the definitive tun offloads branch

[JackDoan]

formerly known as "biggest headache yet"

[rawdigits]

Bug: sendNoMetrics panics on relayed connections with small packets (e.g. TestReply)

Panic:

panic: runtime error: slice bounds out of range [:48] with capacity 32

goroutine 57 [running]:
github.com/slackhq/nebula.(*Interface).sendNoMetrics(...)
    inside.go:569

Root cause: sendNoMetrics saves fullOut := out before offsetting out for the relay header. After EncryptDanger, if the buffer was too small (cap < header + ciphertext + AEAD tag), Go allocates a new backing array for out. But fullOut still points at the original small buffer. Then fullOut[:header.Len+len(out)] overflows.

MTU-sized buffers (normal data packets) always have enough capacity so EncryptDanger writes in-place — fullOut and out share the same array and everything works. Small packets like TestReply (~32 bytes) don't — EncryptDanger reallocates, fullOut goes stale, panic.

Conditions to trigger: (1) relayed tunnel (no direct path between peers), AND (2) small packet (TestReply health-check ping is the common case). Direct tunnels never hit the relay branch; large packets never trigger reallocation.

Fix (9 lines, applies cleanly to current PR HEAD):

-			f.SendVia(relayHostInfo, relay, out, nb, fullOut[:header.Len+len(out)], true)
+			needed := header.Len + len(out)
+			if needed <= cap(fullOut) {
+				f.SendVia(relayHostInfo, relay, out, nb, fullOut[:needed], true)
+			} else {
+				// EncryptDanger reallocated out into a new backing array, so fullOut
+				// no longer contains the encrypted payload. Build a new relay buffer.
+				relayBuf := make([]byte, needed)
+				copy(relayBuf[header.Len:], out)
+				f.SendVia(relayHostInfo, relay, out, nb, relayBuf, true)
+			}

Happy path (buffer big enough) is identical behavior — just guarded by a cap check. The else branch handles the reallocation edge case.

Hit this in production on a host behind residential NAT where peer tunnels are relayed through lighthouses. Gateway routers with public IPs never trigger it because their tunnels are direct.

[JackDoan]

@rawdigits fixed this a layer up by making relay outbounds also use the tx batcher, which also puts them on the fast path

[JackDoan]

don't merge this!

[JackDoan]

this is what's causing the e2e fails

[JackDoan]

probably shouldn't merge in this PR either but it makes clod shut up when asking for reviews