personal_interest_mirrors/nebula
1
0 Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-11-15 14:56:52 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
831 Commits 120 Branches 30 Tags
21a7f1b7111879ad45fa5cc35a66645a9622d9b1
Commit Graph
831 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ryan HuberandClaude Opus 5.5 21a7f1b711 overlay/darwin: read the utun with recvmsg_x 
tunQueue.Read now takes up to 64 queued packets with one recvmsg_x through
internal/msgx, each into its own 64KiB slot of a buffer allocated once per
queue, and falls back to the readv drain for good when recvmsg_x is refused
or returns a batch intact msghdr_x entries can't produce, or for one Read on
a transient error. Ported from the pipeline bench build's tunRecvX, minus its
env toggle and stats.

With 64 pending packets on the utun this is the remaining send gain: on an
M2 mini, one stream, pipeline + 64 pending reads 4.9 Gbps with recvmsg_x and
2.6 with the readv loop, the same as this branch before this commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-30 13:27:27 +00:00
Ryan HuberandClaude Opus 5.5 64bec56404 darwin: pipeline listenIn's sends so write batches can form 
On darwin, listenIn encrypts into one SendBatch while a sender goroutine
writes the other (batch.SendPipeline). The sender takes whatever built up
during its last write, so writes overlap tun reads and packets queued
behind a write leave in one WriteBatch, which a connected socket sends as
one sendmsg_x. Two batches bound memory; a full producer waits for the
swap rather than dropping. One producer and one sender keep per-peer order
equal to message-counter order.

Everywhere else the branch is a false constant and listenIn is unchanged.
-tags send_pipeline builds the pipeline on any platform, so its tests and
the e2e suite can run through it on linux.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-30 11:11:48 +00:00
Ryan HuberandClaude Opus 5.5 81f991f1fd overlay/darwin: batch tun writes with sendmsg_x, drain reads, 64 pending packets 
tun.WriteBatch writes up to 64 packets per sendmsg_x on the utun control
socket, and Passthrough.Flush hands its lane to it whole through the new
tio.BatchWriter (Caleb Jasik's #1896). Only the darwin tun implements
BatchWriter, so every other platform keeps one Write per packet.

tunQueue.Read drains every packet already queued on the utun, up to 64,
so a burst reaches the send batch together.

xnu lets only one packet wait on a utun control socket by default, so
each read found one packet. The tun now raises
UTUN_OPT_MAX_PENDING_PACKETS to 64, growing SO_RCVBUF to hold that many
packets first; on failure it logs and keeps xnu's default.

Tests: #1896's WriteBatch tests over sendmsg_x and the writev fallback,
the drain tests, the pending-packet setsockopts, and #1906's framing and
zero-alloc Read/Write tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-30 11:11:48 +00:00
Ryan HuberandClaude Opus 5.5 21075ba32e udp/darwin: batch receives and connected-socket sends with recvmsg_x/sendmsg_x 
internal/msgx is the one copy of xnu's private batched socket calls: the
msghdr_x layout, Send/Recv through the raw syscall (EINTR retried) and
Unsupported for the errnos a kernel or sandbox refuses them with.

Every socket the listener owns reads with recvmsg_x: the listener and each
connected socket run their own reader goroutine, and hand whole batches to
ListenOut over a channel. ListenOut runs the EncReader over a batch and
flushes once, so the reader stays single-threaded without a lock that
readers contend on, and the next recvmsg_x overlaps the decrypt of the last
batch. Batch buffers (64 x MTU) come from a per-listener free list that
keeps up to 11; a reader takes one only while its socket is readable, so
idle connected sockets hold none. A batch with a header intact msghdr_x
entries can't produce, or ENOSYS/EPERM/EOPNOTSUPP, switches every reader to
one datagram per read for good.

Connected sockets send runs with sendmsg_x, which xnu batches through the
stack on a connected socket. EAGAIN/ENOBUFS keep #1901's single-datagram
stall handling; a refused sendmsg_x retries the datagram with write and
turns sendmsg_x off once that goes through.

The connected-socket knobs lose their NEBULA_CONNSOCK* environment
overrides and keep #1901's defaults.

