("tun.dev", "")
+	// Get the actual device name
-	guid, err := generateGUIDByDeviceName(deviceName)
+	actualName, err := tunDevice.Name()
 	if err != nil {
-		return nil, fmt.Errorf("generate GUID failed: %w", err)
+		tunDevice.Close()
+		return nil, fmt.Errorf("failed to get TUN device name: %w", err)
 	}
 
-	t := &winTun{
+	t := &wgTun{
-		Device:         deviceName,
+		tunDevice:   tunDevice,
-		vpnNetworks:    vpnNetworks,
+		vpnNetworks: vpnNetworks,
-		unsafeNetworks: unsafeNetworks,
+		MaxMTU:      mtu,
-		MTU:            c.GetInt("tun.mtu", DefaultMTU),
+		DefaultMTU:  mtu,
-		l:              l,
+		l:           l,
 	}
 
+	// Create Windows-specific route manager
+	rm := &tun{}
+
+	// Get LUID from the TUN device
+	// The WireGuard TUN device on Windows should provide a LUID() method
+	if nativeTun, ok := tunDevice.(interface{ LUID() uint64 }); ok {
+		rm.luid = winipcfg.LUID(nativeTun.LUID())
+	} else {
+		tunDevice.Close()
+		return nil, fmt.Errorf("failed to get LUID from TUN device")
+	}
+	t.routeManager = rm
+
 	err = t.reload(c, true)
 	if err != nil {
+		tunDevice.Close()
 		return nil, err
 	}
 
-	var tunDevice wintun.Device
-	tunDevice, err = wintun.CreateTUNWithRequestedGUID(deviceName, guid, t.MTU)
-	if err != nil {
-		// Windows 10 has an issue with unclean shutdowns not fully cleaning up the wintun device.
-		// Trying a second time resolves the issue.
-		l.WithError(err).Debug("Failed to create wintun device, retrying")
-		tunDevice, err = wintun.CreateTUNWithRequestedGUID(deviceName, guid, t.MTU)
-		if err != nil {
-			return nil, &NameError{
-				Name:       deviceName,
-				Underlying: fmt.Errorf("create TUN device failed: %w", err),
-			}
-		}
-	}
-	t.tun = tunDevice.(*wintun.NativeTun)
-
 	c.RegisterReloadCallback(func(c *config.C) {
 		err := t.reload(c, false)
 		if err != nil {
@@ -92,231 +79,140 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNet
 		}
 	})
 
+	l.WithField("name", actualName).Info("Created WireGuard TUN device")
+
 	return t, nil
 }
 
-func (t *winTun) reload(c *config.C, initial bool) error {
+func (rm *tun) Activate(t *wgTun) error {
-	change, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)
+	// Set MTU
+	err := rm.setMTU(t, t.MaxMTU)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to set MTU: %w", err)
 	}
 
-	if !initial && !change {
+	// Add IP addresses
-		return nil
+	for _, network := range t.vpnNetworks {
-	}
+		if err := rm.addIP(t, network); err != nil {
-
+			return err
-	if initial {
-		t.unsafeIPv4Origin = prepareUnsafeOriginAddr(t, t.l, c, routes)
-	}
-
-	routeTree, err := makeRouteTree(t.l, routes, false)
-	if err != nil {
-		return err
-	}
-
-	// Teach nebula how to handle the routes before establishing them in the system table
-	oldRoutes := t.Routes.Swap(&routes)
-	t.routeTree.Store(routeTree)
-
-	if !initial {
-		// Remove first, if the system removes a wanted route hopefully it will be re-added next
-		err := t.removeRoutes(findRemovedRoutes(routes, *oldRoutes))
-		if err != nil {
-			util.LogWithContextIfNeeded("Failed to remove routes", err, t.l)
-		}
-
-		// Ensure any routes we actually want are installed
-		err = t.addRoutes(true)
-		if err != nil {
-			// Catch any stray logs
-			util.LogWithContextIfNeeded("Failed to add routes", err, t.l)
 		}
 	}
 
-	return nil
+	// Add routes
-}
+	if err := rm.AddRoutes(t, false); err != nil {
-
-func (t *winTun) Activate() error {
-	luid := winipcfg.LUID(t.tun.LUID())
-
-	prefixes := t.vpnNetworks
-	if t.unsafeIPv4Origin.IsValid() {
-		prefixes = append(prefixes, t.unsafeIPv4Origin)
-	}
-
-	err := luid.SetIPAddresses(prefixes)
-	if err != nil {
-		return fmt.Errorf("failed to set address: %w", err)
-	}
-
-	err = t.addRoutes(false)
-	if err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func (t *winTun) addRoutes(logErrors bool) error {
+func (rm *tun) SetMTU(t *wgTun, mtu int) {
-	luid := winipcfg.LUID(t.tun.LUID())
+	if err := rm.setMTU(t, mtu); err != nil {
+		t.l.WithError(err).Error("Failed to set MTU")
+	}
+}
+
+func (rm *tun) setMTU(t *wgTun, mtu int) error {
+	// Set MTU using winipcfg
+	// Note: MTU setting on Windows TUN devices may be handled by the driver
+	// For now, we'll skip explicit MTU setting as the WireGuard TUN handles it
+	return nil
+}
+
+func (rm *tun) SetDefaultRoute(t *wgTun, cidr netip.Prefix) error {
+	// On Windows, routes are managed differently
+	return nil
+}
+
+func (rm *tun) AddRoutes(t *wgTun, logErrors bool) error {
 	routes := *t.Routes.Load()
-	foundDefault4 := false
-
 	for _, r := range routes {
-		if len(r.Via) == 0 || !r.Install {
+		if !r.Install {
-			// We don't allow route MTUs so only install routes with a via
 			continue
 		}
 
