personal_interest_mirrors/nebula
1
0 Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-11-15 13:16:52 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
831 Commits 120 Branches 30 Tags
2ff485255194367c09ce6282e455452d47d80ab7
Commit Graph
831 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
JackDoan 2ff4852551 split tun setup and tun IO 2026-09-25 12:26:07 -05:00
Caleb JasikandClaude Opus 5.5 10e1924489 udp/darwin: batch sends with sendmsg_x 
WriteBatch hands up to 64 datagrams to one sendmsg_x call instead of
one sendto each. The socket is unconnected, so xnu still runs every
message through sendit, per-send MAC checks included; the saving is the
syscall crossings.

xnu's per-message loop stops at the first message that fails. For
EWOULDBLOCK, ENOBUFS and EMSGSIZE it reports how many went out, or the
errno alone when none did; for any other error it returns only the
errno, with the messages before it already sent. So each call carries
one run of datagrams to a single destination, and nothing is resent
after the kernel may have taken it. A datagram that fails on its own
account (a full interface queue, an oversize packet) goes to sendto,
which delivers or reports it, so it costs only itself, as without
batching; a refused destination costs its run. ENOSYS/EOPNOTSUPP, or
EPERM/EINVAL on a datagram sendto then delivers, switch the socket
back to sendto for good.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-24 16:10:26 -05:00
Caleb JasikandClaude Opus 5.5 4d191f805f overlay/darwin: drain several tun packets per read wakeup 
The darwin tun returned one packet per Read, and listenIn flushes its
UDP send batch after every Read, so each outbound packet went to the
underlay as its own batch. tunQueue.Read now keeps calling readv until
the utun would block, up to tunReadBatch packets, so a burst reaches the
send batch together.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-24 12:44:00 -05:00
Caleb JasikandClaude Opus 5.5 61947ff1c2 overlay/darwin: batch tun writes with sendmsg_x 
Passthrough.Flush hands its whole lane to a new tio.BatchWriter in one
WriteBatch call when the queue implements it, and NewSingleQueue
exposes WriteBatch when its source does. On darwin, tun.WriteBatch
writes up to 64 packets per sendmsg_x on the utun control socket,
which is a connected datagram socket, so xnu takes the batched
sendit_x path rather than one sendit per message. utun registers no
send_list handler, so the kernel still passes each packet to utun on
its own: this saves syscalls and fd locking, not per-packet kernel work.

Error handling follows what sendmsg_x reports:

- A short count with no error (a packet past the send buffer
  mid-call, or a later send failing with ENOBUFS): the remainder goes
  out in the next sendmsg_x.
- EMSGSIZE: only returned when the first packet is too large, before
  the kernel takes any, so that packet alone goes through Write, which
  reports it, and the rest are batched again.
- ENOSYS, EPERM, EOPNOTSUPP: sendmsg_x is private API, so WriteBatch
  logs once and falls back to writev per packet for good.
- Anything else: sendmsg_x returns the error without the count it
  took, so the call is reported rather than retried, which could
  deliver packets twice.

One loss mode has no userspace fix. sendit_x counts each packet as
sent once it is copied into an mbuf; if a later allocation fails, it
frees the copied prefix unsent, returns its length, and sendmsg_x
drops the ENOBUFS because the count is nonzero. That looks exactly
like a real short count, so under mbuf exhaustion WriteBatch silently
drops packets that writev would have delivered.

The iOS tun path (tun_ios.go) is unchanged.

Inside a macOS Network Extension, download goes from 640 to 832 Mbps
against the recvmsg_x change alone in three paired rounds, at 15% less
CPU per Mbps; the likely cause is that its utun charges more per write
than a raw one. Raw dnclient already runs download near line rate,
and there the CPU difference is within noise.