Based on Caleb Jasik's #1895 (recvmsg_x) and #1897 (sendmsg_x), and Jack
Doan's internal/msgx shape from #1898.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-30 11:11:48 +00:00
Caleb JasikandClaude Opus 5.5 37032a22bf udp/darwin: send to busy established peers on connected sockets 
On darwin an unconnected sendto runs the address and MAC policy checks
and the EndpointSecurity send check for every datagram, and while
xprotectd throttles it each send takes about 185us, which caps a
tunnel's upload and, through its ACKs, its download. A connected socket
runs those checks once, at connect, and it is the only UDP send that
reports the interface queue's flow control, as ENOBUFS.

Only the current direct remote of an established tunnel is eligible.
udp.EstablishedPeerConn is an optional Conn interface, implemented on
darwin; establishedRemotes refcounts remotes over the main hostmap and
tells each writer on the first and last reference: handshake completion
adds one, deleting or retiring a hostinfo removes it, SetRemote (roaming,
SetRemoteIfPreferred, control, ssh) moves it. Pending and relayed
hostinfos hold none, and a rehandshake's two hostinfos share one.

An eligible peer that Nebula sends NEBULA_CONNSOCK_RUN (64) datagrams to
within NEBULA_CONNSOCK_WINDOW (1s) gets a connected socket: SO_REUSEPORT,
bound to the source address the listener's route to the peer picks on
the listener's port, carrying the listener's IP_BOUND_IF. The peer sees
the same address and port as from the listener, and the socket's reader
delivers through the listener's reader. The listener itself never sets
SO_REUSEPORT (listen routines still do), so no other uid can bind the
port; with a specific listen.host and no routines connected sockets stay
off, since sharing an exact address needs SO_REUSEPORT on both.

All routines listening on one address share one set of connected
sockets: at most NEBULA_CONNSOCKS (8), one per peer, with opens from a
bucket that refills one per NEBULA_CONNSOCK_OPEN_EVERY (1s). A socket
closes when its peer stops being eligible, after NEBULA_CONNSOCK_IDLE
(30s) without traffic, on Rebind (of every routine) and Close, and on an
error that means the connected path is gone. Closing never runs under
the hostmap's or the eligibility lock; the peer can't reopen until the
close finishes. A send that gets ENOBUFS or EAGAIN waits within one
10ms budget shared by every writer since the last send that went
through, then drops; nothing waits in the netpoller without a deadline.
When nothing is eligible or open, a send costs one atomic load before
the listener path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-30 09:59:09 +00:00
Jack Doan 7cfa47d569 tweaks to error handling in iputil.IPv6FindUpperProtocol (#1893) 2026-09-22 15:45:01 -05:00
Caleb JasikandNate Brown e20569ce51 Let the darwin tun adopt an fd the host already configured (#1890) 
newTunFromFd was a stub on darwin, so an embedder handed a utun by the OS had
no way to use it. A darwin network extension is given exactly that:
NEPacketTunnelProvider creates the device and applies addressing, mtu and
routes from its network settings, and a sandboxed extension cannot change them
afterwards. Adopting that fd means everything about moving packets is shared
with newTun and only the setup differs, so the tun tracks whether the host owns
it and leaves the system routing table and interface config alone when it does.

Co-authored-by: Nate Brown <nbrown.us@gmail.com>
 2026-09-22 11:54:30 -05:00
Caleb JasikandNate Brown 9651ffdb0d Cancel the context when Main hands back no Control (#1889) 
The goroutines Main starts stop only when its context does, and only a caller
holding the Control can arrange that. Cancelling solely on error left a config
test, which returns no Control and no error, with the lighthouse query worker
and a hostname resolver per dns named static host running for the life of the
process. Every embedder that validates a config in process rather than by
exec'ing pays for that on each config load, dnclient and the apple clients
included.

