skeleton to handle other tunless packets

Newly signed P256 based certificates will have their signature clamped to the low-s form.

Update CHANGELOG.md

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
           mv build/*.tar.gz release
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: linux-latest
           path: release
@@ -55,7 +55,7 @@ jobs:
           mv dist\windows\wintun build\dist\windows\
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: windows-latest
           path: build
@@ -104,7 +104,7 @@ jobs:
           fi
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: darwin-latest
           path: ./release/*
@@ -128,7 +128,7 @@ jobs:
 
       - name: Download artifacts
         if: ${{ env.HAS_DOCKER_CREDS == 'true' }}
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: linux-latest
           path: artifacts
@@ -163,7 +163,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Download artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           path: artifacts
 

.github/workflows/test.yml

@@ -45,7 +45,7 @@ jobs:
     - name: Build test mobile
       run: make build-test-mobile
 
-    - uses: actions/upload-artifact@v5
+    - uses: actions/upload-artifact@v6
       with:
         name: e2e packet flow linux-latest
         path: e2e/mermaid/linux-latest
@@ -125,7 +125,7 @@ jobs:
     - name: End 2 end
       run: make e2evv
 
-    - uses: actions/upload-artifact@v5
+    - uses: actions/upload-artifact@v6
       with:
         name: e2e packet flow ${{ matrix.os }}
         path: e2e/mermaid/${{ matrix.os }}

CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.10.3] - 2026-02-06
+
+### Security
+
+- Fix an issue where blocklist bypass is possible when using curve P256 since the signature can have 2 valid representations.
+  Both fingerprint representations will be tested against the blocklist.
+  Any newly issued P256 based certificates will have their signature clamped to the low-s form.
+  Nebula will assert the low-s signature form when validating certificates in a future version. [GHSA-69x3-g4r3-p962](https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962)
+
+### Changed
+
+- Improve error reporting if nebula fails to start due to a tun device naming issue. (#1588)
+
+## [1.10.2] - 2026-01-21
+
+### Fixed
+
+- Fix panic when using `use_system_route_table` that was introduced in v1.10.1. (#1580)
+
+### Changed
+
+- Fix some typos in comments. (#1582)
+- Dependency updates. (#1581)
+
+## [1.10.1] - 2026-01-16
+
+See the [v1.10.1](https://github.com/slackhq/nebula/milestone/26?closed=1) milestone for a complete list of changes.
+
+### Fixed
+
+- Fix a bug where an unsafe route derived from the system route table could be lost on a config reload. (#1573)
+- Fix the PEM banner for ECDSA P256 public keys. (#1552)
+- Fix a regression on Windows from 1.9.x where nebula could fall back to a less performant UDP listener if 
+  non-critical ioctls failed. (#1568)
+- Fix a bug in handshake processing when a peer sends an unexpected public key. (#1566)
+
+### Added
+
+- Add a config option to control accepting `recv_error` packets which defaults to `always`. (#1569)
+
+### Changed
+
+- Various dependency updates. (#1541, #1549, #1550, #1557, #1558, #1560, #1561, #1570, #1571)
+
 ## [1.10.0] - 2025-12-04
 
 See the [v1.10.0](https://github.com/slackhq/nebula/milestone/16?closed=1) milestone for a complete list of changes.
@@ -744,7 +788,10 @@ created.)
 
 - Initial public release.
 
-[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.0...HEAD
+[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.3...HEAD
+[1.10.3]: https://github.com/slackhq/nebula/releases/tag/v1.10.3
+[1.10.2]: https://github.com/slackhq/nebula/releases/tag/v1.10.2
+[1.10.1]: https://github.com/slackhq/nebula/releases/tag/v1.10.1
 [1.10.0]: https://github.com/slackhq/nebula/releases/tag/v1.10.0
 [1.9.7]: https://github.com/slackhq/nebula/releases/tag/v1.9.7
 [1.9.6]: https://github.com/slackhq/nebula/releases/tag/v1.9.6

cert/ca_pool.go

@@ -141,10 +141,23 @@ func (ncp *CAPool) VerifyCertificate(now time.Time, c Certificate) (*CachedCerti
 		return nil, err
 	}
 
+	// Pre nebula v1.10.3 could generate signatures in either high or low s form and validation
+	// of signatures allowed for either. Nebula v1.10.3 and beyond clamps signature generation to low-s form
+	// but validation still allows for either. Since a change in the signature bytes affects the fingerprint, we
+	// need to test both forms until such a time comes that we enforce low-s form on signature validation.
+	fp2, err := CalculateAlternateFingerprint(c)
+	if err != nil {
+		return nil, fmt.Errorf("could not calculate alternate fingerprint to verify: %w", err)
+	}
+	if fp2 != "" && ncp.IsBlocklisted(fp2) {
+		return nil, ErrBlockListed
+	}
+
 	cc := CachedCertificate{
 		Certificate:       c,
 		InvertedGroups:    make(map[string]struct{}),
 		Fingerprint:       fp,
+		fingerprint2:      fp2,
 		signerFingerprint: signer.Fingerprint,
 	}
 
@@ -158,6 +171,11 @@ func (ncp *CAPool) VerifyCertificate(now time.Time, c Certificate) (*CachedCerti
 // VerifyCachedCertificate is the same as VerifyCertificate other than it operates on a pre-verified structure and
 // is a cheaper operation to perform as a result.
 func (ncp *CAPool) VerifyCachedCertificate(now time.Time, c *CachedCertificate) error {
+	// Check any available alternate fingerprint forms for this certificate, re P256 high-s/low-s
+	if c.fingerprint2 != "" && ncp.IsBlocklisted(c.fingerprint2) {
+		return ErrBlockListed
+	}
+
 	_, err := ncp.verify(c.Certificate, now, c.Fingerprint, c.signerFingerprint)
 	return err
 }

cert/ca_pool_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/slackhq/nebula/cert/p256"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -170,6 +171,15 @@ func TestCertificateV1_VerifyP256(t *testing.T) {
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.EqualError(t, err, "certificate is in the block list")
 
+	// Create a copy of the cert and swap to the alternate form for the signature
+	nc := c.Copy()
+	b, err := p256.Swap(c.Signature())
+	require.NoError(t, err)
+	require.NoError(t, nc.(*certificateV1).setSignature(b))
+
+	_, err = caPool.VerifyCertificate(time.Now(), nc)
+	require.EqualError(t, err, "certificate is in the block list")
+
 	caPool.ResetCertBlocklist()
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.NoError(t, err)
@@ -187,7 +197,7 @@ func TestCertificateV1_VerifyP256(t *testing.T) {
 	require.NoError(t, err)
 
 	caPool = NewCAPool()
-	b, err := caPool.AddCAFromPEM(caPem)
+	b, err = caPool.AddCAFromPEM(caPem)
 	require.NoError(t, err)
 	assert.Empty(t, b)
 
@@ -196,7 +206,17 @@ func TestCertificateV1_VerifyP256(t *testing.T) {
 	})
 
 	c, _, _, _ = NewTestCert(Version1, Curve_P256, ca, caKey, "test", time.Now(), time.Now().Add(5*time.Minute), nil, nil, []string{"test1"})
-	_, err = caPool.VerifyCertificate(time.Now(), c)
+	cc, err := caPool.VerifyCertificate(time.Now(), c)
+	require.NoError(t, err)
+
+	// Reset the blocklist and block the alternate form fingerprint
+	caPool.ResetCertBlocklist()
+	caPool.BlocklistFingerprint(cc.fingerprint2)
+	err = caPool.VerifyCachedCertificate(time.Now(), cc)
+	require.EqualError(t, err, "certificate is in the block list")
+
+	caPool.ResetCertBlocklist()
+	err = caPool.VerifyCachedCertificate(time.Now(), cc)
 	require.NoError(t, err)
 }
 
@@ -394,6 +414,15 @@ func TestCertificateV2_VerifyP256(t *testing.T) {
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.EqualError(t, err, "certificate is in the block list")
 
+	// Create a copy of the cert and swap to the alternate form for the signature
+	nc := c.Copy()
+	b, err := p256.Swap(c.Signature())
+	require.NoError(t, err)
+	require.NoError(t, nc.(*certificateV2).setSignature(b))
+
+	_, err = caPool.VerifyCertificate(time.Now(), nc)
+	require.EqualError(t, err, "certificate is in the block list")
+
 	caPool.ResetCertBlocklist()
 	_, err = caPool.VerifyCertificate(time.Now(), c)
 	require.NoError(t, err)
@@ -411,7 +440,7 @@ func TestCertificateV2_VerifyP256(t *testing.T) {
 	require.NoError(t, err)
 
 	caPool = NewCAPool()
-	b, err := caPool.AddCAFromPEM(caPem)
+	b, err = caPool.AddCAFromPEM(caPem)
 	require.NoError(t, err)
 	assert.Empty(t, b)
 
@@ -420,7 +449,17 @@ func TestCertificateV2_VerifyP256(t *testing.T) {
 	})
 
 	c, _, _, _ = NewTestCert(Version2, Curve_P256, ca, caKey, "test", time.Now(), time.Now().Add(5*time.Minute), nil, nil, []string{"test1"})
-	_, err = caPool.VerifyCertificate(time.Now(), c)
+	cc, err := caPool.VerifyCertificate(time.Now(), c)
+	require.NoError(t, err)
+
+	// Reset the blocklist and block the alternate form fingerprint
+	caPool.ResetCertBlocklist()
+	caPool.BlocklistFingerprint(cc.fingerprint2)
+	err = caPool.VerifyCachedCertificate(time.Now(), cc)
+	require.EqualError(t, err, "certificate is in the block list")
+
+	caPool.ResetCertBlocklist()
+	err = caPool.VerifyCachedCertificate(time.Now(), cc)
 	require.NoError(t, err)
 }
 

cert/cert.go

@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"net/netip"
 	"time"
+
+	"github.com/slackhq/nebula/cert/p256"
 )
 
 type Version uint8
@@ -110,6 +112,9 @@ type CachedCertificate struct {
 	InvertedGroups    map[string]struct{}
 	Fingerprint       string
 	signerFingerprint string
+
+	// A place to store a 2nd fingerprint if the certificate could have one, such as with P256
+	fingerprint2 string
 }
 
 func (cc *CachedCertificate) String() string {
@@ -119,6 +124,7 @@ func (cc *CachedCertificate) String() string {
 // Recombine will attempt to unmarshal a certificate received in a handshake.
 // Handshakes save space by placing the peers public key in a different part of the packet, we have to
 // reassemble the actual certificate structure with that in mind.
+// Implementations MUST assert the public key is not in the raw certificate bytes if the passed in public key is not empty.
 func Recombine(v Version, rawCertBytes, publicKey []byte, curve Curve) (Certificate, error) {
 	if publicKey == nil {
 		return nil, ErrNoPeerStaticKey
@@ -151,3 +157,31 @@ func Recombine(v Version, rawCertBytes, publicKey []byte, curve Curve) (Certific
 
 	return c, nil
 }
+
+// CalculateAlternateFingerprint calculates a 2nd fingerprint representation for P256 certificates
+// CAPool blocklist testing through `VerifyCertificate` and `VerifyCachedCertificate` automatically performs this step.
+func CalculateAlternateFingerprint(c Certificate) (string, error) {
+	if c.Curve() != Curve_P256 {
+		return "", nil
+	}
+
+	nc := c.Copy()
+	b, err := p256.Swap(nc.Signature())
+	if err != nil {
+		return "", err
+	}
+
+	switch v := nc.(type) {
+	case *certificateV1:
+		err = v.setSignature(b)
+	case *certificateV2:
+		err = v.setSignature(b)
+	default:
+		return "", ErrUnknownVersion
+	}
+
+	if err != nil {
+		return "", err
+	}
+	return nc.Fingerprint()
+}

cert/cert_v1.go

@@ -426,7 +426,7 @@ func unmarshalCertificateV1(b []byte, publicKey []byte) (*certificateV1, error)
 			unsafeNetworks: make([]netip.Prefix, len(rc.Details.Subnets)/2),
 			notBefore:      time.Unix(rc.Details.NotBefore, 0),
 			notAfter:       time.Unix(rc.Details.NotAfter, 0),
-			publicKey:      make([]byte, len(rc.Details.PublicKey)),
+			publicKey:      nil,
 			isCA:           rc.Details.IsCA,
 			curve:          rc.Details.Curve,
 		},
@@ -437,12 +437,19 @@ func unmarshalCertificateV1(b []byte, publicKey []byte) (*certificateV1, error)
 	copy(nc.details.groups, rc.Details.Groups)
 	nc.details.issuer = hex.EncodeToString(rc.Details.Issuer)
 
+	// If a public key is passed in as an argument, the certificate pubkey must be empty
+	// and the passed-in pubkey copied into the cert.
 	if len(publicKey) > 0 {
-		nc.details.publicKey = publicKey
+		if len(rc.Details.PublicKey) != 0 {
+			return nil, ErrCertPubkeyPresent
+		}
+		nc.details.publicKey = make([]byte, len(publicKey))
+		copy(nc.details.publicKey, publicKey)
+	} else {
+		nc.details.publicKey = make([]byte, len(rc.Details.PublicKey))
+		copy(nc.details.publicKey, rc.Details.PublicKey)
 	}
 
-	copy(nc.details.publicKey, rc.Details.PublicKey)
-
 	var ip netip.Addr
 	for i, rawIp := range rc.Details.Ips {
 		if i%2 == 0 {

cert/cert_v1_test.go

@@ -62,6 +62,62 @@ func TestCertificateV1_Marshal(t *testing.T) {
 	assert.Equal(t, nc.Groups(), nc2.Groups())
 }
 
+func TestCertificateV1_Unmarshal(t *testing.T) {
+	t.Parallel()
+	before := time.Now().Add(time.Second * -60).Round(time.Second)
+	after := time.Now().Add(time.Second * 60).Round(time.Second)
+	pubKey := []byte("1234567890abcedfghij1234567890ab")
+	invalidPubkey := []byte("00000000000000000000000000000000")
+
+	nc := certificateV1{
+		details: detailsV1{
+			name: "testing",
+			networks: []netip.Prefix{
+				mustParsePrefixUnmapped("10.1.1.1/24"),
+				mustParsePrefixUnmapped("10.1.1.2/16"),
+			},
+			unsafeNetworks: []netip.Prefix{
+				mustParsePrefixUnmapped("9.1.1.2/24"),
+				mustParsePrefixUnmapped("9.1.1.3/16"),
+			},
+			groups:    []string{"test-group1", "test-group2", "test-group3"},
+			notBefore: before,
+			notAfter:  after,
+			publicKey: pubKey,
+			isCA:      false,
+			issuer:    "1234567890abcedfghij1234567890ab",
+		},
+		signature: []byte("1234567890abcedfghij1234567890ab"),
+	}
+
+	// This certificate has a pubkey included
+	certWithPubkey, err := nc.Marshal()
+	require.NoError(t, err)
+
+	// This certificate is missing the pubkey section
+	certWithoutPubkey, err := nc.MarshalForHandshakes()
+	require.NoError(t, err)
+
+	// Cert has no pubkey and no pubkey passed in must fail to validate
+	isNil, err := unmarshalCertificateV1(certWithoutPubkey, nil)
+	require.Error(t, err)
+
+	// Cert has different pubkey than one passed in must fail
+	isNil, err = unmarshalCertificateV1(certWithPubkey, invalidPubkey)
+	require.Nil(t, isNil)
+	require.Error(t, err)
+
+	// Cert has pubkey and no pubkey argument works ok
+	_, err = unmarshalCertificateV1(certWithPubkey, nil)
+	require.NoError(t, err)
+
+	// Cert has no pubkey and valid, correctly signed pubkey passed in
+	nc2, err := unmarshalCertificateV1(certWithoutPubkey, pubKey)
+	require.NoError(t, err)
+
+	assert.Equal(t, pubKey, nc2.PublicKey())
+}
+
 func TestCertificateV1_PublicKeyPem(t *testing.T) {
 	t.Parallel()
 	before := time.Now().Add(time.Second * -60).Round(time.Second)

cert/cert_v2.go

@@ -592,7 +592,13 @@ func unmarshalCertificateV2(b []byte, publicKey []byte, curve Curve) (*certifica
 	// Maybe grab the public key
 	var rawPublicKey cryptobyte.String
 	if len(publicKey) > 0 {
-		rawPublicKey = publicKey
+		// If a public key is passed in, then the handshake certificate must
+		// not have a public key present
+		if input.PeekASN1Tag(TagCertPublicKey) {
+			return nil, ErrCertPubkeyPresent
+		}
+		rawPublicKey = make(cryptobyte.String, len(publicKey))
+		copy(rawPublicKey, publicKey)
 	} else if !input.ReadOptionalASN1(&rawPublicKey, nil, TagCertPublicKey) {
 		return nil, ErrBadFormat
 	}

cert/cert_v2_test.go

@@ -76,6 +76,58 @@ func TestCertificateV2_Marshal(t *testing.T) {
 	assert.Equal(t, nc.Groups(), nc2.Groups())
 }
 
+func TestCertificateV2_Unmarshal(t *testing.T) {
+	t.Parallel()
+	before := time.Now().Add(time.Second * -60).Round(time.Second)
+	after := time.Now().Add(time.Second * 60).Round(time.Second)
+	pubKey := []byte("1234567890abcedfghij1234567890ab")
+
+	nc := certificateV2{
+		details: detailsV2{
+			name: "testing",
+			networks: []netip.Prefix{
+				mustParsePrefixUnmapped("10.1.1.2/16"),
+				mustParsePrefixUnmapped("10.1.1.1/24"),
+			},
+			unsafeNetworks: []netip.Prefix{
+				mustParsePrefixUnmapped("9.1.1.3/16"),
+				mustParsePrefixUnmapped("9.1.1.2/24"),
+			},
+			groups:    []string{"test-group1", "test-group2", "test-group3"},
+			notBefore: before,
+			notAfter:  after,
+			isCA:      false,
+			issuer:    "1234567890abcdef1234567890abcdef",
+		},
+		signature: []byte("1234567890abcdef1234567890abcdef"),
+		publicKey: pubKey,
+	}
+
+	db, err := nc.details.Marshal()
+	require.NoError(t, err)
+	nc.rawDetails = db
+
+	certWithPubkey, err := nc.Marshal()
+	require.NoError(t, err)
+	//t.Log("Cert size:", len(b))
+	certWithoutPubkey, err := nc.MarshalForHandshakes()
+	require.NoError(t, err)
+
+	// Cert must not have a pubkey if one is passed in as an argument
+	_, err = unmarshalCertificateV2(certWithPubkey, pubKey, Curve_CURVE25519)
+	require.ErrorIs(t, err, ErrCertPubkeyPresent)
+
+	// Certs must have pubkeys
+	_, err = unmarshalCertificateV2(certWithoutPubkey, nil, Curve_CURVE25519)
+	require.ErrorIs(t, err, ErrBadFormat)
+
+	// Ensure proper unmarshal if a pubkey is passed in
+	nc2, err := unmarshalCertificateV2(certWithoutPubkey, pubKey, Curve_CURVE25519)
+	require.NoError(t, err)
+
+	assert.Equal(t, nc.PublicKey(), nc2.PublicKey())
+}
+
 func TestCertificateV2_PublicKeyPem(t *testing.T) {
 	t.Parallel()
 	before := time.Now().Add(time.Second * -60).Round(time.Second)

cert/crypto_test.go

@@ -79,7 +79,7 @@ qrlJ69wer3ZUHFXA
 	assert.Nil(t, k)
 	assert.Equal(t, rest, invalidPem)
 
-	// Fail due to ivalid PEM format, because
+	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	curve, k, rest, err = DecryptAndUnmarshalSigningPrivateKey(passphrase, rest)
 	require.EqualError(t, err, "input did not contain a valid PEM encoded block")

cert/errors.go

@@ -21,6 +21,7 @@ var (
 	ErrPrivateKeyEncrypted        = errors.New("private key must be decrypted")
 	ErrCaNotFound                 = errors.New("could not find ca for the certificate")
 	ErrUnknownVersion             = errors.New("certificate version unrecognized")
+	ErrCertPubkeyPresent          = errors.New("certificate has unexpected pubkey present")
 
 	ErrInvalidPEMBlock                   = errors.New("input did not contain a valid PEM encoded block")
 	ErrInvalidPEMCertificateBanner       = errors.New("bytes did not contain a proper certificate banner")

cert/p256/p256.go

@@ -0,0 +1,122 @@
+package p256
+
+import (
+	"crypto/elliptic"
+	"errors"
+	"math/big"
+
+	"filippo.io/bigmod"
+
+	"golang.org/x/crypto/cryptobyte"
+	"golang.org/x/crypto/cryptobyte/asn1"
+)
+
+var halfN = new(big.Int).Rsh(elliptic.P256().Params().N, 1)
+var nMod *bigmod.Modulus
+
+func init() {
+	n, err := bigmod.NewModulus(elliptic.P256().Params().N.Bytes())
+	if err != nil {
+		panic(err)
+	}
+	nMod = n
+}
+
+func IsNormalized(sig []byte) (bool, error) {
+	r, s, err := parseSignature(sig)
+	if err != nil {
+		return false, err
+	}
+	return checkLowS(r, s), nil
+}
+
+func checkLowS(_, s []byte) bool {
+	bigS := new(big.Int).SetBytes(s)
+	// Check if S <= (N/2), because we want to include the midpoint in the set of low-s
+	return bigS.Cmp(halfN) <= 0
+}
+
+func swap(r, s []byte) ([]byte, []byte, error) {
+	var err error
+	bigS, err := bigmod.NewNat().SetBytes(s, nMod)
+	if err != nil {
+		return nil, nil, err
+	}
+	sNormalized := nMod.Nat().Sub(bigS, nMod)
+
+	return r, sNormalized.Bytes(nMod), nil
+}
+
+func Normalize(sig []byte) ([]byte, error) {
+	r, s, err := parseSignature(sig)
+	if err != nil {
+		return nil, err
+	}
+
+	if checkLowS(r, s) {
+		return sig, nil
+	}
+
+	newR, newS, err := swap(r, s)
+	if err != nil {
+		return nil, err
+	}
+
+	return encodeSignature(newR, newS)
+}
+
+// Swap will change sig between its current form to the opposite high or low form.
+func Swap(sig []byte) ([]byte, error) {
+	r, s, err := parseSignature(sig)
+	if err != nil {
+		return nil, err
+	}
+
+	newR, newS, err := swap(r, s)
+	if err != nil {
+		return nil, err
+	}
+
+	return encodeSignature(newR, newS)
+}
+
+// parseSignature taken exactly from crypto/ecdsa/ecdsa.go
+func parseSignature(sig []byte) (r, s []byte, err error) {
+	var inner cryptobyte.String
+	input := cryptobyte.String(sig)
+	if !input.ReadASN1(&inner, asn1.SEQUENCE) ||
+		!input.Empty() ||
+		!inner.ReadASN1Integer(&r) ||
+		!inner.ReadASN1Integer(&s) ||
+		!inner.Empty() {
+		return nil, nil, errors.New("invalid ASN.1")
+	}
+	return r, s, nil
+}
+
+func encodeSignature(r, s []byte) ([]byte, error) {
+	var b cryptobyte.Builder
+	b.AddASN1(asn1.SEQUENCE, func(b *cryptobyte.Builder) {
+		addASN1IntBytes(b, r)
+		addASN1IntBytes(b, s)
+	})
+	return b.Bytes()
+}
+
+// addASN1IntBytes encodes in ASN.1 a positive integer represented as
+// a big-endian byte slice with zero or more leading zeroes.
+func addASN1IntBytes(b *cryptobyte.Builder, bytes []byte) {
+	for len(bytes) > 0 && bytes[0] == 0 {
+		bytes = bytes[1:]
+	}
+	if len(bytes) == 0 {
+		b.SetError(errors.New("invalid integer"))
+		return
+	}
+	b.AddASN1(asn1.INTEGER, func(c *cryptobyte.Builder) {
+		if bytes[0]&0x80 != 0 {
+			c.AddUint8(0)
+		}
+		c.AddBytes(bytes)
+	})
+}

cert/p256/p256_test.go

@@ -0,0 +1,28 @@
+package p256
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestFlipping(t *testing.T) {
+	priv, err1 := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err1)
+
+	out, err := ecdsa.SignASN1(rand.Reader, priv, []byte("big chungus"))
+	require.NoError(t, err)
+
+	r, s, err := parseSignature(out)
+	require.NoError(t, err)
+
+	r, s1, err := swap(r, s)
+	require.NoError(t, err)
+	r, s2, err := swap(r, s1)
+	require.NoError(t, err)
+	require.Equal(t, s, s2)
+	require.NotEqual(t, s, s1)
+}

cert/pem_test.go

@@ -44,7 +44,7 @@ bzBEr00kERQxxTzTsH8cpYEgRoipvmExvg8WP8NdAJEYJosB
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "bytes did not contain a proper certificate banner")
 
-	// Fail due to ivalid PEM format, because
+	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	cert, rest, err = UnmarshalCertificateFromPEM(rest)
 	assert.Nil(t, cert)
@@ -106,7 +106,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "bytes did not contain a proper Ed25519/ECDSA private key banner")
 
-	// Fail due to ivalid PEM format, because
+	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalSigningPrivateKeyFromPEM(rest)
 	assert.Nil(t, k)
@@ -168,7 +168,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 	assert.Equal(t, rest, invalidPem)
 	require.EqualError(t, err, "bytes did not contain a proper private key banner")
 
-	// Fail due to ivalid PEM format, because
+	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalPrivateKeyFromPEM(rest)
 	assert.Nil(t, k)
@@ -221,7 +221,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)
 
-	// Fail due to ivalid PEM format, because
+	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)
@@ -299,7 +299,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 	require.EqualError(t, err, "bytes did not contain a proper public key banner")
 	assert.Equal(t, rest, invalidPem)
 
-	// Fail due to ivalid PEM format, because
+	// Fail due to invalid PEM format, because
 	// it's missing the requisite pre-encapsulation boundary.
 	k, rest, curve, err = UnmarshalPublicKeyFromPEM(rest)
 	assert.Nil(t, k)

cert/sign.go

@@ -9,6 +9,8 @@ import (
 	"fmt"
 	"net/netip"
 	"time"
+
+	"github.com/slackhq/nebula/cert/p256"
 )
 
 // TBSCertificate represents a certificate intended to be signed.
@@ -126,6 +128,13 @@ func (t *TBSCertificate) SignWith(signer Certificate, curve Curve, sp SignerLamb
 		return nil, err
 	}
 
+	if curve == Curve_P256 {
+		sig, err = p256.Normalize(sig)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	err = c.setSignature(sig)
 	if err != nil {
 		return nil, err

cert/sign_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/slackhq/nebula/cert/p256"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -89,3 +90,48 @@ func TestCertificateV1_SignP256(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, uc)
 }
+
+func TestCertificate_SignP256_AlwaysNormalized(t *testing.T) {
+	before := time.Now().Add(time.Second * -60).Round(time.Second)
+	after := time.Now().Add(time.Second * 60).Round(time.Second)
+	pubKey := []byte("01234567890abcedfghij1234567890ab1234567890abcedfghij1234567890ab")
+
+	tbs := TBSCertificate{
+		Version: Version1,
+		Name:    "testing",
+		Networks: []netip.Prefix{
+			mustParsePrefixUnmapped("10.1.1.1/24"),
+			mustParsePrefixUnmapped("10.1.1.2/16"),
+		},
+		UnsafeNetworks: []netip.Prefix{
+			mustParsePrefixUnmapped("9.1.1.2/24"),
+			mustParsePrefixUnmapped("9.1.1.3/16"),
+		},
+		Groups:    []string{"test-group1", "test-group2", "test-group3"},
+		NotBefore: before,
+		NotAfter:  after,
+		PublicKey: pubKey,
+		IsCA:      true,
+		Curve:     Curve_P256,
+	}
+
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	pub := elliptic.Marshal(elliptic.P256(), priv.PublicKey.X, priv.PublicKey.Y)
+	rawPriv := priv.D.FillBytes(make([]byte, 32))
+
+	for i := 0; i < 1000; i++ {
+		if i&1 == 1 {
+			tbs.Version = Version1
+		} else {
+			tbs.Version = Version2
+		}
+		c, err := tbs.Sign(nil, Curve_P256, rawPriv)
+		require.NoError(t, err)
+		assert.NotNil(t, c)
+		assert.True(t, c.CheckSignature(pub))
+		normie, err := p256.IsNormalized(c.Signature())
+		require.NoError(t, err)
+		assert.True(t, normie)
+	}
+}

cmd/nebula-cert/ca_test.go

@@ -200,7 +200,7 @@ func Test_ca(t *testing.T) {
 	assert.Empty(t, b)
 	assert.Len(t, lKey, 64)
 
-	// test when reading passsword results in an error
+	// test when reading password results in an error
 	os.Remove(keyF.Name())
 	os.Remove(crtF.Name())
 	ob.Reset()

cmd/nebula/main.go

@@ -3,9 +3,6 @@ package main
 import (
 	"flag"
 	"fmt"
-	"log"
-	"net/http"
-	_ "net/http/pprof"
 	"os"
 	"runtime/debug"
 	"strings"
@@ -74,10 +71,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	go func() {
-		log.Println(http.ListenAndServe("0.0.0.0:6060", nil))
-	}()
-
 	if !*configTest {
 		ctrl.Start()
 		notifyReady(l)

connection_state.go

@@ -13,7 +13,7 @@ import (
 	"github.com/slackhq/nebula/noiseutil"
 )
 
-const ReplayWindow = 4096
+const ReplayWindow = 1024
 
 type ConnectionState struct {
 	eKey           *NebulaCipherState

control_tester.go

@@ -80,8 +80,7 @@ func (c *Control) GetFromTun(block bool) []byte {
 
 // GetFromUDP will pull a udp packet off the udp side of nebula
 func (c *Control) GetFromUDP(block bool) *udp.Packet {
-	out := c.f.outside.(*udp.TesterConn).Get(block)
+	return c.f.outside.(*udp.TesterConn).Get(block)
-	return out
 }
 
 func (c *Control) GetUDPTxChan() <-chan *udp.Packet {

examples/config.yml

@@ -144,6 +144,10 @@ listen:
   # valid values: always, never, private
   # This setting is reloadable.
   #send_recv_error: always
+  # Similar to send_recv_error, this option lets you configure if you want to accept "recv_error" packets from remote hosts.
+  # valid values: always, never, private
+  # This setting is reloadable.
+  #accept_recv_error: always
   # The so_sock option is a Linux-specific feature that allows all outgoing Nebula packets to be tagged with a specific identifier.
   # This tagging enables IP rule-based filtering. For example, it supports 0.0.0.0/0 unsafe_routes,
   # allowing for more precise routing decisions based on the packet tags. Default is 0 meaning no mark is set.

firewall.go

@@ -403,9 +403,9 @@ var ErrNoMatchingRule = errors.New("no matching rule in firewall table")
 
 // Drop returns an error if the packet should be dropped, explaining why. It
 // returns nil if the packet should not be dropped.
-func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache, now time.Time) error {
+func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) error {
 	// Check if we spoke to this tuple, if we did then allow this packet
-	if f.inConns(fp, h, caPool, localCache, now) {
+	if f.inConns(fp, h, caPool, localCache) {
 		return nil
 	}
 
@@ -454,7 +454,7 @@ func (f *Firewall) Drop(fp firewall.Packet, incoming bool, h *HostInfo, caPool *
 	}
 