-		// Add our unsafe route
+		if r.MTU > 0 {
-		// Windows does not support multipath routes natively, so we install only a single route.
+			// Windows route MTU is not directly supported
-		// This is not a problem as traffic will always be sent to Nebula which handles the multipath routing internally.
+			t.l.WithField("route", r).Debug("Route MTU is not supported on Windows")
-		// In effect this provides multipath routing support to windows supporting loadbalancing and redundancy.
+		}
-		err := luid.AddRoute(r.Cidr, r.Via[0].Addr(), uint32(r.Metric))
+
+		// Use winipcfg to add the route
+		// The rm.luid should have the AddRoute method from winipcfg
+		if len(r.Via) == 0 {
+			t.l.WithField("route", r).Warn("Route has no via address, skipping")
+			continue
+		}
+
+		err := rm.luid.AddRoute(r.Cidr, r.Via[0].Addr(), uint32(r.Metric))
 		if err != nil {
 			retErr := util.NewContextualError("Failed to add route", map[string]any{"route": r}, err)
 			if logErrors {
 				retErr.Log(t.l)
-				continue
 			} else {
 				return retErr
 			}
 		} else {
 			t.l.WithField("route", r).Info("Added route")
 		}
-
-		if !foundDefault4 {
-			if r.Cidr.Bits() == 0 && r.Cidr.Addr().BitLen() == 32 {
-				foundDefault4 = true
-			}
-		}
 	}
 
-	ipif, err := luid.IPInterface(windows.AF_INET)
-	if err != nil {
-		return fmt.Errorf("failed to get ip interface: %w", err)
-	}
-
-	ipif.NLMTU = uint32(t.MTU)
-	if foundDefault4 {
-		ipif.UseAutomaticMetric = false
-		ipif.Metric = 0
-	}
-
-	if err := ipif.Set(); err != nil {
-		return fmt.Errorf("failed to set ip interface: %w", err)
-	}
 	return nil
 }
 
-func (t *winTun) removeRoutes(routes []Route) error {
+func (rm *tun) RemoveRoutes(t *wgTun, routes []Route) {
-	luid := winipcfg.LUID(t.tun.LUID())
-
 	for _, r := range routes {
 		if !r.Install {
 			continue
 		}
 
-		// See comment on luid.AddRoute
+		if len(r.Via) == 0 {
-		err := luid.DeleteRoute(r.Cidr, r.Via[0].Addr())
+			continue
+		}
+
+		err := rm.luid.DeleteRoute(r.Cidr, r.Via[0].Addr())
 		if err != nil {
 			t.l.WithError(err).WithField("route", r).Error("Failed to remove route")
 		} else {
 			t.l.WithField("route", r).Info("Removed route")
 		}
 	}
+}
+
+func (rm *tun) NewMultiQueueReader(t *wgTun) (io.ReadWriteCloser, error) {
+	// Windows doesn't support multi-queue TUN devices
+	// Return a reader that wraps the same device
+	return &wgTunReader{
+		parent:    t,
+		tunDevice: t.tunDevice,
+		offset:    0,
+		l:         t.l,
+	}, nil
+}
+
+func (rm *tun) addIP(t *wgTun, network netip.Prefix) error {
+	// Add IP address using winipcfg
+	// SetIPAddresses expects a slice of prefixes
+	err := rm.luid.SetIPAddresses([]netip.Prefix{network})
+	if err != nil {
+		return fmt.Errorf("failed to add IP address %s: %w", network, err)
+	}
 	return nil
 }
 
-func (t *winTun) RoutesFor(ip netip.Addr) routing.Gateways {
+// generateGUIDByDeviceName generates a GUID based on the device name
-	r, _ := t.routeTree.Load().Lookup(ip)
+func generateGUIDByDeviceName(deviceName string) (*windows.GUID, error) {
-	return r
+	// Hash the device name to create a deterministic GUID
-}
+	h := crypto.SHA256.New()
+	h.Write([]byte(tunGUIDLabel))
+	h.Write([]byte(deviceName))
+	sum := h.Sum(nil)
 