Co-authored-by: Nate Brown <nbrown.us@gmail.com>
 2026-09-22 11:52:28 -05:00
Jack Doan 3a45c01656 Advertise underlay addresses on Android (#1881) 2026-09-21 14:59:56 -05:00
Jack Doan 019cc46a7f smoke: Prove windows honors NlMtu with a 9000 byte ping (#1873) 2026-09-21 12:59:31 -05:00
Nate Brown cf3f315cd3 IPv6FindUpperProtocol: fail closed when the extension header walk runs out of budget (#1883) 2026-09-21 12:09:51 -05:00
Wade Simmons 3fc627e08d Add script to backport a merged PR to a release branch (#1851) 
* Add script to backport a merged PR to a release branch

.github/backport.sh cherry-picks a merged PR's commit onto a release
branch and opens a backport PR mirroring the shape of #1842.

- Infers the target release from the PR's milestone (v1.12.0 -> release-1.11);
  an explicit target-version argument overrides it.
- Requires a clean working tree (untracked files allowed) before starting.
- Prompts with the exact push and gh pr create commands before running them.
- Sets the new PR's milestone to the highest open v<target>.* milestone.
- Removes the needs-backport label from the original PR once the backport opens.
- Supports --continue to resume after resolving cherry-pick conflicts.

* cleanup

* just fetch all of origin

We need to ensure we have MERGE_SHA available too
 2026-09-14 16:14:43 -04:00
dependabot[bot] abff1a4555 Bump Vampire/setup-wsl from 3 to 7 (#1720) 
Bumps [Vampire/setup-wsl](https://github.com/vampire/setup-wsl) from 3 to 7.
- [Release notes](https://github.com/vampire/setup-wsl/releases)
- [Commits](https://github.com/vampire/setup-wsl/compare/v3...v7)

---
updated-dependencies:
- dependency-name: Vampire/setup-wsl
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 10:11:27 -04:00
dependabot[bot] 227134a1d5 Bump golang.org/x/net in the golang-x-dependencies group (#1876) 
Bumps the golang-x-dependencies group with 1 update: [golang.org/x/net](https://github.com/golang/net).


Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](https://github.com/golang/net/compare/v0.58.0...v0.59.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 10:01:25 -04:00
dependabot[bot] 232bacfdd0 Bump github.com/gaissmai/bart from 0.28.0 to 0.29.0 (#1829) 
Bumps [github.com/gaissmai/bart](https://github.com/gaissmai/bart) from 0.28.0 to 0.29.0.
- [Release notes](https://github.com/gaissmai/bart/releases)
- [Commits](https://github.com/gaissmai/bart/compare/v0.28.0...v0.29.0)

---
updated-dependencies:
- dependency-name: github.com/gaissmai/bart
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:39:13 -04:00
dependabot[bot] 4e1ef9cd73 Bump the golang-x-dependencies group across 1 directory with 5 updates (#1875) 
Bumps the golang-x-dependencies group with 2 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto) and [golang.org/x/sync](https://github.com/golang/sync).


Updates `golang.org/x/crypto` from 0.54.0 to 0.57.0
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.57.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](https://github.com/golang/net/compare/v0.57.0...v0.58.0)

Updates `golang.org/x/sync` from 0.22.0 to 0.23.0
- [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0)

Updates `golang.org/x/sys` from 0.47.0 to 0.48.0
- [Commits](https://github.com/golang/sys/compare/v0.47.0...v0.48.0)

Updates `golang.org/x/term` from 0.45.0 to 0.46.0
- [Commits](https://github.com/golang/term/compare/v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:37:37 -04:00
dependabot[bot] 614e0ea3aa Bump google.golang.org/protobuf (#1846) 
Bumps the protobuf-dependencies group with 1 update in the / directory: google.golang.org/protobuf.


Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: protobuf-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:31:44 -04:00
dependabot[bot] 2999fc0b6a Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#1859) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:29:03 -04:00
dependabot[bot] f474b534e1 Bump github.com/miekg/dns from 1.1.72 to 1.1.73 (#1860) 
Bumps [github.com/miekg/dns](https://github.com/miekg/dns) from 1.1.72 to 1.1.73.
- [Commits](https://github.com/miekg/dns/compare/v1.1.72...v1.1.73)

---
updated-dependencies:
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:28:03 -04:00
Wade Simmons 0dc8a28d1f apply go fix for Go 1.26 (#1867) 
* apply `go fix` for Go 1.26

This applies the `go fix` recommendations for go1.26

* for all of ./...
 2026-09-14 09:25:35 -04:00
Nate Brown 89178f45ba windows: Fix NLMTU for ipv6 (#1871)
smoke-extra / freebsd-amd64 (push) Failing after 16s
Details
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
Details
smoke-extra / netbsd-amd64 (push) Failing after 14s
Details
smoke-extra / openbsd-amd64 (push) Failing after 17s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m33s
Details
Build and test / Static checks (push) Successful in 21s
Details
Build and test / Test linux (push) Failing after 59s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m49s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m38s
Details
Build and test / Test linux-fips140 (push) Failing after 2m52s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m54s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m35s
Details
Build and test / Cross-build windows (push) Successful in 59s
Details
Build and test / Cross-build freebsd (push) Successful in 1m28s
Details
Build and test / Cross-build openbsd (push) Successful in 1m28s
Details
Build and test / Cross-build mobile (push) Successful in 3m7s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
Build and test / Cross-build linux-other (push) Successful in 2m58s
Details
Build and test / Cross-build netbsd (push) Successful in 1m28s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details
2026-09-08 18:30:16 -05:00
Wade Simmons 6a72e1c304 v1.11.1 Changelog (#1857)
smoke-extra / freebsd-amd64 (push) Failing after 18s
Details
smoke-extra / linux-amd64-ipv6disable (push) Failing after 17s
Details
smoke-extra / netbsd-amd64 (push) Failing after 14s
Details
smoke-extra / openbsd-amd64 (push) Failing after 16s
Details
smoke-extra / linux-386 (push) Failing after 17s
Details
smoke / Run multi node smoke test (push) Failing after 1m33s
Details
Build and test / Static checks (push) Successful in 23s
Details
Build and test / Test linux (push) Failing after 58s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m50s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m36s
Details
Build and test / Test linux-fips140 (push) Failing after 3m0s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m50s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m34s
Details
Build and test / Cross-build windows (push) Successful in 1m0s
Details
Build and test / Cross-build freebsd (push) Successful in 1m28s
Details
Build and test / Cross-build openbsd (push) Successful in 1m28s
Details
Build and test / Cross-build mobile (push) Successful in 3m9s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
Build and test / Cross-build linux-other (push) Successful in 2m59s
Details
Build and test / Cross-build netbsd (push) Successful in 1m28s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details 
Copy the v1.11.1 CHANGELOG updates from release-v1.11
 2026-09-08 13:50:27 -04:00
Matt Richardson e50f8128f4 Drop hostQueries to our overlay addresses (#1866)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 23s
Details
smoke-extra / netbsd-amd64 (push) Failing after 16s
Details
smoke-extra / openbsd-amd64 (push) Failing after 11s
Details
smoke-extra / linux-386 (push) Failing after 22s
Details
smoke / Run multi node smoke test (push) Failing after 1m37s
Details
Build and test / Static checks (push) Successful in 2m16s
Details
Build and test / Test linux (push) Failing after 1m20s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m50s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m39s
Details
Build and test / Test linux-fips140 (push) Failing after 2m51s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m55s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m41s
Details
Build and test / Cross-build windows (push) Successful in 1m1s
Details
Build and test / Cross-build freebsd (push) Successful in 1m30s
Details
Build and test / Cross-build openbsd (push) Successful in 1m30s
Details
Build and test / Cross-build mobile (push) Successful in 3m10s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
smoke-extra / freebsd-amd64 (push) Failing after 24s
Details
Build and test / Cross-build linux-other (push) Successful in 3m0s
Details
Build and test / Cross-build netbsd (push) Successful in 1m29s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details 
* Drop hostQueries to our overlay addresses