 	// We always want to conntrack since it is a faster operation
-	f.addConn(fp, incoming, now)
+	f.addConn(fp, incoming)
 
 	return nil
 }
@@ -483,7 +483,7 @@ func (f *Firewall) EmitStats() {
 	metrics.GetOrRegisterGauge("firewall.rules.hash", nil).Update(int64(f.GetRuleHashFNV()))
 }
 
-func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache, now time.Time) bool {
+func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool, localCache firewall.ConntrackCache) bool {
 	if localCache != nil {
 		if _, ok := localCache[fp]; ok {
 			return true
@@ -495,7 +495,7 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 	// Purge every time we test
 	ep, has := conntrack.TimerWheel.Purge()
 	if has {
-		f.evict(ep, now)
+		f.evict(ep)
 	}
 
 	c, ok := conntrack.Conns[fp]
@@ -542,11 +542,11 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 
 	switch fp.Protocol {
 	case firewall.ProtoTCP:
-		c.Expires = now.Add(f.TCPTimeout)
+		c.Expires = time.Now().Add(f.TCPTimeout)
 	case firewall.ProtoUDP:
-		c.Expires = now.Add(f.UDPTimeout)
+		c.Expires = time.Now().Add(f.UDPTimeout)
 	default:
-		c.Expires = now.Add(f.DefaultTimeout)
+		c.Expires = time.Now().Add(f.DefaultTimeout)
 	}
 
 	conntrack.Unlock()
@@ -558,7 +558,7 @@ func (f *Firewall) inConns(fp firewall.Packet, h *HostInfo, caPool *cert.CAPool,
 	return true
 }
 
-func (f *Firewall) addConn(fp firewall.Packet, incoming bool, now time.Time) {
+func (f *Firewall) addConn(fp firewall.Packet, incoming bool) {
 	var timeout time.Duration
 	c := &conn{}
 
@@ -574,7 +574,7 @@ func (f *Firewall) addConn(fp firewall.Packet, incoming bool, now time.Time) {
 	conntrack := f.Conntrack
 	conntrack.Lock()
 	if _, ok := conntrack.Conns[fp]; !ok {
-		conntrack.TimerWheel.Advance(now)
+		conntrack.TimerWheel.Advance(time.Now())
 		conntrack.TimerWheel.Add(fp, timeout)
 	}
 
@@ -582,14 +582,14 @@ func (f *Firewall) addConn(fp firewall.Packet, incoming bool, now time.Time) {
 	// firewall reload
 	c.incoming = incoming
 	c.rulesVersion = f.rulesVersion
-	c.Expires = now.Add(timeout)
+	c.Expires = time.Now().Add(timeout)
 	conntrack.Conns[fp] = c
 	conntrack.Unlock()
 }
 
 // Evict checks if a conntrack entry has expired, if so it is removed, if not it is re-added to the wheel
 // Caller must own the connMutex lock!
-func (f *Firewall) evict(p firewall.Packet, now time.Time) {
+func (f *Firewall) evict(p firewall.Packet) {
 	// Are we still tracking this conn?
 	conntrack := f.Conntrack
 	t, ok := conntrack.Conns[p]
@@ -597,11 +597,11 @@ func (f *Firewall) evict(p firewall.Packet, now time.Time) {
 		return
 	}
 
-	newT := t.Expires.Sub(now)
+	newT := t.Expires.Sub(time.Now())
 
 	// Timeout is in the future, re-add the timer
 	if newT > 0 {
-		conntrack.TimerWheel.Advance(now)
+		conntrack.TimerWheel.Advance(time.Now())
 		conntrack.TimerWheel.Add(p, newT)
 		return
 	}

firewall/packet.go

@@ -1,9 +1,15 @@
 package firewall
 
 import (
+	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/netip"
+
+	"github.com/google/gopacket/layers"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
 )
 
 type m = map[string]any
@@ -17,6 +23,17 @@ const (
 
 	PortAny      = 0  // Special value for matching `port: any`
 	PortFragment = -1 // Special value for matching `port: fragment`
+
+	minFwPacketLen = 4
+)
+
+var (
+	ErrPacketTooShort          = errors.New("packet is too short")
+	ErrUnknownIPVersion        = errors.New("packet is an unknown ip version")
+	ErrIPv4InvalidHeaderLength = errors.New("invalid ipv4 header length")
+	ErrIPv4PacketTooShort      = errors.New("ipv4 packet is too short")
+	ErrIPv6PacketTooShort      = errors.New("ipv6 packet is too short")
+	ErrIPv6CouldNotFindPayload = errors.New("could not find payload in ipv6 packet")
 )
 
 type Packet struct {
@@ -60,3 +77,172 @@ func (fp Packet) MarshalJSON() ([]byte, error) {
 		"Fragment":   fp.Fragment,
 	})
 }
+
+func parseV6(data []byte, incoming bool, fp *Packet) error {
+	dataLen := len(data)
+	if dataLen < ipv6.HeaderLen {
+		return ErrIPv6PacketTooShort
+	}
+
+	if incoming {
+		fp.RemoteAddr, _ = netip.AddrFromSlice(data[8:24])
+		fp.LocalAddr, _ = netip.AddrFromSlice(data[24:40])
+	} else {
+		fp.LocalAddr, _ = netip.AddrFromSlice(data[8:24])
+		fp.RemoteAddr, _ = netip.AddrFromSlice(data[24:40])
+	}
+
+	protoAt := 6             // NextHeader is at 6 bytes into the ipv6 header
+	offset := ipv6.HeaderLen // Start at the end of the ipv6 header
+	next := 0
+	for {
+		if protoAt >= dataLen {
+			break
+		}
+		proto := layers.IPProtocol(data[protoAt])
+
+		switch proto {
+		case layers.IPProtocolICMPv6, layers.IPProtocolESP, layers.IPProtocolNoNextHeader:
+			fp.Protocol = uint8(proto)
+			fp.RemotePort = 0
+			fp.LocalPort = 0
+			fp.Fragment = false
+			return nil
+
+		case layers.IPProtocolTCP, layers.IPProtocolUDP:
+			if dataLen < offset+4 {
+				return ErrIPv6PacketTooShort
+			}
+
+			fp.Protocol = uint8(proto)
+			if incoming {
+				fp.RemotePort = binary.BigEndian.Uint16(data[offset : offset+2])
+				fp.LocalPort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
+			} else {
+				fp.LocalPort = binary.BigEndian.Uint16(data[offset : offset+2])
+				fp.RemotePort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
+			}
+
+			fp.Fragment = false
+			return nil
+
+		case layers.IPProtocolIPv6Fragment:
+			// Fragment header is 8 bytes, need at least offset+4 to read the offset field
+			if dataLen < offset+8 {
+				return ErrIPv6PacketTooShort
+			}
+
+			// Check if this is the first fragment
+			fragmentOffset := binary.BigEndian.Uint16(data[offset+2:offset+4]) &^ uint16(0x7) // Remove the reserved and M flag bits
+			if fragmentOffset != 0 {
+				// Non-first fragment, use what we have now and stop processing
+				fp.Protocol = data[offset]
+				fp.Fragment = true
+				fp.RemotePort = 0
+				fp.LocalPort = 0
+				return nil
+			}
+
+			// The next loop should be the transport layer since we are the first fragment
+			next = 8 // Fragment headers are always 8 bytes
+
+		case layers.IPProtocolAH:
+			// Auth headers, used by IPSec, have a different meaning for header length
+			if dataLen <= offset+1 {
+				break
+			}
+
+			next = int(data[offset+1]+2) << 2
+
+		default:
+			// Normal ipv6 header length processing
+			if dataLen <= offset+1 {
+				break
+			}
+
+			next = int(data[offset+1]+1) << 3
+		}
+
+		if next <= 0 {
+			// Safety check, each ipv6 header has to be at least 8 bytes
+			next = 8
+		}
+
+		protoAt = offset
+		offset = offset + next
+	}
+
+	return ErrIPv6CouldNotFindPayload
+}
+
+func parseV4(data []byte, incoming bool, fp *Packet) error {
+	// Do we at least have an ipv4 header worth of data?
+	if len(data) < ipv4.HeaderLen {
+		return ErrIPv4PacketTooShort
+	}
+
+	// Adjust our start position based on the advertised ip header length
+	ihl := int(data[0]&0x0f) << 2
+
+	// Well-formed ip header length?
+	if ihl < ipv4.HeaderLen {
+		return ErrIPv4InvalidHeaderLength
+	}
+
+	// Check if this is the second or further fragment of a fragmented packet.
+	flagsfrags := binary.BigEndian.Uint16(data[6:8])
+	fp.Fragment = (flagsfrags & 0x1FFF) != 0
+
+	// Firewall handles protocol checks
+	fp.Protocol = data[9]
+
+	// Accounting for a variable header length, do we have enough data for our src/dst tuples?
+	minLen := ihl
+	if !fp.Fragment && fp.Protocol != ProtoICMP {
+		minLen += minFwPacketLen
+	}
+	if len(data) < minLen {
+		return ErrIPv4InvalidHeaderLength
+	}
+
+	// Firewall packets are locally oriented
+	if incoming {
+		fp.RemoteAddr, _ = netip.AddrFromSlice(data[12:16])
+		fp.LocalAddr, _ = netip.AddrFromSlice(data[16:20])
+		if fp.Fragment || fp.Protocol == ProtoICMP {
+			fp.RemotePort = 0
+			fp.LocalPort = 0
+		} else {
+			fp.RemotePort = binary.BigEndian.Uint16(data[ihl : ihl+2])
+			fp.LocalPort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
+		}
+	} else {
+		fp.LocalAddr, _ = netip.AddrFromSlice(data[12:16])
+		fp.RemoteAddr, _ = netip.AddrFromSlice(data[16:20])
+		if fp.Fragment || fp.Protocol == ProtoICMP {
+			fp.RemotePort = 0
+			fp.LocalPort = 0
+		} else {
+			fp.LocalPort = binary.BigEndian.Uint16(data[ihl : ihl+2])
+			fp.RemotePort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
+		}
+	}
+
+	return nil
+}
+
+// NewPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers
+func NewPacket(data []byte, incoming bool, fp *Packet) error {
+	if len(data) < 1 {
+		return ErrPacketTooShort
+	}
+
+	version := int((data[0] >> 4) & 0x0f)
+	switch version {
+	case ipv4.Version:
+		return parseV4(data, incoming, fp)
+	case ipv6.Version:
+		return parseV6(data, incoming, fp)
+	}
+	return ErrUnknownIPVersion
+}

go.mod

@@ -4,6 +4,7 @@ go 1.25
 
 require (
 	dario.cat/mergo v1.0.2
+	filippo.io/bigmod v0.1.0
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/armon/go-radix v1.0.0
 	github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432
@@ -12,27 +13,27 @@ require (
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
 	github.com/kardianos/service v1.2.4
-	github.com/miekg/dns v1.1.68
+	github.com/miekg/dns v1.1.70
 	github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b
 	github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
-	github.com/sirupsen/logrus v1.9.3
+	github.com/sirupsen/logrus v1.9.4
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
 	github.com/stretchr/testify v1.11.1
 	github.com/vishvananda/netlink v1.3.1
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/crypto v0.45.0
+	golang.org/x/crypto v0.47.0
 	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
-	golang.org/x/net v0.47.0
+	golang.org/x/net v0.49.0
 	golang.org/x/sync v0.19.0
-	golang.org/x/sys v0.39.0
+	golang.org/x/sys v0.40.0
-	golang.org/x/term v0.38.0
+	golang.org/x/term v0.39.0
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
 	golang.zx2c4.com/wireguard/windows v0.5.3
-	google.golang.org/protobuf v1.36.10
+	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 	gvisor.dev/gvisor v0.0.0-20240423190808-9d7a357edefe
 )
@@ -49,7 +50,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/mod v0.31.0 // indirect
-	golang.org/x/time v0.7.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.33.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
 )

go.sum

@@ -1,6 +1,8 @@
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
+filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -83,8 +85,8 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
+github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
-github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
+github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b h1:J/AzCvg5z0Hn1rqZUJjpbzALUmkKX0Zwbc/i4fw7Sfk=
 github.com/miekg/pkcs11 v1.1.2-0.20231115102856-9078ad6b9d4b/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -131,8 +133,8 @@ github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncj
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
@@ -162,16 +164,16 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 h1:Di6/M8l0O2lCLc6VVRWhgCiApHV8MnQurBnFSHsQtNY=
 golang.org/x/exp v0.0.0-20230725093048-515e97ebf090/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -182,8 +184,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -206,26 +208,25 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
-golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -244,8 +245,8 @@ google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miE
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

handshake_ix.go

@@ -1,6 +1,7 @@
 package nebula
 
 import (
+	"bytes"
 	"net/netip"
 	"time"
 
@@ -166,6 +167,13 @@ func ixHandshakeStage1(f *Interface, via ViaSender, packet []byte, h *header.H)
 		return
 	}
 
+	if !bytes.Equal(remoteCert.Certificate.PublicKey(), ci.H.PeerStatic()) {
+		f.l.WithField("from", via).
+			WithField("handshake", m{"stage": 1, "style": "ix_psk0"}).
+			WithField("cert", remoteCert).Info("public key mismatch between certificate and handshake")
+		return
+	}
+
 	if remoteCert.Certificate.Version() != ci.myCert.Version() {
 		// We started off using the wrong certificate version, lets see if we can match the version that was sent to us
 		myCertOtherVersion := cs.getCertificate(remoteCert.Certificate.Version())
@@ -535,6 +543,12 @@ func ixHandshakeStage2(f *Interface, via ViaSender, hh *HandshakeHostInfo, packe
 		e.Info("Invalid certificate from host")
 		return true
 	}
+	if !bytes.Equal(remoteCert.Certificate.PublicKey(), ci.H.PeerStatic()) {
+		f.l.WithField("from", via).
+			WithField("handshake", m{"stage": 2, "style": "ix_psk0"}).
+			WithField("cert", remoteCert).Info("public key mismatch between certificate and handshake")
+		return true
+	}
 
 	if len(remoteCert.Certificate.Networks()) == 0 {
 		f.l.WithError(err).WithField("from", via).

inside.go

@@ -2,19 +2,17 @@ package nebula
 
 import (
 	"net/netip"
-	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/iputil"
 	"github.com/slackhq/nebula/noiseutil"
-	"github.com/slackhq/nebula/packet"
 	"github.com/slackhq/nebula/routing"
 )
 
-func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet, nb []byte, out *packet.UDPPacket, q int, localCache firewall.ConntrackCache, now time.Time) {
+func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet, nb, out []byte, q int, localCache firewall.ConntrackCache) {
-	err := newPacket(packet, false, fwPacket)
+	err := firewall.NewPacket(packet, false, fwPacket)
 	if err != nil {
 		if f.l.Level >= logrus.DebugLevel {
 			f.l.WithField("packet", packet).Debugf("Error while validating outbound packet: %s", err)
@@ -55,7 +53,7 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 	})
 
 	if hostinfo == nil {
-		f.rejectInside(packet, out.Payload, q) //todo vector?
+		f.rejectInside(packet, out, q)
 		if f.l.Level >= logrus.DebugLevel {
 			f.l.WithField("vpnAddr", fwPacket.RemoteAddr).
 				WithField("fwPacket", fwPacket).
@@ -68,11 +66,12 @@ func (f *Interface) consumeInsidePacket(packet []byte, fwPacket *firewall.Packet
 		return
 	}
 
-	dropReason := f.firewall.Drop(*fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache, now)
+	dropReason := f.firewall.Drop(*fwPacket, false, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason == nil {
-		f.sendNoMetricsDelayed(header.Message, 0, hostinfo.ConnectionState, hostinfo, netip.AddrPort{}, packet, nb, out, q)
+		f.sendNoMetrics(header.Message, 0, hostinfo.ConnectionState, hostinfo, netip.AddrPort{}, packet, nb, out, q)
+
 	} else {
-		f.rejectInside(packet, out.Payload, q) //todo vector?
+		f.rejectInside(packet, out, q)
 		if f.l.Level >= logrus.DebugLevel {
 			hostinfo.logger(f.l).
 				WithField("fwPacket", fwPacket).
@@ -212,14 +211,14 @@ func (f *Interface) getOrHandshakeConsiderRouting(fwPacket *firewall.Packet, cac
 
 func (f *Interface) sendMessageNow(t header.MessageType, st header.MessageSubType, hostinfo *HostInfo, p, nb, out []byte) {
 	fp := &firewall.Packet{}
-	err := newPacket(p, false, fp)
+	err := firewall.NewPacket(p, false, fp)
 	if err != nil {
 		f.l.Warnf("error while parsing outgoing packet for firewall check; %v", err)
 		return
 	}
 
 	// check if packet is in outbound fw rules
-	dropReason := f.firewall.Drop(*fp, false, hostinfo, f.pki.GetCAPool(), nil, time.Now())
+	dropReason := f.firewall.Drop(*fp, false, hostinfo, f.pki.GetCAPool(), nil)
 	if dropReason != nil {
 		if f.l.Level >= logrus.DebugLevel {
 			f.l.WithField("fwPacket", fp).
@@ -411,81 +410,3 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 		}
 	}
 }
-
-func (f *Interface) sendNoMetricsDelayed(t header.MessageType, st header.MessageSubType, ci *ConnectionState, hostinfo *HostInfo, remote netip.AddrPort, p, nb []byte, out *packet.UDPPacket, q int) {
-	if ci.eKey == nil {
-		return
-	}
-	useRelay := !remote.IsValid() && !hostinfo.remote.IsValid()
-	fullOut := out.Payload
-
-	if useRelay {
-		if len(out.Payload) < header.Len {
-			// out always has a capacity of mtu, but not always a length greater than the header.Len.
-			// Grow it to make sure the next operation works.
-			out.Payload = out.Payload[:header.Len]
-		}
-		// Save a header's worth of data at the front of the 'out' buffer.
-		out.Payload = out.Payload[header.Len:]
-	}
-
-	if noiseutil.EncryptLockNeeded {
-		// NOTE: for goboring AESGCMTLS we need to lock because of the nonce check
-		ci.writeLock.Lock()
-	}
-	c := ci.messageCounter.Add(1)
-
-	//l.WithField("trace", string(debug.Stack())).Error("out Header ", &Header{Version, t, st, 0, hostinfo.remoteIndexId, c}, p)
-	out.Payload = header.Encode(out.Payload, header.Version, t, st, hostinfo.remoteIndexId, c)
-	f.connectionManager.Out(hostinfo)
-
-	// Query our LH if we haven't since the last time we've been rebound, this will cause the remote to punch against
-	// all our addrs and enable a faster roaming.
-	if t != header.CloseTunnel && hostinfo.lastRebindCount != f.rebindCount {
-		//NOTE: there is an update hole if a tunnel isn't used and exactly 256 rebinds occur before the tunnel is
-		// finally used again. This tunnel would eventually be torn down and recreated if this action didn't help.
-		f.lightHouse.QueryServer(hostinfo.vpnAddrs[0])
-		hostinfo.lastRebindCount = f.rebindCount
-		if f.l.Level >= logrus.DebugLevel {
-			f.l.WithField("vpnAddrs", hostinfo.vpnAddrs).Debug("Lighthouse update triggered for punch due to rebind counter")
-		}
-	}
-
-	var err error
-	out.Payload, err = ci.eKey.EncryptDanger(out.Payload, out.Payload, p, c, nb)
-	if noiseutil.EncryptLockNeeded {
-		ci.writeLock.Unlock()
-	}
-	if err != nil {
-		hostinfo.logger(f.l).WithError(err).
-			WithField("udpAddr", remote).WithField("counter", c).
-			WithField("attemptedCounter", c).
-			Error("Failed to encrypt outgoing packet")
-		return
-	}
-
-	if remote.IsValid() {
-		err = f.writers[q].Prep(out, remote)
-		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", remote).Error("Failed to write outgoing packet")
-		}
-	} else if hostinfo.remote.IsValid() {
-		err = f.writers[q].Prep(out, hostinfo.remote)
-		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", remote).Error("Failed to write outgoing packet")
-		}
-	} else {
-		// Try to send via a relay
-		for _, relayIP := range hostinfo.relayState.CopyRelayIps() {
-			relayHostInfo, relay, err := f.hostMap.QueryVpnAddrsRelayFor(hostinfo.vpnAddrs, relayIP)
-			if err != nil {
-				hostinfo.relayState.DeleteRelay(relayIP)
-				hostinfo.logger(f.l).WithField("relay", relayIP).WithError(err).Info("sendNoMetrics failed to find HostInfo")
-				continue
-			}
-			//todo vector!!
-			f.SendVia(relayHostInfo, relay, out.Payload, nb, fullOut[:header.Len+len(out.Payload)], true)
-			break
-		}
-	}
-}

interface.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"net/netip"
 	"os"
 	"runtime"
@@ -17,12 +18,10 @@ import (
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
 	"github.com/slackhq/nebula/overlay"
-	"github.com/slackhq/nebula/packet"
 	"github.com/slackhq/nebula/udp"
 )
 
 const mtu = 9001
-const batch = 1024 //todo config!
 
 type InterfaceConfig struct {
 	HostMap            *HostMap
@@ -78,7 +77,8 @@ type Interface struct {
 	reQueryEvery    atomic.Uint32
 	reQueryWait     atomic.Int64
 
-	sendRecvErrorConfig sendRecvErrorConfig
+	sendRecvErrorConfig   recvErrorConfig
+	acceptRecvErrorConfig recvErrorConfig
 
 	// rebindCount is used to decide if an active tunnel should trigger a punch notification through a lighthouse
 	rebindCount int8
@@ -87,18 +87,12 @@ type Interface struct {
 	conntrackCacheTimeout time.Duration
 
 	writers []udp.Conn
-	readers []overlay.TunDev
+	readers []io.ReadWriteCloser
 
 	metricHandshakes    metrics.Histogram
 	messageMetrics      *MessageMetrics
 	cachedPacketMetrics *cachedPacketMetrics
 
-	listenInN  int
-	listenOutN int
-
-	listenInMetric  metrics.Histogram
-	listenOutMetric metrics.Histogram
-
 	l *logrus.Logger
 }
 
@@ -117,34 +111,34 @@ type EncWriter interface {
 	GetCertState() *CertState
 }
 
-type sendRecvErrorConfig uint8
+type recvErrorConfig uint8
 
 const (
-	sendRecvErrorAlways sendRecvErrorConfig = iota
+	recvErrorAlways recvErrorConfig = iota
-	sendRecvErrorNever
+	recvErrorNever
-	sendRecvErrorPrivate
+	recvErrorPrivate
 )
 
-func (s sendRecvErrorConfig) ShouldSendRecvError(endpoint netip.AddrPort) bool {
+func (s recvErrorConfig) ShouldRecvError(endpoint netip.AddrPort) bool {
 	switch s {
-	case sendRecvErrorPrivate:
+	case recvErrorPrivate:
 		return endpoint.Addr().IsPrivate()
-	case sendRecvErrorAlways:
+	case recvErrorAlways:
 		return true
-	case sendRecvErrorNever:
+	case recvErrorNever:
 		return false
 	default:
-		panic(fmt.Errorf("invalid sendRecvErrorConfig value: %d", s))
+		panic(fmt.Errorf("invalid recvErrorConfig value: %d", s))
 	}
 }
 
-func (s sendRecvErrorConfig) String() string {
+func (s recvErrorConfig) String() string {
 	switch s {
-	case sendRecvErrorAlways:
+	case recvErrorAlways:
 		return "always"
-	case sendRecvErrorNever:
+	case recvErrorNever:
 		return "never"
-	case sendRecvErrorPrivate:
+	case recvErrorPrivate:
 		return "private"
 	default:
 		return fmt.Sprintf("invalid(%d)", s)
@@ -184,7 +178,7 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 		routines:              c.routines,
 		version:               c.version,
 		writers:               make([]udp.Conn, c.routines),
-		readers:               make([]overlay.TunDev, c.routines),
+		readers:               make([]io.ReadWriteCloser, c.routines),
 		myVpnNetworks:         cs.myVpnNetworks,
 		myVpnNetworksTable:    cs.myVpnNetworksTable,
 		myVpnAddrs:            cs.myVpnAddrs,
@@ -203,8 +197,6 @@ func NewInterface(ctx context.Context, c *InterfaceConfig) (*Interface, error) {
 
 		l: c.l,
 	}
-	ifce.listenInMetric = metrics.GetOrRegisterHistogram("vhost.listenIn.n", nil, metrics.NewExpDecaySample(1028, 0.015))
-	ifce.listenOutMetric = metrics.GetOrRegisterHistogram("vhost.listenOut.n", nil, metrics.NewExpDecaySample(1028, 0.015))
 
 	ifce.tryPromoteEvery.Store(c.tryPromoteEvery)
 	ifce.reQueryEvery.Store(c.reQueryEvery)
@@ -241,7 +233,7 @@ func (f *Interface) activate() {
 	metrics.GetOrRegisterGauge("routines", nil).Update(int64(f.routines))
 
 	// Prepare n tun queues
-	var reader overlay.TunDev = f.inside
+	var reader io.ReadWriteCloser = f.inside
 	for i := 0; i < f.routines; i++ {
 		if i > 0 {
 			reader, err = f.inside.NewMultiQueueReader()
@@ -270,81 +262,40 @@ func (f *Interface) run() {
 	}
 }
 
-type Scratches struct {
+func (f *Interface) listenOut(i int) {
-	h        *header.H
-	nb       []byte
-	fwPacket *firewall.Packet
-	scratch  []byte
-}
-
-func NewScratches() *Scratches {
-	return &Scratches{
-		h:        &header.H{},
-		fwPacket: &firewall.Packet{},
-		nb:       make([]byte, 12),
-		scratch:  make([]byte, udp.MTU),
-	}
-}
-
-func (f *Interface) listenOut(q int) {
 	runtime.LockOSThread()
 
 	var li udp.Conn
-	if q > 0 {
+	if i > 0 {
-		li = f.writers[q]
+		li = f.writers[i]
 	} else {
 		li = f.outside
 	}
 
 	ctCache := firewall.NewConntrackCacheTicker(f.conntrackCacheTimeout)
 	lhh := f.lightHouse.NewRequestHandler()
+	plaintext := make([]byte, udp.MTU)
+	h := &header.H{}
+	fwPacket := &firewall.Packet{}
+	nb := make([]byte, 12, 12)
 
-	outPackets := make([]*packet.OutPacket, batch)
+	li.ListenOut(func(fromUdpAddr netip.AddrPort, payload []byte) {
-	for i := 0; i < batch; i++ {
+		f.readOutsidePackets(ViaSender{UdpAddr: fromUdpAddr}, plaintext[:0], payload, h, fwPacket, lhh, nb, i, ctCache.Get(f.l))
-		outPackets[i] = packet.NewOut()
-	}
-
-	scratches := NewScratches()
-
-	toSend := make([][]byte, batch)
-
-	li.ListenOut(func(pkts []*packet.UDPPacket) {
-		toSend = toSend[:0]
-
-		f.readOutsidePacketsMany(pkts, outPackets, lhh, scratches, q, ctCache.Get(f.l), time.Now())
-		//we opportunistically tx, but try to also send stragglers
-		if _, err := f.readers[q].WriteMany(outPackets, q); err != nil {
-			f.l.WithError(err).Error("Failed to send packets")
-		}
-		//todo I broke this
-		//n := len(toSend)
-		//if f.l.Level == logrus.DebugLevel {
-		//	f.listenOutMetric.Update(int64(n))
-		//}
-		//f.listenOutN = n
-
 	})
 }
 
-func (f *Interface) listenIn(reader overlay.TunDev, queueNum int) {
+func (f *Interface) listenIn(reader io.ReadWriteCloser, i int) {
 	runtime.LockOSThread()
 
+	packet := make([]byte, mtu)
+	out := make([]byte, mtu)
 	fwPacket := &firewall.Packet{}
 	nb := make([]byte, 12, 12)
 
 	conntrackCache := firewall.NewConntrackCacheTicker(f.conntrackCacheTimeout)
 
-	packets := reader.NewPacketArrays(batch)
-
-	outPackets := make([]*packet.UDPPacket, batch)
-	for i := 0; i < batch; i++ {
-		outPackets[i] = packet.New(false) //todo isv4?
-	}
-
 	for {
-		n, err := reader.ReadMany(packets, queueNum)
+		n, err := reader.Read(packet)
-
-		//todo!!
 		if err != nil {
 			if errors.Is(err, os.ErrClosed) && f.closed.Load() {
 				return
@@ -355,27 +306,14 @@ func (f *Interface) listenIn(reader overlay.TunDev, queueNum int) {
 			os.Exit(2)
 		}
 
-		if f.l.Level == logrus.DebugLevel {
+		f.consumeInsidePacket(packet[:n], fwPacket, nb, out, i, conntrackCache.Get(f.l))
-			f.listenInMetric.Update(int64(n))
-		}
-		f.listenInN = n
-
-		now := time.Now()
-		for i, pkt := range packets[:n] {
-			outPackets[i].ReadyToSend = false
-			f.consumeInsidePacket(pkt.GetPayload(), fwPacket, nb, outPackets[i], queueNum, conntrackCache.Get(f.l), now)
-			reader.RecycleRxSeg(pkt, i == (n-1), queueNum) //todo handle err?
-		}
-		_, err = f.writers[queueNum].WriteBatch(outPackets[:n])
-		if err != nil {
-			f.l.WithError(err).Error("Error while writing outbound packets")
-		}
 	}
 }
 
 func (f *Interface) RegisterConfigChangeCallbacks(c *config.C) {
 	c.RegisterReloadCallback(f.reloadFirewall)
 	c.RegisterReloadCallback(f.reloadSendRecvError)
+	c.RegisterReloadCallback(f.reloadAcceptRecvError)
 	c.RegisterReloadCallback(f.reloadDisconnectInvalid)
 	c.RegisterReloadCallback(f.reloadMisc)
 
@@ -439,16 +377,16 @@ func (f *Interface) reloadSendRecvError(c *config.C) {
 
 		switch stringValue {
 		case "always":
-			f.sendRecvErrorConfig = sendRecvErrorAlways
+			f.sendRecvErrorConfig = recvErrorAlways
 		case "never":
-			f.sendRecvErrorConfig = sendRecvErrorNever
+			f.sendRecvErrorConfig = recvErrorNever
 		case "private":
-			f.sendRecvErrorConfig = sendRecvErrorPrivate
+			f.sendRecvErrorConfig = recvErrorPrivate
 		default:
 			if c.GetBool("listen.send_recv_error", true) {
-				f.sendRecvErrorConfig = sendRecvErrorAlways
+				f.sendRecvErrorConfig = recvErrorAlways
 			} else {
-				f.sendRecvErrorConfig = sendRecvErrorNever
+				f.sendRecvErrorConfig = recvErrorNever
 			}
 		}
 
@@ -457,6 +395,30 @@ func (f *Interface) reloadSendRecvError(c *config.C) {
 	}
 }
 