-func (t *winTun) Networks() []netip.Prefix {
+	guid := &windows.GUID{
-	return t.vpnNetworks
+		Data1: binary.LittleEndian.Uint32(sum[0:4]),
-}
+		Data2: binary.LittleEndian.Uint16(sum[4:6]),
-
+		Data3: binary.LittleEndian.Uint16(sum[6:8]),
-func (t *winTun) UnsafeNetworks() []netip.Prefix {
-	return t.unsafeNetworks
-}
-
-func (t *winTun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return t.unsafeIPv4Origin
-}
-
-func (t *winTun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
-func (t *winTun) Name() string {
-	return t.Device
-}
-
-func (t *winTun) Read(b []byte) (int, error) {
-	return t.tun.Read(b, 0)
-}
-
-func (t *winTun) Write(b []byte) (int, error) {
-	return t.tun.Write(b, 0)
-}
-
-func (t *winTun) SupportsMultiqueue() bool {
-	return false
-}
-
-func (t *winTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	return nil, fmt.Errorf("TODO: multiqueue not implemented for windows")
-}
-
-func (t *winTun) Close() error {
-	// It seems that the Windows networking stack doesn't like it when we destroy interfaces that have active routes,
-	// so to be certain, just remove everything before destroying.
-	luid := winipcfg.LUID(t.tun.LUID())
-	_ = luid.FlushRoutes(windows.AF_INET)
-	_ = luid.FlushIPAddresses(windows.AF_INET)
-
-	_ = luid.FlushRoutes(windows.AF_INET6)
-	_ = luid.FlushIPAddresses(windows.AF_INET6)
-
-	_ = luid.FlushDNS(windows.AF_INET)
-	_ = luid.FlushDNS(windows.AF_INET6)
-
-	return t.tun.Close()
-}
-
-func generateGUIDByDeviceName(name string) (*windows.GUID, error) {
-	// GUID is 128 bit
-	hash := crypto.MD5.New()
-
-	_, err := hash.Write([]byte(tunGUIDLabel))
-	if err != nil {
-		return nil, err
 	}
+	copy(guid.Data4[:], sum[8:16])
 
-	_, err = hash.Write([]byte(name))
+	return guid, nil
-	if err != nil {
-		return nil, err
-	}
-
-	sum := hash.Sum(nil)
-
-	return (*windows.GUID)(unsafe.Pointer(&sum[0])), nil
-}
-
-func checkWinTunExists() error {
-	myPath, err := os.Executable()
-	if err != nil {
-		return err
-	}
-
-	arch := runtime.GOARCH
-	switch arch {
-	case "386":
-		//NOTE: wintun bundles 386 as x86
-		arch = "x86"
-	}
-
-	_, err = syscall.LoadDLL(filepath.Join(filepath.Dir(myPath), "dist", "windows", "wintun", "bin", arch, "wintun.dll"))
-	return err
 }

overlay/user.go

@@ -9,7 +9,7 @@ import (
 	"github.com/slackhq/nebula/routing"
 )
 
-func NewUserDeviceFromConfig(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, unsafeNetworks []netip.Prefix, routines int) (Device, error) {
+func NewUserDeviceFromConfig(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
 	return NewUserDevice(vpnNetworks)
 }
 
@@ -36,17 +36,6 @@ type UserDevice struct {
 	inboundWriter *io.PipeWriter
 }
 
-func (d *UserDevice) UnsafeNetworks() []netip.Prefix {
-	return nil
-}
-
-func (d *UserDevice) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-func (d *UserDevice) UnsafeIPv4OriginAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
 func (d *UserDevice) Activate() error {
 	return nil
 }
@@ -57,10 +46,6 @@ func (d *UserDevice) RoutesFor(ip netip.Addr) routing.Gateways {
 	return routing.Gateways{routing.NewGateway(ip, 1)}
 }
 
-func (d *UserDevice) SupportsMultiqueue() bool {
-	return true
-}
-
 func (d *UserDevice) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return d, nil
 }