Don't bother responding to hostQuery's for our overlay addresses.
 2026-09-04 11:26:08 -04:00
Jack Doan dd8f660c0a save about 10MB of RAM by not importing gopacket except for tests (#1864)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
Details
smoke-extra / netbsd-amd64 (push) Failing after 15s
Details
smoke-extra / openbsd-amd64 (push) Failing after 16s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m34s
Details
Build and test / Static checks (push) Successful in 46s
Details
Build and test / Test linux (push) Failing after 1m11s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m51s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m35s
Details
Build and test / Test linux-fips140 (push) Failing after 2m41s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m57s
Details
Build and test / Cross-build linux-mips (push) Successful in 4m0s
Details
Build and test / Cross-build windows (push) Successful in 1m2s
Details
Build and test / Cross-build freebsd (push) Successful in 1m30s
Details
Build and test / Cross-build openbsd (push) Successful in 1m29s
Details
Build and test / Cross-build mobile (push) Successful in 3m7s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
smoke-extra / freebsd-amd64 (push) Failing after 15s
Details
Build and test / Cross-build linux-other (push) Successful in 3m2s
Details
Build and test / Cross-build netbsd (push) Successful in 1m29s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details 
* save about 10MB of RAM by not importing gopacket except for tests

* big ol find-replace
 2026-08-28 14:00:09 -05:00
Caleb Jasik ec3304e3a9 Recompute the transport checksum on self-forwarded packets (#1862)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 14s
Details
smoke-extra / netbsd-amd64 (push) Failing after 16s
Details
smoke-extra / openbsd-amd64 (push) Failing after 15s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m34s
Details
Build and test / Static checks (push) Successful in 43s
Details
Build and test / Test linux (push) Failing after 1m29s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m2s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m46s
Details
Build and test / Test linux-fips140 (push) Failing after 2m41s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m0s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m46s
Details
Build and test / Cross-build windows (push) Successful in 1m1s
Details
Build and test / Cross-build freebsd (push) Successful in 1m33s
Details
Build and test / Cross-build openbsd (push) Successful in 1m33s
Details
Build and test / Cross-build mobile (push) Successful in 3m16s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
smoke-extra / freebsd-amd64 (push) Failing after 16s
Details
Build and test / Cross-build linux-other (push) Successful in 3m8s
Details
Build and test / Cross-build netbsd (push) Successful in 1m32s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details
2026-08-27 16:10:32 -05:00
Jack Doan aaa2ff7fff respect setting for tun.pin_threads_key (#1861) 2026-08-27 12:31:08 -05:00
Nate Brown 657f6ad044 Fold the rebind counter and traffic flags into one atomic word (#1820)
smoke-extra / freebsd-amd64 (push) Failing after 23s
Details
smoke-extra / linux-amd64-ipv6disable (push) Failing after 14s
Details
smoke-extra / netbsd-amd64 (push) Failing after 13s
Details
smoke-extra / openbsd-amd64 (push) Failing after 13s
Details
smoke-extra / linux-386 (push) Failing after 11s
Details
smoke / Run multi node smoke test (push) Failing after 1m36s
Details
Build and test / Static checks (push) Successful in 2m15s
Details
Build and test / Test linux (push) Failing after 58s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m55s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m40s
Details
Build and test / Test linux-fips140 (push) Failing after 2m41s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m3s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m43s
Details
Build and test / Cross-build windows (push) Successful in 1m2s
Details
Build and test / Cross-build freebsd (push) Successful in 1m32s
Details
Build and test / Cross-build openbsd (push) Successful in 1m33s
Details
Build and test / Cross-build mobile (push) Successful in 3m18s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
Build and test / Cross-build linux-other (push) Successful in 3m5s
Details
Build and test / Cross-build netbsd (push) Successful in 1m32s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details
2026-08-26 15:15:37 -05:00
Jack Doan 19e04db115 disable offloads by default for first release (#1858) 2026-08-24 12:33:08 -05:00
Wade Simmons 9c5d701648 Support native Golang "fips140" mode (#1696) 
Add support for the "fips140" mode of Go:

- https://go.dev/doc/security/fips140
- https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247

You can build with `make fips140`, see the README changes for more info.

