JackDoan
dff5c51dd6
Make post-quantum handshakes hybrid only: drop ix_psk2_mlkem1024, need a v3 certificate, and leave a classical msg1 crossing a hybrid one unanswered
2026-10-14 14:58:29 -05:00
JackDoan
656164b259
cert: Name the post-quantum algorithms of a version 3 certificate with a PQSuite, like its curve, and pick the hybrid subtype by the suite's KEM
2026-10-14 14:40:52 -05:00
JackDoan
bbade4dc9a
Take a hybrid tunnel on msg3 even over a newer one, the initiator has committed to it
2026-10-14 12:56:12 -05:00
JackDoan
70e7d3f2ea
Hold a pending hybrid responder locked until it is filled in
2026-10-14 11:09:18 -05:00
JackDoan
b26c1e9c3e
Run hybrid handshakes: v3 holders initiate them, responders wait for msg3, initiators resend it until confirmed
2026-10-14 11:03:04 -05:00
JackDoan
13658b74a0
Add handshakes.pq.require, and give new paths and responsive peers the PQ attempt
2026-10-14 10:18:00 -05:00
JackDoan
22cdb0739a
Demand cookies for post-quantum msg1s while under load, and reload handshakes.pq settings
2026-10-13 22:50:28 -05:00
JackDoan
a36ce25af4
Speak post-quantum handshakes over fragments, alternating with classical until one answers
2026-10-13 22:42:07 -05:00
Matt Richardson
f9b0853476
Attach a pending handshake's RemoteList when the handshake starts ( #1909 )
...
StartHandshake returned a hostinfo with no RemoteList; handleOutbound attached
one lazily on its first tick. Anything that touched the pending host before
then, notably create-tunnel -address, dereferenced nil and took the daemon
down. StartHandshake now attaches the lighthouse's list as it builds the
hostinfo. To keep the surrounding locking sound, a lighthouse now resolves a
punch target before taking the querier's RemoteList lock, and closeTunnel
deletes the host and evicts its RemoteList under a single hostmap write lock so
a completing handshake cannot land in between. The lock order, now documented
on the handshake manager mutex, is hostmap, then handshake manager, then
lighthouse, then RemoteList; no RemoteList lock is ever held across a hostmap
lookup.
2026-10-07 11:22:50 -04:00
Jack Doan
edc3c5e018
the definitive tun offloads branch ( #1704 )
2026-08-21 11:57:38 -05:00
Nate Brown
f15d10fc54
Enforce outbound message counter limits to prevent nonce reuse ( #1841 )
2026-08-19 20:48:02 -05:00
Nate Brown
15f0f0d5d0
Be less verbose with handshake send errors ( #1810 )
2026-07-23 09:26:45 -05:00
Jack Doan
a99699e370
before removing a pending hostinfo in handshake_manager, make sure it's the one we wanted to delete ( #1811 )
2026-07-21 10:31:00 -05:00
John Maguire
e290a6892f
Fix relay re-establishment for handshake on Disestablised entry ( #1805 )
...
handleOutsideRelayPacket filled ViaSender.remoteIdx with relay.RemoteIndex,
an index from the relay peer's index space, but the rescue in
sendHandshakeResponse looks that value up in relayForByIdx, which is keyed
by local index. The lookup could never hit, so a terminal relay entry left
Disestablished by a one-sided teardown stayed Disestablished even after a
valid handshake arrived over it. The responder's first transmit then failed
to find an Established relay, deleted its only relay entry, and every
subsequent send was silently dropped until dead-tunnel detection forced a
re-handshake.