+func (f *Interface) reloadAcceptRecvError(c *config.C) {
+	if c.InitialLoad() || c.HasChanged("listen.accept_recv_error") {
+		stringValue := c.GetString("listen.accept_recv_error", "always")
+
+		switch stringValue {
+		case "always":
+			f.acceptRecvErrorConfig = recvErrorAlways
+		case "never":
+			f.acceptRecvErrorConfig = recvErrorNever
+		case "private":
+			f.acceptRecvErrorConfig = recvErrorPrivate
+		default:
+			if c.GetBool("listen.accept_recv_error", true) {
+				f.acceptRecvErrorConfig = recvErrorAlways
+			} else {
+				f.acceptRecvErrorConfig = recvErrorNever
+			}
+		}
+
+		f.l.WithField("acceptRecvError", f.acceptRecvErrorConfig.String()).
+			Info("Loaded accept_recv_error config")
+	}
+}
+
 func (f *Interface) reloadMisc(c *config.C) {
 	if c.HasChanged("counters.try_promote") {
 		n := c.GetUint32("counters.try_promote", defaultPromoteEvery)
@@ -507,11 +469,6 @@ func (f *Interface) emitStats(ctx context.Context, i time.Duration) {
 			} else {
 				certMaxVersion.Update(int64(certState.v1Cert.Version()))
 			}
-			if f.l.Level != logrus.DebugLevel {
-				f.listenInMetric.Update(int64(f.listenInN))
-				f.listenOutMetric.Update(int64(f.listenOutN))
-			}
-
 		}
 	}
 }
@@ -533,6 +490,14 @@ func (f *Interface) Close() error {
 			f.l.WithError(err).Error("Error while closing udp socket")
 		}
 	}
+	for i, r := range f.readers {
+		if i == 0 {
+			continue // f.readers[0] is f.inside, which we want to save for last
+		}
+		if err := r.Close(); err != nil {
+			f.l.WithError(err).Error("Error while closing tun reader")
+		}
+	}
 
 	// Release the tun device
 	return f.inside.Close()

lighthouse_test.go

@@ -1,7 +1,6 @@
 package nebula
 
 import (
-	"context"
 	"encoding/binary"
 	"fmt"
 	"net/netip"
@@ -42,14 +41,14 @@ func Test_lhStaticMapping(t *testing.T) {
 	c := config.NewC(l)
 	c.Settings["lighthouse"] = map[string]any{"hosts": []any{lh1}}
 	c.Settings["static_host_map"] = map[string]any{lh1: []any{"1.1.1.1:4242"}}
-	_, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	_, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 
 	lh2 := "10.128.0.3"
 	c = config.NewC(l)
 	c.Settings["lighthouse"] = map[string]any{"hosts": []any{lh1, lh2}}
 	c.Settings["static_host_map"] = map[string]any{lh1: []any{"100.1.1.1:4242"}}
-	_, err = NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	_, err = NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.EqualError(t, err, "lighthouse 10.128.0.3 does not have a static_host_map entry")
 }
 
@@ -71,7 +70,7 @@ func TestReloadLighthouseInterval(t *testing.T) {
 	}
 
 	c.Settings["static_host_map"] = map[string]any{lh1: []any{"1.1.1.1:4242"}}
-	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}
 
@@ -99,7 +98,7 @@ func BenchmarkLighthouseHandleRequest(b *testing.B) {
 	}
 
 	c := config.NewC(l)
-	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(b.Context(), l, c, cs, nil, nil)
 	require.NoError(b, err)
 
 	hAddr := netip.MustParseAddrPort("4.5.6.7:12345")
@@ -202,7 +201,7 @@ func TestLighthouse_Memory(t *testing.T) {
 		myVpnNetworks:      []netip.Prefix{myVpnNet},
 		myVpnNetworksTable: nt,
 	}
-	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	lh.ifce = &mockEncWriter{}
 	require.NoError(t, err)
 	lhh := lh.NewRequestHandler()
@@ -288,7 +287,7 @@ func TestLighthouse_reload(t *testing.T) {
 		myVpnNetworksTable: nt,
 	}
 
-	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 
 	nc := map[string]any{
@@ -523,7 +522,7 @@ func TestLighthouse_Dont_Delete_Static_Hosts(t *testing.T) {
 		myVpnNetworks:      []netip.Prefix{myVpnNet},
 		myVpnNetworksTable: nt,
 	}
-	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}
 
@@ -589,7 +588,7 @@ func TestLighthouse_DeletesWork(t *testing.T) {
 		myVpnNetworks:      []netip.Prefix{myVpnNet},
 		myVpnNetworksTable: nt,
 	}
-	lh, err := NewLightHouseFromConfig(context.Background(), l, c, cs, nil, nil)
+	lh, err := NewLightHouseFromConfig(t.Context(), l, c, cs, nil, nil)
 	require.NoError(t, err)
 	lh.ifce = &mockEncWriter{}
 

main.go

@@ -265,6 +265,7 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 		ifce.RegisterConfigChangeCallbacks(c)
 		ifce.reloadDisconnectInvalid(c)
 		ifce.reloadSendRecvError(c)
+		ifce.reloadAcceptRecvError(c)
 
 		handshakeManager.f = ifce
 		go handshakeManager.Run(ctx)

noiseutil/boring.go

@@ -22,7 +22,7 @@ const EncryptLockNeeded = true
 // NewGCMTLS is no longer exposed in go1.19+, so we need to link it in
 // See: https://github.com/golang/go/issues/56326
 //
-// NewGCMTLS is the internal method used with boringcrypto that provices a
+// NewGCMTLS is the internal method used with boringcrypto that provides a
 // validated mode of AES-GCM which enforces the nonce is strictly
 // monotonically increasing.  This is the TLS 1.2 specification for nonce
 // generation (which also matches the method used by the Noise Protocol)

outside.go

@@ -1,127 +1,39 @@
 package nebula
 
 import (
-	"encoding/binary"
 	"errors"
 	"net/netip"
 	"time"
 
-	"github.com/google/gopacket/layers"
-	"github.com/slackhq/nebula/packet"
-	"golang.org/x/net/ipv6"
-
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/header"
-	"golang.org/x/net/ipv4"
 )
 
-const (
+func (f *Interface) readOutsidePackets(via ViaSender, out []byte, packet []byte, h *header.H, fwPacket *firewall.Packet, lhf *LightHouseHandler, nb []byte, q int, localCache firewall.ConntrackCache) {
-	minFwPacketLen = 4
+	err := h.Parse(packet)
-)
-
-// handleRelayPackets handles relay packets. Returns false if there's nothing left to do, true for continuing to process an unwrapped TerminalType packet
-// scratch must be large enough to contain a packet to be relayed if needed
-func (f *Interface) handleRelayPackets(via ViaSender, hostinfo *HostInfo, segment []byte, scratch []byte, h *header.H, nb []byte) ([]byte, *ViaSender, bool) {
-	var err error
-	// The entire body is sent as AD, not encrypted.
-	// The packet consists of a 16-byte parsed Nebula header, Associated Data-protected payload, and a trailing 16-byte AEAD signature value.
-	// The packet is guaranteed to be at least 16 bytes at this point, b/c it got past the h.Parse() call above. If it's
-	// otherwise malformed (meaning, there is no trailing 16 byte AEAD value), then this will result in at worst a 0-length slice
-	// which will gracefully fail in the DecryptDanger call.
-	signedPayload := segment[:len(segment)-hostinfo.ConnectionState.dKey.Overhead()]
-	signatureValue := segment[len(segment)-hostinfo.ConnectionState.dKey.Overhead():]
-	scratch, err = hostinfo.ConnectionState.dKey.DecryptDanger(scratch, signedPayload, signatureValue, h.MessageCounter, nb)
 	if err != nil {
-		return nil, nil, false
+		// Hole punch packets are 0 or 1 byte big, so lets ignore printing those errors
-	}
+		if len(packet) > 1 {
-	// Successfully validated the thing. Get rid of the Relay header.
+			f.l.WithField("packet", packet).Infof("Error while parsing inbound packet from %s: %s", via, err)
-	signedPayload = signedPayload[header.Len:]
-	// Pull the Roaming parts up here, and return in all call paths.
-	f.handleHostRoaming(hostinfo, via)
-	// Track usage of both the HostInfo and the Relay for the received & authenticated packet
-	f.connectionManager.In(hostinfo)
-	f.connectionManager.RelayUsed(h.RemoteIndex)
-
-	relay, ok := hostinfo.relayState.QueryRelayForByIdx(h.RemoteIndex)
-	if !ok {
-		// The only way this happens is if hostmap has an index to the correct HostInfo, but the HostInfo is missing
-		// its internal mapping. This should never happen.
-		hostinfo.logger(f.l).WithFields(logrus.Fields{"vpnAddrs": hostinfo.vpnAddrs, "remoteIndex": h.RemoteIndex}).Error("HostInfo missing remote relay index")
-		return nil, nil, false
-	}
-
-	switch relay.Type {
-	case TerminalType:
-		// If I am the target of this relay, process the unwrapped packet
-		// We need to re-write our variables to ensure this segment is correctly parsed.
-		// We could set up for a recursive call here, but this makes it easier to prove that we'll never stack-overflow
-
-		//mirrors the top of readOutsideSegment
-		err = h.Parse(signedPayload)
-		if err != nil {
-			// Hole punch packets are 0 or 1 byte big, so let's ignore printing those errors
-			if len(signedPayload) > 1 {
-				f.l.WithField("packet", segment).Infof("Error while parsing inbound packet from %s: %s", via, err)
-			}
-			return nil, nil, false
-		}
-		newVia := &ViaSender{
-			UdpAddr:   via.UdpAddr,
-			relayHI:   hostinfo,
-			remoteIdx: relay.RemoteIndex,
-			relay:     relay,
-			IsRelayed: true,
-		}
-		//continue flowing through readOutsideSegment()
-		return signedPayload, newVia, true
-	case ForwardingType:
-		// Find the target HostInfo relay object
-		targetHI, targetRelay, err := f.hostMap.QueryVpnAddrsRelayFor(hostinfo.vpnAddrs, relay.PeerAddr)
-		if err != nil {
-			hostinfo.logger(f.l).WithField("relayTo", relay.PeerAddr).WithError(err).WithField("hostinfo.vpnAddrs", hostinfo.vpnAddrs).Info("Failed to find target host info by ip")
-			return nil, nil, false
-		}
-
-		// If that relay is Established, forward the payload through it
-		if targetRelay.State == Established {
-			switch targetRelay.Type {
-			case ForwardingType:
-				// Forward this packet through the relay tunnel, and find the target HostInfo
-				f.SendVia(targetHI, targetRelay, signedPayload, nb, scratch[:0], false) //todo it would be nice to queue this up and do it later, or at least avoid a memcpy of signedPayload
-			case TerminalType:
-				hostinfo.logger(f.l).Error("Unexpected Relay Type of Terminal")
-			default:
-				hostinfo.logger(f.l).WithField("targetRelay.Type", targetRelay.Type).Error("Unexpected Relay Type")
-			}
-		} else {
-			hostinfo.logger(f.l).WithFields(logrus.Fields{"relayTo": relay.PeerAddr, "relayFrom": hostinfo.vpnAddrs[0], "targetRelayState": targetRelay.State}).Info("Unexpected target relay state")
-		}
-	}
-	return nil, nil, false
-}
-
-func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packet.OutPacket, lhf *LightHouseHandler, s *Scratches, q int, localCache firewall.ConntrackCache, now time.Time) {
-	h := s.h
-	err := h.Parse(segment)
-	if err != nil {
-		// Hole punch packets are 0 or 1 byte big, so let's ignore printing those errors
-		if len(segment) > 1 {
-			f.l.WithField("packet", segment).Infof("Error while parsing inbound packet from %s: %s", via, err)
 		}
 		return
 	}
 
+	//l.Error("in packet ", header, packet[HeaderLen:])
+	if !via.IsRelayed {
+		if f.myVpnNetworksTable.Contains(via.UdpAddr.Addr()) {
+			if f.l.Level >= logrus.DebugLevel {
+				f.l.WithField("from", via).Debug("Refusing to process double encrypted packet")
+			}
+			return
+		}
+	}
+
 	var hostinfo *HostInfo
 	// verify if we've seen this index before, otherwise respond to the handshake initiation
 	if h.Type == header.Message && h.Subtype == header.MessageRelay {
 		hostinfo = f.hostMap.QueryRelayIndex(h.RemoteIndex)
-		newSegment, newVia, keepGoing := f.handleRelayPackets(via, hostinfo, segment, s.scratch, h, s.nb)
-		if !keepGoing {
-			return
-		}
-		via = *newVia
-		segment = newSegment
 	} else {
 		hostinfo = f.hostMap.QueryIndex(h.RemoteIndex)
 	}
@@ -139,13 +51,74 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 
 		switch h.Subtype {
 		case header.MessageNone:
-			if !f.decryptToTunDelayWrite(hostinfo, h.MessageCounter, out, segment, s.fwPacket, s.nb, q, localCache, now) {
+			if !f.decryptToTun(hostinfo, h.MessageCounter, out, packet, fwPacket, nb, q, localCache) {
-				out.DestroyLastSegment() //prevent a rejected segment from being used
 				return
 			}
 		case header.MessageRelay:
-			f.l.Error("relayed messages cannot contain relay messages, dropping packet")
+			// The entire body is sent as AD, not encrypted.
-			return
+			// The packet consists of a 16-byte parsed Nebula header, Associated Data-protected payload, and a trailing 16-byte AEAD signature value.
+			// The packet is guaranteed to be at least 16 bytes at this point, b/c it got past the h.Parse() call above. If it's
+			// otherwise malformed (meaning, there is no trailing 16 byte AEAD value), then this will result in at worst a 0-length slice
+			// which will gracefully fail in the DecryptDanger call.
+			signedPayload := packet[:len(packet)-hostinfo.ConnectionState.dKey.Overhead()]
+			signatureValue := packet[len(packet)-hostinfo.ConnectionState.dKey.Overhead():]
+			out, err = hostinfo.ConnectionState.dKey.DecryptDanger(out, signedPayload, signatureValue, h.MessageCounter, nb)
+			if err != nil {
+				return
+			}
+			// Successfully validated the thing. Get rid of the Relay header.
+			signedPayload = signedPayload[header.Len:]
+			// Pull the Roaming parts up here, and return in all call paths.
+			f.handleHostRoaming(hostinfo, via)
+			// Track usage of both the HostInfo and the Relay for the received & authenticated packet
+			f.connectionManager.In(hostinfo)
+			f.connectionManager.RelayUsed(h.RemoteIndex)
+
+			relay, ok := hostinfo.relayState.QueryRelayForByIdx(h.RemoteIndex)
+			if !ok {
+				// The only way this happens is if hostmap has an index to the correct HostInfo, but the HostInfo is missing
+				// its internal mapping. This should never happen.
+				hostinfo.logger(f.l).WithFields(logrus.Fields{"vpnAddrs": hostinfo.vpnAddrs, "remoteIndex": h.RemoteIndex}).Error("HostInfo missing remote relay index")
+				return
+			}
+
+			switch relay.Type {
+			case TerminalType:
+				// If I am the target of this relay, process the unwrapped packet
+				// From this recursive point, all these variables are 'burned'. We shouldn't rely on them again.
+				via = ViaSender{
+					UdpAddr:   via.UdpAddr,
+					relayHI:   hostinfo,
+					remoteIdx: relay.RemoteIndex,
+					relay:     relay,
+					IsRelayed: true,
+				}
+				f.readOutsidePackets(via, out[:0], signedPayload, h, fwPacket, lhf, nb, q, localCache)
+				return
+			case ForwardingType:
+				// Find the target HostInfo relay object
+				targetHI, targetRelay, err := f.hostMap.QueryVpnAddrsRelayFor(hostinfo.vpnAddrs, relay.PeerAddr)
+				if err != nil {
+					hostinfo.logger(f.l).WithField("relayTo", relay.PeerAddr).WithError(err).WithField("hostinfo.vpnAddrs", hostinfo.vpnAddrs).Info("Failed to find target host info by ip")
+					return
+				}
+
+				// If that relay is Established, forward the payload through it
+				if targetRelay.State == Established {
+					switch targetRelay.Type {
+					case ForwardingType:
+						// Forward this packet through the relay tunnel
+						// Find the target HostInfo
+						f.SendVia(targetHI, targetRelay, signedPayload, nb, out, false)
+						return
+					case TerminalType:
+						hostinfo.logger(f.l).Error("Unexpected Relay Type of Terminal")
+					}
+				} else {
+					hostinfo.logger(f.l).WithFields(logrus.Fields{"relayTo": relay.PeerAddr, "relayFrom": hostinfo.vpnAddrs[0], "targetRelayState": targetRelay.State}).Info("Unexpected target relay state")
+					return
+				}
+			}
 		}
 
 	case header.LightHouse:
@@ -154,14 +127,15 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 			return
 		}
 
-		d, err := f.decrypt(hostinfo, h.MessageCounter, s.scratch, segment, h, s.nb)
+		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", via.UdpAddr).
+			hostinfo.logger(f.l).WithError(err).WithField("from", via).
-				WithField("packet", segment).
+				WithField("packet", packet).
 				Error("Failed to decrypt lighthouse packet")
 			return
 		}
 
+		//TODO: assert via is not relayed
 		lhf.HandleRequest(via.UdpAddr, hostinfo.vpnAddrs, d, f)
 
 		// Fallthrough to the bottom to record incoming traffic
@@ -172,10 +146,10 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 			return
 		}
 
-		d, err := f.decrypt(hostinfo, h.MessageCounter, s.scratch, segment, h, s.nb)
+		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", via).
+			hostinfo.logger(f.l).WithError(err).WithField("from", via).
-				WithField("packet", segment).
+				WithField("packet", packet).
 				Error("Failed to decrypt test packet")
 			return
 		}
@@ -184,7 +158,7 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 			// This testRequest might be from TryPromoteBest, so we should roam
 			// to the new IP address before responding
 			f.handleHostRoaming(hostinfo, via)
-			f.send(header.Test, header.TestReply, ci, hostinfo, d, s.nb, s.scratch)
+			f.send(header.Test, header.TestReply, ci, hostinfo, d, nb, out)
 		}
 
 		// Fallthrough to the bottom to record incoming traffic
@@ -194,7 +168,7 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 
 	case header.Handshake:
 		f.messageMetrics.Rx(h.Type, h.Subtype, 1)
-		f.handshakeManager.HandleIncoming(via, segment, h)
+		f.handshakeManager.HandleIncoming(via, packet, h)
 		return
 
 	case header.RecvError:
@@ -208,7 +182,7 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 			return
 		}
 
-		hostinfo.logger(f.l).WithField("udpAddr", via).
+		hostinfo.logger(f.l).WithField("from", via).
 			Info("Close tunnel received, tearing down.")
 
 		f.closeTunnel(hostinfo)
@@ -219,10 +193,10 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 			return
 		}
 
-		d, err := f.decrypt(hostinfo, h.MessageCounter, s.scratch, segment, h, s.nb)
+		d, err := f.decrypt(hostinfo, h.MessageCounter, out, packet, h, nb)
 		if err != nil {
-			hostinfo.logger(f.l).WithError(err).WithField("udpAddr", via).
+			hostinfo.logger(f.l).WithError(err).WithField("from", via).
-				WithField("packet", segment).
+				WithField("packet", packet).
 				Error("Failed to decrypt Control packet")
 			return
 		}
@@ -240,28 +214,6 @@ func (f *Interface) readOutsideSegment(via ViaSender, segment []byte, out *packe
 	f.connectionManager.In(hostinfo)
 }
 
-func (f *Interface) readOutsidePacketsMany(packets []*packet.UDPPacket, out []*packet.OutPacket, lhf *LightHouseHandler, s *Scratches, q int, localCache firewall.ConntrackCache, now time.Time) {
-	for i, pkt := range packets {
-		via := ViaSender{UdpAddr: pkt.AddrPort()}
-
-		//l.Error("in packet ", header, packet[HeaderLen:])
-		if f.myVpnNetworksTable.Contains(via.UdpAddr.Addr()) {
-			if f.l.Level >= logrus.DebugLevel {
-				f.l.WithField("from", via).Debug("Refusing to process double encrypted packet")
-			}
-			return
-		}
-
-		for segment := range pkt.Segments() {
-			f.readOutsideSegment(via, segment, out[i], lhf, s, q, localCache, now)
-		}
-		//_, err := f.readers[q].WriteOne(out[i], false, q)
-		//if err != nil {
-		//	f.l.WithError(err).Error("Failed to write packet")
-		//}
-	}
-}
-
 // closeTunnel closes a tunnel locally, it does not send a closeTunnel packet to the remote
 func (f *Interface) closeTunnel(hostInfo *HostInfo) {
 	final := f.hostMap.DeleteHostInfo(hostInfo)
@@ -317,184 +269,6 @@ func (f *Interface) handleEncrypted(ci *ConnectionState, via ViaSender, h *heade
 	return true
 }
 
-var (
-	ErrPacketTooShort          = errors.New("packet is too short")
-	ErrUnknownIPVersion        = errors.New("packet is an unknown ip version")
-	ErrIPv4InvalidHeaderLength = errors.New("invalid ipv4 header length")
-	ErrIPv4PacketTooShort      = errors.New("ipv4 packet is too short")
-	ErrIPv6PacketTooShort      = errors.New("ipv6 packet is too short")
-	ErrIPv6CouldNotFindPayload = errors.New("could not find payload in ipv6 packet")
-)
-
-// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers
-func newPacket(data []byte, incoming bool, fp *firewall.Packet) error {
-	if len(data) < 1 {
-		return ErrPacketTooShort
-	}
-
-	//version := int((data[0] >> 4) & 0x0f)
-	switch data[0] & 0xf0 {
-	case ipv4.Version << 4:
-		return parseV4(data, incoming, fp)
-	case ipv6.Version << 4:
-		return parseV6(data, incoming, fp)
-	}
-	return ErrUnknownIPVersion
-}
-
-func parseV6(data []byte, incoming bool, fp *firewall.Packet) error {
-	dataLen := len(data)
-	if dataLen < ipv6.HeaderLen {
-		return ErrIPv6PacketTooShort
-	}
-
-	if incoming {
-		fp.RemoteAddr, _ = netip.AddrFromSlice(data[8:24])
-		fp.LocalAddr, _ = netip.AddrFromSlice(data[24:40])
-	} else {
-		fp.LocalAddr, _ = netip.AddrFromSlice(data[8:24])
-		fp.RemoteAddr, _ = netip.AddrFromSlice(data[24:40])
-	}
-
-	protoAt := 6             // NextHeader is at 6 bytes into the ipv6 header
-	offset := ipv6.HeaderLen // Start at the end of the ipv6 header
-	next := 0
-	for {
-		if protoAt >= dataLen {
-			break
-		}
-		proto := layers.IPProtocol(data[protoAt])
-
-		switch proto {
-		case layers.IPProtocolICMPv6, layers.IPProtocolESP, layers.IPProtocolNoNextHeader:
-			fp.Protocol = uint8(proto)
-			fp.RemotePort = 0
-			fp.LocalPort = 0
-			fp.Fragment = false
-			return nil
-
-		case layers.IPProtocolTCP, layers.IPProtocolUDP:
-			if dataLen < offset+4 {
-				return ErrIPv6PacketTooShort
-			}
-
-			fp.Protocol = uint8(proto)
-			if incoming {
-				fp.RemotePort = binary.BigEndian.Uint16(data[offset : offset+2])
-				fp.LocalPort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
-			} else {
-				fp.LocalPort = binary.BigEndian.Uint16(data[offset : offset+2])
-				fp.RemotePort = binary.BigEndian.Uint16(data[offset+2 : offset+4])
-			}
-
-			fp.Fragment = false
-			return nil
-
-		case layers.IPProtocolIPv6Fragment:
-			// Fragment header is 8 bytes, need at least offset+4 to read the offset field
-			if dataLen < offset+8 {
-				return ErrIPv6PacketTooShort
-			}
-
-			// Check if this is the first fragment
-			fragmentOffset := binary.BigEndian.Uint16(data[offset+2:offset+4]) &^ uint16(0x7) // Remove the reserved and M flag bits
-			if fragmentOffset != 0 {
-				// Non-first fragment, use what we have now and stop processing
-				fp.Protocol = data[offset]
-				fp.Fragment = true
-				fp.RemotePort = 0
-				fp.LocalPort = 0
-				return nil
-			}
-
-			// The next loop should be the transport layer since we are the first fragment
-			next = 8 // Fragment headers are always 8 bytes
-
-		case layers.IPProtocolAH:
-			// Auth headers, used by IPSec, have a different meaning for header length
-			if dataLen <= offset+1 {
-				break
-			}
-
-			next = int(data[offset+1]+2) << 2
-
-		default:
-			// Normal ipv6 header length processing
-			if dataLen <= offset+1 {
-				break
-			}
-
-			next = int(data[offset+1]+1) << 3
-		}
-
-		if next <= 0 {
-			// Safety check, each ipv6 header has to be at least 8 bytes
-			next = 8
-		}
-
-		protoAt = offset
-		offset = offset + next
-	}
-
-	return ErrIPv6CouldNotFindPayload
-}
-
-func parseV4(data []byte, incoming bool, fp *firewall.Packet) error {
-	// Do we at least have an ipv4 header worth of data?
-	if len(data) < ipv4.HeaderLen {
-		return ErrIPv4PacketTooShort
-	}
-
-	// Adjust our start position based on the advertised ip header length
-	ihl := int(data[0]&0x0f) << 2
-
-	// Well-formed ip header length?
-	if ihl < ipv4.HeaderLen {
-		return ErrIPv4InvalidHeaderLength
-	}
-
-	// Check if this is the second or further fragment of a fragmented packet.
-	flagsfrags := binary.BigEndian.Uint16(data[6:8])
-	fp.Fragment = (flagsfrags & 0x1FFF) != 0
-
-	// Firewall handles protocol checks
-	fp.Protocol = data[9]
-
-	// Accounting for a variable header length, do we have enough data for our src/dst tuples?
-	minLen := ihl
-	if !fp.Fragment && fp.Protocol != firewall.ProtoICMP {
-		minLen += minFwPacketLen
-	}
-	if len(data) < minLen {
-		return ErrIPv4InvalidHeaderLength
-	}
-
-	// Firewall packets are locally oriented
-	if incoming {
-		fp.RemoteAddr, _ = netip.AddrFromSlice(data[12:16])
-		fp.LocalAddr, _ = netip.AddrFromSlice(data[16:20])
-		if fp.Fragment || fp.Protocol == firewall.ProtoICMP {
-			fp.RemotePort = 0
-			fp.LocalPort = 0
-		} else {
-			fp.RemotePort = binary.BigEndian.Uint16(data[ihl : ihl+2])
-			fp.LocalPort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
-		}
-	} else {
-		fp.LocalAddr, _ = netip.AddrFromSlice(data[12:16])
-		fp.RemoteAddr, _ = netip.AddrFromSlice(data[16:20])
-		if fp.Fragment || fp.Protocol == firewall.ProtoICMP {
-			fp.RemotePort = 0
-			fp.LocalPort = 0
-		} else {
-			fp.LocalPort = binary.BigEndian.Uint16(data[ihl : ihl+2])
-			fp.RemotePort = binary.BigEndian.Uint16(data[ihl+2 : ihl+4])
-		}
-	}
-
-	return nil
-}
-
 func (f *Interface) decrypt(hostinfo *HostInfo, mc uint64, out []byte, packet []byte, h *header.H, nb []byte) ([]byte, error) {
 	var err error
 	out, err = hostinfo.ConnectionState.dKey.DecryptDanger(out, packet[:header.Len], packet[header.Len:], mc, nb)
@@ -511,23 +285,16 @@ func (f *Interface) decrypt(hostinfo *HostInfo, mc uint64, out []byte, packet []
 	return out, nil
 }
 
-func (f *Interface) decryptToTunDelayWrite(hostinfo *HostInfo, messageCounter uint64, out *packet.OutPacket, inSegment []byte, fwPacket *firewall.Packet, nb []byte, q int, localCache firewall.ConntrackCache, now time.Time) bool {
+func (f *Interface) decryptToTun(hostinfo *HostInfo, messageCounter uint64, out []byte, packet []byte, fwPacket *firewall.Packet, nb []byte, q int, localCache firewall.ConntrackCache) bool {
 	var err error
 
-	seg, err := f.readers[q].AllocSeg(out, q)
+	out, err = hostinfo.ConnectionState.dKey.DecryptDanger(out, packet[:header.Len], packet[header.Len:], messageCounter, nb)
-	if err != nil {
-		f.l.WithError(err).Errorln("decryptToTunDelayWrite: failed to allocate segment")
-		return false
-	}
-
-	out.SegmentPayloads[seg] = out.SegmentPayloads[seg][:0]
-	out.SegmentPayloads[seg], err = hostinfo.ConnectionState.dKey.DecryptDanger(out.SegmentPayloads[seg], inSegment[:header.Len], inSegment[header.Len:], messageCounter, nb)
 	if err != nil {
 		hostinfo.logger(f.l).WithError(err).Error("Failed to decrypt packet")
 		return false
 	}
 
-	err = newPacket(out.SegmentPayloads[seg], true, fwPacket)
+	err = firewall.NewPacket(out, true, fwPacket)
 	if err != nil {
 		hostinfo.logger(f.l).WithError(err).WithField("packet", out).
 			Warnf("Error while validating inbound packet")
@@ -540,11 +307,11 @@ func (f *Interface) decryptToTunDelayWrite(hostinfo *HostInfo, messageCounter ui
 		return false
 	}
 
-	dropReason := f.firewall.Drop(*fwPacket, true, hostinfo, f.pki.GetCAPool(), localCache, now)
+	dropReason := f.firewall.Drop(*fwPacket, true, hostinfo, f.pki.GetCAPool(), localCache)
 	if dropReason != nil {
 		// NOTE: We give `packet` as the `out` here since we already decrypted from it and we don't need it anymore
 		// This gives us a buffer to build the reject packet in
-		f.rejectOutside(out.SegmentPayloads[seg], hostinfo.ConnectionState, hostinfo, nb, inSegment, q)
+		f.rejectOutside(out, hostinfo.ConnectionState, hostinfo, nb, packet, q)
 		if f.l.Level >= logrus.DebugLevel {
 			hostinfo.logger(f.l).WithField("fwPacket", fwPacket).
 				WithField("reason", dropReason).
@@ -554,12 +321,15 @@ func (f *Interface) decryptToTunDelayWrite(hostinfo *HostInfo, messageCounter ui
 	}
 
 	f.connectionManager.In(hostinfo)
-	out.Segments[seg] = out.Segments[seg][:len(out.SegmentHeaders[seg])+len(out.SegmentPayloads[seg])]
+	_, err = f.readers[q].Write(out)
+	if err != nil {
+		f.l.WithError(err).Error("Failed to write to tun")
+	}
 	return true
 }
 
 func (f *Interface) maybeSendRecvError(endpoint netip.AddrPort, index uint32) {
-	if f.sendRecvErrorConfig.ShouldSendRecvError(endpoint) {
+	if f.sendRecvErrorConfig.ShouldRecvError(endpoint) {
 		f.sendRecvError(endpoint, index)
 	}
 }
@@ -577,6 +347,13 @@ func (f *Interface) sendRecvError(endpoint netip.AddrPort, index uint32) {
 }
 
 func (f *Interface) handleRecvError(addr netip.AddrPort, h *header.H) {
+	if !f.acceptRecvErrorConfig.ShouldRecvError(addr) {
+		f.l.WithField("index", h.RemoteIndex).
+			WithField("udpAddr", addr).
+			Debug("Recv error received, ignoring")
+		return
+	}
+
 	if f.l.Level >= logrus.DebugLevel {
 		f.l.WithField("index", h.RemoteIndex).
 			WithField("udpAddr", addr).

