a5cb635db4
use P256 as the default curve for fips140 mode
2026-07-29 16:04:25 -04:00
bf2f26b66f
clean up empty line
2026-07-29 14:40:11 -04:00
7c00c74550
complain earlier if in FIPS-140 enforced mode
2026-07-29 14:37:21 -04:00
738b4fa044
cleanup
2026-07-24 10:26:38 -04:00
0e1f5342ac
test fips140.Enforced mode
2026-07-24 10:03:22 -04:00
00b498f9f9
self-test the reflect code at init
2026-07-24 09:11:53 -04:00
69e5e8eeb4
cleanup
2026-07-24 08:22:58 -04:00
fc950cf765
one var for default fips version
2026-07-24 08:21:22 -04:00
0d91e3e4d8
update PHONY
2026-07-24 08:19:33 -04:00
e8322505ab
fix fips140-all
2026-07-24 08:17:52 -04:00
009d42b4f5
Merge remote-tracking branch 'origin/master' into fips140
2026-07-23 11:37:11 -04:00
f8775bb6ca
Use go 1.26 (latest 1.26.5) ( #1818 )
2026-07-23 10:36:20 -05:00
8d8cc4f73d
note that boringcrypto is deprecated
2026-07-23 10:55:40 -04:00
e16a31ff6a
return err instead of panic
2026-07-23 10:52:06 -04:00
15f0f0d5d0
Be less verbose with handshake send errors ( #1810 )
2026-07-23 09:26:45 -05:00
7902ce674e
Rebind for MacOS ( #1816 )
...
Co-authored-by: Jack Doan <me@jackdoan.com >
2026-07-23 09:26:24 -05:00
c2fbe215e6
Fix a test race, make dns server reload/restart safer ( #1815 )
smoke-extra / freebsd-amd64 (push) Failing after 54s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 11s
smoke-extra / netbsd-amd64 (push) Failing after 11s
smoke-extra / openbsd-amd64 (push) Failing after 22s
smoke-extra / linux-386 (push) Failing after 23s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Static checks (push) Successful in 2m11s
Build and test / Test linux (push) Failing after 1m7s
Build and test / Test linux-boringcrypto (push) Failing after 2m41s
Build and test / Test linux-pkcs11 (push) Failing after 2m2s
Build and test / Cross-build linux-arm (push) Successful in 3m5s
Build and test / Cross-build linux-mips (push) Successful in 3m48s
Build and test / Cross-build linux-other (push) Successful in 3m8s
Build and test / Cross-build windows (push) Successful in 1m4s
Build and test / Cross-build freebsd (push) Successful in 1m36s
Build and test / Cross-build netbsd (push) Successful in 1m33s
Build and test / Cross-build openbsd (push) Successful in 1m32s
Build and test / Cross-build mobile (push) Successful in 3m16s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-07-22 15:05:10 -05:00
94ac6db4ca
Bump the golang-x-dependencies group across 1 directory with 5 updates ( #1800 )
...
Bumps the golang-x-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto ), [golang.org/x/net](https://github.com/golang/net ) and [golang.org/x/sync](https://github.com/golang/sync ).
Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0 )
Updates `golang.org/x/net` from 0.56.0 to 0.57.0
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0 )
Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0 )
Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0 )
Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/net
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sync
dependency-version: 0.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sys
dependency-version: 0.47.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/term
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-22 15:51:22 -04:00
a60350e34e
Bump actions/setup-go from 6 to 7 ( #1807 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6 to 7.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-22 15:49:45 -04:00
58f3b6fda7
Document rootless Nebula in example service script ( #1814 )
2026-07-21 19:32:33 -04:00
a99699e370
before removing a pending hostinfo in handshake_manager, make sure it's the one we wanted to delete ( #1811 )
2026-07-21 10:31:00 -05:00
3615a79b8b
add locks around replay window updates ( #1802 )
2026-07-20 10:28:53 -05:00
6be3d2264e
cleanup nonce
2026-07-20 10:03:29 -04:00
048fa3fa70
Merge remote-tracking branch 'origin/master' into fips140
2026-07-20 09:38:05 -04:00
147c202c27
Swap back to a blocking udp socket, test shutdown(2) ( #1806 )
...
Co-authored-by: Jack Doan <me@jackdoan.com >
2026-07-17 15:16:45 -05:00
e290a6892f
Fix relay re-establishment for handshake on Disestablised entry ( #1805 )
...
handleOutsideRelayPacket filled ViaSender.remoteIdx with relay.RemoteIndex,
an index from the relay peer's index space, but the rescue in
sendHandshakeResponse looks that value up in relayForByIdx, which is keyed
by local index. The lookup could never hit, so a terminal relay entry left
Disestablished by a one-sided teardown stayed Disestablished even after a
valid handshake arrived over it. The responder's first transmit then failed
to find an Established relay, deleted its only relay entry, and every
subsequent send was silently dropped until dead-tunnel detection forced a
re-handshake.
