Add macOS support, fix bloom filter routing and MMP intervals

macOS platform:
- Platform-native TUN interface management with shutdown pipe
- Raw Ethernet transport with macOS socket backend (socket_macos.rs)
- EthernetTransport and TransportHandle::Ethernet ungated from Linux-only
- macOS .pkg packaging (build-pkg.sh, launchd plist, uninstall script)
- CI: macOS build and unit test jobs; x86_64 cross-compiled from
  macos-latest via rustup target add x86_64-apple-darwin

Gateway feature flag:
- New opt-in `gateway` Cargo feature activates optional `rustables` dep
- `pub mod gateway` and `Config.gateway` gated behind the feature so
  macOS builds never pull in Linux-only nftables bindings
- `fips-gateway` bin has `required-features = ["gateway"]`
- All Linux/OpenWrt/AUR packaging passes `--features gateway`

CI / packaging:
- package-linux, package-macos, package-openwrt now trigger on push to
  master/maint/next and on pull requests; release uploads remain tag-gated
- Bloom filter routing fix: fall through to tree routing when no candidate
  is strictly closer
- MMP intervals: raise MIN to 1s / MAX to 5s with 5-sample cold-start phase

src/node/lifecycle.rs

@@ -587,6 +587,22 @@ impl Node {
                     info!("effective MTU: {} bytes", effective_mtu);
                     debug!("   max TCP MSS: {} bytes", max_mss);
 
+                    // On macOS, create a shutdown pipe. Writing to it unblocks the
+                    // reader thread's select() loop without closing the TUN fd
+                    // (which would cause a double-close when TunDevice drops).
+                    #[cfg(target_os = "macos")]
+                    let (shutdown_read_fd, shutdown_write_fd) = {
+                        let mut fds = [0i32; 2];
+                        if unsafe { libc::pipe(fds.as_mut_ptr()) } < 0 {
+                            return Err(NodeError::Tun(
+                                crate::upper::tun::TunError::Configure(
+                                    "failed to create shutdown pipe".into(),
+                                ),
+                            ));
+                        }
+                        (fds[0], fds[1])
+                    };
+
                     // Create writer (dups the fd for independent write access)
                     let (writer, tun_tx) = device.create_writer(max_mss)?;
 
@@ -604,6 +620,11 @@ impl Node {
 
                     // Spawn reader thread
                     let transport_mtu = self.transport_mtu();
+                    #[cfg(target_os = "macos")]
+                    let reader_handle = thread::spawn(move || {
+                        run_tun_reader(device, mtu, our_addr, reader_tun_tx, outbound_tx, transport_mtu, shutdown_read_fd);
+                    });
+                    #[cfg(not(target_os = "macos"))]
                     let reader_handle = thread::spawn(move || {
                         run_tun_reader(device, mtu, our_addr, reader_tun_tx, outbound_tx, transport_mtu);
                     });
@@ -614,6 +635,8 @@ impl Node {
                     self.tun_outbound_rx = Some(outbound_rx);
                     self.tun_reader_handle = Some(reader_handle);
                     self.tun_writer_handle = Some(writer_handle);
+                    #[cfg(target_os = "macos")]
+                    { self.tun_shutdown_fd = Some(shutdown_write_fd); }
                 }
                 Err(e) => {
                     self.tun_state = TunState::Failed;
@@ -704,11 +727,21 @@ impl Node {
             // Drop the tun_tx to signal the writer to stop
             self.tun_tx.take();
 
-            // Delete the interface (causes reader to get EFAULT)
+            // Delete the interface (on Linux, causes reader to get EFAULT)
             if let Err(e) = shutdown_tun_interface(&name).await {
                 warn!(name = %name, error = %e, "Failed to shutdown TUN interface");
             }
 
+            // On macOS, signal the reader thread to exit by writing to the
+            // shutdown pipe. The reader's select() will wake up and break.
+            #[cfg(target_os = "macos")]
+            if let Some(fd) = self.tun_shutdown_fd.take() {
+                unsafe {
+                    libc::write(fd, b"x".as_ptr() as *const libc::c_void, 1);
+                    libc::close(fd);
+                }
+            }
+
             // Wait for threads to finish
             if let Some(handle) = self.tun_reader_handle.take() {
                 let _ = handle.join();

src/node/mod.rs

@@ -33,7 +33,6 @@ use crate::transport::{
 use crate::transport::udp::UdpTransport;
 use crate::transport::tcp::TcpTransport;
 use crate::transport::tor::TorTransport;
-#[cfg(target_os = "linux")]
 use crate::transport::ethernet::EthernetTransport;
 use crate::tree::TreeState;
 use crate::upper::hosts::HostMap;
@@ -364,6 +363,10 @@ pub struct Node {
     tun_reader_handle: Option<JoinHandle<()>>,
     /// TUN writer thread handle.
     tun_writer_handle: Option<JoinHandle<()>>,
+    /// Shutdown pipe: writing to this fd unblocks the TUN reader thread on macOS.
+    /// On Linux, deleting the interface via netlink serves the same purpose.
+    #[cfg(target_os = "macos")]
+    tun_shutdown_fd: Option<std::os::unix::io::RawFd>,
 