2026-07-17 11:57:47 -04:00
Nate Brown
384610f81a
hostmap: replace the shared next/prev hostinfo chain with independent per-address lists so divergent or overlapping vpnAddr sets cannot corrupt the map ( #1790 )
2026-07-09 09:34:30 -05:00
Jack Doan
2e9117da5b
fix tunnels that could permanently escape connection-manager monitoring ( #1752 )
smoke-extra / freebsd-amd64 (push) Failing after 16s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 16s
smoke-extra / linux-386 (push) Failing after 17s
smoke / Run multi node smoke test (push) Failing after 1m25s
Build and test / Static checks (push) Successful in 1m42s
Build and test / Test linux (push) Failing after 2m17s
Build and test / Test linux-boringcrypto (push) Failing after 3m9s
Build and test / Test linux-pkcs11 (push) Failing after 2m54s
Build and test / Cross-build linux-arm (push) Successful in 3m3s
Build and test / Cross-build linux-mips (push) Successful in 3m44s
Build and test / Cross-build linux-other (push) Successful in 3m7s
Build and test / Cross-build windows (push) Successful in 59s
Build and test / Cross-build freebsd (push) Successful in 1m33s
Build and test / Cross-build netbsd (push) Successful in 1m34s
Build and test / Cross-build openbsd (push) Successful in 1m33s
Build and test / Cross-build mobile (push) Successful in 3m15s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-06-10 11:03:23 -05:00
Nate Brown
3a95495c63
Fix duplicate log fields which slog duplicates ( #1734 )
smoke-extra / freebsd-amd64 (push) Failing after 16s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 16s
smoke-extra / netbsd-amd64 (push) Failing after 15s
smoke-extra / openbsd-amd64 (push) Failing after 15s
smoke-extra / linux-386 (push) Failing after 15s
smoke / Run multi node smoke test (push) Failing after 1m27s
Build and test / Static checks (push) Successful in 40s
Build and test / Test linux (push) Failing after 1m7s
Build and test / Test linux-boringcrypto (push) Failing after 2m41s
Build and test / Test linux-pkcs11 (push) Failing after 2m3s
Build and test / Cross-build linux-arm (push) Successful in 3m5s
Build and test / Cross-build linux-mips (push) Successful in 3m57s
Build and test / Cross-build linux-other (push) Successful in 3m5s
Build and test / Cross-build windows (push) Successful in 1m0s
Build and test / Cross-build freebsd (push) Successful in 1m33s
Build and test / Cross-build netbsd (push) Successful in 1m31s
Build and test / Cross-build openbsd (push) Successful in 1m33s
Build and test / Cross-build mobile (push) Successful in 3m13s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-05-22 10:19:53 -05:00
Nate Brown
873f94f465
Reduce relay log spam ( #1733 )
2026-05-22 10:19:06 -05:00
Nate Brown
33c2d7277c
Reduce HandshakeManager complexity a little bit ( #1701 )
gofmt / Run gofmt (push) Failing after 3s
smoke-extra / Run extra smoke tests (push) Failing after 3s
smoke / Run multi node smoke test (push) Failing after 2s
Build and test / Build all and test on ubuntu-linux (push) Failing after 3s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2026-05-01 13:21:38 -05:00
Nate Brown
9ec8cf10f3
Handshake state machine ( #1656 )
2026-04-30 21:30:27 -05:00
Nate Brown
d0f02ba873
Switch to slog, remove logrus ( #1672 )
2026-04-27 09:41:47 -05:00
Wade Simmons
422fc2ad1e
go fix ( #1608 )
gofmt / Run gofmt (push) Failing after 3s
smoke-extra / Run extra smoke tests (push) Failing after 2s
smoke / Run multi node smoke test (push) Failing after 2s
Build and test / Build all and test on ubuntu-linux (push) Failing after 2s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2026-02-17 11:42:14 -05:00
Nate Brown
56067afca2
Stab at better logging when a relay is being used ( #1533 )
gofmt / Run gofmt (push) Failing after 5s
smoke-extra / Run extra smoke tests (push) Failing after 2s
smoke / Run multi node smoke test (push) Failing after 3s
Build and test / Build all and test on ubuntu-linux (push) Failing after 2s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-12-03 17:48:29 -06:00
Jack Doan
a89f95182c
Firewall types and cross-stack subnet stuff ( #1509 )
...
* firewall can distinguish if the host connecting has an overlapping network, is a VPN peer without an overlapping network, or is a unsafe network
* Cross stack subnet stuff (#1512 )
* experiment with not filtering out non-common addresses in hostinfo.networks
* allow handshakes without overlaps
* unsafe network test
* change HostInfo.buildNetworks argument to reference the cert
2025-11-12 13:40:20 -06:00
Jack Doan
01909f4715
try to make certificate addition/removal reloadable in some cases ( #1468 )
...
* try to make certificate addition/removal reloadable in some cases
* very spicy change to respond to handshakes with cert versions we cannot match with a cert that we can indeed match
* even spicier change to rehandshake if we detect our cert is lower-version than our peer, and we have a newer-version cert available
* make tryRehandshake easier to understand
2025-11-03 19:38:44 -06:00
brad-defined
b158eb0c4c
Use a list for relay IPs instead of a map ( #1423 )
...
* Use a list for relay IPs instead of a map
* linter
2025-07-02 08:47:05 -04:00
Wade Simmons
b8ea55eb90
optimize usage of bart ( #1395 )
...
gofmt / Run gofmt (push) Successful in 9s
smoke-extra / Run extra smoke tests (push) Failing after 19s
smoke / Run multi node smoke test (push) Failing after 1m19s
Build and test / Build all and test on ubuntu-linux (push) Failing after 18m41s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2m47s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m47s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
Use `bart.Lite` and `.Contains` as suggested by the bart maintainer:
- https://github.com/gaissmai/bart/commit/9455952eedcf59a6e755fc28ed16e906fa4f3066#commitcomment-155362580
2025-04-18 12:37:20 -04:00
Nate Brown
f8734ffa43
Improve logging when handshaking with an invalid cert ( #1345 )
2025-03-07 10:45:31 -06:00
d97ed57a19
V2 certificate format ( #1216 )
...