TestTunWriteBatch* round-trip through a connected AF_UNIX datagram
socketpair, which takes sendmsg_x the same way, over both the batched
and the fallback path: order, AF prefixes, skipped invalid packets,
and an oversize packet mid-call and first-in-call. Dropping Namelen
from msghdrX fails them. Mutation testing with gremlins leaves only
equivalent survivors in WriteBatch, plus which error is reported first
when several fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-24 10:04:03 -05:00
Caleb JasikandClaude Opus 5.5 a33a6356c6 udp/darwin: batch receives with recvmsg_x 
ListenOut drains the socket with recvmsg_x, xnu's private batched
recvmsg (SYS_RECVMSG_X, bsd/sys/socket_private.h), up to 64 datagrams
per syscall, and calls flush once per batch instead of once per packet.
Each msghdr_x carries its own sockaddr, so this works on the shared
unconnected socket. The send side stays on sendto: xnu only batches
sendmsg_x through the stack on connected sockets, and on an unconnected
socket like this one it falls back to one sendit per message, with
msg_name documented as unsupported.

recvmsg_x is private, so ListenOut falls back to one
ReadFromUDPAddrPort per datagram, logging once, if the kernel or a
sandbox refuses it (ENOSYS, EPERM, EOPNOTSUPP) or if a batch comes back
in a shape intact msghdr_x entries can't produce: more datagrams than
headers, a length past MTU, or a sender that isn't a matching
AF_INET/AF_INET6 sockaddr. That batch is dropped rather than delivered. IPv6 sources now arrive without their
zone, matching the Linux recvmmsg path; WriteTo already drops it.

macOS raw dnclient to a Windows peer on the same gigabit LAN, iperf3
10 s, median of 3 alternating rounds against 7cfa47d:

  download, 1/4/8 streams  606/600/604 -> 869/873/863 Mbps
  download CPU             ~159% -> ~123%
  upload                   340 -> 323 Mbps
  UDP 500M loss            0.32% -> 0.31%

Download is now close to the 902 Mbps the LAN gives without a tunnel.

TestMsghdrXKernelRoundTrip and FuzzMsghdrXKernelRoundTrip pin msghdrX
against the kernel's struct msghdr_x, which the SDK doesn't ship: they
round-trip bursts through recvmsg_x on loopback and check every field
the kernel writes. recvmsg_x never reports MSG_TRUNC (soreceive_m_list
doesn't set it), so a datagram past MTU arrives cut to MTU with Flags
0, the same as ReadFromUDP. TestListenOutSingleFallback covers the
fallback loop, TestCheckMsghdrX the shape check, and the round trip
asserts the check accepts every batch the kernel returns.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-09-23 16:30:55 -05:00
Jack Doan 7cfa47d569 tweaks to error handling in iputil.IPv6FindUpperProtocol (#1893) 2026-09-22 15:45:01 -05:00
Caleb JasikandNate Brown e20569ce51 Let the darwin tun adopt an fd the host already configured (#1890) 
newTunFromFd was a stub on darwin, so an embedder handed a utun by the OS had
no way to use it. A darwin network extension is given exactly that:
NEPacketTunnelProvider creates the device and applies addressing, mtu and
routes from its network settings, and a sandboxed extension cannot change them
afterwards. Adopting that fd means everything about moving packets is shared
with newTun and only the setup differs, so the tun tracks whether the host owns
it and leaves the system routing table and interface config alone when it does.

Co-authored-by: Nate Brown <nbrown.us@gmail.com>
 2026-09-22 11:54:30 -05:00
Caleb JasikandNate Brown 9651ffdb0d Cancel the context when Main hands back no Control (#1889) 
The goroutines Main starts stop only when its context does, and only a caller
holding the Control can arrange that. Cancelling solely on error left a config
test, which returns no Control and no error, with the lighthouse query worker
and a hostname resolver per dns named static host running for the life of the
process. Every embedder that validates a config in process rather than by
exec'ing pays for that on each config load, dnclient and the apple clients
included.

Co-authored-by: Nate Brown <nbrown.us@gmail.com>
 2026-09-22 11:52:28 -05:00
Jack Doan 3a45c01656 Advertise underlay addresses on Android (#1881) 2026-09-21 14:59:56 -05:00
Jack Doan 019cc46a7f smoke: Prove windows honors NlMtu with a 9000 byte ping (#1873) 2026-09-21 12:59:31 -05:00
Nate Brown cf3f315cd3 IPv6FindUpperProtocol: fail closed when the extension header walk runs out of budget (#1883) 2026-09-21 12:09:51 -05:00
Wade Simmons 3fc627e08d Add script to backport a merged PR to a release branch (#1851) 
* Add script to backport a merged PR to a release branch

.github/backport.sh cherry-picks a merged PR's commit onto a release
branch and opens a backport PR mirroring the shape of #1842.