2026-07-17 11:57:47 -04:00
6c3972f464
code-sign: default the S3 key-prefix to the calling repo ( #1799 )
2026-07-13 11:49:59 -05:00
861d3aabd7
correct directionality of firewall.inbound_action and firewall.outbound_action ( #1798 )
2026-07-13 08:40:42 -05:00
86733864fe
don't make new relay state on a just-discarded tunnel ( #1796 )
2026-07-10 12:02:17 -05:00
ab736e4c6b
Make Control safe to stop and wait on from any lifecycle state ( #1794 )
2026-07-10 10:35:17 -05:00
5ecdd4eaa9
Fix e2e test races when looking at hostmap counts ( #1795 )
2026-07-09 18:48:14 -05:00
1b84bd0050
Remove dev fmt.Println ( #1793 )
2026-07-09 11:04:25 -05:00
384610f81a
hostmap: replace the shared next/prev hostinfo chain with independent per-address lists so divergent or overlapping vpnAddr sets cannot corrupt the map ( #1790 )
2026-07-09 09:34:30 -05:00
3264ebf953
cleanup
2026-07-08 10:55:29 -04:00
3c1dd52953
update README
2026-07-08 10:51:38 -04:00
4e8733ca22
run all smoke tests with -race
...
Why not?
2026-07-08 10:46:21 -04:00
6675f5a361
use go:debug to enable fips140=only
...
This is safer because it doesn't clober other defaults that are set by
Go or the environment.
2026-07-08 10:41:24 -04:00
14c9288127
Ensure Curve25519 and ChaChaPoly are not used in fips140 enforced mode
...
Since these some from golang/x/crypto, there is a change that stdlib
fips140.Enforced gate won't catch their usage.
2026-07-08 10:33:55 -04:00
90c7630270
extract the internal FIPS GCM implementation
...
We do this because the TLS wrapper is not thread safe on Open. instead of locking around it we
can grab the internal implementation that is thread safe. This is the FIPS
module implementation: `crypto/internal/fips140/aes/gcm.GCMWithXORCounterNonce`
- https://github.com/golang/go/blob/go1.26.4/src/crypto/internal/fips140/aes/gcm/gcm_nonces.go#L212-L287
The wrapper is struct `crypto/tls.xorNonceAEAD`, with field `aead`:
- https://github.com/golang/go/blob/go1.26.4/src/crypto/tls/cipher_suites.go#L482-L487
This can be cleaned up once these FIPS implementations are exposed directly:
- https://github.com/golang/go/issues/73110
2026-07-08 10:19:48 -04:00
c1eea118f4
fix firewall port/proto bypass in parseV6 from uint8 extension-header length overflow ( #1789 )
2026-07-07 20:43:26 -05:00
1e66c0d3ee
hostmap: unlink a multi-vpnAddr hostinfo from the shared chain exactly once on delete ( #1788 )
2026-07-07 17:32:25 -05:00
e5c0fdad8d
Darwin and openbsd in line with the other bsds for tun support ( #1703 )
2026-07-07 17:05:12 -05:00
7bd0bc285a
sshd: guard trustedKeys/trustedCAs with a mutex to fix a concurrent map crash on reload ( #1787 )
2026-07-07 15:50:06 -05:00
942ee522e0
lighthouse: unmap 4-in-6 addresses in protoV6AddrPortToNetAddrPort so remote_allow_list v4 rules apply ( #1786 )
2026-07-07 15:23:39 -05:00
32149f3a93
Bump github.com/kardianos/service from 1.2.4 to 1.3.0 ( #1782 )
...
Bumps [github.com/kardianos/service](https://github.com/kardianos/service ) from 1.2.4 to 1.3.0.
- [Commits](https://github.com/kardianos/service/compare/v1.2.4...v1.3.0 )
---
updated-dependencies:
- dependency-name: github.com/kardianos/service
dependency-version: 1.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 14:42:33 -05:00
19ad3bb904
correctly discard nil proto addresses ( #1785 )
2026-07-07 14:41:01 -05:00
647775d8c3
Bump golang.zx2c4.com/wireguard/windows ( #1665 )
...
Bumps the zx2c4-dependencies group with 1 update in the / directory: golang.zx2c4.com/wireguard/windows.
Updates `golang.zx2c4.com/wireguard/windows` from 0.6.1 to 1.0.1
---
updated-dependencies:
- dependency-name: golang.zx2c4.com/wireguard/windows
dependency-version: 1.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: zx2c4-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 13:40:12 -05:00
abfeb502a8
iputil: fix infinite loop in ipv6FindUpperProtocol from uint8 extension-header length overflow ( #1784 )
2026-07-07 13:28:52 -05:00
0a953915bb
Make HostInfo.remote atomic to fix torn reads on the send path ( #1773 )
2026-07-07 14:27:53 -04:00
6aa3363d85
Add explicit unmarshaller for signing and key agreement public keys ( #1777 )
2026-07-07 13:16:57 -05:00
Wade Simmons