outside_test.go

@@ -20,13 +20,13 @@ func Test_newPacket(t *testing.T) {
 	p := &firewall.Packet{}
 
 	// length fails
-	err := newPacket([]byte{}, true, p)
+	err := firewall.NewPacket([]byte{}, true, p)
 	require.ErrorIs(t, err, ErrPacketTooShort)
 
-	err = newPacket([]byte{0x40}, true, p)
+	err = firewall.NewPacket([]byte{0x40}, true, p)
 	require.ErrorIs(t, err, ErrIPv4PacketTooShort)
 
-	err = newPacket([]byte{0x60}, true, p)
+	err = firewall.NewPacket([]byte{0x60}, true, p)
 	require.ErrorIs(t, err, ErrIPv6PacketTooShort)
 
 	// length fail with ip options
@@ -39,15 +39,15 @@ func Test_newPacket(t *testing.T) {
 	}
 
 	b, _ := h.Marshal()
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.ErrorIs(t, err, ErrIPv4InvalidHeaderLength)
 
 	// not an ipv4 packet
-	err = newPacket([]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, true, p)
+	err = firewall.NewPacket([]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, true, p)
 	require.ErrorIs(t, err, ErrUnknownIPVersion)
 
 	// invalid ihl
-	err = newPacket([]byte{4<<4 | (8 >> 2 & 0x0f), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, true, p)
+	err = firewall.NewPacket([]byte{4<<4 | (8 >> 2 & 0x0f), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, true, p)
 	require.ErrorIs(t, err, ErrIPv4InvalidHeaderLength)
 
 	// account for variable ip header length - incoming
@@ -62,7 +62,7 @@ func Test_newPacket(t *testing.T) {
 
 	b, _ = h.Marshal()
 	b = append(b, []byte{0, 3, 0, 4}...)
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 
 	require.NoError(t, err)
 	assert.Equal(t, uint8(firewall.ProtoTCP), p.Protocol)
@@ -84,7 +84,7 @@ func Test_newPacket(t *testing.T) {
 
 	b, _ = h.Marshal()
 	b = append(b, []byte{0, 5, 0, 6}...)
-	err = newPacket(b, false, p)
+	err = firewall.NewPacket(b, false, p)
 
 	require.NoError(t, err)
 	assert.Equal(t, uint8(2), p.Protocol)
@@ -114,7 +114,7 @@ func Test_newPacket_v6(t *testing.T) {
 	err := gopacket.SerializeLayers(buffer, opt, &ip)
 	require.NoError(t, err)
 
-	err = newPacket(buffer.Bytes(), true, p)
+	err = firewall.NewPacket(buffer.Bytes(), true, p)
 	require.ErrorIs(t, err, ErrIPv6CouldNotFindPayload)
 
 	// A v6 packet with a hop-by-hop extension
@@ -148,12 +148,12 @@ func Test_newPacket_v6(t *testing.T) {
 
 	// A full IPv6 header and 1 byte in the first extension, but missing
 	// the length byte.
-	err = newPacket(buffer.Bytes()[:41], true, p)
+	err = firewall.NewPacket(buffer.Bytes()[:41], true, p)
 	require.ErrorIs(t, err, ErrIPv6CouldNotFindPayload)
 
 	// A full IPv6 header plus 1 full extension, but only 1 byte of the
 	// next layer, missing length byte
-	err = newPacket(buffer.Bytes()[:49], true, p)
+	err = firewall.NewPacket(buffer.Bytes()[:49], true, p)
 	require.ErrorIs(t, err, ErrIPv6CouldNotFindPayload)
 
 	// A good ICMP packet
@@ -173,7 +173,7 @@ func Test_newPacket_v6(t *testing.T) {
 		panic(err)
 	}
 
-	err = newPacket(buffer.Bytes(), true, p)
+	err = firewall.NewPacket(buffer.Bytes(), true, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(layers.IPProtocolICMPv6), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
@@ -185,7 +185,7 @@ func Test_newPacket_v6(t *testing.T) {
 	// A good ESP packet
 	b := buffer.Bytes()
 	b[6] = byte(layers.IPProtocolESP)
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(layers.IPProtocolESP), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
@@ -197,7 +197,7 @@ func Test_newPacket_v6(t *testing.T) {
 	// A good None packet
 	b = buffer.Bytes()
 	b[6] = byte(layers.IPProtocolNoNextHeader)
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(layers.IPProtocolNoNextHeader), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
@@ -209,7 +209,7 @@ func Test_newPacket_v6(t *testing.T) {
 	// An unknown protocol packet
 	b = buffer.Bytes()
 	b[6] = 255 // 255 is a reserved protocol number
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.ErrorIs(t, err, ErrIPv6CouldNotFindPayload)
 
 	// A good UDP packet
@@ -236,7 +236,7 @@ func Test_newPacket_v6(t *testing.T) {
 	b = buffer.Bytes()
 
 	// incoming
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(firewall.ProtoUDP), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
@@ -246,7 +246,7 @@ func Test_newPacket_v6(t *testing.T) {
 	assert.False(t, p.Fragment)
 
 	// outgoing
-	err = newPacket(b, false, p)
+	err = firewall.NewPacket(b, false, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(firewall.ProtoUDP), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.LocalAddr)
@@ -256,14 +256,14 @@ func Test_newPacket_v6(t *testing.T) {
 	assert.False(t, p.Fragment)
 
 	// Too short UDP packet
-	err = newPacket(b[:len(b)-10], false, p) // pull off the last 10 bytes
+	err = firewall.NewPacket(b[:len(b)-10], false, p) // pull off the last 10 bytes
 	require.ErrorIs(t, err, ErrIPv6PacketTooShort)
 
 	// A good TCP packet
 	b[6] = byte(layers.IPProtocolTCP)
 
 	// incoming
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(firewall.ProtoTCP), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
@@ -273,7 +273,7 @@ func Test_newPacket_v6(t *testing.T) {
 	assert.False(t, p.Fragment)
 
 	// outgoing
-	err = newPacket(b, false, p)
+	err = firewall.NewPacket(b, false, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(firewall.ProtoTCP), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.LocalAddr)
@@ -283,7 +283,7 @@ func Test_newPacket_v6(t *testing.T) {
 	assert.False(t, p.Fragment)
 
 	// Too short TCP packet
-	err = newPacket(b[:len(b)-10], false, p) // pull off the last 10 bytes
+	err = firewall.NewPacket(b[:len(b)-10], false, p) // pull off the last 10 bytes
 	require.ErrorIs(t, err, ErrIPv6PacketTooShort)
 
 	// A good UDP packet with an AH header
@@ -318,7 +318,7 @@ func Test_newPacket_v6(t *testing.T) {
 	b = append(b, ahb...)
 	b = append(b, udpHeader...)
 
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.NoError(t, err)
 	assert.Equal(t, uint8(firewall.ProtoUDP), p.Protocol)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
@@ -328,12 +328,12 @@ func Test_newPacket_v6(t *testing.T) {
 	assert.False(t, p.Fragment)
 
 	// Ensure buffer bounds checking during processing
-	err = newPacket(b[:41], true, p)
+	err = firewall.NewPacket(b[:41], true, p)
 	require.ErrorIs(t, err, ErrIPv6PacketTooShort)
 
 	// Invalid AH header
 	b = buffer.Bytes()
-	err = newPacket(b, true, p)
+	err = firewall.NewPacket(b, true, p)
 	require.ErrorIs(t, err, ErrIPv6CouldNotFindPayload)
 }
 
@@ -381,7 +381,7 @@ func Test_newPacket_ipv6Fragment(t *testing.T) {
 	firstFrag = append(firstFrag, []byte{0xde, 0xad, 0xbe, 0xef}...)
 
 	// Test first fragment incoming
-	err = newPacket(firstFrag, true, p)
+	err = firewall.NewPacket(firstFrag, true, p)
 	require.NoError(t, err)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
 	assert.Equal(t, netip.MustParseAddr("ff02::1"), p.LocalAddr)
@@ -391,7 +391,7 @@ func Test_newPacket_ipv6Fragment(t *testing.T) {
 	assert.False(t, p.Fragment)
 
 	// Test first fragment outgoing
-	err = newPacket(firstFrag, false, p)
+	err = firewall.NewPacket(firstFrag, false, p)
 	require.NoError(t, err)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.LocalAddr)
 	assert.Equal(t, netip.MustParseAddr("ff02::1"), p.RemoteAddr)
@@ -420,7 +420,7 @@ func Test_newPacket_ipv6Fragment(t *testing.T) {
 	secondFrag = append(secondFrag, []byte{0xde, 0xad, 0xbe, 0xef}...)
 
 	// Test second fragment incoming
-	err = newPacket(secondFrag, true, p)
+	err = firewall.NewPacket(secondFrag, true, p)
 	require.NoError(t, err)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.RemoteAddr)
 	assert.Equal(t, netip.MustParseAddr("ff02::1"), p.LocalAddr)
@@ -430,7 +430,7 @@ func Test_newPacket_ipv6Fragment(t *testing.T) {
 	assert.True(t, p.Fragment)
 
 	// Test second fragment outgoing
-	err = newPacket(secondFrag, false, p)
+	err = firewall.NewPacket(secondFrag, false, p)
 	require.NoError(t, err)
 	assert.Equal(t, netip.MustParseAddr("ff02::2"), p.LocalAddr)
 	assert.Equal(t, netip.MustParseAddr("ff02::1"), p.RemoteAddr)
@@ -440,7 +440,7 @@ func Test_newPacket_ipv6Fragment(t *testing.T) {
 	assert.True(t, p.Fragment)
 
 	// Too short of a fragment packet
-	err = newPacket(secondFrag[:len(secondFrag)-10], false, p)
+	err = firewall.NewPacket(secondFrag[:len(secondFrag)-10], false, p)
 	require.ErrorIs(t, err, ErrIPv6PacketTooShort)
 }
 

overlay/device.go

@@ -1,17 +1,18 @@
 package overlay
 
 import (
+	"io"
 	"net/netip"
 
 	"github.com/slackhq/nebula/routing"
 )
 
 type Device interface {
-	TunDev
+	io.ReadWriteCloser
 	Activate() error
 	Networks() []netip.Prefix
 	Name() string
 	RoutesFor(netip.Addr) routing.Gateways
 	SupportsMultiqueue() bool
-	NewMultiQueueReader() (TunDev, error)
+	NewMultiQueueReader() (io.ReadWriteCloser, error)
 }

overlay/eventfd/eventfd.go

@@ -1,91 +0,0 @@
-package eventfd
-
-import (
-	"encoding/binary"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-type EventFD struct {
-	fd  int
-	buf [8]byte
-}
-
-func New() (EventFD, error) {
-	fd, err := unix.Eventfd(0, unix.EFD_NONBLOCK)
-	if err != nil {
-		return EventFD{}, err
-	}
-	return EventFD{
-		fd:  fd,
-		buf: [8]byte{},
-	}, nil
-}
-
-func (e *EventFD) Kick() error {
-	binary.LittleEndian.PutUint64(e.buf[:], 1) //is this right???
-	_, err := syscall.Write(int(e.fd), e.buf[:])
-	return err
-}
-
-func (e *EventFD) Close() error {
-	if e.fd != 0 {
-		return unix.Close(e.fd)
-	}
-	return nil
-}
-
-func (e *EventFD) FD() int {
-	return e.fd
-}
-
-type Epoll struct {
-	fd     int
-	buf    [8]byte
-	events []syscall.EpollEvent
-}
-
-func NewEpoll() (Epoll, error) {
-	fd, err := unix.EpollCreate1(0)
-	if err != nil {
-		return Epoll{}, err
-	}
-	return Epoll{
-		fd:     fd,
-		buf:    [8]byte{},
-		events: make([]syscall.EpollEvent, 1),
-	}, nil
-}
-
-func (ep *Epoll) AddEvent(fdToAdd int) error {
-	event := syscall.EpollEvent{
-		Events: syscall.EPOLLIN,
-		Fd:     int32(fdToAdd),
-	}
-	return syscall.EpollCtl(ep.fd, syscall.EPOLL_CTL_ADD, fdToAdd, &event)
-}
-
-func (ep *Epoll) Block() (int, error) {
-	n, err := syscall.EpollWait(ep.fd, ep.events, -1)
-	if err != nil {
-		//goland:noinspection GoDirectComparisonOfErrors
-		if err == syscall.EINTR {
-			return 0, nil //??
-		}
-		return -1, err
-	}
-	return n, nil
-}
-
-func (ep *Epoll) Clear() error {
-	_, err := syscall.Read(int(ep.events[0].Fd), ep.buf[:])
-	return err
-}
-
-func (ep *Epoll) Close() error {
-	if ep.fd != 0 {
-		return unix.Close(ep.fd)
-	}
-	return nil
-}

overlay/packets.go

@@ -1,36 +0,0 @@
-package overlay
-
-//import (
-//	"github.com/slackhq/nebula/util/virtio"
-//)
-
-//type VirtIOPacket struct {
-//	Payload   []byte
-//	Header    virtio.NetHdr
-//	Chains    []uint16
-//	ChainRefs [][]byte
-//}
-//
-//func NewVIO() *VirtIOPacket {
-//	out := new(VirtIOPacket)
-//	out.Payload = nil
-//	out.ChainRefs = make([][]byte, 0, 4)
-//	out.Chains = make([]uint16, 0, 8)
-//	return out
-//}
-//
-//func (v *VirtIOPacket) Reset() {
-//	v.Payload = nil
-//	v.ChainRefs = v.ChainRefs[:0]
-//	v.Chains = v.Chains[:0]
-//}
-
-// TunPacket is formerly VirtIOPacket
-type TunPacket interface {
-	SetPayload([]byte)
-	GetPayload() []byte
-}
-type OutPacket interface {
-	SetPayload([]byte)
-	GetPayload() []byte
-}

overlay/tun.go

@@ -2,29 +2,23 @@ package overlay
 
 import (
 	"fmt"
-	"io"
 	"net"
 	"net/netip"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/packet"
 	"github.com/slackhq/nebula/util"
 )
 
 const DefaultMTU = 1300
 
-type TunDev interface {
+type NameError struct {
-	io.WriteCloser
+	Name       string
-	NewPacketArrays(batchSize int) []TunPacket
+	Underlying error
+}
 
-	ReadMany(x []TunPacket, q int) (int, error)
+func (e *NameError) Error() string {
-	RecycleRxSeg(pkt TunPacket, kick bool, q int) error
+	return fmt.Sprintf("could not set tun device name: %s because %s", e.Name, e.Underlying)
-
-	//todo this interface sux
-	AllocSeg(pkt *packet.OutPacket, q int) (int, error)
-	WriteOne(x *packet.OutPacket, kick bool, q int) (int, error)
-	WriteMany(x []*packet.OutPacket, q int) (int, error)
 }
 
 // TODO: We may be able to remove routines
@@ -33,19 +27,19 @@ type DeviceFactory func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefi
 func NewDeviceFromConfig(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
 	switch {
 	case c.GetBool("tun.disabled", false):
-		t := newDisabledTun(vpnNetworks, c.GetInt("tun.tx_queue", 500), c.GetBool("stats.message_metrics", false), l)
+		tun := newDisabledTun(vpnNetworks, c.GetInt("tun.tx_queue", 500), c.GetBool("stats.message_metrics", false), l)
-		return t, nil
+		return tun, nil
 
 	default:
 		return newTun(c, l, vpnNetworks, routines > 1)
 	}
 }
 
-//func NewFdDeviceFromConfig(fd *int) DeviceFactory {
+func NewFdDeviceFromConfig(fd *int) DeviceFactory {
-//	return func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
+	return func(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, routines int) (Device, error) {
-//		return newTunFromFd(c, l, *fd, vpnNetworks)
+		return newTunFromFd(c, l, *fd, vpnNetworks)
-//	}
+	}
-//}
+}
 
 func getAllRoutesFromConfig(c *config.C, vpnNetworks []netip.Prefix, initial bool) (bool, []Route, error) {
 	if !initial && !c.HasChanged("tun.routes") && !c.HasChanged("tun.unsafe_routes") {

overlay/tun_disabled.go

@@ -8,9 +8,8 @@ import (
 
 	"github.com/rcrowley/go-metrics"
 	"github.com/sirupsen/logrus"
+	"github.com/slackhq/nebula/firewall"
 	"github.com/slackhq/nebula/iputil"
-	"github.com/slackhq/nebula/overlay/virtqueue"
-	"github.com/slackhq/nebula/packet"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -24,14 +23,6 @@ type disabledTun struct {
 	l  *logrus.Logger
 }
 
-func (t *disabledTun) NewPacketArrays(batchSize int) []TunPacket {
-	panic("implement me") //TODO
-}
-
-func (*disabledTun) RecycleRxSeg(pkt TunPacket, kick bool, q int) error {
-	return nil
-}
-
 func newDisabledTun(vpnNetworks []netip.Prefix, queueLen int, metricsEnabled bool, l *logrus.Logger) *disabledTun {
 	tun := &disabledTun{
 		vpnNetworks: vpnNetworks,
@@ -50,10 +41,6 @@ func newDisabledTun(vpnNetworks []netip.Prefix, queueLen int, metricsEnabled boo
 	return tun
 }
 
-func (*disabledTun) GetQueues() []*virtqueue.SplitQueue {
-	return nil
-}
-
 func (*disabledTun) Activate() error {
 	return nil
 }
@@ -101,21 +88,45 @@ func (t *disabledTun) handleICMPEchoRequest(b []byte) bool {
 	default:
 		t.l.Debugf("tun_disabled: dropped ICMP Echo Reply response")
 	}
-
+	if t.l.Level >= logrus.DebugLevel {
+		t.l.WithField("raw", prettyPacket(b)).Debugf("Disabled tun responded to ICMP Echo Request")
+	}
 	return true
 }
 
+func (t *disabledTun) handleOtherPackets(b []byte) error {
+	fp := &firewall.Packet{}
+	err := firewall.NewPacket(b, true, fp)
+	if err != nil {
+		return err
+	}
+	out := make([]byte, len(b)) //todo do something!
+
+	// attempt to write it, but don't block
+	select {
+	case t.read <- out:
+	default:
+		t.l.Debugf("tun_disabled: dropped reply")
+	}
+
+	return err
+}
+
 func (t *disabledTun) Write(b []byte) (int, error) {
 	t.rx.Inc(1)
-
-	// Check for ICMP Echo Request before spending time doing the full parsing
 	if t.handleICMPEchoRequest(b) {
+		return len(b), nil
+	}
+	if err := t.handleOtherPackets(b); err != nil {
 		if t.l.Level >= logrus.DebugLevel {
-			t.l.WithField("raw", prettyPacket(b)).Debugf("Disabled tun responded to ICMP Echo Request")
+			t.l.WithField("raw", prettyPacket(b)).WithError(err).Debugf("Disabled tun failed to respond")
 		}
-	} else if t.l.Level >= logrus.DebugLevel {
+		return len(b), nil
+	}
+	if t.l.Level >= logrus.DebugLevel {
 		t.l.WithField("raw", prettyPacket(b)).Debugf("Disabled tun received unexpected payload")
 	}
+
 	return len(b), nil
 }
 
@@ -123,23 +134,7 @@ func (t *disabledTun) SupportsMultiqueue() bool {
 	return true
 }
 
-func (t *disabledTun) AllocSeg(pkt *packet.OutPacket, q int) (int, error) {
+func (t *disabledTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
-	return 0, fmt.Errorf("tun_disabled: AllocSeg not implemented")
-}
-
-func (t *disabledTun) WriteOne(x *packet.OutPacket, kick bool, q int) (int, error) {
-	return 0, fmt.Errorf("tun_disabled: WriteOne not implemented")
-}
-
-func (t *disabledTun) WriteMany(x []*packet.OutPacket, q int) (int, error) {
-	return 0, fmt.Errorf("tun_disabled: WriteMany not implemented")
-}
-
-func (t *disabledTun) ReadMany(b []TunPacket, _ int) (int, error) {
-	return t.Read(b[0].GetPayload())
-}
-
-func (t *disabledTun) NewMultiQueueReader() (TunDev, error) {
 	return t, nil
 }
 

overlay/tun_freebsd.go

@@ -266,7 +266,7 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 		}
 
 		// Set the device name
-		ioctl(fd, syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
+		_ = ioctl(fd, syscall.SIOCSIFNAME, uintptr(unsafe.Pointer(&ifrr)))
 	}
 
 	t := &tun{

overlay/tun_linux.go

@@ -4,12 +4,13 @@
 package overlay
 
 import (
-	"context"
 	"fmt"
+	"io"
 	"net"
 	"net/netip"
 	"os"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"time"
 	"unsafe"
@@ -17,19 +18,15 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay/vhostnet"
-	"github.com/slackhq/nebula/packet"
 	"github.com/slackhq/nebula/routing"
 	"github.com/slackhq/nebula/util"
-	"github.com/slackhq/nebula/util/virtio"
 	"github.com/vishvananda/netlink"
 	"golang.org/x/sys/unix"
 )
 
 type tun struct {
-	file        *os.File
+	io.ReadWriteCloser
 	fd          int
-	vdev        []*vhostnet.Device
 	Device      string
 	vpnNetworks []netip.Prefix
 	MaxMTU      int
@@ -44,8 +41,12 @@ type tun struct {
 	useSystemRoutes           bool
 	useSystemRoutesBufferSize int
 
-	isV6 bool
+	// These are routes learned from `tun.use_system_route_table`
-	l    *logrus.Logger
+	// stored here to make it easier to restore them after a reload
+	routesFromSystem     map[netip.Prefix]routing.Gateways
+	routesFromSystemLock sync.Mutex
+
+	l *logrus.Logger
 }
 
 func (t *tun) Networks() []netip.Prefix {
@@ -107,67 +108,42 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, multiqueu
 	}
 
 	var req ifReq
-	req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI | unix.IFF_TUN_EXCL | unix.IFF_VNET_HDR | unix.IFF_NAPI)
+	req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI)
 	if multiqueue {
 		req.Flags |= unix.IFF_MULTI_QUEUE
 	}
-	copy(req.Name[:], c.GetString("tun.dev", ""))
+	nameStr := c.GetString("tun.dev", "")
+	copy(req.Name[:], nameStr)
 	if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
-		return nil, err
+		return nil, &NameError{
+			Name:       nameStr,
+			Underlying: err,
+		}
 	}
 	name := strings.Trim(string(req.Name[:]), "\x00")
 
-	if err = unix.SetNonblock(fd, true); err != nil {
-		_ = unix.Close(fd)
-		return nil, fmt.Errorf("make file descriptor non-blocking: %w", err)
-	}
-
 	file := os.NewFile(uintptr(fd), "/dev/net/tun")
-
-	err = unix.IoctlSetPointerInt(fd, unix.TUNSETVNETHDRSZ, virtio.NetHdrSize)
-	if err != nil {
-		return nil, fmt.Errorf("set vnethdr size: %w", err)
-	}
-
-	flags := 0
-	//flags = //unix.TUN_F_CSUM //| unix.TUN_F_TSO4 | unix.TUN_F_USO4 | unix.TUN_F_TSO6 | unix.TUN_F_USO6
-	err = unix.IoctlSetInt(fd, unix.TUNSETOFFLOAD, flags)
-	if err != nil {
-		return nil, fmt.Errorf("set offloads: %w", err)
-	}
-
 	t, err := newTunGeneric(c, l, file, vpnNetworks)
 	if err != nil {
 		return nil, err
 	}
-	t.fd = fd
-	t.Device = name
 
-	vdev, err := vhostnet.NewDevice(
+	t.Device = name
-		vhostnet.WithBackendFD(fd),
-		vhostnet.WithQueueSize(8192), //todo config
-	)
-	if err != nil {
-		return nil, err
-	}
-	t.vdev = []*vhostnet.Device{vdev}
 
 	return t, nil
 }
 
 func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []netip.Prefix) (*tun, error) {
 	t := &tun{
-		file:                      file,
+		ReadWriteCloser:           file,
 		fd:                        int(file.Fd()),
 		vpnNetworks:               vpnNetworks,
 		TXQueueLen:                c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
 		useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0),
+		routesFromSystem:          map[netip.Prefix]routing.Gateways{},
 		l:                         l,
 	}
-	if len(vpnNetworks) != 0 {
-		t.isV6 = vpnNetworks[0].Addr().Is6() //todo what about multi-IP?
-	}
 
 	err := t.reload(c, true)
 	if err != nil {
@@ -184,14 +160,6 @@ func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []n
 	return t, nil
 }
 
-func (t *tun) NewPacketArrays(batchSize int) []TunPacket {
-	inPackets := make([]TunPacket, batchSize)
-	for i := 0; i < batchSize; i++ {
-		inPackets[i] = vhostnet.NewVIO()
-	}
-	return inPackets
-}
-
 func (t *tun) reload(c *config.C, initial bool) error {
 	routeChange, routes, err := getAllRoutesFromConfig(c, t.vpnNetworks, initial)
 	if err != nil {
@@ -207,6 +175,13 @@ func (t *tun) reload(c *config.C, initial bool) error {
 		return err
 	}
 
+	// Bring along any routes learned from the system route table on reload
+	t.routesFromSystemLock.Lock()
+	for dst, gw := range t.routesFromSystem {
+		routeTree.Insert(dst, gw)
+	}
+	t.routesFromSystemLock.Unlock()
+
 	oldDefaultMTU := t.DefaultMTU
 	oldMaxMTU := t.MaxMTU
 	newDefaultMTU := c.GetInt("tun.mtu", DefaultMTU)
@@ -263,7 +238,7 @@ func (t *tun) SupportsMultiqueue() bool {
 	return true
 }
 
-func (t *tun) NewMultiQueueReader() (TunDev, error) {
+func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
 	if err != nil {
 		return nil, err
@@ -276,17 +251,9 @@ func (t *tun) NewMultiQueueReader() (TunDev, error) {
 		return nil, err
 	}
 
-	vdev, err := vhostnet.NewDevice(
+	file := os.NewFile(uintptr(fd), "/dev/net/tun")
-		vhostnet.WithBackendFD(fd),
-		vhostnet.WithQueueSize(8192), //todo config
-	)
-	if err != nil {
-		return nil, err
-	}
 
-	t.vdev = append(t.vdev, vdev)
+	return file, nil
-
-	return t, nil
 }
 
 func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
@@ -294,6 +261,29 @@ func (t *tun) RoutesFor(ip netip.Addr) routing.Gateways {
 	return r
 }
 
+func (t *tun) Write(b []byte) (int, error) {
+	var nn int
+	maximum := len(b)
+
+	for {
+		n, err := unix.Write(t.fd, b[nn:maximum])
+		if n > 0 {
+			nn += n
+		}
+		if nn == len(b) {
+			return nn, err
+		}
+
+		if err != nil {
+			return nn, err
+		}
+
+		if n == 0 {
+			return nn, io.ErrUnexpectedEOF
+		}
+	}
+}
+
 func (t *tun) deviceBytes() (o [16]byte) {
 	for i, c := range t.Device {
 		o[i] = byte(c)
@@ -701,14 +691,18 @@ func (t *tun) updateRoutes(r netlink.RouteUpdate) {
 
 	newTree := t.routeTree.Load().Clone()
 
+	t.routesFromSystemLock.Lock()
 	if r.Type == unix.RTM_NEWROUTE {
 		t.l.WithField("destination", dst).WithField("via", gateways).Info("Adding route")
+		t.routesFromSystem[dst] = gateways
 		newTree.Insert(dst, gateways)
 
 	} else {
 		t.l.WithField("destination", dst).WithField("via", gateways).Info("Removing route")
+		delete(t.routesFromSystem, dst)
 		newTree.Delete(dst)
 	}
+	t.routesFromSystemLock.Unlock()
 	t.routeTree.Store(newTree)
 }
 
@@ -717,100 +711,14 @@ func (t *tun) Close() error {
 		close(t.routeChan)
 	}
 
-	for _, v := range t.vdev {
+	if t.ReadWriteCloser != nil {
-		if v != nil {
+		_ = t.ReadWriteCloser.Close()
-			_ = v.Close()
-		}
-	}
-
-	if t.file != nil {
-		_ = t.file.Close()
 	}
 
 	if t.ioctlFd > 0 {
 		_ = os.NewFile(t.ioctlFd, "ioctlFd").Close()
+		t.ioctlFd = 0
 	}
 
 	return nil
 }
-
-func (t *tun) ReadMany(p []TunPacket, q int) (int, error) {
-	err := t.vdev[q].ReceiveQueue.WaitForUsedElements(context.TODO())
-	if err != nil {
-		return 0, err
-	}
-	i := 0
-	for i = 0; i < len(p); i++ {
-		item, ok := t.vdev[q].ReceiveQueue.TakeSingleNoBlock()
-		if !ok {
-			break
-		}
-		pkt := p[i].(*vhostnet.VirtIOPacket) //todo I'm not happy about this but I don't want to change how memory is "owned" rn
-		_, err = t.vdev[q].ProcessRxChain(pkt, item)
-		if err != nil {
-			return i, err
-		}
-		i++
-	}
-	return i, nil
-}
-
-func (t *tun) Write(b []byte) (int, error) {
-	maximum := len(b) //we are RXing
-
-	//todo garbagey
-	out := packet.NewOut()
-	x, err := t.AllocSeg(out, 0)
-	if err != nil {
-		return 0, err
-	}
-	copy(out.SegmentPayloads[x], b)
-	err = t.vdev[0].TransmitPacket(out, true)
-
-	if err != nil {
-		t.l.WithError(err).Error("Transmitting packet")
-		return 0, err
-	}
-	return maximum, nil
-}
-
-func (t *tun) AllocSeg(pkt *packet.OutPacket, q int) (int, error) {
-	idx, buf, err := t.vdev[q].GetPacketForTx()
-	if err != nil {
-		return 0, err
-	}
-	x := pkt.UseSegment(idx, buf, t.isV6)
-	return x, nil
-}
-
-func (t *tun) WriteOne(x *packet.OutPacket, kick bool, q int) (int, error) {
-	if err := t.vdev[q].TransmitPacket(x, kick); err != nil {
-		t.l.WithError(err).Error("Transmitting packet")
-		return 0, err
-	}
-	return 1, nil
-}
-
-func (t *tun) WriteMany(x []*packet.OutPacket, q int) (int, error) {
-	maximum := len(x) //we are RXing
-	if maximum == 0 {
-		return 0, nil
-	}
-
-	err := t.vdev[q].TransmitPackets(x)
-	if err != nil {
-		t.l.WithError(err).Error("Transmitting packet")
-		return 0, err
-	}
-	return maximum, nil
-}
-
-func (t *tun) RecycleRxSeg(pkt TunPacket, kick bool, q int) error {
-	if pkt.GetPayload() == nil {
-		return nil
-	}
-	vpkt := pkt.(*vhostnet.VirtIOPacket)
-	err := t.vdev[q].ReceiveQueue.OfferDescriptorChains([]uint16{vpkt.Chain}, kick)
-	vpkt.Reset() //intentionally ignoring err!
-	return err
-}

overlay/tun_tester.go

@@ -13,7 +13,6 @@ import (
 	"github.com/gaissmai/bart"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/packet"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -27,7 +26,6 @@ type TestTun struct {
 	closed    atomic.Bool
 	rxPackets chan []byte // Packets to receive into nebula
 	TxPackets chan []byte // Packets transmitted outside by nebula
-	buffers   [][]byte
 }
 
 func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (*TestTun, error) {
@@ -106,68 +104,15 @@ func (t *TestTun) Name() string {
 	return t.Device
 }
 
