41 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
JackDoanandClaude Fable 5	10e9514e44	pin tun reader threads to CPUs so per-flow packets keep wire order ... Each listenIn goroutine locks its OS thread and pins it to one CPU (sched_setaffinity), so every UDP send from that goroutine leaves through the same XPS-selected NIC TX ring instead of being sprayed across rings and reordered. On by default via tun.pin_threads; queue i pins to the i-th entry of the process's allowed CPU set (respecting cpuset/taskset masks, whose IDs are often not 0..NumCPU-1), or to an explicit tun.cpu_affinity list, validated against that same allowed set. Linux only; pinning is a no-op elsewhere. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-16 12:25:58 -05:00
JackDoanandClaude Fable 5	913a37cfee	overlay: replace per-fd tun readers with a batched Queue interface ... Device loses io.ReadWriteCloser + NewMultiQueueReader in favor of Queues(n), which returns up to n tio.Queue objects; platforms without multiqueue hand back their single queue and the interface sizes its reader routines to what it actually got. Queue.Read returns a batch of borrowed packets (single-element for every current backend) so a future backend can deliver more than one packet per syscall without another interface change. The Linux poll/eventfd machinery moves out of tun_linux.go into the new overlay/tio package: nonblocking fds, a shared shutdown eventfd owned by the queue set, and pollfd arrays built on the stack so concurrent writers parked in blockOnWrite no longer share Revents storage. Other platforms wrap their existing one-datagram Read/Write in a singleQueue adapter that owns a private scratch buffer, so multiqueue-by-sharing devices (user, disabled) no longer race concurrent readers on one buffer. This is the tun-interface subset of better-tun-interface-ordering, extracted at 18dc13b with none of the GSO/GRO offload mechanics and no udp/sendmmsg changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-16 12:19:09 -05:00
Jack Doan	861d3aabd7	correct directionality of firewall.inbound_action and firewall.outbound_action (#1798)	2026-07-13 08:40:42 -05:00
Jack Doan	86733864fe	don't make new relay state on a just-discarded tunnel (#1796)	2026-07-10 12:02:17 -05:00
Jack Doan	19ad3bb904	correctly discard nil proto addresses (#1785)	2026-07-07 14:41:01 -05:00
Jack Doan	95d98b1f4b	firewall: move conntrack check after cert+IP verification (#1779)	2026-07-07 13:10:11 -05:00
Jack Doan	6afca0f461	correctly handle a test packet with a payload longer than the header (#1778)	2026-07-03 11:06:22 -05:00
Jack Doan	16b302c11d	Relay log fix (#1765) ... * ensure CreateRelayRequest gets logged correctly * ensure CreateRelayResponse gets logged correctly	2026-06-16 11:38:34 -05:00
Jack Doan	2e9117da5b	fix tunnels that could permanently escape connection-manager monitoring (#1752)	2026-06-10 11:03:23 -05:00
Jack Doan	a690c904ba	improve rejection of malformed handshakes (#1756)	2026-06-10 09:28:07 -05:00
Jack Doan	e028e6bf1a	disallow negative stats intervals (#1754)	2026-06-10 09:27:40 -05:00
Jack Doan	3db406b8ac	fix a race in RelayState.CopyRelayIps (#1753)	2026-06-10 09:27:15 -05:00
Jack Doan	eaad4896c1	udp_darwin: don't call the EncReader on a UDP error (#1755)	2026-06-10 09:26:31 -05:00
Jack Doan	e6032f81aa	correctly record window counters for relayed packets in a tunnel (#1751)	2026-06-09 16:18:59 -05:00
Jack Doan	a82a8dc547	don't panic on bad ed25519 key lengths (#1601) ... * don't panic on bad ed25519 key lengths * don't allow mismatched curves * add test	2026-05-06 17:00:07 -05:00
Jack Doan	ff91c37529	switch Bits to a packed u64 (#1705)	2026-05-06 10:22:26 -05:00
Jack Doan	5f890dbc34	noise: only type-assert once (#1691)	2026-04-24 13:12:42 -05:00
Jack Doan	e80b9830a3	Remove more os.Exit calls and give a more reliable wait for stop function (attempt 3) (#1661)	2026-04-20 16:08:26 -05:00
Jack Doan	b3194236aa	udp_linux: wrap socket operations with syscall.RawConn for clean teardown (#1654) ... remove runtime.LockOSThread() because it makes things worse now remove the "custom" Write() method from tun_linux.go, the stdlib path via os.File performs better We should change our guidance around number of routines, ~2 per thread (that you wish to use for Nebula) seems to be about right now	2026-04-14 18:25:24 -05:00