pki.go

@@ -91,7 +91,7 @@ func (p *PKI) reload(c *config.C, initial bool) error {
 }
 
 func (p *PKI) reloadCerts(c *config.C, initial bool) *util.ContextualError {
-	newState, err := newCertStateFromConfig(c, p.l)
+	newState, err := newCertStateFromConfig(c)
 	if err != nil {
 		return util.NewContextualError("Could not load client cert", nil, err)
 	}
@@ -100,70 +100,55 @@ func (p *PKI) reloadCerts(c *config.C, initial bool) *util.ContextualError {
 		currentState := p.cs.Load()
 		if newState.v1Cert != nil {
 			if currentState.v1Cert == nil {
-				//adding certs is fine, actually. Networks-in-common confirmed in newCertState().
+				return util.NewContextualError("v1 certificate was added, restart required", nil, err)
-			} else {
-				// did IP in cert change? if so, don't set. If we ever allow this, need to set p.firewallReloadNeeded
-				if !slices.Equal(currentState.v1Cert.Networks(), newState.v1Cert.Networks()) {
-					return util.NewContextualError(
-						"Networks in new cert was different from old",
-						m{"new_networks": newState.v1Cert.Networks(), "old_networks": currentState.v1Cert.Networks(), "cert_version": cert.Version1},
-						nil,
-					)
-				}
-
-				if currentState.v1Cert.Curve() != newState.v1Cert.Curve() {
-					return util.NewContextualError(
-						"Curve in new v1 cert was different from old",
-						m{"new_curve": newState.v1Cert.Curve(), "old_curve": currentState.v1Cert.Curve(), "cert_version": cert.Version1},
-						nil,
-					)
-				}
 			}
+
+			// did IP in cert change? if so, don't set
+			if !slices.Equal(currentState.v1Cert.Networks(), newState.v1Cert.Networks()) {
+				return util.NewContextualError(
+					"Networks in new cert was different from old",
+					m{"new_networks": newState.v1Cert.Networks(), "old_networks": currentState.v1Cert.Networks()},
+					nil,
+				)
+			}
+
+			if currentState.v1Cert.Curve() != newState.v1Cert.Curve() {
+				return util.NewContextualError(
+					"Curve in new cert was different from old",
+					m{"new_curve": newState.v1Cert.Curve(), "old_curve": currentState.v1Cert.Curve()},
+					nil,
+				)
+			}
+
+		} else if currentState.v1Cert != nil {
+			//TODO: CERT-V2 we should be able to tear this down
+			return util.NewContextualError("v1 certificate was removed, restart required", nil, err)
 		}
 
 		if newState.v2Cert != nil {
 			if currentState.v2Cert == nil {
-				//adding certs is fine, actually
+				return util.NewContextualError("v2 certificate was added, restart required", nil, err)
-			} else {
-				// did IP in cert change? if so, don't set
-				if !slices.Equal(currentState.v2Cert.Networks(), newState.v2Cert.Networks()) {
-					return util.NewContextualError(
-						"Networks in new cert was different from old",
-						m{"new_networks": newState.v2Cert.Networks(), "old_networks": currentState.v2Cert.Networks(), "cert_version": cert.Version2},
-						nil,
-					)
-				}
-
-				if currentState.v2Cert.Curve() != newState.v2Cert.Curve() {
-					return util.NewContextualError(
-						"Curve in new cert was different from old",
-						m{"new_curve": newState.v2Cert.Curve(), "old_curve": currentState.v2Cert.Curve(), "cert_version": cert.Version2},
-						nil,
-					)
-				}
 			}
 
-		} else if currentState.v2Cert != nil {
+			// did IP in cert change? if so, don't set
-			//newState.v1Cert is non-nil bc empty certstates aren't permitted
+			if !slices.Equal(currentState.v2Cert.Networks(), newState.v2Cert.Networks()) {
-			if newState.v1Cert == nil {
-				return util.NewContextualError("v1 and v2 certs are nil, this should be impossible", nil, err)
-			}
-			//if we're going to v1-only, we need to make sure we didn't orphan any v2-cert vpnaddrs
-			if !slices.Equal(currentState.v2Cert.Networks(), newState.v1Cert.Networks()) {
 				return util.NewContextualError(
-					"Removing a V2 cert is not permitted unless it has identical networks to the new V1 cert",
+					"Networks in new cert was different from old",
-					m{"new_v1_networks": newState.v1Cert.Networks(), "old_v2_networks": currentState.v2Cert.Networks()},
+					m{"new_networks": newState.v2Cert.Networks(), "old_networks": currentState.v2Cert.Networks()},
 					nil,
 				)
 			}
-		}
 
-		newUN := newState.GetDefaultCertificate().UnsafeNetworks()
+			if currentState.v2Cert.Curve() != newState.v2Cert.Curve() {
-		oldUN := currentState.GetDefaultCertificate().UnsafeNetworks()
+				return util.NewContextualError(
-		if !slices.Equal(newUN, oldUN) {
+					"Curve in new cert was different from old",
-			//todo I don't love this, because other clients will see the new assignments and act on them, but we will not be able to.
+					m{"new_curve": newState.v2Cert.Curve(), "old_curve": currentState.v2Cert.Curve()},
-			//I think we need to wire this into the firewall reload.
+					nil,
-			p.l.WithFields(m{"previous": oldUN, "new": newUN}).Warning("UnsafeNetworks assignments differ. A restart is required in order for this to take effect.")
+				)
+			}
+
+		} else if currentState.v2Cert != nil {
+			return util.NewContextualError("v2 certificate was removed, restart required", nil, err)
 		}
 
 		// Cipher cant be hot swapped so just leave it at what it was before
@@ -268,7 +253,7 @@ func (cs *CertState) MarshalJSON() ([]byte, error) {
 	return json.Marshal(msg)
 }
 
-func newCertStateFromConfig(c *config.C, l *logrus.Logger) (*CertState, error) {
+func newCertStateFromConfig(c *config.C) (*CertState, error) {
 	var err error
 
 	privPathOrPEM := c.GetString("pki.key", "")
@@ -352,33 +337,10 @@ func newCertStateFromConfig(c *config.C, l *logrus.Logger) (*CertState, error) {
 		return nil, fmt.Errorf("unknown pki.initiating_version: %v", rawInitiatingVersion)
 	}
 
