(cherry picked from commit 7c2acadba17cadf8a1df957c49e1333130d460ad)
(cherry picked from commit ...

GRO requires big allocations to be efficient. This isn't great, as there
might be Android memory...

Otherwise in the event that we're using GSO without sticky sockets, we
pass garbage OOB buffers ...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Android wants GSO but not sticky.

Signed-off-by: Jason A. Donenfeld <[email protected]>

Otherwise GRO gets enabled on Android, but the conn doesn't use it,
resulting in bundled packets...

This allows a kernel to support UDP_GRO while not supporting
UDP_SEGMENT.

Signed-off-by: Jason ...

Signed-off-by: James Tucker <[email protected]>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4...

Close closes the events channel, resulting in a panic from send on
closed channel.

Reported-By:...

Queue{In,Out}boundElement locking can contribute to significant
overhead via sync.Mutex.lockSlow...

After reducing UDP stack traversal overhead via GSO and GRO,
runtime.chanrecv() began to account...

IPv4 header and pseudo header checksums were being computed on every
merge operation. Additional...

$ benchstat old.txt new.txt
goos: linux
goarch: amd64
pkg: golang.zx2c4.com/wireguard/tun
cpu: 1...

StdNetBind probes for UDP GSO and GRO support at runtime. UDP GSO is
dependent on checksum offlo...

Signed-off-by: Dimitri Papadopoulos Orfanos <[email protected]...

Signed-off-by: Brad Fitzpatrick <[email protected]>
Signed-off-by: Jason A. Donenfeld <Jaso...

Signed-off-by: SpringHack <[email protected]>
Signed-off-by: Jason A. Donenfeld <[email protected]>

Replace the src storage inside StdNetEndpoint with a copy of the raw
control message buffer, to ...

If an IPC operation is in flight while close starts, it is possible for
both processes to deadlo...

tcpGRO() was using an incorrect IPv4 more fragments bit mask.

tcpPacketsCanCoalesce() was not d...

IP options were not being compared prior to coalescing. They are not
commonly used. Disqualifica...

This results in a more compact structure.

Signed-off-by: Jason A. Donenfeld <[email protected]>

Looks like a simple copy&paste error.

Fixes: 9e2f386 ("conn, device, tun: implement vectorized ...

In 9e2f386 ("conn, device, tun: implement vectorized I/O on Linux"), the
Linux-specific Bind imp...

We can't have the netlink listener socket, so it's not possible to
support it. Plus, android net...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Reviewed-by: Maisem Ali <[email protected]>
Signed-off-by: Jordan Whited <[email protected]...

Reviewed-by: Maisem Ali <[email protected]>
Signed-off-by: Jordan Whited <[email protected]...

We only expect a single control message in the normal case, but this
would loop infinitely if th...

CmsgLen() does not account for data alignment.

Reviewed-by: Adrian Dewhurst <[email protected]...

This always struck me as kind of weird and non-standard.

Signed-off-by: Jason A. Donenfeld <Jas...

Cmsghdr uses uint32 and uint64 on 32-bit and 64-bit respectively for the
Len member, which makes...

This commit updates StdNetBind.BatchSize() to return 1 instead of
IdealBatchSize for non-Linux p...

Enable TCP SACK for the gVisor Stack used in tun/netstack. This can
improve throughput by an ord...

This commit re-slices received control messages in StdNetBind to the
value the OS reports on a s...

If RIO is unavailable, NewWinRingBind() falls back to StdNetBind.
StdNetBind uses x/net/ipv{4,6}...

There's not really a use at the moment for making this configurable, and
once bind_windows.go be...

The conn.Bind UDP sockets' send and receive buffers are now being sized
to 7MB, whereas they wer...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Implement TCP offloading via TSO and GRO for the Linux tun.Device, which
is made possible by vir...

Accept packet vectors for reading and writing in the tun.Device and
conn.Bind interfaces, so tha...

Signed-off-by: Jason A. Donenfeld <[email protected]>

For some reason, this was omitted for response messages.

Reported-by: z <[email protected]>
Fixes...

Signed-off-by: Jordan Whited <[email protected]>
Signed-off-by: Jason A. Donenfeld <Jason@zx2...

Signed-off-by: Jason A. Donenfeld <[email protected]>

This seems like a much better demonstration as it removes the need for
external components.

Sig...

Bump gVisor to a recent known-good version.

Signed-off-by: Colin Adler <[email protected]>
...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Without this, `device.Close()` will deadlock.

Signed-off-by: Colin Adler <[email protected]...

Signed-off-by: Brad Fitzpatrick <[email protected]>
Signed-off-by: Jason A. Donenfeld <Jaso...

Now that the gvisor deps aren't insane, we can just do this in the main
module.

Signed-off-by: ...

To build with go1.19, gvisor needs
99325baf ("Bump gVisor build tags to go1.19").

However gviso...

Signed-off-by: Brad Fitzpatrick <[email protected]>
Signed-off-by: Jason A. Donenfeld <Jaso...

Use unix.ByteSliceToString in (*NativeTun).nameSlice to convert the
TUNGETIFF ioctl result []byt...

This does bind_std only; other platforms remain.

The remaining alloc per iteration in the Throu...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Enabled by using Go 1.18. A bit less verbose.

Signed-off-by: Josh Bleecher Snyder <josh@tailsca...

Bump go.mod and README.

Switch to upstream net/netip.

Use strings.Cut.

Signed-off-by: Josh Bl...

This commit fixes all callsites of netip.AddrFromSlice(), which has
changed its signature and no...

Signed-off-by: Alexander Neumann <[email protected]>
[Jason: don't wrap de...

I'm not 100% sure this is correct, but it certainly is a lot simpler.

Signed-off-by: Jason A. D...

Provide a PacketConn interface for netstack's ICMP endpoint; netstack
currently only provides Ec...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Reported-by: J. Michael McAtee <[email protected]>
Signed-off-by: Jason A. Donenfeld <Jaso...

Signed-off-by: Jason A. Donenfeld <[email protected]>

We missed a function exit point. This was exacerbated by e3134bf
("device: defer state machine t...

The deferred RUnlock calls weren't executing until all peers
had been processed. Add an anonymou...

There is no performance impact.

name old time/op new time/op delt...

There are more places where we'll need to add it later, when Go 1.18
comes out with support for ...

A peer.endpoint never becomes nil after being not-nil, so creation is
the only time we actually ...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: David Anderson <[email protected]>
Signed-off-by: Jason A. Donenfeld <Jason...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Forgetting to seed the unsafe rng, the jitter before followed a fixed
pattern, which didn't help...

Signed-off-by: Jason A. Donenfeld <[email protected]>

Suggested-by: Adam Bliss <[email protected]>
Signed-off-by: Jason A. Donenfeld <[email protected]>

Update gvisor to v0.0.0-20211020211948-f76a604701b6, which requires some
changes to tun.go:

Wri...

Signed-off-by: Brad Fitzpatrick <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Signed-off-by: Jason A. Donenfeld <[email protected]>

Only wireguard-windows used this, and it's moving to wgnt exclusively.

Signed-off-by: Jason A. ...