-func (t *TestTun) ReadMany(x []TunPacket, q int) (int, error) {
+func (t *TestTun) Write(b []byte) (n int, err error) {
-	p, ok := <-t.rxPackets
-	if !ok {
-		return 0, os.ErrClosed
-	}
-	x[0].Payload = p
-	return 1, nil
-}
-
-func (t *TestTun) AllocSeg(pkt *packet.OutPacket, q int) (int, error) {
-	buf := make([]byte, 9000)
-	t.buffers = append(t.buffers, buf)
-	idx := len(t.buffers) - 1
-	isV6 := false //todo?
-	x := pkt.UseSegment(uint16(idx), buf, isV6)
-	return x, nil
-}
-
-func (t *TestTun) Write(b []byte) (int, error) {
-	//todo garbagey
-	out := packet.NewOut()
-	x, err := t.AllocSeg(out, 0)
-	if err != nil {
-		return 0, err
-	}
-	copy(out.SegmentPayloads[x], b)
-	return t.WriteOne(out, true, 0)
-}
-
-func (t *TestTun) WriteOne(x *packet.OutPacket, kick bool, q int) (int, error) {
 	if t.closed.Load() {
 		return 0, io.ErrClosedPipe
 	}
-	if len(x.SegmentIDs) == 0 {
-		return 0, nil
-	}
-	for i, _ := range x.SegmentIDs {
-		t.TxPackets <- x.SegmentPayloads[i]
-	}
-	//todo if kick, delete alloced seg
 
-	return 1, nil
+	packet := make([]byte, len(b), len(b))
-}
+	copy(packet, b)
-
+	t.TxPackets <- packet
-func (t *TestTun) WriteMany(x []*packet.OutPacket, q int) (int, error) {
+	return len(b), nil
-	if len(x) == 0 {
-		return 0, nil
-	}
-
-	for _, pkt := range x {
-		_, err := t.WriteOne(pkt, true, q)
-		if err != nil {
-			return 0, err
-		}
-	}
-
-	return len(x), nil
-}
-
-func (t *TestTun) RecycleRxSeg(pkt *TunPacket, kick bool, q int) error {
-	//todo this ought to maybe track something
-	return nil
 }
 
 func (t *TestTun) Close() error {
@@ -178,10 +123,19 @@ func (t *TestTun) Close() error {
 	return nil
 }
 
+func (t *TestTun) Read(b []byte) (int, error) {
+	p, ok := <-t.rxPackets
+	if !ok {
+		return 0, os.ErrClosed
+	}
+	copy(b, p)
+	return len(p), nil
+}
+
 func (t *TestTun) SupportsMultiqueue() bool {
 	return false
 }
 
-func (t *TestTun) NewMultiQueueReader() (TunDev, error) {
+func (t *TestTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return nil, fmt.Errorf("TODO: multiqueue not implemented")
 }

overlay/tun_windows.go

@@ -74,7 +74,10 @@ func newTun(c *config.C, l *logrus.Logger, vpnNetworks []netip.Prefix, _ bool) (
 		l.WithError(err).Debug("Failed to create wintun device, retrying")
 		tunDevice, err = wintun.CreateTUNWithRequestedGUID(deviceName, guid, t.MTU)
 		if err != nil {
-			return nil, fmt.Errorf("create TUN device failed: %w", err)
+			return nil, &NameError{
+				Name:       deviceName,
+				Underlying: fmt.Errorf("create TUN device failed: %w", err),
+			}
 		}
 	}
 	t.tun = tunDevice.(*wintun.NativeTun)

overlay/user.go

@@ -1,13 +1,11 @@
 package overlay
 
 import (
-	"fmt"
 	"io"
 	"net/netip"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/packet"
 	"github.com/slackhq/nebula/routing"
 )
 
@@ -38,21 +36,6 @@ type UserDevice struct {
 	inboundWriter *io.PipeWriter
 }
 
-func (d *UserDevice) NewPacketArrays(batchSize int) []TunPacket {
-	//inPackets := make([]TunPacket, batchSize)
-	//outPackets := make([]OutPacket, batchSize)
-	panic("not implemented") //todo!
-	//for i := 0; i < batchSize; i++ {
-	//	inPackets[i] = vhostnet.NewVIO()
-	//	outPackets[i] = packet.New(false)
-	//}
-	//return inPackets, outPackets
-}
-
-func (d *UserDevice) RecycleRxSeg(pkt TunPacket, kick bool, q int) error {
-	return nil
-}
-
 func (d *UserDevice) Activate() error {
 	return nil
 }
@@ -67,7 +50,7 @@ func (d *UserDevice) SupportsMultiqueue() bool {
 	return true
 }
 
-func (d *UserDevice) NewMultiQueueReader() (TunDev, error) {
+func (d *UserDevice) NewMultiQueueReader() (io.ReadWriteCloser, error) {
 	return d, nil
 }
 
@@ -86,23 +69,3 @@ func (d *UserDevice) Close() error {
 	d.outboundWriter.Close()
 	return nil
 }
-
-func (d *UserDevice) ReadMany(b []TunPacket, _ int) (int, error) {
-	_, err := d.Read(b[0].GetPayload())
-	if err != nil {
-		return 0, err
-	}
-	return 1, nil
-}
-
-func (d *UserDevice) AllocSeg(pkt *packet.OutPacket, q int) (int, error) {
-	return 0, fmt.Errorf("user: AllocSeg not implemented")
-}
-
-func (d *UserDevice) WriteOne(x *packet.OutPacket, kick bool, q int) (int, error) {
-	return 0, fmt.Errorf("user: WriteOne not implemented")
-}
-
-func (d *UserDevice) WriteMany(x []*packet.OutPacket, q int) (int, error) {
-	return 0, fmt.Errorf("user: WriteMany not implemented")
-}

overlay/vhost/README.md

@@ -1,23 +0,0 @@
-Significant portions of this code are derived from https://pkg.go.dev/github.com/hetznercloud/virtio-go
-
-MIT License
-
-Copyright (c) 2025 Hetzner Cloud GmbH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

overlay/vhost/doc.go

@@ -1,4 +0,0 @@
-// Package vhost implements the basic ioctl requests needed to interact with the
-// kernel-level virtio server that provides accelerated virtio devices for
-// networking and more.
-package vhost

overlay/vhost/ioctl.go

@@ -1,218 +0,0 @@
-package vhost
-
-import (
-	"fmt"
-	"unsafe"
-
-	"github.com/slackhq/nebula/overlay/virtqueue"
-	"github.com/slackhq/nebula/util/virtio"
-	"golang.org/x/sys/unix"
-)
-
-const (
-	// vhostIoctlGetFeatures can be used to retrieve the features supported by
-	// the vhost implementation in the kernel.
-	//
-	// Response payload: [virtio.Feature]
-	// Kernel name: VHOST_GET_FEATURES
-	vhostIoctlGetFeatures = 0x8008af00
-
-	// vhostIoctlSetFeatures can be used to communicate the features supported
-	// by this virtio implementation to the kernel.
-	//
-	// Request payload: [virtio.Feature]
-	// Kernel name: VHOST_SET_FEATURES
-	vhostIoctlSetFeatures = 0x4008af00
-
-	// vhostIoctlSetOwner can be used to set the current process as the
-	// exclusive owner of a control file descriptor.
-	//
-	// Request payload: none
-	// Kernel name: VHOST_SET_OWNER
-	vhostIoctlSetOwner = 0x0000af01
-
-	// vhostIoctlSetMemoryLayout can be used to set up or modify the memory
-	// layout which describes the IOTLB mappings in the kernel.
-	//
-	// Request payload: [MemoryLayout] with custom serialization
-	// Kernel name: VHOST_SET_MEM_TABLE
-	vhostIoctlSetMemoryLayout = 0x4008af03
-
-	// vhostIoctlSetQueueSize can be used to set the size of the virtqueue.
-	//
-	// Request payload: [QueueState]
-	// Kernel name: VHOST_SET_VRING_NUM
-	vhostIoctlSetQueueSize = 0x4008af10
-
-	// vhostIoctlSetQueueAddress can be used to set the addresses of the
-	// different parts of the virtqueue.
-	//
-	// Request payload: [QueueAddresses]
-	// Kernel name: VHOST_SET_VRING_ADDR
-	vhostIoctlSetQueueAddress = 0x4028af11
-
-	// vhostIoctlSetAvailableRingBase can be used to set the index of the next
-	// available ring entry the device will process.
-	//
-	// Request payload: [QueueState]
-	// Kernel name: VHOST_SET_VRING_BASE
-	vhostIoctlSetAvailableRingBase = 0x4008af12
-
-	// vhostIoctlSetQueueKickEventFD can be used to set the event file
-	// descriptor to signal the device when descriptor chains were added to the
-	// available ring.
-	//
-	// Request payload: [QueueFile]
-	// Kernel name: VHOST_SET_VRING_KICK
-	vhostIoctlSetQueueKickEventFD = 0x4008af20
-
-	// vhostIoctlSetQueueCallEventFD can be used to set the event file
-	// descriptor that gets signaled by the device when descriptor chains have
-	// been used by it.
-	//
-	// Request payload: [QueueFile]
-	// Kernel name: VHOST_SET_VRING_CALL
-	vhostIoctlSetQueueCallEventFD = 0x4008af21
-)
-
-// QueueState is an ioctl request payload that can hold a queue index and any
-// 32-bit number.
-//
-// Kernel name: vhost_vring_state
-type QueueState struct {
-	// QueueIndex is the index of the virtqueue.
-	QueueIndex uint32
-	// Num is any 32-bit number, depending on the request.
-	Num uint32
-}
-
-// QueueAddresses is an ioctl request payload that can hold the addresses of the
-// different parts of a virtqueue.
-//
-// Kernel name: vhost_vring_addr
-type QueueAddresses struct {
-	// QueueIndex is the index of the virtqueue.
-	QueueIndex uint32
-	// Flags that are not used in this implementation.
-	Flags uint32
-	// DescriptorTableAddress is the address of the descriptor table in user
-	// space memory. It must be 16-byte aligned.
-	DescriptorTableAddress uintptr
-	// UsedRingAddress is the address of the used ring in user space memory. It
-	// must be 4-byte aligned.
-	UsedRingAddress uintptr
-	// AvailableRingAddress is the address of the available ring in user space
-	// memory. It must be 2-byte aligned.
-	AvailableRingAddress uintptr
-	// LogAddress is used for an optional logging support, not supported by this
-	// implementation.
-	LogAddress uintptr
-}
-
-// QueueFile is an ioctl request payload that can hold a queue index and a file
-// descriptor.
-//
-// Kernel name: vhost_vring_file
-type QueueFile struct {
-	// QueueIndex is the index of the virtqueue.
-	QueueIndex uint32
-	// FD is the file descriptor of the file. Pass -1 to unbind from a file.
-	FD int32
-}
-
-// IoctlPtr is a copy of the similarly named unexported function from the Go
-// unix package. This is needed to do custom ioctl requests not supported by the
-// standard library.
-func IoctlPtr(fd int, req uint, arg unsafe.Pointer) error {
-	_, _, err := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
-	if err != 0 {
-		return fmt.Errorf("ioctl request %d: %w", req, err)
-	}
-	return nil
-}
-
-// GetFeatures requests the supported feature bits from the virtio device
-// associated with the given control file descriptor.
-func GetFeatures(controlFD int) (virtio.Feature, error) {
-	var features virtio.Feature
-	if err := IoctlPtr(controlFD, vhostIoctlGetFeatures, unsafe.Pointer(&features)); err != nil {
-		return 0, fmt.Errorf("get features: %w", err)
-	}
-	return features, nil
-}
-
-// SetFeatures communicates the feature bits supported by this implementation
-// to the virtio device associated with the given control file descriptor.
-func SetFeatures(controlFD int, features virtio.Feature) error {
-	if err := IoctlPtr(controlFD, vhostIoctlSetFeatures, unsafe.Pointer(&features)); err != nil {
-		return fmt.Errorf("set features: %w", err)
-	}
-	return nil
-}
-
-// OwnControlFD sets the current process as the exclusive owner for the
-// given control file descriptor. This must be called before interacting with
-// the control file descriptor in any other way.
-func OwnControlFD(controlFD int) error {
-	if err := IoctlPtr(controlFD, vhostIoctlSetOwner, unsafe.Pointer(nil)); err != nil {
-		return fmt.Errorf("set control file descriptor owner: %w", err)
-	}
-	return nil
-}
-
-// SetMemoryLayout sets up or modifies the memory layout for the kernel-level
-// virtio device associated with the given control file descriptor.
-func SetMemoryLayout(controlFD int, layout MemoryLayout) error {
-	payload := layout.serializePayload()
-	if err := IoctlPtr(controlFD, vhostIoctlSetMemoryLayout, unsafe.Pointer(&payload[0])); err != nil {
-		return fmt.Errorf("set memory layout: %w", err)
-	}
-	return nil
-}
-
-// RegisterQueue registers a virtio queue with the kernel-level virtio server.
-// The virtqueue will be linked to the given control file descriptor and will
-// have the given index. The kernel will use this queue until the control file
-// descriptor is closed.
-func RegisterQueue(controlFD int, queueIndex uint32, queue *virtqueue.SplitQueue) error {
-	if err := IoctlPtr(controlFD, vhostIoctlSetQueueSize, unsafe.Pointer(&QueueState{
-		QueueIndex: queueIndex,
-		Num:        uint32(queue.Size()),
-	})); err != nil {
-		return fmt.Errorf("set queue size: %w", err)
-	}
-
-	if err := IoctlPtr(controlFD, vhostIoctlSetQueueAddress, unsafe.Pointer(&QueueAddresses{
-		QueueIndex:             queueIndex,
-		Flags:                  0,
-		DescriptorTableAddress: queue.DescriptorTable().Address(),
-		UsedRingAddress:        queue.UsedRing().Address(),
-		AvailableRingAddress:   queue.AvailableRing().Address(),
-		LogAddress:             0,
-	})); err != nil {
-		return fmt.Errorf("set queue addresses: %w", err)
-	}
-
-	if err := IoctlPtr(controlFD, vhostIoctlSetAvailableRingBase, unsafe.Pointer(&QueueState{
-		QueueIndex: queueIndex,
-		Num:        0,
-	})); err != nil {
-		return fmt.Errorf("set available ring base: %w", err)
-	}
-
-	if err := IoctlPtr(controlFD, vhostIoctlSetQueueKickEventFD, unsafe.Pointer(&QueueFile{
-		QueueIndex: queueIndex,
-		FD:         int32(queue.KickEventFD()),
-	})); err != nil {
-		return fmt.Errorf("set kick event file descriptor: %w", err)
-	}
-
-	if err := IoctlPtr(controlFD, vhostIoctlSetQueueCallEventFD, unsafe.Pointer(&QueueFile{
-		QueueIndex: queueIndex,
-		FD:         int32(queue.CallEventFD()),
-	})); err != nil {
-		return fmt.Errorf("set call event file descriptor: %w", err)
-	}
-
-	return nil
-}

overlay/vhost/ioctl_test.go

@@ -1,21 +0,0 @@
-package vhost_test
-
-import (
-	"testing"
-	"unsafe"
-
-	"github.com/slackhq/nebula/overlay/vhost"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestQueueState_Size(t *testing.T) {
-	assert.EqualValues(t, 8, unsafe.Sizeof(vhost.QueueState{}))
-}
-
-func TestQueueAddresses_Size(t *testing.T) {
-	assert.EqualValues(t, 40, unsafe.Sizeof(vhost.QueueAddresses{}))
-}
-
-func TestQueueFile_Size(t *testing.T) {
-	assert.EqualValues(t, 8, unsafe.Sizeof(vhost.QueueFile{}))
-}

overlay/vhost/memory.go

@@ -1,73 +0,0 @@
-package vhost
-
-import (
-	"encoding/binary"
-	"fmt"
-	"unsafe"
-
-	"github.com/slackhq/nebula/overlay/virtqueue"
-)
-
-// MemoryRegion describes a region of userspace memory which is being made
-// accessible to a vhost device.
-//
-// Kernel name: vhost_memory_region
-type MemoryRegion struct {
-	// GuestPhysicalAddress is the physical address of the memory region within
-	// the guest, when virtualization is used. When no virtualization is used,
-	// this should be the same as UserspaceAddress.
-	GuestPhysicalAddress uintptr
-	// Size is the size of the memory region.
-	Size uint64
-	// UserspaceAddress is the virtual address in the userspace of the host
-	// where the memory region can be found.
-	UserspaceAddress uintptr
-	// Padding and room for flags. Currently unused.
-	_ uint64
-}
-
-// MemoryLayout is a list of [MemoryRegion]s.
-type MemoryLayout []MemoryRegion
-
-// NewMemoryLayoutForQueues returns a new [MemoryLayout] that describes the
-// memory pages used by the descriptor tables of the given queues.
-func NewMemoryLayoutForQueues(queues []*virtqueue.SplitQueue) MemoryLayout {
-	regions := make([]MemoryRegion, 0)
-	for _, queue := range queues {
-		for address, size := range queue.DescriptorTable().BufferAddresses() {
-			regions = append(regions, MemoryRegion{
-				// There is no virtualization in play here, so the guest address
-				// is the same as in the host's userspace.
-				GuestPhysicalAddress: address,
-				Size:                 uint64(size),
-				UserspaceAddress:     address,
-			})
-		}
-	}
-	return regions
-}
-
-// serializePayload serializes the list of memory regions into a format that is
-// compatible to the vhost_memory kernel struct. The returned byte slice can be
-// used as a payload for the vhostIoctlSetMemoryLayout ioctl.
-func (regions MemoryLayout) serializePayload() []byte {
-	regionCount := len(regions)
-	regionSize := int(unsafe.Sizeof(MemoryRegion{}))
-	payload := make([]byte, 8+regionCount*regionSize)
-
-	// The first 32 bits contain the number of memory regions. The following 32
-	// bits are padding.
-	binary.LittleEndian.PutUint32(payload[0:4], uint32(regionCount))
-
-	if regionCount > 0 {
-		// The underlying byte array of the slice should already have the correct
-		// format, so just copy that.
-		copied := copy(payload[8:], unsafe.Slice((*byte)(unsafe.Pointer(&regions[0])), regionCount*regionSize))
-		if copied != regionCount*regionSize {
-			panic(fmt.Sprintf("copied only %d bytes of the memory regions, but expected %d",
-				copied, regionCount*regionSize))
-		}
-	}
-
-	return payload
-}

overlay/vhost/memory_internal_test.go

@@ -1,42 +0,0 @@
-package vhost
-
-import (
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestMemoryRegion_Size(t *testing.T) {
-	assert.EqualValues(t, 32, unsafe.Sizeof(MemoryRegion{}))
-}
-
-func TestMemoryLayout_SerializePayload(t *testing.T) {
-	layout := MemoryLayout([]MemoryRegion{
-		{
-			GuestPhysicalAddress: 42,
-			Size:                 100,
-			UserspaceAddress:     142,
-		}, {
-			GuestPhysicalAddress: 99,
-			Size:                 100,
-			UserspaceAddress:     99,
-		},
-	})
-	payload := layout.serializePayload()
-
-	assert.Equal(t, []byte{
-		0x02, 0x00, 0x00, 0x00, // nregions
-		0x00, 0x00, 0x00, 0x00, // padding
-		// region 0
-		0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // guest_phys_addr
-		0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // memory_size
-		0x8e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // userspace_addr
-		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // flags_padding
-		// region 1
-		0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // guest_phys_addr
-		0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // memory_size
-		0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // userspace_addr
-		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // flags_padding
-	}, payload)
-}

overlay/vhostnet/README.md

@@ -1,23 +0,0 @@
-Significant portions of this code are derived from https://pkg.go.dev/github.com/hetznercloud/virtio-go
-
-MIT License
-
-Copyright (c) 2025 Hetzner Cloud GmbH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

overlay/vhostnet/device.go

@@ -1,339 +0,0 @@
-package vhostnet
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"runtime"
-
-	"github.com/slackhq/nebula/overlay/vhost"
-	"github.com/slackhq/nebula/overlay/virtqueue"
-	"github.com/slackhq/nebula/packet"
-	"github.com/slackhq/nebula/util/virtio"
-	"golang.org/x/sys/unix"
-)
-
-// ErrDeviceClosed is returned when the [Device] is closed while operations are
-// still running.
-var ErrDeviceClosed = errors.New("device was closed")
-
-// The indexes for the receive and transmit queues.
-const (
-	receiveQueueIndex  = 0
-	transmitQueueIndex = 1
-)
-
-// Device represents a vhost networking device within the kernel-level virtio
-// implementation and provides methods to interact with it.
-type Device struct {
-	controlFD int
-
-	ReceiveQueue  *virtqueue.SplitQueue
-	TransmitQueue *virtqueue.SplitQueue
-}
-
-// NewDevice initializes a new vhost networking device within the
-// kernel-level virtio implementation, sets up the virtqueues and returns a
-// [Device] instance that can be used to communicate with that vhost device.
-//
-// There are multiple options that can be passed to this constructor to
-// influence device creation:
-//   - [WithQueueSize]
-//   - [WithBackendFD]
-//   - [WithBackendDevice]
-//
-// Remember to call [Device.Close] after use to free up resources.
-func NewDevice(options ...Option) (*Device, error) {
-	var err error
-	opts := optionDefaults
-	opts.apply(options)
-	if err = opts.validate(); err != nil {
-		return nil, fmt.Errorf("invalid options: %w", err)
-	}
-
-	dev := Device{
-		controlFD: -1,
-	}
-
-	// Clean up a partially initialized device when something fails.
-	defer func() {
-		if err != nil {
-			_ = dev.Close()
-		}
-	}()
-
-	// Retrieve a new control file descriptor. This will be used to configure
-	// the vhost networking device in the kernel.
-	dev.controlFD, err = unix.Open("/dev/vhost-net", os.O_RDWR, 0666)
-	if err != nil {
-		return nil, fmt.Errorf("get control file descriptor: %w", err)
-	}
-	if err = vhost.OwnControlFD(dev.controlFD); err != nil {
-		return nil, fmt.Errorf("own control file descriptor: %w", err)
-	}
-
-	// Advertise the supported features. This isn't much for now.
-	// TODO: Add feature options and implement proper feature negotiation.
-	getFeatures, err := vhost.GetFeatures(dev.controlFD) //0x1033D008000 but why
-	if err != nil {
-		return nil, fmt.Errorf("get features: %w", err)
-	}
-	if getFeatures == 0 {
-
-	}
-	//const funky = virtio.Feature(1 << 27)
-	//features := virtio.FeatureVersion1 | funky // | todo virtio.FeatureNetMergeRXBuffers
-	features := virtio.FeatureVersion1 | virtio.FeatureNetMergeRXBuffers
-	if err = vhost.SetFeatures(dev.controlFD, features); err != nil {
-		return nil, fmt.Errorf("set features: %w", err)
-	}
-
-	itemSize := os.Getpagesize() * 4 //todo config
-
-	// Initialize and register the queues needed for the networking device.
-	if dev.ReceiveQueue, err = createQueue(dev.controlFD, receiveQueueIndex, opts.queueSize, itemSize); err != nil {
-		return nil, fmt.Errorf("create receive queue: %w", err)
-	}
-	if dev.TransmitQueue, err = createQueue(dev.controlFD, transmitQueueIndex, opts.queueSize, itemSize); err != nil {
-		return nil, fmt.Errorf("create transmit queue: %w", err)
-	}
-
-	// Set up memory mappings for all buffers used by the queues. This has to
-	// happen before a backend for the queues can be registered.
-	memoryLayout := vhost.NewMemoryLayoutForQueues(
-		[]*virtqueue.SplitQueue{dev.ReceiveQueue, dev.TransmitQueue},
-	)
-	if err = vhost.SetMemoryLayout(dev.controlFD, memoryLayout); err != nil {
-		return nil, fmt.Errorf("setup memory layout: %w", err)
-	}
-
-	// Set the queue backends. This activates the queues within the kernel.
-	if err = SetQueueBackend(dev.controlFD, receiveQueueIndex, opts.backendFD); err != nil {
-		return nil, fmt.Errorf("set receive queue backend: %w", err)
-	}
-	if err = SetQueueBackend(dev.controlFD, transmitQueueIndex, opts.backendFD); err != nil {
-		return nil, fmt.Errorf("set transmit queue backend: %w", err)
-	}
-
-	// Fully populate the rx queue with available buffers which the device
-	// can write new packets into.
-	if err = dev.refillReceiveQueue(); err != nil {
-		return nil, fmt.Errorf("refill receive queue: %w", err)
-	}
-	if err = dev.prefillTxQueue(); err != nil {
-		return nil, fmt.Errorf("prefill tx queue: %w", err)
-	}
-
-	// Make sure to clean up even when the device gets garbage collected without
-	// Close being called first.
-	devPtr := &dev
-	runtime.SetFinalizer(devPtr, (*Device).Close)
-
-	return devPtr, nil
-}
-
-// refillReceiveQueue offers as many new device-writable buffers to the device
-// as the queue can fit. The device will then use these to write received
-// packets.
-func (dev *Device) refillReceiveQueue() error {
-	for {
-		_, err := dev.ReceiveQueue.OfferInDescriptorChains()
-		if err != nil {
-			if errors.Is(err, virtqueue.ErrNotEnoughFreeDescriptors) {
-				// Queue is full, job is done.
-				return nil
-			}
-			return fmt.Errorf("offer descriptor chain: %w", err)
-		}
-	}
-}
-
-func (dev *Device) prefillTxQueue() error {
-	for {
-		dt := dev.TransmitQueue.DescriptorTable()
-		for {
-			x, _, err := dt.CreateDescriptorForOutputs()
-			if err != nil {
-				if errors.Is(err, virtqueue.ErrNotEnoughFreeDescriptors) {
-					// Queue is full, job is done.
-					return nil
-				}
-				return err
-			}
-			err = dev.TransmitQueue.OfferDescriptorChains([]uint16{x}, false)
-			if err != nil {
-				return err
-			}
-		}
-
-	}
-}
-
-// Close cleans up the vhost networking device within the kernel and releases
-// all resources used for it.
-// The implementation will try to release as many resources as possible and
-// collect potential errors before returning them.
-func (dev *Device) Close() error {
-	// Closing the control file descriptor will unregister all queues from the
-	// kernel.
-	if dev.controlFD >= 0 {
-		if err := unix.Close(dev.controlFD); err != nil {
-			// Return an error and do not continue, because the memory used for
-			// the queues should not be released before they were unregistered
-			// from the kernel.
-			return fmt.Errorf("close control file descriptor: %w", err)
-		}
-		dev.controlFD = -1
-	}
-
-	var errs []error
-
-	if dev.ReceiveQueue != nil {
-		if err := dev.ReceiveQueue.Close(); err == nil {
-			dev.ReceiveQueue = nil
-		} else {
-			errs = append(errs, fmt.Errorf("close receive queue: %w", err))
-		}
-	}
-
-	if dev.TransmitQueue != nil {
-		if err := dev.TransmitQueue.Close(); err == nil {
-			dev.TransmitQueue = nil
-		} else {
-			errs = append(errs, fmt.Errorf("close transmit queue: %w", err))
-		}
-	}
-
-	if len(errs) == 0 {
-		// Everything was cleaned up. No need to run the finalizer anymore.
-		runtime.SetFinalizer(dev, nil)
-	}
-
-	return errors.Join(errs...)
-}
-
-// createQueue creates a new virtqueue and registers it with the vhost device
-// using the given index.
-func createQueue(controlFD int, queueIndex int, queueSize int, itemSize int) (*virtqueue.SplitQueue, error) {
-	queue, err := virtqueue.NewSplitQueue(queueSize, itemSize)
-	if err != nil {
-		return nil, fmt.Errorf("create virtqueue: %w", err)
-	}
-	if err = vhost.RegisterQueue(controlFD, uint32(queueIndex), queue); err != nil {
-		return nil, fmt.Errorf("register virtqueue with index %d: %w", queueIndex, err)
-	}
-	return queue, nil
-}
-
-func (dev *Device) GetPacketForTx() (uint16, []byte, error) {
-	idx, err := dev.TransmitQueue.TakeSingleIndex(context.TODO())
-	if err != nil {
-		return 0, nil, fmt.Errorf("transmit queue: %w", err)
-	}
-	buf := dev.TransmitQueue.GetDescriptorItem(idx)
-	return idx, buf, nil
-}
-
-func (dev *Device) TransmitPacket(pkt *packet.OutPacket, kick bool) error {
-	if len(pkt.SegmentIDs) == 0 {
-		return nil
-	}
-	for idx := range pkt.SegmentIDs {
-		segmentID := pkt.SegmentIDs[idx]
-		dev.TransmitQueue.SetDescSize(segmentID, len(pkt.Segments[idx]))
-	}
-	err := dev.TransmitQueue.OfferDescriptorChains(pkt.SegmentIDs, false)
-	if err != nil {
-		return fmt.Errorf("offer descriptor chains: %w", err)
-	}
-	pkt.Reset()
-	if kick {
-		return dev.TransmitQueue.Kick()
-	}
-
-	return nil
-}
-
-func (dev *Device) TransmitPackets(pkts []*packet.OutPacket) error {
-	if len(pkts) == 0 {
-		return nil
-	}
-
-	for i := range pkts {
-		if err := dev.TransmitPacket(pkts[i], false); err != nil {
-			return err
-		}
-	}
-	if err := dev.TransmitQueue.Kick(); err != nil {
-		return err
-	}
-	return nil
-}
-
-// ProcessRxChain processes a single chain to create one packet. The number of processed chains is returned.
-func (dev *Device) ProcessRxChain(pkt *VirtIOPacket, chain virtqueue.UsedElement) (int, error) {
-	//read first element to see how many descriptors we need:
-	pkt.Chain = uint16(chain.DescriptorIndex)
-	buf := dev.ReceiveQueue.GetDescriptorItem(pkt.Chain)
-
-	// The specification requires that the first descriptor chain starts
-	// with a virtio-net header. It is not clear, whether it is also
-	// required to be fully contained in the first buffer of that
-	// descriptor chain, but it is reasonable to assume that this is
-	// always the case.
-	// The decode method already does the buffer length check.
-
-	//HACK: we only want the last bit of the header, the NumBuffers field. So, let's grab just that:
-	//numBuffers := binary.BigEndian.Uint16(buf[virtio.NetHdrSize-3:])
-	//even bigger hack: apparently this is hitting some kind of memory access pitfall? Let's only grab the last byte:
-	//numBuffers := buf[virtio.NetHdrSize-2]
-
-	//if err = pkt.header.Decode(buf); err != nil {
-	//	// The device misbehaved. There is no way we can gracefully
-	//	// recover from this, because we don't know how many of the
-	//	// following descriptor chains belong to this packet.
-	//	return 0, fmt.Errorf("decode vnethdr: %w", err)
-	//}
-
-	//we have the header now: what do we need to do?
-	//todo we're ignoring the header lol
-	//if int(numBuffers) != 1 {
-	//	return 0, fmt.Errorf("too smol-brain to handle more than one buffer per Chain item right now: %d chains, %d bufs", 1, int(numBuffers))
-	//}
-
-	if chain.Length > 16000 {
-		//todo!
-		pkt.payload = nil
-		return 1, fmt.Errorf("too big packet length: %d", chain.Length)
-	}
-
-	//shift the buffer out of out:
-	pkt.payload = buf[virtio.NetHdrSize:chain.Length]
-	return 1, nil
-}
-
-type VirtIOPacket struct {
-	payload []byte
-	//header  virtio.NetHdr
-	Chain uint16
-}
-
-func NewVIO() *VirtIOPacket {
-	out := new(VirtIOPacket)
-	out.payload = nil
-	out.Chain = 0
-	return out
-}
-
-func (v *VirtIOPacket) Reset() {
-	v.payload = nil
-	v.Chain = 0
-}
-
-func (v *VirtIOPacket) GetPayload() []byte {
-	return v.payload //todo this could be dev.ReceiveQueue.GetDescriptorItem(idx)
-}
-func (v *VirtIOPacket) SetPayload(x []byte) {
-	v.payload = x
-}