Some differences from the boringcrypto builds:

- We switch to using `go:linkname crypto/tls.aeadAESGCMTLS13`, which gives us the fips implementation for both `boringcrypto` and `fips140` modes. This means we also no longer need `-checklinkname=0`
- Go native `fips140` doesn't need CGO_ENABLED=1
- We decide if we should use the fips140 GCM at runtime, if `fips140.Enabled()` is true. If you use the `make release-fips140`, we build with build tag `fips140enforce` which ensures the binary is running with fips140 enabled and that only P256 / AES-GCM is being used. If you don't want this enforce mode, you can build without the build tag.
 2026-08-21 19:33:40 -04:00
Jack Doan edc3c5e018 the definitive tun offloads branch (#1704) 2026-08-21 11:57:38 -05:00
Nate Brown b8b159a486 release: retry the STS assume until the secret key survives Windows (#1855) 2026-08-21 11:03:43 -05:00
Nate Brown 49e35d1283 parseV6: only walk real ipv6 extension headers, fail closed on unknown protocols (#1840) 2026-08-20 13:21:08 -05:00
sn0w 6fcb926334 cmd/ca: prevent out-of-memory on 32bit systems (#1834) 2026-08-20 14:07:31 -04:00
Jay R. WrenandClaude 28d82f7b8a Drop dependency on github.com/cyberdelia/go-metrics-graphite (#1832) 
The go-metrics-graphite package has been unmaintained for 10+ years,
which is a packaging and supply-chain concern for downstream
distributors (see #1831). Nebula only used its Config struct and Once()
entrypoint, so inline just those (~65 lines) into a local graphite.go,
preserving the upstream BSD-2-Clause copyright notice, and remove the
dependency.

Fixes #1831

Co-authored-by: Claude <svc-devxp-claude@slack-corp.com>
 2026-08-20 09:46:41 -04:00
Nate Brown f15d10fc54 Enforce outbound message counter limits to prevent nonce reuse (#1841) 2026-08-19 20:48:02 -05:00
dependabot[bot] bfe7790848 Bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1847) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 20:19:10 -05:00
Nate Brown e7b4e094b9 Take Apple signing credentials from Secrets Manager (#1833) 2026-08-18 15:35:57 -05:00
Wade Simmons 6740518403 use stdlib maps.Values (#1843) 
* use stdlib maps.Values

This has been in stdlib since go1.23, no need to use golang.org/x/exp
anymore just for this:

- https://pkg.go.dev/maps#Values

* use slices.AppendSeq to match old behavior
 2026-08-18 14:49:41 -04:00
dependabot[bot]andWade Simmons 5cbf029d06 Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (#1828) 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.1.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.1)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Wade Simmons <wadey@slack-corp.com>
 2026-08-17 13:51:48 -04:00
dependabot[bot] 368855c2e8 Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#1827) 
Bumps [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml) from 3.0.4 to 3.0.5.
- [Commits](https://github.com/yaml/go-yaml/compare/v3.0.4...v3.0.5)