-	return newCertState(l, initiatingVersion, v1, v2, isPkcs11, curve, rawKey)
+	return newCertState(initiatingVersion, v1, v2, isPkcs11, curve, rawKey)
 }
 
-func compareUnsafeNetworksAcrossCertVersions(v1, v2 cert.Certificate) error {
+func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, privateKeyCurve cert.Curve, privateKey []byte) (*CertState, error) {
-	if v1 == nil || v2 == nil {
-		return nil //can't be a problem if we don't have one of the kinds of cert
-	}
-
-	v4UnsafeNets := 0
-	for _, n := range v2.UnsafeNetworks() {
-		if n.Addr().Is6() {
-			continue // V1 certs can't have IPv6 unsafe networks
-		} else {
-			v4UnsafeNets++
-		}
-		if !slices.Contains(v1.UnsafeNetworks(), n) {
-			return errors.New("UnsafeNetworks mismatch")
-		}
-	}
-	if len(v1.UnsafeNetworks()) != v4UnsafeNets {
-		return errors.New("UnsafeNetworks mismatch")
-	}
-
-	return nil
-}
-
-func newCertState(l *logrus.Logger, dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, privateKeyCurve cert.Curve, privateKey []byte) (*CertState, error) {
 	cs := CertState{
 		privateKey:               privateKey,
 		pkcs11Backed:             pkcs11backed,
@@ -401,12 +363,6 @@ func newCertState(l *logrus.Logger, dv cert.Version, v1, v2 cert.Certificate, pk
 		}
 
 		cs.initiatingVersion = dv
-
-		warn := compareUnsafeNetworksAcrossCertVersions(v1, v2)
-		if warn != nil {
-			l.WithFields(m{"UnsafeNetworksV1": v1.UnsafeNetworks(), "UnsafeNetworksV2": v2.UnsafeNetworks()}).
-				Warning("the IPv4 UnsafeNetworks assigned in the V1 certificate do not match the ones in V2")
-		}
 	}
 
 	if v1 != nil {
@@ -560,13 +516,9 @@ func loadCAPoolFromConfig(l *logrus.Logger, c *config.C) (*cert.CAPool, error) {
 		return nil, fmt.Errorf("error while adding CA certificate to CA trust store: %s", err)
 	}
 
-	bl := c.GetStringSlice("pki.blocklist", []string{})
+	for _, fp := range c.GetStringSlice("pki.blocklist", []string{}) {
-	if len(bl) > 0 {
+		l.WithField("fingerprint", fp).Info("Blocklisting cert")
-		for _, fp := range bl {
+		caPool.BlocklistFingerprint(fp)
-			caPool.BlocklistFingerprint(fp)
-		}
-
-		l.WithField("fingerprintCount", len(bl)).Info("Blocklisted certificates")
 	}
 
 	return caPool, nil

relay_manager.go

@@ -55,7 +55,7 @@ func (rm *relayManager) setAmRelay(v bool) {
 func AddRelay(l *logrus.Logger, relayHostInfo *HostInfo, hm *HostMap, vpnIp netip.Addr, remoteIdx *uint32, relayType int, state int) (uint32, error) {
 	hm.Lock()
 	defer hm.Unlock()
-	for range 32 {
+	for i := 0; i < 32; i++ {
 		index, err := generateIndex(l)
 		if err != nil {
 			return 0, err

remote_list.go

@@ -338,21 +338,21 @@ func (r *RemoteList) CopyCache() *CacheMap {
 }
 
 // BlockRemote locks and records the address as bad, it will be excluded from the deduplicated address list
-func (r *RemoteList) BlockRemote(bad ViaSender) {
+func (r *RemoteList) BlockRemote(bad netip.AddrPort) {
-	if bad.IsRelayed {
+	if !bad.IsValid() {
+		// relays can have nil udp Addrs
 		return
 	}
-
 	r.Lock()
 	defer r.Unlock()
 
 	// Check if we already blocked this addr
-	if r.unlockedIsBad(bad.UdpAddr) {
+	if r.unlockedIsBad(bad) {
 		return
 	}
 
 	// We copy here because we are taking something else's memory and we can't trust everything
-	r.badRemotes = append(r.badRemotes, bad.UdpAddr)
+	r.badRemotes = append(r.badRemotes, bad)
 
 	// Mark the next interaction must recollect/dedupe
 	r.shouldRebuild = true
@@ -404,7 +404,12 @@ func (r *RemoteList) Rebuild(preferredRanges []netip.Prefix) {
 
 // unlockedIsBad assumes you have the write lock and checks if the remote matches any entry in the blocked address list
 func (r *RemoteList) unlockedIsBad(remote netip.AddrPort) bool {
-	return slices.Contains(r.badRemotes, remote)
+	for _, v := range r.badRemotes {
+		if v == remote {
+			return true
+		}
+	}
+	return false
 }
 