overlay/vhostnet/doc.go

@@ -1,3 +0,0 @@
-// Package vhostnet implements methods to initialize vhost networking devices
-// within the kernel-level virtio implementation and communicate with them.
-package vhostnet

overlay/vhostnet/ioctl.go

@@ -1,31 +0,0 @@
-package vhostnet
-
-import (
-	"fmt"
-	"unsafe"
-
-	"github.com/slackhq/nebula/overlay/vhost"
-)
-
-const (
-	// vhostNetIoctlSetBackend can be used to attach a virtqueue to a RAW socket
-	// or TAP device.
-	//
-	// Request payload: [vhost.QueueFile]
-	// Kernel name: VHOST_NET_SET_BACKEND
-	vhostNetIoctlSetBackend = 0x4008af30
-)
-
-// SetQueueBackend attaches a virtqueue of the vhost networking device
-// described by controlFD to the given backend file descriptor.
-// The backend file descriptor can either be a RAW socket or a TAP device. When
-// it is -1, the queue will be detached.
-func SetQueueBackend(controlFD int, queueIndex uint32, backendFD int) error {
-	if err := vhost.IoctlPtr(controlFD, vhostNetIoctlSetBackend, unsafe.Pointer(&vhost.QueueFile{
-		QueueIndex: queueIndex,
-		FD:         int32(backendFD),
-	})); err != nil {
-		return fmt.Errorf("set queue backend file descriptor: %w", err)
-	}
-	return nil
-}

overlay/vhostnet/options.go

@@ -1,69 +0,0 @@
-package vhostnet
-
-import (
-	"errors"
-
-	"github.com/slackhq/nebula/overlay/virtqueue"
-)
-
-type optionValues struct {
-	queueSize int
-	backendFD int
-}
-
-func (o *optionValues) apply(options []Option) {
-	for _, option := range options {
-		option(o)
-	}
-}
-
-func (o *optionValues) validate() error {
-	if o.queueSize == -1 {
-		return errors.New("queue size is required")
-	}
-	if err := virtqueue.CheckQueueSize(o.queueSize); err != nil {
-		return err
-	}
-	if o.backendFD == -1 {
-		return errors.New("backend file descriptor is required")
-	}
-	return nil
-}
-
-var optionDefaults = optionValues{
-	// Required.
-	queueSize: -1,
-	// Required.
-	backendFD: -1,
-}
-
-// Option can be passed to [NewDevice] to influence device creation.
-type Option func(*optionValues)
-
-// WithQueueSize returns an [Option] that sets the size of the TX and RX queues
-// that are to be created for the device. It specifies the number of
-// entries/buffers each queue can hold. This also affects the memory
-// consumption.
-// This is required and must be an integer from 1 to 32768 that is also a power
-// of 2.
-func WithQueueSize(queueSize int) Option {
-	return func(o *optionValues) { o.queueSize = queueSize }
-}
-
-// WithBackendFD returns an [Option] that sets the file descriptor of the
-// backend that will be used for the queues of the device. The device will write
-// and read packets to/from that backend. The file descriptor can either be of a
-// RAW socket or TUN/TAP device.
-// Either this or [WithBackendDevice] is required.
-func WithBackendFD(backendFD int) Option {
-	return func(o *optionValues) { o.backendFD = backendFD }
-}
-
-//// WithBackendDevice returns an [Option] that sets the given TAP device as the
-//// backend that will be used for the queues of the device. The device will
-//// write and read packets to/from that backend. The TAP device should have been
-//// created with the [tuntap.WithVirtioNetHdr] option enabled.
-//// Either this or [WithBackendFD] is required.
-//func WithBackendDevice(dev *tuntap.Device) Option {
-//	return func(o *optionValues) { o.backendFD = int(dev.File().Fd()) }
-//}

overlay/virtqueue/README.md

@@ -1,23 +0,0 @@
-Significant portions of this code are derived from https://pkg.go.dev/github.com/hetznercloud/virtio-go
-
-MIT License
-
-Copyright (c) 2025 Hetzner Cloud GmbH
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

overlay/virtqueue/available_ring.go

@@ -1,140 +0,0 @@
-package virtqueue
-
-import (
-	"fmt"
-	"unsafe"
-)
-
-// availableRingFlag is a flag that describes an [AvailableRing].
-type availableRingFlag uint16
-
-const (
-	// availableRingFlagNoInterrupt is used by the guest to advise the host to
-	// not interrupt it when consuming a buffer. It's unreliable, so it's simply
-	// an optimization.
-	availableRingFlagNoInterrupt availableRingFlag = 1 << iota
-)
-
-// availableRingSize is the number of bytes needed to store an [AvailableRing]
-// with the given queue size in memory.
-func availableRingSize(queueSize int) int {
-	return 6 + 2*queueSize
-}
-
-// availableRingAlignment is the minimum alignment of an [AvailableRing]
-// in memory, as required by the virtio spec.
-const availableRingAlignment = 2
-
-// AvailableRing is used by the driver to offer descriptor chains to the device.
-// Each ring entry refers to the head of a descriptor chain. It is only written
-// to by the driver and read by the device.
-//
-// Because the size of the ring depends on the queue size, we cannot define a
-// Go struct with a static size that maps to the memory of the ring. Instead,
-// this struct only contains pointers to the corresponding memory areas.
-type AvailableRing struct {
-	initialized bool
-
-	// flags that describe this ring.
-	flags *availableRingFlag
-	// ringIndex indicates where the driver would put the next entry into the
-	// ring (modulo the queue size).
-	ringIndex *uint16
-	// ring references buffers using the index of the head of the descriptor
-	// chain in the [DescriptorTable]. It wraps around at queue size.
-	ring []uint16
-	// usedEvent is not used by this implementation, but we reserve it anyway to
-	// avoid issues in case a device may try to access it, contrary to the
-	// virtio specification.
-	usedEvent *uint16
-}
-
-// newAvailableRing creates an available ring that uses the given underlying
-// memory. The length of the memory slice must match the size needed for the
-// ring (see [availableRingSize]) for the given queue size.
-func newAvailableRing(queueSize int, mem []byte) *AvailableRing {
-	ringSize := availableRingSize(queueSize)
-	if len(mem) != ringSize {
-		panic(fmt.Sprintf("memory size (%v) does not match required size "+
-			"for available ring: %v", len(mem), ringSize))
-	}
-
-	return &AvailableRing{
-		initialized: true,
-		flags:       (*availableRingFlag)(unsafe.Pointer(&mem[0])),
-		ringIndex:   (*uint16)(unsafe.Pointer(&mem[2])),
-		ring:        unsafe.Slice((*uint16)(unsafe.Pointer(&mem[4])), queueSize),
-		usedEvent:   (*uint16)(unsafe.Pointer(&mem[ringSize-2])),
-	}
-}
-
-// Address returns the pointer to the beginning of the ring in memory.
-// Do not modify the memory directly to not interfere with this implementation.
-func (r *AvailableRing) Address() uintptr {
-	if !r.initialized {
-		panic("available ring is not initialized")
-	}
-	return uintptr(unsafe.Pointer(r.flags))
-}
-
-// offer adds the given descriptor chain heads to the available ring and
-// advances the ring index accordingly to make the device process the new
-// descriptor chains.
-func (r *AvailableRing) offerElements(chains []UsedElement) {
-	//always called under lock
-	//r.mu.Lock()
-	//defer r.mu.Unlock()
-
-	// Add descriptor chain heads to the ring.
-	for offset, x := range chains {
-		// The 16-bit ring index may overflow. This is expected and is not an
-		// issue because the size of the ring array (which equals the queue
-		// size) is always a power of 2 and smaller than the highest possible
-		// 16-bit value.
-		insertIndex := int(*r.ringIndex+uint16(offset)) % len(r.ring)
-		r.ring[insertIndex] = x.GetHead()
-	}
-
-	// Increase the ring index by the number of descriptor chains added to the
-	// ring.
-	*r.ringIndex += uint16(len(chains))
-}
-
-func (r *AvailableRing) offer(chains []uint16) {
-	//always called under lock
-	//r.mu.Lock()
-	//defer r.mu.Unlock()
-
-	// Add descriptor chain heads to the ring.
-	for offset, x := range chains {
-		// The 16-bit ring index may overflow. This is expected and is not an
-		// issue because the size of the ring array (which equals the queue
-		// size) is always a power of 2 and smaller than the highest possible
-		// 16-bit value.
-		insertIndex := int(*r.ringIndex+uint16(offset)) % len(r.ring)
-		r.ring[insertIndex] = x
-	}
-
-	// Increase the ring index by the number of descriptor chains added to the
-	// ring.
-	*r.ringIndex += uint16(len(chains))
-}
-
-func (r *AvailableRing) offerSingle(x uint16) {
-	//always called under lock
-	//r.mu.Lock()
-	//defer r.mu.Unlock()
-
-	offset := 0
-	// Add descriptor chain heads to the ring.
-
-	// The 16-bit ring index may overflow. This is expected and is not an
-	// issue because the size of the ring array (which equals the queue
-	// size) is always a power of 2 and smaller than the highest possible
-	// 16-bit value.
-	insertIndex := int(*r.ringIndex+uint16(offset)) % len(r.ring)
-	r.ring[insertIndex] = x
-
-	// Increase the ring index by the number of descriptor chains added to the ring.
-	*r.ringIndex += 1
-}

overlay/virtqueue/available_ring_internal_test.go

@@ -1,71 +0,0 @@
-package virtqueue
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestAvailableRing_MemoryLayout(t *testing.T) {
-	const queueSize = 2
-
-	memory := make([]byte, availableRingSize(queueSize))
-	r := newAvailableRing(queueSize, memory)
-
-	*r.flags = 0x01ff
-	*r.ringIndex = 1
-	r.ring[0] = 0x1234
-	r.ring[1] = 0x5678
-
-	assert.Equal(t, []byte{
-		0xff, 0x01,
-		0x01, 0x00,
-		0x34, 0x12,
-		0x78, 0x56,
-		0x00, 0x00,
-	}, memory)
-}
-
-func TestAvailableRing_Offer(t *testing.T) {
-	const queueSize = 8
-
-	chainHeads := []uint16{42, 33, 69}
-
-	tests := []struct {
-		name              string
-		startRingIndex    uint16
-		expectedRingIndex uint16
-		expectedRing      []uint16
-	}{
-		{
-			name:              "no overflow",
-			startRingIndex:    0,
-			expectedRingIndex: 3,
-			expectedRing:      []uint16{42, 33, 69, 0, 0, 0, 0, 0},
-		},
-		{
-			name:              "ring overflow",
-			startRingIndex:    6,
-			expectedRingIndex: 9,
-			expectedRing:      []uint16{69, 0, 0, 0, 0, 0, 42, 33},
-		},
-		{
-			name:              "index overflow",
-			startRingIndex:    65535,
-			expectedRingIndex: 2,
-			expectedRing:      []uint16{33, 69, 0, 0, 0, 0, 0, 42},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			memory := make([]byte, availableRingSize(queueSize))
-			r := newAvailableRing(queueSize, memory)
-			*r.ringIndex = tt.startRingIndex
-
-			r.offer(chainHeads)
-
-			assert.Equal(t, tt.expectedRingIndex, *r.ringIndex)
-			assert.Equal(t, tt.expectedRing, r.ring)
-		})
-	}
-}

overlay/virtqueue/descriptor.go

@@ -1,43 +0,0 @@
-package virtqueue
-
-// descriptorFlag is a flag that describes a [Descriptor].
-type descriptorFlag uint16
-
-const (
-	// descriptorFlagHasNext marks a descriptor chain as continuing via the next
-	// field.
-	descriptorFlagHasNext descriptorFlag = 1 << iota
-	// descriptorFlagWritable marks a buffer as device write-only (otherwise
-	// device read-only).
-	descriptorFlagWritable
-	// descriptorFlagIndirect means the buffer contains a list of buffer
-	// descriptors to provide an additional layer of indirection.
-	// Only allowed when the [virtio.FeatureIndirectDescriptors] feature was
-	// negotiated.
-	descriptorFlagIndirect
-)
-
-// descriptorSize is the number of bytes needed to store a [Descriptor] in
-// memory.
-const descriptorSize = 16
-
-// Descriptor describes (a part of) a buffer which is either read-only for the
-// device or write-only for the device (depending on [descriptorFlagWritable]).
-// Multiple descriptors can be chained to produce a "descriptor chain" that can
-// contain both device-readable and device-writable buffers. Device-readable
-// descriptors always come first in a chain. A single, large buffer may be
-// split up by chaining multiple similar descriptors that reference different
-// memory pages. This is required, because buffers may exceed a single page size
-// and the memory accessed by the device is expected to be continuous.
-type Descriptor struct {
-	// address is the address to the continuous memory holding the data for this
-	// descriptor.
-	address uintptr
-	// length is the amount of bytes stored at address.
-	length uint32
-	// flags that describe this descriptor.
-	flags descriptorFlag
-	// next contains the index of the next descriptor continuing this descriptor
-	// chain when the [descriptorFlagHasNext] flag is set.
-	next uint16
-}

overlay/virtqueue/descriptor_internal_test.go

@@ -1,12 +0,0 @@
-package virtqueue
-
-import (
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestDescriptor_Size(t *testing.T) {
-	assert.EqualValues(t, descriptorSize, unsafe.Sizeof(Descriptor{}))
-}

overlay/virtqueue/descriptor_table.go

@@ -1,288 +0,0 @@
-package virtqueue
-
-import (
-	"errors"
-	"fmt"
-	"math"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-var (
-	// ErrNotEnoughFreeDescriptors is returned when the free descriptors are
-	// exhausted, meaning that the queue is full.
-	ErrNotEnoughFreeDescriptors = errors.New("not enough free descriptors, queue is full")
-
-	// ErrInvalidDescriptorChain is returned when a descriptor chain is not
-	// valid for a given operation.
-	ErrInvalidDescriptorChain = errors.New("invalid descriptor chain")
-)
-
-// noFreeHead is used to mark when all descriptors are in use and we have no
-// free chain. This value is impossible to occur as an index naturally, because
-// it exceeds the maximum queue size.
-const noFreeHead = uint16(math.MaxUint16)
-
-// descriptorTableSize is the number of bytes needed to store a
-// [DescriptorTable] with the given queue size in memory.
-func descriptorTableSize(queueSize int) int {
-	return descriptorSize * queueSize
-}
-
-// descriptorTableAlignment is the minimum alignment of a [DescriptorTable]
-// in memory, as required by the virtio spec.
-const descriptorTableAlignment = 16
-
-// DescriptorTable is a table that holds [Descriptor]s, addressed via their
-// index in the slice.
-type DescriptorTable struct {
-	descriptors []Descriptor
-
-	// freeHeadIndex is the index of the head of the descriptor chain which
-	// contains all currently unused descriptors. When all descriptors are in
-	// use, this has the special value of noFreeHead.
-	freeHeadIndex uint16
-	// freeNum tracks the number of descriptors which are currently not in use.
-	freeNum uint16
-
-	bufferBase uintptr
-	bufferSize int
-	itemSize   int
-}
-
-// newDescriptorTable creates a descriptor table that uses the given underlying
-// memory. The Length of the memory slice must match the size needed for the
-// descriptor table (see [descriptorTableSize]) for the given queue size.
-//
-// Before this descriptor table can be used, [initialize] must be called.
-func newDescriptorTable(queueSize int, mem []byte, itemSize int) *DescriptorTable {
-	dtSize := descriptorTableSize(queueSize)
-	if len(mem) != dtSize {
-		panic(fmt.Sprintf("memory size (%v) does not match required size "+
-			"for descriptor table: %v", len(mem), dtSize))
-	}
-
-	return &DescriptorTable{
-		descriptors: unsafe.Slice((*Descriptor)(unsafe.Pointer(&mem[0])), queueSize),
-		// We have no free descriptors until they were initialized.
-		freeHeadIndex: noFreeHead,
-		freeNum:       0,
-		itemSize:      itemSize, //todo configurable? needs to be page-aligned
-	}
-}
-
-// Address returns the pointer to the beginning of the descriptor table in
-// memory. Do not modify the memory directly to not interfere with this
-// implementation.
-func (dt *DescriptorTable) Address() uintptr {
-	if dt.descriptors == nil {
-		panic("descriptor table is not initialized")
-	}
-	//should be same as dt.bufferBase
-	return uintptr(unsafe.Pointer(&dt.descriptors[0]))
-}
-
-func (dt *DescriptorTable) Size() uintptr {
-	if dt.descriptors == nil {
-		panic("descriptor table is not initialized")
-	}
-	return uintptr(dt.bufferSize)
-}
-
-// BufferAddresses returns a map of pointer->size for all allocations used by the table
-func (dt *DescriptorTable) BufferAddresses() map[uintptr]int {
-	if dt.descriptors == nil {
-		panic("descriptor table is not initialized")
-	}
-
-	return map[uintptr]int{dt.bufferBase: dt.bufferSize}
-}
-
-// initializeDescriptors allocates buffers with the size of a full memory page
-// for each descriptor in the table. While this may be a bit wasteful, it makes
-// dealing with descriptors way easier. Without this preallocation, we would
-// have to allocate and free memory on demand, increasing complexity.
-//
-// All descriptors will be marked as free and will form a free chain. The
-// addresses of all descriptors will be populated while their length remains
-// zero.
-func (dt *DescriptorTable) initializeDescriptors() error {
-	numDescriptors := len(dt.descriptors)
-
-	// Allocate ONE large region for all buffers
-	totalSize := dt.itemSize * numDescriptors
-	basePtr, err := unix.MmapPtr(-1, 0, nil, uintptr(totalSize),
-		unix.PROT_READ|unix.PROT_WRITE,
-		unix.MAP_PRIVATE|unix.MAP_ANONYMOUS)
-	if err != nil {
-		return fmt.Errorf("allocate buffer memory for descriptors: %w", err)
-	}
-
-	// Store the base for cleanup later
-	dt.bufferBase = uintptr(basePtr)
-	dt.bufferSize = totalSize
-
-	for i := range dt.descriptors {
-		dt.descriptors[i] = Descriptor{
-			address: dt.bufferBase + uintptr(i*dt.itemSize),
-			length:  0,
-			// All descriptors should form a free chain that loops around.
-			flags: descriptorFlagHasNext,
-			next:  uint16((i + 1) % len(dt.descriptors)),
-		}
-	}
-
-	// All descriptors are free to use now.
-	dt.freeHeadIndex = 0
-	dt.freeNum = uint16(len(dt.descriptors))
-
-	return nil
-}
-
-// releaseBuffers releases all allocated buffers for this descriptor table.
-// The implementation will try to release as many buffers as possible and
-// collect potential errors before returning them.
-// The descriptor table should no longer be used after calling this.
-func (dt *DescriptorTable) releaseBuffers() error {
-	for i := range dt.descriptors {
-		descriptor := &dt.descriptors[i]
-		descriptor.address = 0
-	}
-
-	// As a safety measure, make sure no descriptors can be used anymore.
-	dt.freeHeadIndex = noFreeHead
-	dt.freeNum = 0
-
-	if dt.bufferBase != 0 {
-		// The pointer points to memory not managed by Go, so this conversion
-		// is safe. See https://github.com/golang/go/issues/58625
-		dt.bufferBase = 0
-		//goland:noinspection GoVetUnsafePointer
-		err := unix.MunmapPtr(unsafe.Pointer(dt.bufferBase), uintptr(dt.bufferSize))
-		if err != nil {
-			return fmt.Errorf("release buffer memory: %w", err)
-		}
-	}
-
-	return nil
-}
-
-func (dt *DescriptorTable) CreateDescriptorForOutputs() (uint16, uint32, error) {
-	//todo just fill the damn table
-	// Do we still have enough free descriptors?
-
-	if 1 > dt.freeNum {
-		return 0, 0, ErrNotEnoughFreeDescriptors
-	}
-
-	// Above validation ensured that there is at least one free descriptor, so
-	// the free descriptor chain head should be valid.
-	if dt.freeHeadIndex == noFreeHead {
-		panic("free descriptor chain head is unset but there should be free descriptors")
-	}
-
-	// To avoid having to iterate over the whole table to find the descriptor
-	// pointing to the head just to replace the free head, we instead always
-	// create descriptor chains from the descriptors coming after the head.
-	// This way we only have to touch the head as a last resort, when all other
-	// descriptors are already used.
-	head := dt.descriptors[dt.freeHeadIndex].next
-	desc := &dt.descriptors[head]
-	next := desc.next
-
-	checkUnusedDescriptorLength(head, desc)
-
-	// Give the device the maximum available number of bytes to write into.
-	desc.length = uint32(dt.itemSize)
-	desc.flags = 0 // descriptorFlagWritable
-	desc.next = 0  // Not necessary to clear this, it's just for looks.
-
-	dt.freeNum -= 1
-
-	if dt.freeNum == 0 {
-		// The last descriptor in the chain should be the free chain head
-		// itself.
-		if next != dt.freeHeadIndex {
-			panic("descriptor chain takes up all free descriptors but does not end with the free chain head")
-		}
-
-		// When this new chain takes up all remaining descriptors, we no longer
-		// have a free chain.
-		dt.freeHeadIndex = noFreeHead
-	} else {
-		// We took some descriptors out of the free chain, so make sure to close
-		// the circle again.
-		dt.descriptors[dt.freeHeadIndex].next = next
-	}
-
-	return head, desc.length, nil
-}
-
-func (dt *DescriptorTable) createDescriptorForInputs() (uint16, error) {
-	// Do we still have enough free descriptors?
-	if 1 > dt.freeNum {
-		return 0, ErrNotEnoughFreeDescriptors
-	}
-
-	// Above validation ensured that there is at least one free descriptor, so
-	// the free descriptor chain head should be valid.
-	if dt.freeHeadIndex == noFreeHead {
-		panic("free descriptor chain head is unset but there should be free descriptors")
-	}
-
-	// To avoid having to iterate over the whole table to find the descriptor
-	// pointing to the head just to replace the free head, we instead always
-	// create descriptor chains from the descriptors coming after the head.
-	// This way we only have to touch the head as a last resort, when all other
-	// descriptors are already used.
-	head := dt.descriptors[dt.freeHeadIndex].next
-	desc := &dt.descriptors[head]
-	next := desc.next
-
-	checkUnusedDescriptorLength(head, desc)
-
-	// Give the device the maximum available number of bytes to write into.
-	desc.length = uint32(dt.itemSize)
-	desc.flags = descriptorFlagWritable
-	desc.next = 0 // Not necessary to clear this, it's just for looks.
-
-	dt.freeNum -= 1
-
-	if dt.freeNum == 0 {
-		// The last descriptor in the chain should be the free chain head
-		// itself.
-		if next != dt.freeHeadIndex {
-			panic("descriptor chain takes up all free descriptors but does not end with the free chain head")
-		}
-
-		// When this new chain takes up all remaining descriptors, we no longer
-		// have a free chain.
-		dt.freeHeadIndex = noFreeHead
-	} else {
-		// We took some descriptors out of the free chain, so make sure to close
-		// the circle again.
-		dt.descriptors[dt.freeHeadIndex].next = next
-	}
-
-	return head, nil
-}
-
-func (dt *DescriptorTable) getDescriptorItem(head uint16) []byte {
-	desc := &dt.descriptors[head] //todo this is a pretty nasty hack with no checks
-
-	// The descriptor address points to memory not managed by Go, so this
-	// conversion is safe. See https://github.com/golang/go/issues/58625
-	//goland:noinspection GoVetUnsafePointer
-	return unsafe.Slice((*byte)(unsafe.Pointer(desc.address)), desc.length)
-}
-
-// checkUnusedDescriptorLength asserts that the length of an unused descriptor
-// is zero, as it should be.
-// This is not a requirement by the virtio spec but rather a thing we do to
-// notice when our algorithm goes sideways.
-func checkUnusedDescriptorLength(index uint16, desc *Descriptor) {
-	if desc.length != 0 {
-		panic(fmt.Sprintf("descriptor %d should be unused but has a non-zero length", index))
-	}
-}

overlay/virtqueue/doc.go

@@ -1,7 +0,0 @@
-// Package virtqueue implements the driver-side for a virtio queue as described
-// in the specification:
-// https://docs.oasis-open.org/virtio/virtio/v1.2/csd01/virtio-v1.2-csd01.html#x1-270006
-// This package does not make assumptions about the device that consumes the
-// queue. It rather just allocates the queue structures in memory and provides
-// methods to interact with it.
-package virtqueue

overlay/virtqueue/eventfd_test.go

@@ -1,45 +0,0 @@
-package virtqueue
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gvisor.dev/gvisor/pkg/eventfd"
-)
-
-// Tests how an eventfd and a waiting goroutine can be gracefully closed.
-// Extends the eventfd test suite:
-// https://github.com/google/gvisor/blob/0799336d64be65eb97d330606c30162dc3440cab/pkg/eventfd/eventfd_test.go
-func TestEventFD_CancelWait(t *testing.T) {
-	efd, err := eventfd.Create()
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		assert.NoError(t, efd.Close())
-	})
-
-	var stop bool
-
-	done := make(chan struct{})
-	go func() {
-		for !stop {
-			_ = efd.Wait()
-		}
-		close(done)
-	}()
-	select {
-	case <-done:
-		t.Fatalf("goroutine ended early")
-	case <-time.After(500 * time.Millisecond):
-	}
-
-	stop = true
-	assert.NoError(t, efd.Notify())
-	select {
-	case <-done:
-		break
-	case <-time.After(5 * time.Second):
-		t.Error("goroutine did not end")
-	}
-}

overlay/virtqueue/size.go

@@ -1,33 +0,0 @@
-package virtqueue
-
-import (
-	"errors"
-	"fmt"
-)
-
-// ErrQueueSizeInvalid is returned when a queue size is invalid.
-var ErrQueueSizeInvalid = errors.New("queue size is invalid")
-
-// CheckQueueSize checks if the given value would be a valid size for a
-// virtqueue and returns an [ErrQueueSizeInvalid], if not.
-func CheckQueueSize(queueSize int) error {
-	if queueSize <= 0 {
-		return fmt.Errorf("%w: %d is too small", ErrQueueSizeInvalid, queueSize)
-	}
-
-	// The queue size must always be a power of 2.
-	// This ensures that ring indexes wrap correctly when the 16-bit integers
-	// overflow.
-	if queueSize&(queueSize-1) != 0 {
-		return fmt.Errorf("%w: %d is not a power of 2", ErrQueueSizeInvalid, queueSize)
-	}
-
-	// The largest power of 2 that fits into a 16-bit integer is 32768.
-	// 2 * 32768 would be 65536 which no longer fits.
-	if queueSize > 32768 {
-		return fmt.Errorf("%w: %d is larger than the maximum possible queue size 32768",
-			ErrQueueSizeInvalid, queueSize)
-	}
-
-	return nil
-}

overlay/virtqueue/size_test.go

@@ -1,59 +0,0 @@
-package virtqueue
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCheckQueueSize(t *testing.T) {
-	tests := []struct {
-		name        string
-		queueSize   int
-		containsErr string
-	}{
-		{
-			name:        "negative",
-			queueSize:   -1,
-			containsErr: "too small",
-		},
-		{
-			name:        "zero",
-			queueSize:   0,
-			containsErr: "too small",
-		},
-		{
-			name:        "not a power of 2",
-			queueSize:   24,
-			containsErr: "not a power of 2",
-		},
-		{
-			name:        "too large",
-			queueSize:   65536,
-			containsErr: "larger than the maximum",
-		},
-		{
-			name:      "valid 1",
-			queueSize: 1,
-		},
-		{
-			name:      "valid 256",
-			queueSize: 256,
-		},
-
-		{
-			name:      "valid 32768",
-			queueSize: 32768,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := CheckQueueSize(tt.queueSize)
-			if tt.containsErr != "" {
-				assert.ErrorContains(t, err, tt.containsErr)
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}