Jack Doan	91d1f4675a	properly handle closetunnel packets (#1638)	2026-03-25 11:59:37 -05:00
Jack Doan	51308b845b	connection-track ICMP traffic (#1602) ... * connection-track ICMP and ICMPv6 traffic * icmpv6 only has identifier on echo	2026-02-18 23:19:37 -06:00
Jack Doan	353ad1f271	firewall: icmp no longer requires a port spec (#1609)	2026-02-13 11:10:40 -06:00
Jack Doan	f573e8a266	Merge commit from fork ... Newly signed P256 based certificates will have their signature clamped to the low-s form. Update CHANGELOG.md	2026-02-06 14:26:51 -05:00
Jack Doan	42bee7cf17	Report if Nebula start fails because of tun device name (#1588) ... * specifically report if nebula start fails because of tun device name * close all routines when closing the tun	2026-01-28 10:03:36 -06:00
Jack Doan	3ec527e42c	cert.MarshalSigningPublicKeyToPEM should emit the 'ECDSA' variant of the banner (#1552) ... * cert.MarshalSigningPublicKeyToPEM should emit the 'ECDSA' variant of the banner * oof owie ouch my tests	2025-12-10 10:39:36 -06:00
Jack Doan	6d7cf611c9	improve nebula-cert sign version auto-select (#1535)	2025-11-20 13:27:27 -06:00
Jack Doan	297767b2e3	warn user if they configure a firewall rule that will allow way more traffic than you might expect (#1513) ... * warn user if they accidentally configure a firewall rule that will allow way more traffic than you might expect * add groups-contains-any warning	2025-11-19 11:06:34 -06:00
Jack Doan	a89f95182c	Firewall types and cross-stack subnet stuff (#1509) ... * firewall can distinguish if the host connecting has an overlapping network, is a VPN peer without an overlapping network, or is a unsafe network * Cross stack subnet stuff (#1512) * experiment with not filtering out non-common addresses in hostinfo.networks * allow handshakes without overlaps * unsafe network test * change HostInfo.buildNetworks argument to reference the cert	2025-11-12 13:40:20 -06:00
Jack Doan	0f305d5397	don't block startup on failure to configure SSH (#1520)	2025-11-05 10:41:56 -06:00
Jack Doan	01909f4715	try to make certificate addition/removal reloadable in some cases (#1468) ... * try to make certificate addition/removal reloadable in some cases * very spicy change to respond to handshakes with cert versions we cannot match with a cert that we can indeed match * even spicier change to rehandshake if we detect our cert is lower-version than our peer, and we have a newer-version cert available * make tryRehandshake easier to understand	2025-11-03 19:38:44 -06:00
Jack Doan	770147264d	fix make bench (#1510)	2025-10-21 11:32:34 -05:00
Jack Doan	8824eeaea2	helper functions to more correctly marshal curve 25519 public keys (#1481)	2025-10-02 13:56:41 -05:00
Jack Doan	f1e992f6dd	don't require a detailsVpnAddr in a HostUpdateNotification (#1472) ... * don't require a detailsVpnAddr in a HostUpdateNotification * don't send our own addr on HostUpdateNotification for v2	2025-09-29 13:43:12 -05:00
Jack Doan	1ea5f776d7	update to go 1.25, use the cool new ECDSA key marshalling functions (#1483) ... * update to go 1.25, use the cool new ECDSA key marshalling functions * bonk the runners * actually bump go.mod * bump golangci-lint	2025-09-29 13:02:25 -05:00
Jack Doan	5cccd39465	update RemoteList.vpnAddrs when we complete a handshake (#1467)	2025-09-10 09:44:25 -05:00
Jack Doan	8196c22b5a	store lighthouses as a slice (#1473) ... * store lighthouses as a slice. If you have fewer than 16 lighthouses (and fewer than 16 vpnaddrs on a host, I guess), it's faster	2025-09-10 09:43:25 -05:00
Jack Doan	65cc253c19	prevent linux from assigning ipv6 link-local addresses (#1476)	2025-09-09 13:25:23 -05:00
Jack Doan	768325c9b4	cert-v2 chores (#1466)	2025-09-05 15:08:22 -05:00
Jack Doan	932e329164	Don't delete static host mappings for non-primary IPs (#1464) ... * Don't delete a vpnaddr if it's part of a certificate that contains a vpnaddr that's in the static host map * remove unused arg from ConnectionManager.shouldSwapPrimary()	2025-09-04 14:49:40 -05:00
Jack Doan	4bea299265	don't send recv errors for packets outside the connection window anymore (#1463) ... * don't send recv errors for packets outside the connection window anymore * Pull in fix from #1459, add my opinion on maxRecvError * remove recv_error counter entirely	2025-09-03 11:52:52 -05:00
Jack Doan	fd1906b16f	minor text fixes (#1135)	2024-05-03 20:43:40 -05:00