John Maguire
6d124d0441
Tolerate ErrDumpInterrupted when listing tun addresses ( #1835 )
smoke-extra / freebsd-amd64 (push) Failing after 37s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 11s
smoke-extra / netbsd-amd64 (push) Failing after 12s
smoke-extra / openbsd-amd64 (push) Failing after 13s
smoke-extra / linux-386 (push) Failing after 14s
smoke / Run multi node smoke test (push) Failing after 1m41s
Build and test / Static checks (push) Successful in 2m10s
Build and test / Test linux (push) Failing after 1m32s
Build and test / Test linux-boringcrypto (push) Failing after 2m45s
Build and test / Test linux-pkcs11 (push) Failing after 1m57s
Build and test / Cross-build linux-arm (push) Successful in 3m8s
Build and test / Cross-build linux-mips (push) Successful in 3m49s
Build and test / Cross-build linux-other (push) Successful in 3m10s
Build and test / Cross-build windows (push) Successful in 1m3s
Build and test / Cross-build freebsd (push) Successful in 1m35s
Build and test / Cross-build netbsd (push) Successful in 1m33s
Build and test / Cross-build openbsd (push) Successful in 1m36s
Build and test / Cross-build mobile (push) Successful in 3m22s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-07-31 19:09:28 +00:00
John Maguire
58f3b6fda7
Document rootless Nebula in example service script ( #1814 )
2026-07-21 19:32:33 -04:00
John Maguire
e290a6892f
Fix relay re-establishment for handshake on Disestablised entry ( #1805 )
...
handleOutsideRelayPacket filled ViaSender.remoteIdx with relay.RemoteIndex,
an index from the relay peer's index space, but the rescue in
sendHandshakeResponse looks that value up in relayForByIdx, which is keyed
by local index. The lookup could never hit, so a terminal relay entry left
Disestablished by a one-sided teardown stayed Disestablished even after a
valid handshake arrived over it. The responder's first transmit then failed
to find an Established relay, deleted its only relay entry, and every
subsequent send was silently dropped until dead-tunnel detection forced a
re-handshake.
2026-07-17 11:57:47 -04:00
John Maguire
0a953915bb
Make HostInfo.remote atomic to fix torn reads on the send path ( #1773 )
2026-07-07 14:27:53 -04:00
John Maguire
184cdc8586
Add OCI image labels with version info ( #1772 )
smoke-extra / freebsd-amd64 (push) Failing after 19s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 16s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 17s
smoke / Run multi node smoke test (push) Failing after 1m31s
Build and test / Static checks (push) Successful in 1m47s
Build and test / Test linux (push) Failing after 2m12s
Build and test / Test linux-boringcrypto (push) Failing after 3m8s
Build and test / Test linux-pkcs11 (push) Failing after 3m1s
Build and test / Cross-build linux-arm (push) Successful in 3m6s
Build and test / Cross-build linux-mips (push) Successful in 3m52s
Build and test / Cross-build linux-other (push) Successful in 3m10s
Build and test / Cross-build windows (push) Successful in 1m5s
Build and test / Cross-build freebsd (push) Successful in 1m35s
Build and test / Cross-build netbsd (push) Successful in 1m36s
Build and test / Cross-build openbsd (push) Successful in 1m36s
Build and test / Cross-build mobile (push) Successful in 3m18s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-06-23 14:21:28 -04:00
John Maguire
e753e6e93c
Immediate Lighthouse update after reconfig/reconnect ( #1645 )
gofmt / Run gofmt (push) Failing after 3s
smoke-extra / Run extra smoke tests (push) Failing after 3s
smoke / Run multi node smoke test (push) Failing after 2s
Build and test / Build all and test on ubuntu-linux (push) Failing after 3s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2026-04-21 16:33:32 -04:00
John Maguire
32a7c04498
Return NODATA instead of NXDOMAIN for missing record types ( #1668 )
...
The DNS responder was setting RCODE=NXDOMAIN (Name Error) any time the
answer section was empty, including for names that exist in the
lighthouse but lack a record of the requested type (e.g. an AAAA query
for a v4-only host). Per RFC 2308 §2.1, NXDOMAIN means "the domain
referred to by the QNAME does not exist", and per RFC 2308 §2.2 a name
that exists with no record of the requested type must be answered with
RCODE=NOERROR and an empty answer section (NODATA).
The practical fallout: busybox ping in Alpine issues AAAA first, treats
NXDOMAIN as a hard failure, and never falls through to A. Returning
NODATA lets the resolver continue to the A query as it should.
Track whether any queried A/AAAA name is known in either map and only
set RcodeNameError when no queried name exists at all.
2026-04-21 16:32:48 -04:00
0ad5c771e9
Refactor CA pool handling to use streaming ( #1644 )
...
gofmt / Run gofmt (push) Failing after 3s
smoke-extra / Run extra smoke tests (push) Failing after 3s
smoke / Run multi node smoke test (push) Failing after 3s
Build and test / Build all and test on ubuntu-linux (push) Failing after 2s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
Co-authored-by: maggie44 <64841595+maggie44@users.noreply.github.com >
Co-authored-by: JackDoan <me@jackdoan.com >
2026-04-13 13:19:55 -04:00
John Maguire
951d368faf
Add a small link to DN Managed Nebula ( #1641 )
...