overlay/virtqueue/split_virtqueue.go

@@ -1,415 +0,0 @@
-package virtqueue
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-
-	"github.com/slackhq/nebula/overlay/eventfd"
-	"golang.org/x/sys/unix"
-)
-
-// SplitQueue is a virtqueue that consists of several parts, where each part is
-// writeable by either the driver or the device, but not both.
-type SplitQueue struct {
-	// size is the size of the queue.
-	size int
-	// buf is the underlying memory used for the queue.
-	buf []byte
-
-	descriptorTable *DescriptorTable
-	availableRing   *AvailableRing
-	usedRing        *UsedRing
-
-	// kickEventFD is used to signal the device when descriptor chains were
-	// added to the available ring.
-	kickEventFD eventfd.EventFD
-	// callEventFD is used by the device to signal when it has used descriptor
-	// chains and put them in the used ring.
-	callEventFD eventfd.EventFD
-
-	// stop is used by [SplitQueue.Close] to cancel the goroutine that handles
-	// used buffer notifications. It blocks until the goroutine ended.
-	stop func() error
-
-	itemSize int
-
-	epoll eventfd.Epoll
-	more  int
-}
-
-// NewSplitQueue allocates a new [SplitQueue] in memory. The given queue size
-// specifies the number of entries/buffers the queue can hold. This also affects
-// the memory consumption.
-func NewSplitQueue(queueSize int, itemSize int) (_ *SplitQueue, err error) {
-	if err = CheckQueueSize(queueSize); err != nil {
-		return nil, err
-	}
-
-	if itemSize%os.Getpagesize() != 0 {
-		return nil, errors.New("split queue size must be multiple of os.Getpagesize()")
-	}
-
-	sq := SplitQueue{
-		size:     queueSize,
-		itemSize: itemSize,
-	}
-
-	// Clean up a partially initialized queue when something fails.
-	defer func() {
-		if err != nil {
-			_ = sq.Close()
-		}
-	}()
-
-	// There are multiple ways for how the memory for the virtqueue could be
-	// allocated. We could use Go native structs with arrays inside them, but
-	// this wouldn't allow us to make the queue size configurable. And including
-	// a slice in the Go structs wouldn't work, because this would just put the
-	// Go slice descriptor into the memory region which the virtio device will
-	// not understand.
-	// Additionally, Go does not allow us to ensure a correct alignment of the
-	// parts of the virtqueue, as it is required by the virtio specification.
-	//
-	// To resolve this, let's just allocate the memory manually by allocating
-	// one or more memory pages, depending on the queue size. Making the
-	// virtqueue start at the beginning of a page is not strictly necessary, as
-	// the virtio specification does not require it to be continuous in the
-	// physical memory of the host (e.g. the vhost implementation in the kernel
-	// always uses copy_from_user to access it), but this makes it very easy to
-	// guarantee the alignment. Also, it is not required for the virtqueue parts
-	// to be in the same memory region, as we pass separate pointers to them to
-	// the device, but this design just makes things easier to implement.
-	//
-	// One added benefit of allocating the memory manually is, that we have full
-	// control over its lifetime and don't risk the garbage collector to collect
-	// our valuable structures while the device still works with them.
-
-	// The descriptor table is at the start of the page, so alignment is not an
-	// issue here.
-	descriptorTableStart := 0
-	descriptorTableEnd := descriptorTableStart + descriptorTableSize(queueSize)
-	availableRingStart := align(descriptorTableEnd, availableRingAlignment)
-	availableRingEnd := availableRingStart + availableRingSize(queueSize)
-	usedRingStart := align(availableRingEnd, usedRingAlignment)
-	usedRingEnd := usedRingStart + usedRingSize(queueSize)
-
-	sq.buf, err = unix.Mmap(-1, 0, usedRingEnd,
-		unix.PROT_READ|unix.PROT_WRITE,
-		unix.MAP_PRIVATE|unix.MAP_ANONYMOUS)
-	if err != nil {
-		return nil, fmt.Errorf("allocate virtqueue buffer: %w", err)
-	}
-
-	sq.descriptorTable = newDescriptorTable(queueSize, sq.buf[descriptorTableStart:descriptorTableEnd], sq.itemSize)
-	sq.availableRing = newAvailableRing(queueSize, sq.buf[availableRingStart:availableRingEnd])
-	sq.usedRing = newUsedRing(queueSize, sq.buf[usedRingStart:usedRingEnd])
-
-	sq.kickEventFD, err = eventfd.New()
-	if err != nil {
-		return nil, fmt.Errorf("create kick event file descriptor: %w", err)
-	}
-	sq.callEventFD, err = eventfd.New()
-	if err != nil {
-		return nil, fmt.Errorf("create call event file descriptor: %w", err)
-	}
-
-	if err = sq.descriptorTable.initializeDescriptors(); err != nil {
-		return nil, fmt.Errorf("initialize descriptors: %w", err)
-	}
-
-	sq.epoll, err = eventfd.NewEpoll()
-	if err != nil {
-		return nil, err
-	}
-	err = sq.epoll.AddEvent(sq.callEventFD.FD())
-	if err != nil {
-		return nil, err
-	}
-
-	sq.stop = sq.kickSelfToExit()
-
-	return &sq, nil
-}
-
-// Size returns the size of this queue, which is the number of entries/buffers
-// this queue can hold.
-func (sq *SplitQueue) Size() int {
-	return sq.size
-}
-
-// DescriptorTable returns the [DescriptorTable] behind this queue.
-func (sq *SplitQueue) DescriptorTable() *DescriptorTable {
-	return sq.descriptorTable
-}
-
-// AvailableRing returns the [AvailableRing] behind this queue.
-func (sq *SplitQueue) AvailableRing() *AvailableRing {
-	return sq.availableRing
-}
-
-// UsedRing returns the [UsedRing] behind this queue.
-func (sq *SplitQueue) UsedRing() *UsedRing {
-	return sq.usedRing
-}
-
-// KickEventFD returns the kick event file descriptor behind this queue.
-// The returned file descriptor should be used with great care to not interfere
-// with this implementation.
-func (sq *SplitQueue) KickEventFD() int {
-	return sq.kickEventFD.FD()
-}
-
-// CallEventFD returns the call event file descriptor behind this queue.
-// The returned file descriptor should be used with great care to not interfere
-// with this implementation.
-func (sq *SplitQueue) CallEventFD() int {
-	return sq.callEventFD.FD()
-}
-
-func (sq *SplitQueue) kickSelfToExit() func() error {
-	return func() error {
-
-		// The goroutine blocks until it receives a signal on the event file
-		// descriptor, so it will never notice the context being canceled.
-		// To resolve this, we can just produce a fake-signal ourselves to wake
-		// it up.
-		if err := sq.callEventFD.Kick(); err != nil {
-			return fmt.Errorf("wake up goroutine: %w", err)
-		}
-		return nil
-	}
-}
-
-func (sq *SplitQueue) TakeSingleIndex(ctx context.Context) (uint16, error) {
-	element, err := sq.TakeSingle(ctx)
-	if err != nil {
-		return 0xffff, err
-	}
-	return element.GetHead(), nil
-}
-
-func (sq *SplitQueue) TakeSingle(ctx context.Context) (UsedElement, error) {
-	var n int
-	var err error
-	for ctx.Err() == nil {
-		out, ok := sq.usedRing.takeOne()
-		if ok {
-			return out, nil
-		}
-		// Wait for a signal from the device.
-		if n, err = sq.epoll.Block(); err != nil {
-			return UsedElement{}, fmt.Errorf("wait: %w", err)
-		}
-
-		if n > 0 {
-			out, ok = sq.usedRing.takeOne()
-			if ok {
-				_ = sq.epoll.Clear() //???
-				return out, nil
-			} else {
-				continue //???
-			}
-		}
-	}
-	return UsedElement{}, ctx.Err()
-}
-
-func (sq *SplitQueue) TakeSingleNoBlock() (UsedElement, bool) {
-	return sq.usedRing.takeOne()
-}
-
-func (sq *SplitQueue) WaitForUsedElements(ctx context.Context) error {
-	if sq.usedRing.availableToTake() != 0 {
-		return nil
-	}
-	for ctx.Err() == nil {
-		// Wait for a signal from the device.
-		n, err := sq.epoll.Block()
-		if err != nil {
-			return fmt.Errorf("wait: %w", err)
-		}
-		if n > 0 {
-			_ = sq.epoll.Clear()
-			if sq.usedRing.availableToTake() != 0 {
-				return nil
-			}
-		}
-	}
-	return ctx.Err()
-}
-
-func (sq *SplitQueue) BlockAndGetHeadsCapped(ctx context.Context, maxToTake int) ([]UsedElement, error) {
-	var n int
-	var err error
-	for ctx.Err() == nil {
-
-		//we have leftovers in the fridge
-		if sq.more > 0 {
-			stillNeedToTake, out := sq.usedRing.take(maxToTake)
-			sq.more = stillNeedToTake
-			return out, nil
-		}
-		//look inside the fridge
-		stillNeedToTake, out := sq.usedRing.take(maxToTake)
-		if len(out) > 0 {
-			sq.more = stillNeedToTake
-			return out, nil
-		}
-		//fridge is empty I guess
-
-		// Wait for a signal from the device.
-		if n, err = sq.epoll.Block(); err != nil {
-			return nil, fmt.Errorf("wait: %w", err)
-		}
-		if n > 0 {
-			_ = sq.epoll.Clear()
-			stillNeedToTake, out = sq.usedRing.take(maxToTake)
-			sq.more = stillNeedToTake
-			return out, nil
-		}
-	}
-
-	return nil, ctx.Err()
-}
-
-// OfferDescriptorChain offers a descriptor chain to the device which contains a
-// number of device-readable buffers (out buffers) and device-writable buffers
-// (in buffers).
-//
-// All buffers in the outBuffers slice will be concatenated by chaining
-// descriptors, one for each buffer in the slice. When a buffer is too large to
-// fit into a single descriptor (limited by the system's page size), it will be
-// split up into multiple descriptors within the chain.
-// When numInBuffers is greater than zero, the given number of device-writable
-// descriptors will be appended to the end of the chain, each referencing a
-// whole memory page (see [os.Getpagesize]).
-//
-// When the queue is full and no more descriptor chains can be added, a wrapped
-// [ErrNotEnoughFreeDescriptors] will be returned. If you set waitFree to true,
-// this method will handle this error and will block instead until there are
-// enough free descriptors again.
-//
-// After defining the descriptor chain in the [DescriptorTable], the index of
-// the head of the chain will be made available to the device using the
-// [AvailableRing] and will be returned by this method.
-// Callers should read from the [SplitQueue.UsedDescriptorChains] channel to be
-// notified when the descriptor chain was used by the device and should free the
-// used descriptor chains again using [SplitQueue.FreeDescriptorChain] when
-// they're done with them. When this does not happen, the queue will run full
-// and any further calls to [SplitQueue.OfferDescriptorChain] will stall.
-
-func (sq *SplitQueue) OfferInDescriptorChains() (uint16, error) {
-	var (
-		head uint16
-		err  error
-	)
-	for {
-		head, err = sq.descriptorTable.createDescriptorForInputs()
-		if err == nil {
-			break
-		}
-
-		// I don't wanna use errors.Is, it's slow
-		//goland:noinspection GoDirectComparisonOfErrors
-		if err == ErrNotEnoughFreeDescriptors {
-			return 0, err
-		} else {
-			return 0, fmt.Errorf("create descriptor chain: %w", err)
-		}
-	}
-
-	// Make the descriptor chain available to the device.
-	sq.availableRing.offerSingle(head)
-
-	// Notify the device to make it process the updated available ring.
-	if err = sq.kickEventFD.Kick(); err != nil {
-		return head, fmt.Errorf("notify device: %w", err)
-	}
-
-	return head, nil
-}
-
-// GetDescriptorItem returns the buffer of a given index
-// The head index must be one that was returned by a previous call to
-// [SplitQueue.OfferDescriptorChain] and the descriptor chain must not have been
-// freed yet.
-//
-// Be careful to only access the returned buffer slices when the device is no
-// longer using them. They must not be accessed after
-// [SplitQueue.FreeDescriptorChain] has been called.
-func (sq *SplitQueue) GetDescriptorItem(head uint16) []byte {
-	sq.descriptorTable.descriptors[head].length = uint32(sq.descriptorTable.itemSize)
-	return sq.descriptorTable.getDescriptorItem(head)
-}
-
-func (sq *SplitQueue) SetDescSize(head uint16, sz int) {
-	//not called under lock
-	sq.descriptorTable.descriptors[int(head)].length = uint32(sz)
-}
-
-func (sq *SplitQueue) OfferDescriptorChains(chains []uint16, kick bool) error {
-	// Make the descriptor chain available to the device.
-	sq.availableRing.offer(chains)
-
-	// Notify the device to make it process the updated available ring.
-	if kick {
-		return sq.Kick()
-	}
-
-	return nil
-}
-
-func (sq *SplitQueue) Kick() error {
-	if err := sq.kickEventFD.Kick(); err != nil {
-		return fmt.Errorf("notify device: %w", err)
-	}
-	return nil
-}
-
-// Close releases all resources used for this queue.
-// The implementation will try to release as many resources as possible and
-// collect potential errors before returning them.
-func (sq *SplitQueue) Close() error {
-	var errs []error
-
-	if sq.stop != nil {
-		// This has to happen before the event file descriptors may be closed.
-		if err := sq.stop(); err != nil {
-			errs = append(errs, fmt.Errorf("stop consume used ring: %w", err))
-		}
-
-		// Make sure that this code block is executed only once.
-		sq.stop = nil
-	}
-
-	if err := sq.kickEventFD.Close(); err != nil {
-		errs = append(errs, fmt.Errorf("close kick event file descriptor: %w", err))
-	}
-	if err := sq.callEventFD.Close(); err != nil {
-		errs = append(errs, fmt.Errorf("close call event file descriptor: %w", err))
-	}
-
-	if err := sq.descriptorTable.releaseBuffers(); err != nil {
-		errs = append(errs, fmt.Errorf("release descriptor buffers: %w", err))
-	}
-
-	if sq.buf != nil {
-		if err := unix.Munmap(sq.buf); err == nil {
-			sq.buf = nil
-		} else {
-			errs = append(errs, fmt.Errorf("unmap virtqueue buffer: %w", err))
-		}
-	}
-
-	return errors.Join(errs...)
-}
-
-func align(index, alignment int) int {
-	remainder := index % alignment
-	if remainder == 0 {
-		return index
-	}
-	return index + alignment - remainder
-}

overlay/virtqueue/used_element.go

@@ -1,21 +0,0 @@
-package virtqueue
-
-// usedElementSize is the number of bytes needed to store a [UsedElement] in
-// memory.
-const usedElementSize = 8
-
-// UsedElement is an element of the [UsedRing] and describes a descriptor chain
-// that was used by the device.
-type UsedElement struct {
-	// DescriptorIndex is the index of the head of the used descriptor chain in
-	// the [DescriptorTable].
-	// The index is 32-bit here for padding reasons.
-	DescriptorIndex uint32
-	// Length is the number of bytes written into the device writable portion of
-	// the buffer described by the descriptor chain.
-	Length uint32
-}
-
-func (u *UsedElement) GetHead() uint16 {
-	return uint16(u.DescriptorIndex)
-}

overlay/virtqueue/used_element_internal_test.go

@@ -1,12 +0,0 @@
-package virtqueue
-
-import (
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUsedElement_Size(t *testing.T) {
-	assert.EqualValues(t, usedElementSize, unsafe.Sizeof(UsedElement{}))
-}

overlay/virtqueue/used_ring.go

@@ -1,170 +0,0 @@
-package virtqueue
-
-import (
-	"fmt"
-	"unsafe"
-)
-
-// usedRingFlag is a flag that describes a [UsedRing].
-type usedRingFlag uint16
-
-const (
-	// usedRingFlagNoNotify is used by the host to advise the guest to not
-	// kick it when adding a buffer. It's unreliable, so it's simply an
-	// optimization. Guest will still kick when it's out of buffers.
-	usedRingFlagNoNotify usedRingFlag = 1 << iota
-)
-
-// usedRingSize is the number of bytes needed to store a [UsedRing] with the
-// given queue size in memory.
-func usedRingSize(queueSize int) int {
-	return 6 + usedElementSize*queueSize
-}
-
-// usedRingAlignment is the minimum alignment of a [UsedRing] in memory, as
-// required by the virtio spec.
-const usedRingAlignment = 4
-
-// UsedRing is where the device returns descriptor chains once it is done with
-// them. Each ring entry is a [UsedElement]. It is only written to by the device
-// and read by the driver.
-//
-// Because the size of the ring depends on the queue size, we cannot define a
-// Go struct with a static size that maps to the memory of the ring. Instead,
-// this struct only contains pointers to the corresponding memory areas.
-type UsedRing struct {
-	initialized bool
-
-	// flags that describe this ring.
-	flags *usedRingFlag
-	// ringIndex indicates where the device would put the next entry into the
-	// ring (modulo the queue size).
-	ringIndex *uint16
-	// ring contains the [UsedElement]s. It wraps around at queue size.
-	ring []UsedElement
-	// availableEvent is not used by this implementation, but we reserve it
-	// anyway to avoid issues in case a device may try to write to it, contrary
-	// to the virtio specification.
-	availableEvent *uint16
-
-	// lastIndex is the internal ringIndex up to which all [UsedElement]s were
-	// processed.
-	lastIndex uint16
-
-	//mu sync.Mutex
-}
-
-// newUsedRing creates a used ring that uses the given underlying memory. The
-// length of the memory slice must match the size needed for the ring (see
-// [usedRingSize]) for the given queue size.
-func newUsedRing(queueSize int, mem []byte) *UsedRing {
-	ringSize := usedRingSize(queueSize)
-	if len(mem) != ringSize {
-		panic(fmt.Sprintf("memory size (%v) does not match required size "+
-			"for used ring: %v", len(mem), ringSize))
-	}
-
-	r := UsedRing{
-		initialized:    true,
-		flags:          (*usedRingFlag)(unsafe.Pointer(&mem[0])),
-		ringIndex:      (*uint16)(unsafe.Pointer(&mem[2])),
-		ring:           unsafe.Slice((*UsedElement)(unsafe.Pointer(&mem[4])), queueSize),
-		availableEvent: (*uint16)(unsafe.Pointer(&mem[ringSize-2])),
-	}
-	r.lastIndex = *r.ringIndex
-	return &r
-}
-
-// Address returns the pointer to the beginning of the ring in memory.
-// Do not modify the memory directly to not interfere with this implementation.
-func (r *UsedRing) Address() uintptr {
-	if !r.initialized {
-		panic("used ring is not initialized")
-	}
-	return uintptr(unsafe.Pointer(r.flags))
-}
-
-func (r *UsedRing) availableToTake() int {
-	ringIndex := *r.ringIndex
-	if ringIndex == r.lastIndex {
-		// Nothing new.
-		return 0
-	}
-
-	// Calculate the number new used elements that we can read from the ring.
-	// The ring index may wrap, so special handling for that case is needed.
-	count := int(ringIndex - r.lastIndex)
-	if count < 0 {
-		count += 0xffff
-	}
-	return count
-}
-
-// take returns all new [UsedElement]s that the device put into the ring and
-// that weren't already returned by a previous call to this method.
-func (r *UsedRing) take(maxToTake int) (int, []UsedElement) {
-	count := r.availableToTake()
-	if count == 0 {
-		return 0, nil
-	}
-
-	stillNeedToTake := 0
-
-	if maxToTake > 0 {
-		stillNeedToTake = count - maxToTake
-		if stillNeedToTake < 0 {
-			stillNeedToTake = 0
-		}
-		count = min(count, maxToTake)
-	}
-
-	// The number of new elements can never exceed the queue size.
-	if count > len(r.ring) {
-		panic("used ring contains more new elements than the ring is long")
-	}
-
-	elems := make([]UsedElement, count)
-	for i := range count {
-		elems[i] = r.ring[r.lastIndex%uint16(len(r.ring))]
-		r.lastIndex++
-	}
-
-	return stillNeedToTake, elems
-}
-
-func (r *UsedRing) takeOne() (UsedElement, bool) {
-	//r.mu.Lock()
-	//defer r.mu.Unlock()
-
-	count := r.availableToTake()
-	if count == 0 {
-		return UsedElement{}, false
-	}
-
-	// The number of new elements can never exceed the queue size.
-	if count > len(r.ring) {
-		panic("used ring contains more new elements than the ring is long")
-	}
-
-	out := r.ring[r.lastIndex%uint16(len(r.ring))]
-	r.lastIndex++
-
-	return out, true
-}
-
-// InitOfferSingle is only used to pre-fill the used queue at startup, and should not be used if the device is running!
-func (r *UsedRing) InitOfferSingle(x uint16, size uint32) {
-	offset := 0
-	// Add descriptor chain heads to the ring.
-
-	// The 16-bit ring index may overflow. This is expected and is not an
-	// issue because the size of the ring array (which equals the queue
-	// size) is always a power of 2 and smaller than the highest possible
-	// 16-bit value.
-	insertIndex := int(*r.ringIndex+uint16(offset)) % len(r.ring)
-	r.ring[insertIndex].DescriptorIndex = uint32(x)
-	r.ring[insertIndex].Length = size
-
-	// Increase the ring index by the number of descriptor chains added to the ring.
-	*r.ringIndex += 1
-}

overlay/virtqueue/used_ring_internal_test.go

@@ -1,136 +0,0 @@
-package virtqueue
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUsedRing_MemoryLayout(t *testing.T) {
-	const queueSize = 2
-
-	memory := make([]byte, usedRingSize(queueSize))
-	r := newUsedRing(queueSize, memory)
-
-	*r.flags = 0x01ff
-	*r.ringIndex = 1
-	r.ring[0] = UsedElement{
-		DescriptorIndex: 0x0123,
-		Length:          0x4567,
-	}
-	r.ring[1] = UsedElement{
-		DescriptorIndex: 0x89ab,
-		Length:          0xcdef,
-	}
-
-	assert.Equal(t, []byte{
-		0xff, 0x01,
-		0x01, 0x00,
-		0x23, 0x01, 0x00, 0x00,
-		0x67, 0x45, 0x00, 0x00,
-		0xab, 0x89, 0x00, 0x00,
-		0xef, 0xcd, 0x00, 0x00,
-		0x00, 0x00,
-	}, memory)
-}
-
-//func TestUsedRing_Take(t *testing.T) {
-//	const queueSize = 8
-//
-//	tests := []struct {
-//		name      string
-//		ring      []UsedElement
-//		ringIndex uint16
-//		lastIndex uint16
-//		expected  []UsedElement
-//	}{
-//		{
-//			name: "nothing new",
-//			ring: []UsedElement{
-//				{DescriptorIndex: 1},
-//				{DescriptorIndex: 2},
-//				{DescriptorIndex: 3},
-//				{DescriptorIndex: 4},
-//				{},
-//				{},
-//				{},
-//				{},
-//			},
-//			ringIndex: 4,
-//			lastIndex: 4,
-//			expected:  nil,
-//		},
-//		{
-//			name: "no overflow",
-//			ring: []UsedElement{
-//				{DescriptorIndex: 1},
-//				{DescriptorIndex: 2},
-//				{DescriptorIndex: 3},
-//				{DescriptorIndex: 4},
-//				{},
-//				{},
-//				{},
-//				{},
-//			},
-//			ringIndex: 4,
-//			lastIndex: 1,
-//			expected: []UsedElement{
-//				{DescriptorIndex: 2},
-//				{DescriptorIndex: 3},
-//				{DescriptorIndex: 4},
-//			},
-//		},
-//		{
-//			name: "ring overflow",
-//			ring: []UsedElement{
-//				{DescriptorIndex: 9},
-//				{DescriptorIndex: 10},
-//				{DescriptorIndex: 3},
-//				{DescriptorIndex: 4},
-//				{DescriptorIndex: 5},
-//				{DescriptorIndex: 6},
-//				{DescriptorIndex: 7},
-//				{DescriptorIndex: 8},
-//			},
-//			ringIndex: 10,
-//			lastIndex: 7,
-//			expected: []UsedElement{
-//				{DescriptorIndex: 8},
-//				{DescriptorIndex: 9},
-//				{DescriptorIndex: 10},
-//			},
-//		},
-//		{
-//			name: "index overflow",
-//			ring: []UsedElement{
-//				{DescriptorIndex: 9},
-//				{DescriptorIndex: 10},
-//				{DescriptorIndex: 3},
-//				{DescriptorIndex: 4},
-//				{DescriptorIndex: 5},
-//				{DescriptorIndex: 6},
-//				{DescriptorIndex: 7},
-//				{DescriptorIndex: 8},
-//			},
-//			ringIndex: 2,
-//			lastIndex: 65535,
-//			expected: []UsedElement{
-//				{DescriptorIndex: 8},
-//				{DescriptorIndex: 9},
-//				{DescriptorIndex: 10},
-//			},
-//		},
-//	}
-//	for _, tt := range tests {
-//		t.Run(tt.name, func(t *testing.T) {
-//			memory := make([]byte, usedRingSize(queueSize))
-//			r := newUsedRing(queueSize, memory)
-//
-//			copy(r.ring, tt.ring)
-//			*r.ringIndex = tt.ringIndex
-//			r.lastIndex = tt.lastIndex
-//
-//			assert.Equal(t, tt.expected, r.take())
-//		})
-//	}
-//}

packet/outpacket.go

@@ -1,75 +0,0 @@
-package packet
-
-import (
-	"github.com/slackhq/nebula/util/virtio"
-	"golang.org/x/sys/unix"
-)
-
-type OutPacket struct {
-	Segments [][]byte
-	// SegmentHeaders maps to the first virtio.NetHdrSize+14 bytes of Segments[n]
-	SegmentHeaders [][]byte
-	// SegmentPayloads maps to the remaining bytes of Segments[n]
-	SegmentPayloads [][]byte
-	// SegmentIDs is the list of underlying buffer IDs of Segments.
-	// SegmentIDs, Segments, SegmentHeaders, SegmentPayloads should all have the same length at all times!
-	SegmentIDs []uint16
-}
-
-func NewOut() *OutPacket {
-	out := new(OutPacket)
-	out.Segments = make([][]byte, 0, 64)
-	out.SegmentHeaders = make([][]byte, 0, 64)
-	out.SegmentPayloads = make([][]byte, 0, 64)
-	out.SegmentIDs = make([]uint16, 0, 64)
-	return out
-}
-
-func (pkt *OutPacket) Reset() {
-	pkt.Segments = pkt.Segments[:0]
-	pkt.SegmentPayloads = pkt.SegmentPayloads[:0]
-	pkt.SegmentHeaders = pkt.SegmentHeaders[:0]
-	pkt.SegmentIDs = pkt.SegmentIDs[:0]
-}
-
-// DestroyLastSegment removes the contents of the last segment in the list.
-// Use this to handle firewall drops or similar, but still hand the segment buffer back to the underlying driver.
-// Implementations shall discard zero-length segments internally.
-func (pkt *OutPacket) DestroyLastSegment() {
-	if len(pkt.Segments) == 0 {
-		return
-	}
-	lastSeg := len(pkt.SegmentIDs) - 1
-	pkt.SegmentPayloads[lastSeg] = pkt.SegmentPayloads[lastSeg][:0]
-	pkt.SegmentHeaders[lastSeg] = pkt.SegmentHeaders[lastSeg][:0]
-	pkt.Segments[lastSeg] = pkt.Segments[lastSeg][:0]
-}
-
-func (pkt *OutPacket) UseSegment(segID uint16, seg []byte, isV6 bool) int {
-	pkt.SegmentIDs = append(pkt.SegmentIDs, segID)
-	pkt.Segments = append(pkt.Segments, seg) //todo do we need this?
-
-	vhdr := virtio.NetHdr{ //todo
-		Flags:      unix.VIRTIO_NET_HDR_F_DATA_VALID,
-		GSOType:    unix.VIRTIO_NET_HDR_GSO_NONE,
-		HdrLen:     0,
-		GSOSize:    0,
-		CsumStart:  0,
-		CsumOffset: 0,
-		NumBuffers: 0,
-	}
-
-	hdr := seg[0 : virtio.NetHdrSize+14]
-	_ = vhdr.Encode(hdr)
-	if isV6 {
-		hdr[virtio.NetHdrSize+14-2] = 0x86
-		hdr[virtio.NetHdrSize+14-1] = 0xdd
-	} else {
-		hdr[virtio.NetHdrSize+14-2] = 0x08
-		hdr[virtio.NetHdrSize+14-1] = 0x00
-	}
-
-	pkt.SegmentHeaders = append(pkt.SegmentHeaders, hdr)
-	pkt.SegmentPayloads = append(pkt.SegmentPayloads, seg[virtio.NetHdrSize+14:])
-	return len(pkt.SegmentIDs) - 1
-}

packet/packet.go

@@ -1,148 +0,0 @@
-package packet
-
-import (
-	"encoding/binary"
-	"fmt"
-	"iter"
-	"net/netip"
-	"slices"
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-const Size = 0xffff
-
-type UDPPacket struct {
-	Payload []byte
-	Control []byte
-	Name    []byte
-	SegSize int
-
-	ReadyToSend  bool
-	wasSegmented bool
-	isV4         bool
-}
-
-func New(isV4 bool) *UDPPacket {
-	return &UDPPacket{
-		Payload: make([]byte, Size),
-		Control: make([]byte, unix.CmsgSpace(2)),
-		Name:    make([]byte, unix.SizeofSockaddrInet6),
-		isV4:    isV4,
-	}
-}
-
-func (p *UDPPacket) AddrPort() netip.AddrPort {
-	var ip netip.Addr
-	// Its ok to skip the ok check here, the slicing is the only error that can occur and it will panic
-	if p.isV4 {
-		ip, _ = netip.AddrFromSlice(p.Name[4:8])
-	} else {
-		ip, _ = netip.AddrFromSlice(p.Name[8:24])
-	}
-	return netip.AddrPortFrom(ip.Unmap(), binary.BigEndian.Uint16(p.Name[2:4]))
-}
-
-func (p *UDPPacket) encodeSockaddr(dst []byte, addr netip.AddrPort) (uint32, error) {
-	//todo no chance this works on windows?
-	if p.isV4 {
-		if !addr.Addr().Is4() {
-			return 0, fmt.Errorf("Listener is IPv4, but writing to IPv6 remote")
-		}
-		var sa unix.RawSockaddrInet4
-		sa.Family = unix.AF_INET
-		sa.Addr = addr.Addr().As4()
-		binary.BigEndian.PutUint16((*[2]byte)(unsafe.Pointer(&sa.Port))[:], addr.Port())
-		size := unix.SizeofSockaddrInet4
-		copy(dst[:size], (*(*[unix.SizeofSockaddrInet4]byte)(unsafe.Pointer(&sa)))[:])
-		return uint32(size), nil
-	}
-
-	var sa unix.RawSockaddrInet6
-	sa.Family = unix.AF_INET6
-	sa.Addr = addr.Addr().As16()
-	binary.BigEndian.PutUint16((*[2]byte)(unsafe.Pointer(&sa.Port))[:], addr.Port())
-	size := unix.SizeofSockaddrInet6
-	copy(dst[:size], (*(*[unix.SizeofSockaddrInet6]byte)(unsafe.Pointer(&sa)))[:])
-	return uint32(size), nil
-}
-
-func (p *UDPPacket) SetAddrPort(addr netip.AddrPort) error {
-	nl, err := p.encodeSockaddr(p.Name, addr)
-	if err != nil {
-		return err
-	}
-	p.Name = p.Name[:nl]
-	return nil
-}
-
-func (p *UDPPacket) updateCtrl(ctrlLen int) {
-	p.SegSize = len(p.Payload)
-	p.wasSegmented = false
-	if ctrlLen == 0 {
-		return
-	}
-	if len(p.Control) == 0 {
-		return
-	}
-	header, data, _ /*remain*/, err := unix.ParseOneSocketControlMessage(p.Control)
-	if err != nil {
-		return // oh well
-	}
-
-	if header.Level == unix.SOL_UDP && header.Type == unix.UDP_GRO && len(data) >= 2 {
-		p.wasSegmented = true
-		p.SegSize = int(binary.LittleEndian.Uint16(data[:2]))
-		return
-	}
-}
-
-// Update sets a UDPPacket into "just received, not processed" state
-func (p *UDPPacket) Update(ctrlLen int) {
-	p.updateCtrl(ctrlLen)
-}
-
-func (p *UDPPacket) SetSegSizeForTX() {
-	p.SegSize = len(p.Payload)
-	hdr := (*unix.Cmsghdr)(unsafe.Pointer(&p.Control[0]))
-	hdr.Level = unix.SOL_UDP
-	hdr.Type = unix.UDP_SEGMENT
-	hdr.SetLen(syscall.CmsgLen(2))
-	binary.NativeEndian.PutUint16(p.Control[unix.CmsgLen(0):unix.CmsgLen(0)+2], uint16(p.SegSize))
-}
-
-func (p *UDPPacket) CompatibleForSegmentationWith(otherP *UDPPacket, currentTotalSize int) bool {
-	//same dest
-	if !slices.Equal(p.Name, otherP.Name) {
-		return false
-	}
-
-	//don't get too big
-	if len(p.Payload)+currentTotalSize >= 0xffff {
-		return false
-	}
-
-	//same body len
-	//todo allow single different size at end
-	if len(p.Payload) != len(otherP.Payload) {
-		return false //todo technically you can cram one extra in
-	}
-	return true
-}
-
-func (p *UDPPacket) Segments() iter.Seq[[]byte] {
-	return func(yield func([]byte) bool) {
-		//cursor := 0
-		for offset := 0; offset < len(p.Payload); offset += p.SegSize {
-			end := offset + p.SegSize
-			if end > len(p.Payload) {
-				end = len(p.Payload)
-			}
-			if !yield(p.Payload[offset:end]) {
-				return
-			}
-		}
-	}
-}

routing/gateway.go

@@ -6,7 +6,7 @@ import (
 )
 
 const (
-	// Sentinal value
+	// Sentinel value
 	BucketNotCalculated = -1
 )
 

udp/conn.go

@@ -4,13 +4,13 @@ import (
 	"net/netip"
 