 // unlockedSetLearnedV4 assumes you have the write lock and sets the current learned address for this owner and marks the

routing/gateway.go

@@ -6,7 +6,7 @@ import (
 )
 
 const (
-	// Sentinel value
+	// Sentinal value
 	BucketNotCalculated = -1
 )
 

service/service_test.go

@@ -16,8 +16,8 @@ import (
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/overlay"
-	"go.yaml.in/yaml/v3"
 	"golang.org/x/sync/errgroup"
+	"gopkg.in/yaml.v3"
 )
 
 type m = map[string]any

snat.go

@@ -1,91 +0,0 @@
-package nebula
-
-import (
-	"encoding/binary"
-	"net/netip"
-)
-
-func recalcIPv4Checksum(data []byte, oldSrcIP netip.Addr, newSrcIP netip.Addr) {
-	oldChecksum := binary.BigEndian.Uint16(data[10:12])
-	//because of how checksums work, we can re-use this function
-	checksum := calcNewTransportChecksum(oldChecksum, oldSrcIP, 0, newSrcIP, 0)
-	binary.BigEndian.PutUint16(data[10:12], checksum)
-}
-
-func calcNewTransportChecksum(oldChecksum uint16, oldSrcIP netip.Addr, oldSrcPort uint16, newSrcIP netip.Addr, newSrcPort uint16) uint16 {
-	oldIP := binary.BigEndian.Uint32(oldSrcIP.AsSlice())
-	newIP := binary.BigEndian.Uint32(newSrcIP.AsSlice())
-
-	// Start with inverted checksum
-	checksum := uint32(^oldChecksum)
-
-	// Subtract old IP (as two 16-bit words)
-	checksum += uint32(^uint16(oldIP >> 16))
-	checksum += uint32(^uint16(oldIP & 0xFFFF))
-
-	// Subtract old port
-	checksum += uint32(^oldSrcPort)
-
-	// Add new IP (as two 16-bit words)
-	checksum += uint32(newIP >> 16)
-	checksum += uint32(newIP & 0xFFFF)
-
-	// Add new port
-	checksum += uint32(newSrcPort)
-
-	// Fold carries
-	for checksum > 0xFFFF {
-		checksum = (checksum & 0xFFFF) + (checksum >> 16)
-	}
-
-	// Return ones' complement
-	return ^uint16(checksum)
-}
-
-func recalcV4TransportChecksum(offsetInsideHeader int, data []byte, oldSrcIP netip.AddrPort, newSrcIP netip.AddrPort) {
-	ipHeaderOffset := int(data[0]&0x0F) * 4
-	offset := ipHeaderOffset + offsetInsideHeader
-	oldcsum := binary.BigEndian.Uint16(data[offset : offset+2])
-	checksum := calcNewTransportChecksum(oldcsum, oldSrcIP.Addr(), oldSrcIP.Port(), newSrcIP.Addr(), newSrcIP.Port())
-	binary.BigEndian.PutUint16(data[offset:offset+2], checksum)
-}
-
-func recalcUDPv4Checksum(data []byte, oldSrcIP netip.AddrPort, newSrcIP netip.AddrPort) {
-	const offsetInsideHeader = 6
-	recalcV4TransportChecksum(offsetInsideHeader, data, oldSrcIP, newSrcIP)
-}
-
-func recalcTCPv4Checksum(data []byte, oldSrcIP netip.AddrPort, newSrcIP netip.AddrPort) {
-	const offsetInsideHeader = 16
-	recalcV4TransportChecksum(offsetInsideHeader, data, oldSrcIP, newSrcIP)
-}
-
-func calcNewICMPChecksum(oldChecksum uint16, oldCode uint16, newCode uint16, oldID uint16, newID uint16) uint16 {
-	// Start with inverted checksum
-	checksum := uint32(^oldChecksum)
-
-	// Subtract old stuff
-	checksum += uint32(^oldCode)
-	checksum += uint32(^oldID)
-
-	// Add new stuff
-	checksum += uint32(newCode)
-	checksum += uint32(newID)
-
-	// Fold carries
-	for checksum > 0xFFFF {
-		checksum = (checksum & 0xFFFF) + (checksum >> 16)
-	}
-
-	// Return ones' complement
-	return ^uint16(checksum)
-}
-
-func recalcICMPv4Checksum(data []byte, oldCode uint16, newCode uint16, oldID uint16, newID uint16) {
-	const offsetInsideHeader = 2
-	ipHeaderOffset := int(data[0]&0x0F) * 4
-	offset := ipHeaderOffset + offsetInsideHeader
-	oldChecksum := binary.BigEndian.Uint16(data[offset : offset+2])
-	checksum := calcNewICMPChecksum(oldChecksum, oldCode, newCode, oldID, newID)
-	binary.BigEndian.PutUint16(data[offset:offset+2], checksum)
-}

ssh.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"maps"
 	"net"
 	"net/netip"
 	"os"
@@ -832,7 +831,9 @@ func sshPrintRelays(ifce *Interface, fs any, a []string, w sshd.StringWriter) er
 
