[vtep] add tun datapath driver + afxdp wrapper (APO-794)

go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/vishvananda/netlink v1.3.1
 	golang.org/x/sync v0.16.0
 	golang.org/x/sys v0.35.0
+	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	gvisor.dev/gvisor v0.0.0-20250606001031-fa4c4dd86b43
 )
 
@@ -25,5 +26,6 @@ require (
 	golang.org/x/crypto v0.41.0 // indirect
 	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -58,6 +58,10 @@ golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
 golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=
+golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

vtep/afxdp/datapath.go

@@ -0,0 +1,53 @@
+//go:build linux
+
+// Package afxdp adapts the zero-copy AF_XDP forwarder.Forwarder to the
+// vtep.Datapath seam. It is the privileged, kernel-zero-copy driver of the vtep
+// family (veth + driver-XDP NIC, shared UMEM, in-place transform), used for the
+// per-node / tunnelproxy VTEP where the overlay consumer is the host kernel.
+//
+// Unlike the netstack and tun drivers — which drive the engine through the
+// cross-buffer EngineXfrm contract — the AF_XDP driver keeps the in-place
+// forwarder.Handler contract and its shared-UMEM zero-copy fast path entirely
+// internally. This wrapper is a pure lifecycle adapter (Run/Close delegate to the
+// forwarder's existing per-queue poll loop); it deliberately does not route the
+// hot path through EngineXfrm, whose copy-based contract would forfeit the
+// zero-copy handoff. The forwarder's in-place loop, shared UMEM, and
+// minInPlaceHeadroom invariant are untouched.
+package afxdp
+
+import (
+	"context"
+
+	"github.com/apoxy-dev/icx/forwarder"
+	"github.com/apoxy-dev/icx/vtep"
+)
+
+// Datapath wraps a *forwarder.Forwarder so it satisfies vtep.Datapath. The
+// wrapped forwarder owns its veth/XDP device and AF_XDP underlay and releases
+// them on Close.
+type Datapath struct {
+	fwd *forwarder.Forwarder
+}
+
+var _ vtep.Datapath = (*Datapath)(nil)
+
+// Wrap adapts an already-constructed forwarder.Forwarder (built via
+// forwarder.NewForwarder with the desired phy/virt/filter options) to the
+// vtep.Datapath interface. The caller transfers ownership: the returned
+// Datapath's Close closes the forwarder.
+func Wrap(fwd *forwarder.Forwarder) *Datapath {
+	return &Datapath{fwd: fwd}
+}
+
+// Run drives the forwarder's per-queue poll loop, blocking until ctx is
+// cancelled or a queue errors, then returns. Run must not be called more than
+// once (the forwarder's own guards apply).
+func (d *Datapath) Run(ctx context.Context) error {
+	return d.fwd.Start(ctx)
+}
+
+// Close releases the forwarder's device and AF_XDP resources. It is idempotent
+// and safe to call after Run returns.
+func (d *Datapath) Close() error {
+	return d.fwd.Close()
+}