Co-authored-by: Nate Brown <nbrown.us@gmail.com >
Co-authored-by: Jack Doan <jackdoan@rivian.com >
Co-authored-by: brad-defined <77982333+brad-defined@users.noreply.github.com >
Co-authored-by: Jack Doan <me@jackdoan.com >
2025-03-06 11:28:26 -06:00
Nate Brown
08ac65362e
Cert interface ( #1212 )
2024-10-10 18:00:22 -05:00
Jack Doan
248cf194cd
fix integer wraparound in the calculation of handshake timeouts on 32-bit targets ( #1185 )
...
Fixes : #1169
2024-08-13 09:25:18 -04:00
Wade Simmons
f5f6c269ac
fix rare panic when local index collision happens ( #1191 )
...
A local index collision happens when two tunnels attempt to use the same
random int32 index ID. This is a rare chance, and we have code to deal
with it, but we have a panic because we return the wrong thing in this
case. This change should fix the panic.
2024-08-07 11:53:32 -04:00
Nate Brown
e264a0ff88
Switch most everything to netip in prep for ipv6 in the overlay ( #1173 )
2024-07-31 10:18:56 -05:00
Wade Simmons
4eb1da0958
remove deadlock in GetOrHandshake ( #1151 )
...
We had a rare deadlock in GetOrHandshake because we kept the hostmap
lock when we do the call to StartHandshake. StartHandshake can block
while sending to the lighthouse query worker channel, and that worker
needs to be able to grab the hostmap lock to do its work. Other calls
for StartHandshake don't hold the hostmap lock so we should be able to
drop it here.
This lock was originally added with: https://github.com/slackhq/nebula/pull/954
2024-05-29 12:52:52 -04:00
Wade Simmons
7efa750aef
avoid deadlock in lighthouse queryWorker ( #1112 )
...
* avoid deadlock in lighthouse queryWorker
If the lighthouse queryWorker tries to grab to call StartHandshake on
a lighthouse vpnIp, we can deadlock on the handshake_manager lock. This
change drops the handshake_manager lock before we send on the lighthouse
queryChan (which could block), and also avoids sending to the channel if
this is a lighthouse IP itself.
* need to hold lock during cacheCb
2024-04-11 17:00:01 -04:00
Nate Brown
a390125935
Support reloading preferred_ranges ( #1043 )
2024-04-03 22:14:51 -05:00
Nate Brown
072edd56b3
Fix re-entrant GetOrHandshake issues ( #1044 )
2023-12-19 11:58:31 -06:00
Nate Brown
a44e1b8b05
Clean up a hostinfo to reduce memory usage ( #955 )
2023-11-02 16:53:59 -05:00
Nate Brown
50d6a1e8ca
QueryServer needs to be done outside of the lock ( #996 )
2023-10-17 15:43:51 -05:00
Nate Brown
076ebc6c6e
Simplify getting a hostinfo or starting a handshake with one ( #954 )
2023-08-21 18:51:45 -05:00
Nate Brown
7edcf620c0
We only need the certificate in ConnectionState ( #953 )
2023-08-21 14:11:06 -05:00
Nate Brown
a10baeee92
Pull hostmap and pending hostmap apart, remove unused functions ( #843 )
2023-07-24 12:37:52 -05:00
Nate Brown
3bbf5f4e67
Use an interface for udp conns ( #901 )
2023-06-14 10:48:52 -05:00
03e4a7f988
Rehandshaking ( #838 )
...
Co-authored-by: Brad Higgins <brad@defined.net >
Co-authored-by: Wade Simmons <wadey@slack-corp.com >
2023-05-04 15:16:37 -05:00
brad-defined
9b03053191
update EncReader and EncWriter interface function args to have concrete types ( #844 )
...
* Update LightHouseHandlerFunc to remove EncWriter param.
* Move EncWriter to interface
* EncReader, too
2023-04-07 14:28:37 -04:00
Nate Brown
d3fe3efcb0
Fix handshake retry regression ( #842 )
2023-04-05 10:04:30 -05:00
Nate Brown and brad-defined
ee8e1348e9
Use connection manager to drive NAT maintenance ( #835 )
...
Co-authored-by: brad-defined <77982333+brad-defined@users.noreply.github.com >
2023-03-31 15:45:05 -05:00
Nate Brown
1a6c657451
Normalize logs ( #837 )
2023-03-30 15:07:31 -05:00
brad-defined and Nate Brown
2801fb2286
Fix relay ( #827 )
...
Co-authored-by: Nate Brown <nbrown.us@gmail.com >
2023-03-30 11:09:20 -05:00
Nate Brown
f0ef80500d
Remove dead code and re-order transit from pending to main hostmap on stage 2 ( #828 )
2023-03-17 15:36:24 -05:00
JackDoan