- Infers the target release from the PR's milestone (v1.12.0 -> release-1.11);
  an explicit target-version argument overrides it.
- Requires a clean working tree (untracked files allowed) before starting.
- Prompts with the exact push and gh pr create commands before running them.
- Sets the new PR's milestone to the highest open v<target>.* milestone.
- Removes the needs-backport label from the original PR once the backport opens.
- Supports --continue to resume after resolving cherry-pick conflicts.

* cleanup

* just fetch all of origin

We need to ensure we have MERGE_SHA available too
 2026-09-14 16:14:43 -04:00
dependabot[bot] abff1a4555 Bump Vampire/setup-wsl from 3 to 7 (#1720) 
Bumps [Vampire/setup-wsl](https://github.com/vampire/setup-wsl) from 3 to 7.
- [Release notes](https://github.com/vampire/setup-wsl/releases)
- [Commits](https://github.com/vampire/setup-wsl/compare/v3...v7)

---
updated-dependencies:
- dependency-name: Vampire/setup-wsl
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 10:11:27 -04:00
dependabot[bot] 227134a1d5 Bump golang.org/x/net in the golang-x-dependencies group (#1876) 
Bumps the golang-x-dependencies group with 1 update: [golang.org/x/net](https://github.com/golang/net).


Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](https://github.com/golang/net/compare/v0.58.0...v0.59.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 10:01:25 -04:00
dependabot[bot] 232bacfdd0 Bump github.com/gaissmai/bart from 0.28.0 to 0.29.0 (#1829) 
Bumps [github.com/gaissmai/bart](https://github.com/gaissmai/bart) from 0.28.0 to 0.29.0.
- [Release notes](https://github.com/gaissmai/bart/releases)
- [Commits](https://github.com/gaissmai/bart/compare/v0.28.0...v0.29.0)

---
updated-dependencies:
- dependency-name: github.com/gaissmai/bart
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:39:13 -04:00
dependabot[bot] 4e1ef9cd73 Bump the golang-x-dependencies group across 1 directory with 5 updates (#1875) 
Bumps the golang-x-dependencies group with 2 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto) and [golang.org/x/sync](https://github.com/golang/sync).


Updates `golang.org/x/crypto` from 0.54.0 to 0.57.0
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.57.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](https://github.com/golang/net/compare/v0.57.0...v0.58.0)

Updates `golang.org/x/sync` from 0.22.0 to 0.23.0
- [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0)

Updates `golang.org/x/sys` from 0.47.0 to 0.48.0
- [Commits](https://github.com/golang/sys/compare/v0.47.0...v0.48.0)

Updates `golang.org/x/term` from 0.45.0 to 0.46.0
- [Commits](https://github.com/golang/term/compare/v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:37:37 -04:00
dependabot[bot] 614e0ea3aa Bump google.golang.org/protobuf (#1846) 
Bumps the protobuf-dependencies group with 1 update in the / directory: google.golang.org/protobuf.


Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: protobuf-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:31:44 -04:00
dependabot[bot] 2999fc0b6a Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#1859) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:29:03 -04:00
dependabot[bot] f474b534e1 Bump github.com/miekg/dns from 1.1.72 to 1.1.73 (#1860) 
Bumps [github.com/miekg/dns](https://github.com/miekg/dns) from 1.1.72 to 1.1.73.
- [Commits](https://github.com/miekg/dns/compare/v1.1.72...v1.1.73)

---
updated-dependencies:
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-14 09:28:03 -04:00
Wade Simmons 0dc8a28d1f apply go fix for Go 1.26 (#1867) 
* apply `go fix` for Go 1.26