 	relays := map[uint32]*HostInfo{}
 	ifce.hostMap.Lock()
-	maps.Copy(relays, ifce.hostMap.Relays)
+	for k, v := range ifce.hostMap.Relays {
+		relays[k] = v
+	}
 	ifce.hostMap.Unlock()
 
 	type RelayFor struct {

test/tun.go

@@ -10,18 +10,6 @@ import (
 
 type NoopTun struct{}
 
-func (NoopTun) UnsafeNetworks() []netip.Prefix {
-	return nil
-}
-
-func (NoopTun) SNATAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
-func (NoopTun) UnsafeIPv4OriginAddress() netip.Prefix {
-	return netip.Prefix{}
-}
-
 func (NoopTun) RoutesFor(addr netip.Addr) routing.Gateways {
 	return routing.Gateways{}
 }
@@ -46,10 +34,6 @@ func (NoopTun) Write([]byte) (int, error) {
 	return 0, nil
 }
 
-func (NoopTun) SupportsMultiqueue() bool {
-	return false
-}
-
 func (NoopTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, errors.New("unsupported")
 }

timeout_test.go

@@ -134,7 +134,7 @@ func TestTimerWheel_Purge(t *testing.T) {
 	assert.True(t, tw.lastTick.After(lastTick))
 
 	// Make sure we get all 4 packets back
-	for i := range 4 {
+	for i := 0; i < 4; i++ {
 		p, has := tw.Purge()
 		assert.True(t, has)
 		assert.Equal(t, fps[i], p)
@@ -149,7 +149,7 @@ func TestTimerWheel_Purge(t *testing.T) {
 	// Make sure we cached the free'd items
 	assert.Equal(t, 4, tw.itemsCached)
 	ci := tw.itemCache
-	for range 4 {
+	for i := 0; i < 4; i++ {
 		assert.NotNil(t, ci)
 		ci = ci.Next
 	}

udp/conn.go

@@ -19,7 +19,6 @@ type Conn interface {
 	ListenOut(r EncReader)
 	WriteTo(b []byte, addr netip.AddrPort) error
 	ReloadConfig(c *config.C)
-	SupportsMultipleReaders() bool
 	Close() error
 }
 
@@ -34,9 +33,6 @@ func (NoopConn) LocalAddr() (netip.AddrPort, error) {
 func (NoopConn) ListenOut(_ EncReader) {
 	return
 }
-func (NoopConn) SupportsMultipleReaders() bool {
-	return false
-}
 func (NoopConn) WriteTo(_ []byte, _ netip.AddrPort) error {
 	return nil
 }

udp/udp_darwin.go

@@ -98,9 +98,9 @@ func (u *StdConn) WriteTo(b []byte, ap netip.AddrPort) error {
 			return ErrInvalidIPv6RemoteForSocket
 		}
 
-		var rsa unix.RawSockaddrInet4
+		var rsa unix.RawSockaddrInet6
-		rsa.Family = unix.AF_INET
+		rsa.Family = unix.AF_INET6
-		rsa.Addr = ap.Addr().As4()
+		rsa.Addr = ap.Addr().As16()
 		binary.BigEndian.PutUint16((*[2]byte)(unsafe.Pointer(&rsa.Port))[:], ap.Port())
 		sa = unsafe.Pointer(&rsa)
 		addrLen = syscall.SizeofSockaddrInet4
@@ -184,10 +184,6 @@ func (u *StdConn) ListenOut(r EncReader) {
 	}
 }
 
-func (u *StdConn) SupportsMultipleReaders() bool {
-	return false
-}
-
 func (u *StdConn) Rebind() error {
 	var err error
 	if u.isV4 {

udp/udp_generic.go

@@ -10,11 +10,9 @@ package udp
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net"
 	"net/netip"
-	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
@@ -76,28 +74,14 @@ type rawMessage struct {
 func (u *GenericConn) ListenOut(r EncReader) {
 	buffer := make([]byte, MTU)
 
-	var lastRecvErr time.Time
-
 	for {
 		// Just read one packet at a time
 		n, rua, err := u.ReadFromUDPAddrPort(buffer)
 		if err != nil {
-			if errors.Is(err, net.ErrClosed) {
+			u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
-				u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+			return
-				return
-			}
-			// Dampen unexpected message warns to once per minute
-			if lastRecvErr.IsZero() || time.Since(lastRecvErr) > time.Minute {
-				lastRecvErr = time.Now()
-				u.l.WithError(err).Warn("unexpected udp socket receive error")
-			}
-			continue
 		}
 
 		r(netip.AddrPortFrom(rua.Addr().Unmap(), rua.Port()), buffer[:n])
 	}
 }
-
-func (u *GenericConn) SupportsMultipleReaders() bool {
-	return false
-}

udp/udp_linux.go

@@ -72,10 +72,6 @@ func NewListener(l *logrus.Logger, ip netip.Addr, port int, multi bool, batch in
 	return &StdConn{sysFd: fd, isV4: ip.Is4(), l: l, batch: batch}, err
 }
 
