iOS/Macos App for Nylon/ Nylon Export node implementation

[Evsio0n]

Hello, I've been developing this application for Nylon for a while now.

It uses a tailscale-like egress node to add an egress ID to the Nylon protocol, and then implements this egress node to route all traffic as an egress.

If you're interested, I can try porting this part of the functionality I implemented into your main branch in the future.

mobile: https://github.com/Evsio0n/nylon/tree/main/mobile
Export node implementation: Evsio0n@9b9a2b0

[encodeous]

That UI looks really nice! Does it use the IPC mechanism, or the one you implemented previously? I'm not sure if IPC offers everything you need in the UI, so lmk if you need additional data.

As for the exit node, I think I generally agree with the approach of adding a distinct protocol.

• I was originally thinking of advertising 0.0.0.0/0 on one of the nodes as exit node, but that means the client cannot pick an exit node

Looking at the implementation, there are a few things I want to point out:

1. We might need to come up with an internal binary node id in place of the node id string. It's generally not good for performance to have a variable length string in the header (since this is a hot path)
2. We should be VERY careful when using Nylon.* inside of a packet filter. Since accessing those fields require synchronization if done outside of the main dispatch thread. Consider looking at using atomic.Pointer (e.g: https://github.com/encodeous/nylon/blob/main/core/nylon.go#L48). We can periodically/on change update pointer atomically, since this is a read-heavy, write-few path.
3. We should probably better document the header format, and considering what other purposes we can use this new packet type for, outside of exit node routing. (E.g using this to push configs to nodes, or query state). Ultimately, this new packet type represents a way we can unicast to a node on the network within nylon, similar to GRE/other tunnels.

However, I think this is a great idea! You should open up a PR with the changes for the exit node, and we can gradually iron out the implementation. This is a great first step.

Also, I suggest rebasing to the latest commit ASAP, since there were a lot of changes to the core structure of nylon.

[Evsio0n]

1. Binary node id. Introduced state.NodeIdBin (uint16) plus a deterministic BuildNodeIdMap that derives the encoding from sorted CentralCfg routers

• clients. The unicast header now carries fixed 2-byte src/dst instead of variable-length strings on the hot path. Central config validation rejects
  networks larger than 65535 nodes so the encoding can't overflow.

2. No Nylon.* access from the packet filter. Added Nylon.ExitFilter atomic.Pointer[ExitFilterSnapshot] and Nylon.NodeIdMap
   atomic.Pointer[state.NodeIdMap]. The snapshot bundles everything the filter needs — local id, exit settings, per-node source-address ownership, and
   a NodeIdBin → next-hop peer table — and is rebuilt on the dispatch goroutine in three places: Init, ApplyCentralConfig, and every
   TableInsert/DeleteRoute. The dataplane does exactly one atomic.Load. The NodeForward map is populated by looking each node's Addresses up in the
   existing ForwardTable so it transparently handles Babel supernet aggregation.
3. Documented + generic header. The earlier NyExitProtoId is gone; in its place is a generic NyUnicastProtoId (still 9) with the wire format spelled
   out at the top of core/nylon_unicast.go:

poly outer (3 B): protoId<<4 | length
payload (6 B) : subtype | hop_limit | dst_bin(BE u16) | src_bin(BE u16)
payload+6 ... : subtype payload

3. The first subtype = 1 is exit-encap. Future node-targeted features (config push, state query, RPC) can land as new subtype values without
   re-touching the framing.

Tests: unit tests for the NodeIdBin map (deterministic across input ordering, reserved zero), the unicast header round-trip, source-address
ownership, and ComputeSysRouteTable exit behaviour. End-to-end test TestExplicitExitNodeMultiHop (3-node client / relay / exit, asserts ExitEncap /
ExitTransit / ExitDecap traces fire and ping actually round-trips). All green locally with -tags e2e on Docker.

Branch is rebased on current main (eef93e9).

Intentionally out of scope of this PR, will be sent in follow-up PRs after this one merges:

• The iOS/macOS backend client side — both gomobile/ (Go bridge, MobileTunnelRoutes.ExitNode, scoped exit NAT for Linux/Darwin, etc.)
  pages. I'll rebase the client work on top of whatever this PR lands as, then open a separate PR for it.
  SwiftUI app I will create a new repo to upload.