---
updated-dependencies:
- dependency-name: go.yaml.in/yaml/v3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 13:24:15 -04:00
John Maguire 6d124d0441 Tolerate ErrDumpInterrupted when listing tun addresses (#1835)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 11s
Details
smoke-extra / netbsd-amd64 (push) Failing after 12s
Details
smoke-extra / openbsd-amd64 (push) Failing after 13s
Details
smoke-extra / linux-386 (push) Failing after 14s
Details
smoke / Run multi node smoke test (push) Failing after 1m41s
Details
Build and test / Static checks (push) Successful in 2m10s
Details
Build and test / Test linux (push) Failing after 1m32s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m45s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m57s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m8s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m49s
Details
Build and test / Cross-build linux-other (push) Successful in 3m10s
Details
Build and test / Cross-build windows (push) Successful in 1m3s
Details
Build and test / Cross-build freebsd (push) Successful in 1m35s
Details
Build and test / Cross-build netbsd (push) Successful in 1m33s
Details
Build and test / Cross-build openbsd (push) Successful in 1m36s
Details
Build and test / Cross-build mobile (push) Successful in 3m22s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 37s
Details
2026-07-31 19:09:28 +00:00
Nate Brown 72bf111209 Add an e2e Drop exit type and a roaming recovery measurement (#1819)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
Details
smoke-extra / netbsd-amd64 (push) Failing after 14s
Details
smoke-extra / openbsd-amd64 (push) Failing after 15s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m37s
Details
Build and test / Static checks (push) Successful in 18s
Details
Build and test / Test linux (push) Failing after 58s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m45s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m10s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m11s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m53s
Details
Build and test / Cross-build linux-other (push) Successful in 3m16s
Details
Build and test / Cross-build windows (push) Successful in 1m2s
Details
Build and test / Cross-build freebsd (push) Successful in 1m36s
Details
Build and test / Cross-build netbsd (push) Successful in 1m36s
Details
Build and test / Cross-build openbsd (push) Successful in 1m37s
Details
Build and test / Cross-build mobile (push) Successful in 3m23s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 15s
Details
2026-07-23 17:02:02 -05:00
Nate Brown 1617897043 v1.11.0 changelog (#1792)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 13s
Details
smoke-extra / netbsd-amd64 (push) Failing after 13s
Details
smoke-extra / openbsd-amd64 (push) Failing after 11s
Details
smoke-extra / linux-386 (push) Failing after 12s
Details
smoke / Run multi node smoke test (push) Failing after 1m39s
Details
Build and test / Static checks (push) Successful in 2m9s
Details
Build and test / Test linux (push) Failing after 1m3s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m48s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m0s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m17s
Details
Build and test / Cross-build linux-mips (push) Successful in 4m5s
Details
Build and test / Cross-build linux-other (push) Successful in 3m23s
Details
Build and test / Cross-build windows (push) Successful in 1m4s
Details
Build and test / Cross-build freebsd (push) Successful in 1m42s
Details
Build and test / Cross-build netbsd (push) Successful in 1m38s
Details
Build and test / Cross-build openbsd (push) Successful in 1m43s
Details
Build and test / Cross-build mobile (push) Successful in 3m34s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 25s
Details
v1.11.0 		2026-07-23 13:13:45 -05:00
Nate Brown f8775bb6ca Use go 1.26 (latest 1.26.5) (#1818) 2026-07-23 10:36:20 -05:00
Nate Brown 15f0f0d5d0 Be less verbose with handshake send errors (#1810) 2026-07-23 09:26:45 -05:00
Nate BrownandJack Doan 7902ce674e Rebind for MacOS (#1816) 
Co-authored-by: Jack Doan <me@jackdoan.com>
 2026-07-23 09:26:24 -05:00
Nate Brown c2fbe215e6 Fix a test race, make dns server reload/restart safer (#1815)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 11s
Details
smoke-extra / netbsd-amd64 (push) Failing after 11s
Details
smoke-extra / openbsd-amd64 (push) Failing after 22s
Details
smoke-extra / linux-386 (push) Failing after 23s
Details
smoke / Run multi node smoke test (push) Failing after 1m26s
Details
Build and test / Static checks (push) Successful in 2m11s
Details
Build and test / Test linux (push) Failing after 1m7s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m41s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m2s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m5s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m48s
Details
Build and test / Cross-build linux-other (push) Successful in 3m8s
Details
Build and test / Cross-build windows (push) Successful in 1m4s
Details
Build and test / Cross-build freebsd (push) Successful in 1m36s
Details
Build and test / Cross-build netbsd (push) Successful in 1m33s
Details
Build and test / Cross-build openbsd (push) Successful in 1m32s
Details
Build and test / Cross-build mobile (push) Successful in 3m16s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 54s
Details
2026-07-22 15:05:10 -05:00
dependabot[bot] 94ac6db4ca Bump the golang-x-dependencies group across 1 directory with 5 updates (#1800) 
Bumps the golang-x-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/sync](https://github.com/golang/sync).


Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0)

Updates `golang.org/x/net` from 0.56.0 to 0.57.0
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0)

Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0)

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 15:51:22 -04:00
dependabot[bot] a60350e34e Bump actions/setup-go from 6 to 7 (#1807) 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 15:49:45 -04:00
John Maguire 58f3b6fda7 Document rootless Nebula in example service script (#1814) 2026-07-21 19:32:33 -04:00