27 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
JackDoan	bf4e37e99d	merge hell	2026-04-21 11:29:39 -05:00
JackDoan	d0825514a0	GSO again	2026-04-21 11:25:47 -05:00
JackDoan	6ee5e18d84	fancy blocking writes ... wait for goroutines to finish and for tun to actually be closed remove yellow squiggles nbio for tun bugz Remove more os.Exit calls and give a more reliable wait for stop function checkpt tun_linux.go: stdlib too slow, but can't use blocking IO and clean shutdown	2026-04-21 11:22:55 -05:00
Jack Doan	e80b9830a3	Remove more os.Exit calls and give a more reliable wait for stop function (attempt 3) (#1661)	2026-04-20 16:08:26 -05:00
Jack Doan	b3194236aa	udp_linux: wrap socket operations with syscall.RawConn for clean teardown (#1654) ... remove runtime.LockOSThread() because it makes things worse now remove the "custom" Write() method from tun_linux.go, the stdlib path via os.File performs better We should change our guidance around number of routines, ~2 per thread (that you wish to use for Nebula) seems to be about right now	2026-04-14 18:25:24 -05:00
Jack Doan	91d1f4675a	properly handle closetunnel packets (#1638)	2026-03-25 11:59:37 -05:00
Jack Doan	51308b845b	connection-track ICMP traffic (#1602) ... * connection-track ICMP and ICMPv6 traffic * icmpv6 only has identifier on echo	2026-02-18 23:19:37 -06:00
Jack Doan	353ad1f271	firewall: icmp no longer requires a port spec (#1609)	2026-02-13 11:10:40 -06:00
Jack Doan	f573e8a266	Merge commit from fork ... Newly signed P256 based certificates will have their signature clamped to the low-s form. Update CHANGELOG.md	2026-02-06 14:26:51 -05:00
Jack Doan	42bee7cf17	Report if Nebula start fails because of tun device name (#1588) ... * specifically report if nebula start fails because of tun device name * close all routines when closing the tun	2026-01-28 10:03:36 -06:00
Jack Doan	3ec527e42c	cert.MarshalSigningPublicKeyToPEM should emit the 'ECDSA' variant of the banner (#1552) ... * cert.MarshalSigningPublicKeyToPEM should emit the 'ECDSA' variant of the banner * oof owie ouch my tests	2025-12-10 10:39:36 -06:00
Jack Doan	6d7cf611c9	improve nebula-cert sign version auto-select (#1535)	2025-11-20 13:27:27 -06:00
Jack Doan	297767b2e3	warn user if they configure a firewall rule that will allow way more traffic than you might expect (#1513) ... * warn user if they accidentally configure a firewall rule that will allow way more traffic than you might expect * add groups-contains-any warning	2025-11-19 11:06:34 -06:00
Jack Doan	a89f95182c	Firewall types and cross-stack subnet stuff (#1509) ... * firewall can distinguish if the host connecting has an overlapping network, is a VPN peer without an overlapping network, or is a unsafe network * Cross stack subnet stuff (#1512) * experiment with not filtering out non-common addresses in hostinfo.networks * allow handshakes without overlaps * unsafe network test * change HostInfo.buildNetworks argument to reference the cert	2025-11-12 13:40:20 -06:00
Jack Doan	0f305d5397	don't block startup on failure to configure SSH (#1520)	2025-11-05 10:41:56 -06:00
Jack Doan	01909f4715	try to make certificate addition/removal reloadable in some cases (#1468) ... * try to make certificate addition/removal reloadable in some cases * very spicy change to respond to handshakes with cert versions we cannot match with a cert that we can indeed match * even spicier change to rehandshake if we detect our cert is lower-version than our peer, and we have a newer-version cert available * make tryRehandshake easier to understand	2025-11-03 19:38:44 -06:00
Jack Doan	770147264d	fix make bench (#1510)	2025-10-21 11:32:34 -05:00
Jack Doan	8824eeaea2	helper functions to more correctly marshal curve 25519 public keys (#1481)	2025-10-02 13:56:41 -05:00
Jack Doan	f1e992f6dd	don't require a detailsVpnAddr in a HostUpdateNotification (#1472) ... * don't require a detailsVpnAddr in a HostUpdateNotification * don't send our own addr on HostUpdateNotification for v2	2025-09-29 13:43:12 -05:00
Jack Doan	1ea5f776d7	update to go 1.25, use the cool new ECDSA key marshalling functions (#1483) ... * update to go 1.25, use the cool new ECDSA key marshalling functions * bonk the runners * actually bump go.mod * bump golangci-lint	2025-09-29 13:02:25 -05:00
Jack Doan	5cccd39465	update RemoteList.vpnAddrs when we complete a handshake (#1467)	2025-09-10 09:44:25 -05:00
Jack Doan	8196c22b5a	store lighthouses as a slice (#1473) ... * store lighthouses as a slice. If you have fewer than 16 lighthouses (and fewer than 16 vpnaddrs on a host, I guess), it's faster	2025-09-10 09:43:25 -05:00
Jack Doan	65cc253c19	prevent linux from assigning ipv6 link-local addresses (#1476)	2025-09-09 13:25:23 -05:00
Jack Doan	768325c9b4	cert-v2 chores (#1466)	2025-09-05 15:08:22 -05:00
Jack Doan	932e329164	Don't delete static host mappings for non-primary IPs (#1464) ... * Don't delete a vpnaddr if it's part of a certificate that contains a vpnaddr that's in the static host map * remove unused arg from ConnectionManager.shouldSwapPrimary()	2025-09-04 14:49:40 -05:00
Jack Doan	4bea299265	don't send recv errors for packets outside the connection window anymore (#1463) ... * don't send recv errors for packets outside the connection window anymore * Pull in fix from #1459, add my opinion on maxRecvError * remove recv_error counter entirely	2025-09-03 11:52:52 -05:00
Jack Doan	fd1906b16f	minor text fixes (#1135)	2024-05-03 20:43:40 -05:00