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/packet"
 )
 
 const MTU = 9001
 
 type EncReader func(
-	[]*packet.UDPPacket,
+	addr netip.AddrPort,
+	payload []byte,
 )
 
 type Conn interface {
@@ -19,8 +19,6 @@ type Conn interface {
 	ListenOut(r EncReader)
 	WriteTo(b []byte, addr netip.AddrPort) error
 	ReloadConfig(c *config.C)
-	Prep(pkt *packet.UDPPacket, addr netip.AddrPort) error
-	WriteBatch(pkt []*packet.UDPPacket) (int, error)
 	SupportsMultipleReaders() bool
 	Close() error
 }

udp/udp_generic.go

@@ -10,9 +10,11 @@ package udp
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
+	"time"
 
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
@@ -74,12 +76,22 @@ type rawMessage struct {
 func (u *GenericConn) ListenOut(r EncReader) {
 	buffer := make([]byte, MTU)
 
+	var lastRecvErr time.Time
+
 	for {
 		// Just read one packet at a time
 		n, rua, err := u.ReadFromUDPAddrPort(buffer)
 		if err != nil {
-			u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+			if errors.Is(err, net.ErrClosed) {
-			return
+				u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
+				return
+			}
+			// Dampen unexpected message warns to once per minute
+			if lastRecvErr.IsZero() || time.Since(lastRecvErr) > time.Minute {
+				lastRecvErr = time.Now()
+				u.l.WithError(err).Warn("unexpected udp socket receive error")
+			}
+			continue
 		}
 
 		r(netip.AddrPortFrom(rua.Addr().Unmap(), rua.Port()), buffer[:n])

udp/udp_linux.go

@@ -14,22 +14,22 @@ import (
 	"github.com/rcrowley/go-metrics"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/packet"
 	"golang.org/x/sys/unix"
 )
 
-const iovMax = 128 //1024 //no unix constant for this? from limits.h
-//todo I'd like this to be 1024 but we seem to hit errors around ~130?
-
 type StdConn struct {
-	sysFd     int
+	sysFd int
-	isV4      bool
+	isV4  bool
-	l         *logrus.Logger
+	l     *logrus.Logger
-	batch     int
+	batch int
-	enableGRO bool
+}
 
-	msgs []rawMessage
+func maybeIPV4(ip net.IP) (net.IP, bool) {
-	iovs [][]iovec
+	ip4 := ip.To4()
+	if ip4 != nil {
+		return ip4, true
+	}
+	return ip, false
 }
 
 func NewListener(l *logrus.Logger, ip netip.Addr, port int, multi bool, batch int) (Conn, error) {
@@ -69,20 +69,7 @@ func NewListener(l *logrus.Logger, ip netip.Addr, port int, multi bool, batch in
 		return nil, fmt.Errorf("unable to bind to socket: %s", err)
 	}
 
-	const batchSize = 8192
+	return &StdConn{sysFd: fd, isV4: ip.Is4(), l: l, batch: batch}, err
-	msgs := make([]rawMessage, 0, batchSize) //todo configure
-	iovs := make([][]iovec, batchSize)
-	for i := range iovs {
-		iovs[i] = make([]iovec, iovMax)
-	}
-	return &StdConn{
-		sysFd: fd,
-		isV4:  ip.Is4(),
-		l:     l,
-		batch: batch,
-		msgs:  msgs,
-		iovs:  iovs,
-	}, err
 }
 
 func (u *StdConn) SupportsMultipleReaders() bool {
@@ -136,7 +123,9 @@ func (u *StdConn) LocalAddr() (netip.AddrPort, error) {
 }
 
 func (u *StdConn) ListenOut(r EncReader) {
-	msgs, packets := u.PrepareRawMessages(u.batch, u.isV4)
+	var ip netip.Addr
+
+	msgs, buffers, names := u.PrepareRawMessages(u.batch)
 	read := u.ReadMulti
 	if u.batch == 1 {
 		read = u.ReadSingle
@@ -150,12 +139,13 @@ func (u *StdConn) ListenOut(r EncReader) {
 		}
 
 		for i := 0; i < n; i++ {
-			packets[i].Payload = packets[i].Payload[:msgs[i].Len]
+			// Its ok to skip the ok check here, the slicing is the only error that can occur and it will panic
-			packets[i].Update(getRawMessageControlLen(&msgs[i]))
+			if u.isV4 {
-		}
+				ip, _ = netip.AddrFromSlice(names[i][4:8])
-		r(packets[:n])
+			} else {
-		for i := 0; i < n; i++ { //todo reset this in prev loop, but this makes debug ez
+				ip, _ = netip.AddrFromSlice(names[i][8:24])
-			msgs[i].Hdr.Controllen = uint64(unix.CmsgSpace(2))
+			}
+			r(netip.AddrPortFrom(ip.Unmap(), binary.BigEndian.Uint16(names[i][2:4])), buffers[i][:msgs[i].Len])
 		}
 	}
 }
@@ -208,148 +198,6 @@ func (u *StdConn) WriteTo(b []byte, ip netip.AddrPort) error {
 	return u.writeTo6(b, ip)
 }
 
-func (u *StdConn) WriteToBatch(b []byte, ip netip.AddrPort) error {
-	if u.isV4 {
-		return u.writeTo4(b, ip)
-	}
-	return u.writeTo6(b, ip)
-}
-
-func (u *StdConn) Prep(pkt *packet.UDPPacket, addr netip.AddrPort) error {
-	//todo move this into pkt
-	nl, err := u.encodeSockaddr(pkt.Name, addr)
-	if err != nil {
-		return err
-	}
-	pkt.ReadyToSend = true
-	pkt.Name = pkt.Name[:nl]
-	return nil
-}
-
-func (u *StdConn) WriteBatch(pkts []*packet.UDPPacket) (int, error) {
-	if len(pkts) == 0 {
-		return 0, nil
-	}
-
-	u.msgs = u.msgs[:0]
-	//u.iovs = u.iovs[:0]
-
-	sent := 0
-	var mostRecentPkt *packet.UDPPacket
-	mostRecentPktSize := 0
-	//segmenting := false
-	idx := 0
-	for _, pkt := range pkts {
-		if !pkt.ReadyToSend || len(pkt.Payload) == 0 {
-			sent++
-			continue
-		}
-		lastIdx := idx - 1
-		if mostRecentPkt != nil && pkt.CompatibleForSegmentationWith(mostRecentPkt, mostRecentPktSize) && u.msgs[lastIdx].Hdr.Iovlen < iovMax {
-			u.msgs[lastIdx].Hdr.Controllen = uint64(len(mostRecentPkt.Control))
-			u.msgs[lastIdx].Hdr.Control = &mostRecentPkt.Control[0]
-
-			u.iovs[lastIdx][u.msgs[lastIdx].Hdr.Iovlen].Base = &pkt.Payload[0]
-			u.iovs[lastIdx][u.msgs[lastIdx].Hdr.Iovlen].Len = uint64(len(pkt.Payload))
-			u.msgs[lastIdx].Hdr.Iovlen++
-
-			mostRecentPktSize += len(pkt.Payload)
-			mostRecentPkt.SetSegSizeForTX()
-		} else {
-			u.msgs = append(u.msgs, rawMessage{})
-			u.iovs[idx][0] = iovec{
-				Base: &pkt.Payload[0],
-				Len:  uint64(len(pkt.Payload)),
-			}
-
-			msg := &u.msgs[idx]
-			iov := &u.iovs[idx][0]
-			idx++
-
-			msg.Hdr.Iov = iov
-			msg.Hdr.Iovlen = 1
-			setRawMessageControl(msg, nil)
-			msg.Hdr.Flags = 0
-
-			msg.Hdr.Name = &pkt.Name[0]
-			msg.Hdr.Namelen = uint32(len(pkt.Name))
-			mostRecentPkt = pkt
-			mostRecentPktSize = len(pkt.Payload)
-		}
-	}
-
-	if len(u.msgs) == 0 {
-		return sent, nil
-	}
-
-	offset := 0
-	for offset < len(u.msgs) {
-		n, _, errno := unix.Syscall6(
-			unix.SYS_SENDMMSG,
-			uintptr(u.sysFd),
-			uintptr(unsafe.Pointer(&u.msgs[offset])),
-			uintptr(len(u.msgs)-offset),
-			0,
-			0,
-			0,
-		)
-
-		if errno != 0 {
-			if errno == unix.EINTR {
-				continue
-			}
-			//for i := 0; i < len(u.msgs); i++ {
-			//	for j := 0; j < int(u.msgs[i].Hdr.Iovlen); j++ {
-			//		u.l.WithFields(logrus.Fields{
-			//			"msg_index": i,
-			//			"iov idx":   j,
-			//			"iov":       fmt.Sprintf("%+v", u.iovs[i][j]),
-			//		}).Warn("failed to send message")
-			//	}
-			//
-			//}
-			u.l.WithFields(logrus.Fields{
-				"errno":   errno,
-				"idx":     idx,
-				"len":     len(u.msgs),
-				"deets":   fmt.Sprintf("%+v", u.msgs),
-				"lastIOV": fmt.Sprintf("%+v", u.iovs[len(u.msgs)-1][u.msgs[len(u.msgs)-1].Hdr.Iovlen-1]),
-			}).Error("failed to send message")
-			return sent + offset, &net.OpError{Op: "sendmmsg", Err: errno}
-		}
-
-		if n == 0 {
-			break
-		}
-		offset += int(n)
-	}
-
-	return sent + len(u.msgs), nil
-}
-
-func (u *StdConn) encodeSockaddr(dst []byte, addr netip.AddrPort) (uint32, error) {
-	if u.isV4 {
-		if !addr.Addr().Is4() {
-			return 0, fmt.Errorf("Listener is IPv4, but writing to IPv6 remote")
-		}
-		var sa unix.RawSockaddrInet4
-		sa.Family = unix.AF_INET
-		sa.Addr = addr.Addr().As4()
-		binary.BigEndian.PutUint16((*[2]byte)(unsafe.Pointer(&sa.Port))[:], addr.Port())
-		size := unix.SizeofSockaddrInet4
-		copy(dst[:size], (*(*[unix.SizeofSockaddrInet4]byte)(unsafe.Pointer(&sa)))[:])
-		return uint32(size), nil
-	}
-
-	var sa unix.RawSockaddrInet6
-	sa.Family = unix.AF_INET6
-	sa.Addr = addr.Addr().As16()
-	binary.BigEndian.PutUint16((*[2]byte)(unsafe.Pointer(&sa.Port))[:], addr.Port())
-	size := unix.SizeofSockaddrInet6
-	copy(dst[:size], (*(*[unix.SizeofSockaddrInet6]byte)(unsafe.Pointer(&sa)))[:])
-	return uint32(size), nil
-}
-
 func (u *StdConn) writeTo6(b []byte, ip netip.AddrPort) error {
 	var rsa unix.RawSockaddrInet6
 	rsa.Family = unix.AF_INET6
@@ -450,27 +298,6 @@ func (u *StdConn) ReloadConfig(c *config.C) {
 			u.l.WithError(err).Error("Failed to set listen.so_mark")
 		}
 	}
-	u.configureGRO(true)
-}
-
-func (u *StdConn) configureGRO(enable bool) {
-	if enable == u.enableGRO {
-		return
-	}
-
-	if enable {
-		if err := unix.SetsockoptInt(u.sysFd, unix.SOL_UDP, unix.UDP_GRO, 1); err != nil {
-			u.l.WithError(err).Warn("Failed to enable UDP GRO")
-			return
-		}
-		u.enableGRO = true
-		u.l.Info("UDP GRO enabled")
-	} else {
-		if err := unix.SetsockoptInt(u.sysFd, unix.SOL_UDP, unix.UDP_GRO, 0); err != nil && err != unix.ENOPROTOOPT {
-			u.l.WithError(err).Warn("Failed to disable UDP GRO")
-		}
-		u.enableGRO = false
-	}
 }
 
 func (u *StdConn) getMemInfo(meminfo *[unix.SK_MEMINFO_VARS]uint32) error {

udp/udp_linux_64.go

@@ -7,7 +7,6 @@
 package udp
 
 import (
-	"github.com/slackhq/nebula/packet"
 	"golang.org/x/sys/unix"
 )
 
@@ -34,59 +33,25 @@ type rawMessage struct {
 	Pad0 [4]byte
 }
 
-func setRawMessageControl(msg *rawMessage, buf []byte) {
+func (u *StdConn) PrepareRawMessages(n int) ([]rawMessage, [][]byte, [][]byte) {
-	if len(buf) == 0 {
-		msg.Hdr.Control = nil
-		msg.Hdr.Controllen = 0
-		return
-	}
-	msg.Hdr.Control = &buf[0]
-	msg.Hdr.Controllen = uint64(len(buf))
-}
-
-func getRawMessageControlLen(msg *rawMessage) int {
-	return int(msg.Hdr.Controllen)
-}
-
-func setCmsgLen(h *unix.Cmsghdr, l int) {
-	h.Len = uint64(l)
-}
-
-func (u *StdConn) PrepareRawMessages(n int, isV4 bool) ([]rawMessage, []*packet.UDPPacket) {
 	msgs := make([]rawMessage, n)
-	packets := make([]*packet.UDPPacket, n)
+	buffers := make([][]byte, n)
+	names := make([][]byte, n)
 
 	for i := range msgs {
-		packets[i] = packet.New(isV4)
+		buffers[i] = make([]byte, MTU)
+		names[i] = make([]byte, unix.SizeofSockaddrInet6)
 
 		vs := []iovec{
-			{Base: &packets[i].Payload[0], Len: uint64(packet.Size)},
+			{Base: &buffers[i][0], Len: uint64(len(buffers[i]))},
 		}
 
 		msgs[i].Hdr.Iov = &vs[0]
 		msgs[i].Hdr.Iovlen = uint64(len(vs))
 
-		msgs[i].Hdr.Name = &packets[i].Name[0]
+		msgs[i].Hdr.Name = &names[i][0]
-		msgs[i].Hdr.Namelen = uint32(len(packets[i].Name))
+		msgs[i].Hdr.Namelen = uint32(len(names[i]))
-
-		if u.enableGRO {
-			msgs[i].Hdr.Control = &packets[i].Control[0]
-			msgs[i].Hdr.Controllen = uint64(len(packets[i].Control))
-		} else {
-			msgs[i].Hdr.Control = nil
-			msgs[i].Hdr.Controllen = 0
-		}
 	}
 
-	return msgs, packets
+	return msgs, buffers, names
-}
-
-func setIovecSlice(iov *iovec, b []byte) {
-	if len(b) == 0 {
-		iov.Base = nil
-		iov.Len = 0
-		return
-	}
-	iov.Base = &b[0]
-	iov.Len = uint64(len(b))
 }

udp/udp_rio_windows.go

@@ -14,6 +14,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"syscall"
+	"time"
 	"unsafe"
 
 	"github.com/sirupsen/logrus"
@@ -66,7 +67,7 @@ func NewRIOListener(l *logrus.Logger, addr netip.Addr, port int) (*RIOConn, erro
 
 	u := &RIOConn{l: l}
 
-	err := u.bind(&windows.SockaddrInet6{Addr: addr.As16(), Port: port})
+	err := u.bind(l, &windows.SockaddrInet6{Addr: addr.As16(), Port: port})
 	if err != nil {
 		return nil, fmt.Errorf("bind: %w", err)
 	}
@@ -82,11 +83,11 @@ func NewRIOListener(l *logrus.Logger, addr netip.Addr, port int) (*RIOConn, erro
 	return u, nil
 }
 
-func (u *RIOConn) bind(sa windows.Sockaddr) error {
+func (u *RIOConn) bind(l *logrus.Logger, sa windows.Sockaddr) error {
 	var err error
 	u.sock, err = winrio.Socket(windows.AF_INET6, windows.SOCK_DGRAM, windows.IPPROTO_UDP)
 	if err != nil {
-		return err
+		return fmt.Errorf("winrio.Socket error: %w", err)
 	}
 
 	// Enable v4 for this socket
@@ -100,35 +101,40 @@ func (u *RIOConn) bind(sa windows.Sockaddr) error {
 	size := uint32(unsafe.Sizeof(flag))
 	err = syscall.WSAIoctl(syscall.Handle(u.sock), syscall.SIO_UDP_CONNRESET, (*byte)(unsafe.Pointer(&flag)), size, nil, 0, &ret, nil, 0)
 	if err != nil {
-		return err
+		// This is a best-effort to prevent errors from being returned by the udp recv operation.
+		// Quietly log a failure and continue.
+		l.WithError(err).Debug("failed to set UDP_CONNRESET ioctl")
 	}
+
 	ret = 0
 	flag = 0
 	size = uint32(unsafe.Sizeof(flag))
 	SIO_UDP_NETRESET := uint32(syscall.IOC_IN | syscall.IOC_VENDOR | 15)
 	err = syscall.WSAIoctl(syscall.Handle(u.sock), SIO_UDP_NETRESET, (*byte)(unsafe.Pointer(&flag)), size, nil, 0, &ret, nil, 0)
 	if err != nil {
-		return err
+		// This is a best-effort to prevent errors from being returned by the udp recv operation.
+		// Quietly log a failure and continue.
+		l.WithError(err).Debug("failed to set UDP_NETRESET ioctl")
 	}
 
 	err = u.rx.Open()
 	if err != nil {
-		return err
+		return fmt.Errorf("error rx.Open(): %w", err)
 	}
 
 	err = u.tx.Open()
 	if err != nil {
-		return err
+		return fmt.Errorf("error tx.Open(): %w", err)
 	}
 
 	u.rq, err = winrio.CreateRequestQueue(u.sock, packetsPerRing, 1, packetsPerRing, 1, u.rx.cq, u.tx.cq, 0)
 	if err != nil {
-		return err
+		return fmt.Errorf("error CreateRequestQueue: %w", err)
 	}
 
 	err = windows.Bind(u.sock, sa)
 	if err != nil {
-		return err
+		return fmt.Errorf("error windows.Bind(): %w", err)
 	}
 
 	return nil
@@ -137,15 +143,22 @@ func (u *RIOConn) bind(sa windows.Sockaddr) error {
 func (u *RIOConn) ListenOut(r EncReader) {
 	buffer := make([]byte, MTU)
 
+	var lastRecvErr time.Time
+
 	for {
 		// Just read one packet at a time
 		n, rua, err := u.receive(buffer)
+
 		if err != nil {
 			if errors.Is(err, net.ErrClosed) {
 				u.l.WithError(err).Debug("udp socket is closed, exiting read loop")
 				return
 			}
-			u.l.WithError(err).Error("unexpected udp socket receive error")
+			// Dampen unexpected message warns to once per minute
+			if lastRecvErr.IsZero() || time.Since(lastRecvErr) > time.Minute {
+				lastRecvErr = time.Now()
+				u.l.WithError(err).Warn("unexpected udp socket receive error")
+			}
 			continue
 		}
 

udp/udp_tester.go

@@ -11,7 +11,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/packet"
 )
 
 type Packet struct {
@@ -41,11 +40,6 @@ type TesterConn struct {
 	l      *logrus.Logger
 }
 
-func (u *TesterConn) Prep(pkt *packet.UDPPacket, addr netip.AddrPort) error {
-	pkt.ReadyToSend = true
-	return pkt.SetAddrPort(addr)
-}
-
 func NewListener(l *logrus.Logger, ip netip.Addr, port int, _ bool, _ int) (Conn, error) {
 	return &TesterConn{
 		Addr:      netip.AddrPortFrom(ip, uint16(port)),
@@ -96,19 +90,6 @@ func (u *TesterConn) Get(block bool) *Packet {
 // Below this is boilerplate implementation to make nebula actually work
 //********************************************************************************************************************//
 
-func (u *TesterConn) WriteBatch(pkts []*packet.UDPPacket) (int, error) {
-	for _, pkt := range pkts {
-		if !pkt.ReadyToSend {
-			continue
-		}
-		err := u.WriteTo(pkt.Payload, pkt.AddrPort())
-		if err != nil {
-			return 0, err
-		}
-	}
-	return len(pkts), nil
-}
-
 func (u *TesterConn) WriteTo(b []byte, addr netip.AddrPort) error {
 	if u.closed.Load() {
 		return io.ErrClosedPipe
@@ -119,9 +100,6 @@ func (u *TesterConn) WriteTo(b []byte, addr netip.AddrPort) error {
 		From: u.Addr,
 		To:   addr,
 	}
-	if addr.Addr().IsUnspecified() {
-		panic("invalid address")
-	}
 
 	copy(p.Data, b)
 	u.TxPackets <- p
@@ -134,15 +112,7 @@ func (u *TesterConn) ListenOut(r EncReader) {
 		if !ok {
 			return
 		}
-		x := packet.New(p.From.Addr().Is4())
+		r(p.From, p.Data)
-		x.Payload = p.Data
-		x.SetSegSizeForTX()
-		err := x.SetAddrPort(p.From)
-		if err != nil {
-			panic(err)
-		}
-		y := []*packet.UDPPacket{x}
-		r(y)
 	}
 }
 

util/virtio/doc.go

@@ -1,3 +0,0 @@
-// Package virtio contains some generic types and concepts related to the virtio
-// protocol.
-package virtio

util/virtio/features.go

@@ -1,136 +0,0 @@
-package virtio
-
-// Feature contains feature bits that describe a virtio device or driver.
-type Feature uint64
-
-// Device-independent feature bits.
-//
-// Source: https://docs.oasis-open.org/virtio/virtio/v1.2/csd01/virtio-v1.2-csd01.html#x1-6600006
-const (
-	// FeatureIndirectDescriptors indicates that the driver can use descriptors
-	// with an additional layer of indirection.
-	FeatureIndirectDescriptors Feature = 1 << 28
-
-	// FeatureVersion1 indicates compliance with version 1.0 of the virtio
-	// specification.
-	FeatureVersion1 Feature = 1 << 32
-)
-
-// Feature bits for networking devices.
-//
-// Source: https://docs.oasis-open.org/virtio/virtio/v1.2/csd01/virtio-v1.2-csd01.html#x1-2200003
-const (
-	// FeatureNetDeviceCsum indicates that the device can handle packets with
-	// partial checksum (checksum offload).
-	FeatureNetDeviceCsum Feature = 1 << 0
-
-	// FeatureNetDriverCsum indicates that the driver can handle packets with
-	// partial checksum.
-	FeatureNetDriverCsum Feature = 1 << 1
-
-	// FeatureNetCtrlDriverOffloads indicates support for dynamic offload state
-	// reconfiguration.
-	FeatureNetCtrlDriverOffloads Feature = 1 << 2
-
-	// FeatureNetMTU indicates that the device reports a maximum MTU value.
-	FeatureNetMTU Feature = 1 << 3
-
-	// FeatureNetMAC indicates that the device provides a MAC address.
-	FeatureNetMAC Feature = 1 << 5
-
-	// FeatureNetDriverTSO4 indicates that the driver supports the TCP
-	// segmentation offload for received IPv4 packets.
-	FeatureNetDriverTSO4 Feature = 1 << 7
-
-	// FeatureNetDriverTSO6 indicates that the driver supports the TCP
-	// segmentation offload for received IPv6 packets.
-	FeatureNetDriverTSO6 Feature = 1 << 8
-
-	// FeatureNetDriverECN indicates that the driver supports the TCP
-	// segmentation offload with ECN for received packets.
-	FeatureNetDriverECN Feature = 1 << 9
-
-	// FeatureNetDriverUFO indicates that the driver supports the UDP
-	// fragmentation offload for received packets.
-	FeatureNetDriverUFO Feature = 1 << 10
-
-	// FeatureNetDeviceTSO4 indicates that the device supports the TCP
-	// segmentation offload for received IPv4 packets.
-	FeatureNetDeviceTSO4 Feature = 1 << 11
-
-	// FeatureNetDeviceTSO6 indicates that the device supports the TCP
-	// segmentation offload for received IPv6 packets.
-	FeatureNetDeviceTSO6 Feature = 1 << 12
-
-	// FeatureNetDeviceECN indicates that the device supports the TCP
-	// segmentation offload with ECN for received packets.
-	FeatureNetDeviceECN Feature = 1 << 13
-
-	// FeatureNetDeviceUFO indicates that the device supports the UDP
-	// fragmentation offload for received packets.
-	FeatureNetDeviceUFO Feature = 1 << 14
-
-	// FeatureNetMergeRXBuffers indicates that the driver can handle merged
-	// receive buffers.
-	// When this feature is negotiated, devices may merge multiple descriptor
-	// chains together to transport large received packets. [NetHdr.NumBuffers]
-	// will then contain the number of merged descriptor chains.
-	FeatureNetMergeRXBuffers Feature = 1 << 15
-
-	// FeatureNetStatus indicates that the device configuration status field is
-	// available.
-	FeatureNetStatus Feature = 1 << 16
-
-	// FeatureNetCtrlVQ indicates that a control channel virtqueue is
-	// available.
-	FeatureNetCtrlVQ Feature = 1 << 17
-
-	// FeatureNetCtrlRX indicates support for RX mode control (e.g. promiscuous
-	// or all-multicast) for packet receive filtering.
-	FeatureNetCtrlRX Feature = 1 << 18
-
-	// FeatureNetCtrlVLAN indicates support for VLAN filtering through the
-	// control channel.
-	FeatureNetCtrlVLAN Feature = 1 << 19
-
-	// FeatureNetDriverAnnounce indicates that the driver can send gratuitous
-	// packets.
-	FeatureNetDriverAnnounce Feature = 1 << 21
-
-	// FeatureNetMQ indicates that the device supports multiqueue with automatic
-	// receive steering.
-	FeatureNetMQ Feature = 1 << 22
-
-	// FeatureNetCtrlMACAddr indicates that the MAC address can be set through
-	// the control channel.
-	FeatureNetCtrlMACAddr Feature = 1 << 23
-
-	// FeatureNetDeviceUSO indicates that the device supports the UDP
-	// segmentation offload for received packets.
-	FeatureNetDeviceUSO Feature = 1 << 56
-
-	// FeatureNetHashReport indicates that the device can report a per-packet
-	// hash value and type.
-	FeatureNetHashReport Feature = 1 << 57
-
-	// FeatureNetDriverHdrLen indicates that the driver can provide the exact
-	// header length value (see [NetHdr.HdrLen]).
-	// Devices may benefit from knowing the exact header length.
-	FeatureNetDriverHdrLen Feature = 1 << 59
-
-	// FeatureNetRSS indicates that the device supports RSS (receive-side
-	// scaling) with configurable hash parameters.
-	FeatureNetRSS Feature = 1 << 60
-
-	// FeatureNetRSCExt indicates that the device can process duplicated ACKs
-	// and report the number of coalesced segments and duplicated ACKs.
-	FeatureNetRSCExt Feature = 1 << 61
-
-	// FeatureNetStandby indicates that the device may act as a standby for a
-	// primary device with the same MAC address.
-	FeatureNetStandby Feature = 1 << 62
-
-	// FeatureNetSpeedDuplex indicates that the device can report link speed and
-	// duplex mode.
-	FeatureNetSpeedDuplex Feature = 1 << 63
-)

util/virtio/net_hdr.go

@@ -1,77 +0,0 @@
-package virtio
-
-import (
-	"errors"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-// Workaround to make Go doc links work.
-var _ unix.Errno
-
-// NetHdrSize is the number of bytes needed to store a [NetHdr] in memory.
-const NetHdrSize = 12
-
-// ErrNetHdrBufferTooSmall is returned when a buffer is too small to fit a
-// virtio_net_hdr.
-var ErrNetHdrBufferTooSmall = errors.New("the buffer is too small to fit a virtio_net_hdr")
-
-// NetHdr defines the virtio_net_hdr as described by the virtio specification.
-type NetHdr struct {
-	// Flags that describe the packet.
-	// Possible values are:
-	//   - [unix.VIRTIO_NET_HDR_F_NEEDS_CSUM]
-	//   - [unix.VIRTIO_NET_HDR_F_DATA_VALID]
-	//   - [unix.VIRTIO_NET_HDR_F_RSC_INFO]
-	Flags uint8
-	// GSOType contains the type of segmentation offload that should be used for
-	// the packet.
-	// Possible values are:
-	//   - [unix.VIRTIO_NET_HDR_GSO_NONE]
-	//   - [unix.VIRTIO_NET_HDR_GSO_TCPV4]
-	//   - [unix.VIRTIO_NET_HDR_GSO_UDP]
-	//   - [unix.VIRTIO_NET_HDR_GSO_TCPV6]
-	//   - [unix.VIRTIO_NET_HDR_GSO_UDP_L4]
-	//   - [unix.VIRTIO_NET_HDR_GSO_ECN]
-	GSOType uint8
-	// HdrLen contains the length of the headers that need to be replicated by
-	// segmentation offloads. It's the number of bytes from the beginning of the
-	// packet to the beginning of the transport payload.
-	// Only used when [FeatureNetDriverHdrLen] is negotiated.
-	HdrLen uint16
-	// GSOSize contains the maximum size of each segmented packet beyond the
-	// header (payload size). In case of TCP, this is the MSS.
-	GSOSize uint16
-	// CsumStart contains the offset within the packet from which on the
-	// checksum should be computed.
-	CsumStart uint16
-	// CsumOffset specifies how many bytes after [NetHdr.CsumStart] the computed
-	// 16-bit checksum should be inserted.
-	CsumOffset uint16
-	// NumBuffers contains the number of merged descriptor chains when
-	// [FeatureNetMergeRXBuffers] is negotiated.
-	// This field is only used for packets received by the driver and should be
-	// zero for transmitted packets.
-	NumBuffers uint16
-}
-
-// Decode decodes the [NetHdr] from the given byte slice. The slice must contain
-// at least [NetHdrSize] bytes.
-func (v *NetHdr) Decode(data []byte) error {
-	if len(data) < NetHdrSize {
-		return ErrNetHdrBufferTooSmall
-	}
-	copy(unsafe.Slice((*byte)(unsafe.Pointer(v)), NetHdrSize), data[:NetHdrSize])
-	return nil
-}
-
-// Encode encodes the [NetHdr] into the given byte slice. The slice must have
-// room for at least [NetHdrSize] bytes.
-func (v *NetHdr) Encode(data []byte) error {
-	if len(data) < NetHdrSize {
-		return ErrNetHdrBufferTooSmall
-	}
-	copy(data[:NetHdrSize], unsafe.Slice((*byte)(unsafe.Pointer(v)), NetHdrSize))
-	return nil
-}

util/virtio/net_hdr_test.go

@@ -1,43 +0,0 @@
-package virtio
-
-import (
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/unix"
-)
-
-func TestNetHdr_Size(t *testing.T) {
-	assert.EqualValues(t, NetHdrSize, unsafe.Sizeof(NetHdr{}))
-}
-
-func TestNetHdr_Encoding(t *testing.T) {
-	vnethdr := NetHdr{
-		Flags:      unix.VIRTIO_NET_HDR_F_NEEDS_CSUM,
-		GSOType:    unix.VIRTIO_NET_HDR_GSO_UDP_L4,
-		HdrLen:     42,
-		GSOSize:    1472,
-		CsumStart:  34,
-		CsumOffset: 6,
-		NumBuffers: 16,
-	}
-
-	buf := make([]byte, NetHdrSize)
-	require.NoError(t, vnethdr.Encode(buf))
-
-	assert.Equal(t, []byte{
-		0x01, 0x05,
-		0x2a, 0x00,
-		0xc0, 0x05,
-		0x22, 0x00,
-		0x06, 0x00,
-		0x10, 0x00,
-	}, buf)
-
-	var decoded NetHdr
-	require.NoError(t, decoded.Decode(buf))
-
-	assert.Equal(t, vnethdr, decoded)
-}