     // === DNS Responder ===
     /// Receiver for resolved identities from the DNS responder.
@@ -530,6 +533,8 @@ impl Node {
             tun_outbound_rx: None,
             tun_reader_handle: None,
             tun_writer_handle: None,
+            #[cfg(target_os = "macos")]
+            tun_shutdown_fd: None,
             dns_identity_rx: None,
             dns_task: None,
             index_allocator: IndexAllocator::new(),
@@ -640,6 +645,8 @@ impl Node {
             tun_outbound_rx: None,
             tun_reader_handle: None,
             tun_writer_handle: None,
+            #[cfg(target_os = "macos")]
+            tun_shutdown_fd: None,
             dns_identity_rx: None,
             dns_task: None,
             index_allocator: IndexAllocator::new(),
@@ -695,23 +702,19 @@ impl Node {
         }
 
         // Create Ethernet transport instances
-        #[cfg(target_os = "linux")]
-        {
-            let eth_instances: Vec<_> = self
-                .config
-                .transports
-                .ethernet
-                .iter()
-                .map(|(name, config)| (name.map(|s| s.to_string()), config.clone()))
-                .collect();
-
-            let xonly = self.identity.pubkey();
-            for (name, eth_config) in eth_instances {
-                let transport_id = self.allocate_transport_id();
-                let mut eth = EthernetTransport::new(transport_id, name, eth_config, packet_tx.clone());
-                eth.set_local_pubkey(xonly);
-                transports.push(TransportHandle::Ethernet(eth));
-            }
+        let eth_instances: Vec<_> = self
+            .config
+            .transports
+            .ethernet
+            .iter()
+            .map(|(name, config)| (name.map(|s| s.to_string()), config.clone()))
+            .collect();
+        let xonly = self.identity.pubkey();
+        for (name, eth_config) in eth_instances {
+            let transport_id = self.allocate_transport_id();
+            let mut eth = EthernetTransport::new(transport_id, name, eth_config, packet_tx.clone());
+            eth.set_local_pubkey(xonly);
+            transports.push(TransportHandle::Ethernet(eth));
         }
 
         // Create TCP transport instances
@@ -831,18 +834,9 @@ impl Node {
                 ))
             })?;
 
-        // Parse the MAC address
-        #[cfg(target_os = "linux")]
         let mac = crate::transport::ethernet::parse_mac_string(mac_str).map_err(|e| {
             NodeError::NoTransportForType(format!("invalid MAC in '{}': {}", addr_str, e))
         })?;
-        #[cfg(not(target_os = "linux"))]
-        let mac: [u8; 6] = {
-            let _ = mac_str;
-            return Err(NodeError::NoTransportForType(
-                "Ethernet transport not available on this platform".into(),
-            ));
-        };
 
         Ok((transport_id, TransportAddr::from_bytes(&mac)))
     }

src/node/rate_limit.rs

@@ -272,12 +272,20 @@ mod tests {
         }
         assert!(!bucket.available());
 
-        // Wait for refill
-        thread::sleep(Duration::from_millis(50)); // Should refill ~5 tokens
+        // Wait for refill, measuring actual elapsed time to avoid sensitivity
+        // to OS scheduler variance (sleep can overshoot by a large margin).
+        let before = Instant::now();
+        thread::sleep(Duration::from_millis(50));
+        let elapsed_secs = before.elapsed().as_secs_f64();
+
+        // Expected tokens = elapsed * rate, capped at capacity.
+        // Allow ±20% tolerance around the actual elapsed time.
+        let expected = (elapsed_secs * 100.0).min(10.0);
+        let lo = (expected * 0.8).min(expected - 0.5).max(0.0);
+        let hi = (expected * 1.2).max(expected + 0.5).min(10.0);
 
-        // Should have tokens now
         let tokens = bucket.tokens();
-        assert!((4.0..=6.0).contains(&tokens), "tokens: {}", tokens);
+        assert!((lo..=hi).contains(&tokens), "tokens: {}, expected ~{:.2} (range {:.2}..={:.2})", tokens, expected, lo, hi);
     }
 
     #[test]

src/node/tests/mod.rs

@@ -9,7 +9,6 @@ mod bloom;
 mod ble;
 mod disconnect;
 mod discovery;
-#[cfg(target_os = "linux")]
 mod ethernet;
 mod forwarding;
 mod handshake;