* Add a small link to DN Managed Nebula
Also link the mobile source code
2026-03-30 16:20:21 -04:00
John Maguire
9f1aef53fa
Fix dissector logic ( #1626 )
...
* Fix typo in Wireshark dissector
* Fix wireshark dissector prefs_changed logic
The previous logic had several issues:
- Changing only the port number (without toggling all_ports) would
not re-register the dissector on the new port.
- Turning all_ports off would remove all registrations but only
re-add the specific port inside a branch that also required
all_ports to have changed, and never updated default_settings.port.
Simplify to: remove all registrations, then register based on current
prefs, then update the cached state.
2026-03-23 11:15:40 -04:00
John Maguire
83ff2461e2
Mention CA expiration in the README ( #1378 )
gofmt / Run gofmt (push) Successful in 10s
smoke-extra / Run extra smoke tests (push) Failing after 20s
smoke / Run multi node smoke test (push) Failing after 1m21s
Build and test / Build all and test on ubuntu-linux (push) Failing after 17m44s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2m20s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m27s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-04-28 13:36:06 -04:00
John Maguire
15b5a43300
Update issue and PR templates ( #1376 )
2025-04-21 13:45:48 -04:00
John Maguire
2dc30fc300
Support 32-bit machines in crypto test ( #1394 )
2025-04-21 13:28:43 -04:00
John Maguire
d4a7df3083
Rename pki.default_version to pki.initiating_version ( #1381 )
gofmt / Run gofmt (push) Successful in 9s
smoke-extra / Run extra smoke tests (push) Failing after 20s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Build all and test on ubuntu-linux (push) Failing after 21m13s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3m19s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m47s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-04-07 18:08:29 -04:00
John Maguire
e136d1d47a
Update example config with default_local_cidr_any changes ( #1373 )
2025-04-01 16:08:03 -05:00
John Maguire
b5c3486796
Push Docker images as part of the release workflow ( #1037 )
2024-05-02 09:37:11 -04:00
John Maguire
f31bab5f1a
Add support for SSH CAs ( #1098 )
...
- Accept certs signed by trusted CAs
- Username must match the cert principal if set
- Any username can be used if cert principal is empty
- Don't allow removed pubkeys/CAs to be used after reload
2024-04-30 10:50:17 -04:00
John Maguire
f7db0eb5cc
Remove Vagrant example ( #1129 )
2024-04-30 09:40:24 -05:00
John Maguire and Oliver Marriott
d7f52dec41
Fix errant capitalisation in DNS TXT response ( #1127 )
...
Co-authored-by: Oliver Marriott <hello@omarriott.com >
2024-04-30 09:58:56 -04:00
John Maguire
41e2e1de02
Remove Fedora nebula.service file ( #1128 )
2024-04-29 15:30:22 -04:00
John Maguire
8b68a08723
Fix "any" firewall rules for unsafe_routes ( #1099 )
2024-03-28 15:17:12 -05:00
John Maguire
8822f1366c
Add link to logs guide in bug report template ( #1065 )
2024-02-01 12:40:23 -05:00
John Maguire
af2fc48378
Fix mobile builds ( #1035 )
2023-12-06 16:18:21 -05:00
John Maguire
87b628ba24
Fix truncated comment in config.yml ( #999 )
2023-10-27 08:39:34 -04:00
John Maguire
7e380bde7e
Document new DNS config options ( #879 )
2023-07-10 15:19:05 -04:00
John Maguire
8ba5d64dbc
Add support for naming FreeBSD tun devices ( #903 )
2023-06-22 12:13:31 -04:00
John Maguire
165b671e70
v1.7.1 ( #878 )
...
Update CHANGELOG for Nebula v1.7.1
2023-05-18 15:39:24 -04:00
John Maguire
a56a97e5c3
Add ability to encrypt CA private key at rest ( #386 )
...
Fixes #8 .
`nebula-cert ca` now supports encrypting the CA's private key with a
passphrase. Pass `-encrypt` in order to be prompted for a passphrase.
Encryption is performed using AES-256-GCM and Argon2id for KDF. KDF
parameters default to RFC recommendations, but can be overridden via CLI
flags `-argon-memory`, `-argon-parallelism`, and `-argon-iterations`.
2023-04-03 13:59:38 -04:00
John Maguire
5bd8712946
Immediately forward packets from self to self on FreeBSD ( #808 )
2023-01-23 15:51:54 -06:00
John Maguire
c44da3abee
Make DNS queries case insensitive ( #793 )
2022-12-20 16:59:11 -05:00
John Maguire
b7e73da943
Add note indicating modes have usage text ( #794 )
2022-12-20 16:53:56 -05:00
John Maguire
ff54bfd9f3
Add nebula-cert.exe and cert files to .gitignore ( #722 )
2022-12-20 16:52:51 -05:00
John Maguire
b5a85a6eb8
Update example config with IPv6 note for allow lists ( #742 )
2022-12-20 16:50:02 -05:00
John Maguire