-func (u *StdConn) SupportsMultipleReaders() bool {
-	return true
-}
-
 func (u *StdConn) Rebind() error {
 	return nil
 }

udp/udp_rio_windows.go

@@ -14,7 +14,6 @@ import (
 	"sync"
 	"sync/atomic"
 	"syscall"
-	"time"
 	"unsafe"
 
 	"github.com/sirupsen/logrus"
@@ -67,7 +66,7 @@ func NewRIOListener(l *logrus.Logger, addr netip.Addr, port int) (*RIOConn, erro
 
 	u := &RIOConn{l: l}
 
-	err := u.bind(l, &windows.SockaddrInet6{Addr: addr.As16(), Port: port})
+	err := u.bind(&windows.SockaddrInet6{Addr: addr.As16(), Port: port})
 	if err != nil {
 		return nil, fmt.Errorf("bind: %w", err)
 	}
@@ -83,11 +82,11 @@ func NewRIOListener(l *logrus.Logger, addr netip.Addr, port int) (*RIOConn, erro
 	return u, nil
 }
 
-func (u *RIOConn) bind(l *logrus.Logger, sa windows.Sockaddr) error {
+func (u *RIOConn) bind(sa windows.Sockaddr) error {
 	var err error
 	u.sock, err = winrio.Socket(windows.AF_INET6, windows.SOCK_DGRAM, windows.IPPROTO_UDP)
 	if err != nil {
-		return fmt.Errorf("winrio.Socket error: %w", err)
+		return err
 	}
 
 	// Enable v4 for this socket
@@ -101,40 +100,35 @@ func (u *RIOConn) bind(l *logrus.Logger, sa windows.Sockaddr) error {
 	size := uint32(unsafe.Sizeof(flag))
 	err = syscall.WSAIoctl(syscall.Handle(u.sock), syscall.SIO_UDP_CONNRESET, (*byte)(unsafe.Pointer(&flag)), size, nil, 0, &ret, nil, 0)
 	if err != nil {
-		// This is a best-effort to prevent errors from being returned by the udp recv operation.
+		return err
-		// Quietly log a failure and continue.
-		l.WithError(err).Debug("failed to set UDP_CONNRESET ioctl")
 	}
-
 	ret = 0
 	flag = 0
 	size = uint32(unsafe.Sizeof(flag))
 	SIO_UDP_NETRESET := uint32(syscall.IOC_IN | syscall.IOC_VENDOR | 15)
 	err = syscall.WSAIoctl(syscall.Handle(u.sock), SIO_UDP_NETRESET, (*byte)(unsafe.Pointer(&flag)), size, nil, 0, &ret, nil, 0)
 	if err != nil {
-		// This is a best-effort to prevent errors from being returned by the udp recv operation.
+		return err
-		// Quietly log a failure and continue.
-		l.WithError(err).Debug("failed to set UDP_NETRESET ioctl")
 	}
 
 	err = u.rx.Open()
 	if err != nil {
-		return fmt.Errorf("error rx.Open(): %w", err)
+		return err
 	}
 
 	err = u.tx.Open()
 	if err != nil {
-		return fmt.Errorf("error tx.Open(): %w", err)
+		return err
 	}
 
 	u.rq, err = winrio.CreateRequestQueue(u.sock, packetsPerRing, 1, packetsPerRing, 1, u.rx.cq, u.tx.cq, 0)
 	if err != nil {
-		return fmt.Errorf("error CreateRequestQueue: %w", err)
+		return err
 	}
 
 	err = windows.Bind(u.sock, sa)
 	if err != nil {
-		return fmt.Errorf("error windows.Bind(): %w", err)
+		return err
 	}
 
 	return nil
@@ -143,22 +137,15 @@ func (u *RIOConn) bind(l *logrus.Logger, sa windows.Sockaddr) error {
 func (u *RIOConn) ListenOut(r EncReader) {
 	buffer := make([]byte, MTU)
 
-	var lastRecvErr time.Time
-
 	for {
 		// Just read one packet at a time
 		n, rua, err := u.receive(buffer)
-
 		if err != nil {
 			if errors.Is(err, net.ErrClosed) {
 				u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
 				return
 			}
-			// Dampen unexpected message warns to once per minute
+			u.l.WithError(err).Error("unexpected udp socket receive error")
-			if lastRecvErr.IsZero() || time.Since(lastRecvErr) > time.Minute {
-				lastRecvErr = time.Now()
-				u.l.WithError(err).Warn("unexpected udp socket receive error")
-			}
 			continue
 		}
 
@@ -328,10 +315,6 @@ func (u *RIOConn) LocalAddr() (netip.AddrPort, error) {
 
 }
 
-func (u *RIOConn) SupportsMultipleReaders() bool {
-	return false
-}
-
 func (u *RIOConn) Rebind() error {
 	return nil
 }

udp/udp_tester.go

@@ -127,10 +127,6 @@ func (u *TesterConn) LocalAddr() (netip.AddrPort, error) {
 	return u.Addr, nil
 }
 
-func (u *TesterConn) SupportsMultipleReaders() bool {
-	return false
-}
-
 func (u *TesterConn) Rebind() error {
 	return nil
 }