This applies the `go fix` recommendations for go1.26

* for all of ./...
 2026-09-14 09:25:35 -04:00
Nate Brown 89178f45ba windows: Fix NLMTU for ipv6 (#1871)
smoke-extra / freebsd-amd64 (push) Failing after 16s
Details
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
Details
smoke-extra / netbsd-amd64 (push) Failing after 14s
Details
smoke-extra / openbsd-amd64 (push) Failing after 17s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m33s
Details
Build and test / Static checks (push) Successful in 21s
Details
Build and test / Test linux (push) Failing after 59s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m49s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m38s
Details
Build and test / Test linux-fips140 (push) Failing after 2m52s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m54s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m35s
Details
Build and test / Cross-build windows (push) Successful in 59s
Details
Build and test / Cross-build freebsd (push) Successful in 1m28s
Details
Build and test / Cross-build openbsd (push) Successful in 1m28s
Details
Build and test / Cross-build mobile (push) Successful in 3m7s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
Build and test / Cross-build linux-other (push) Successful in 2m58s
Details
Build and test / Cross-build netbsd (push) Successful in 1m28s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details
2026-09-08 18:30:16 -05:00
Wade Simmons 6a72e1c304 v1.11.1 Changelog (#1857)
smoke-extra / freebsd-amd64 (push) Failing after 18s
Details
smoke-extra / linux-amd64-ipv6disable (push) Failing after 17s
Details
smoke-extra / netbsd-amd64 (push) Failing after 14s
Details
smoke-extra / openbsd-amd64 (push) Failing after 16s
Details
smoke-extra / linux-386 (push) Failing after 17s
Details
smoke / Run multi node smoke test (push) Failing after 1m33s
Details
Build and test / Static checks (push) Successful in 23s
Details
Build and test / Test linux (push) Failing after 58s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m50s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m36s
Details
Build and test / Test linux-fips140 (push) Failing after 3m0s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m50s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m34s
Details
Build and test / Cross-build windows (push) Successful in 1m0s
Details
Build and test / Cross-build freebsd (push) Successful in 1m28s
Details
Build and test / Cross-build openbsd (push) Successful in 1m28s
Details
Build and test / Cross-build mobile (push) Successful in 3m9s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
Build and test / Cross-build linux-other (push) Successful in 2m59s
Details
Build and test / Cross-build netbsd (push) Successful in 1m28s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details 
Copy the v1.11.1 CHANGELOG updates from release-v1.11
 2026-09-08 13:50:27 -04:00
Matt Richardson e50f8128f4 Drop hostQueries to our overlay addresses (#1866)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 23s
Details
smoke-extra / netbsd-amd64 (push) Failing after 16s
Details
smoke-extra / openbsd-amd64 (push) Failing after 11s
Details
smoke-extra / linux-386 (push) Failing after 22s
Details
smoke / Run multi node smoke test (push) Failing after 1m37s
Details
Build and test / Static checks (push) Successful in 2m16s
Details
Build and test / Test linux (push) Failing after 1m20s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m50s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m39s
Details
Build and test / Test linux-fips140 (push) Failing after 2m51s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m55s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m41s
Details
Build and test / Cross-build windows (push) Successful in 1m1s
Details
Build and test / Cross-build freebsd (push) Successful in 1m30s
Details
Build and test / Cross-build openbsd (push) Successful in 1m30s
Details
Build and test / Cross-build mobile (push) Successful in 3m10s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
smoke-extra / freebsd-amd64 (push) Failing after 24s
Details
Build and test / Cross-build linux-other (push) Successful in 3m0s
Details
Build and test / Cross-build netbsd (push) Successful in 1m29s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details 
* Drop hostQueries to our overlay addresses

Don't bother responding to hostQuery's for our overlay addresses.
 2026-09-04 11:26:08 -04:00
Jack Doan dd8f660c0a save about 10MB of RAM by not importing gopacket except for tests (#1864)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
Details
smoke-extra / netbsd-amd64 (push) Failing after 15s
Details
smoke-extra / openbsd-amd64 (push) Failing after 16s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m34s
Details
Build and test / Static checks (push) Successful in 46s
Details
Build and test / Test linux (push) Failing after 1m11s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m51s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m35s
Details
Build and test / Test linux-fips140 (push) Failing after 2m41s
Details
Build and test / Cross-build linux-arm (push) Successful in 2m57s
Details
Build and test / Cross-build linux-mips (push) Successful in 4m0s
Details
Build and test / Cross-build windows (push) Successful in 1m2s
Details
Build and test / Cross-build freebsd (push) Successful in 1m30s
Details
Build and test / Cross-build openbsd (push) Successful in 1m29s
Details
Build and test / Cross-build mobile (push) Successful in 3m7s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
smoke-extra / freebsd-amd64 (push) Failing after 15s
Details
Build and test / Cross-build linux-other (push) Successful in 3m2s
Details
Build and test / Cross-build netbsd (push) Successful in 1m29s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details 
* save about 10MB of RAM by not importing gopacket except for tests

* big ol find-replace
 2026-08-28 14:00:09 -05:00
Caleb Jasik ec3304e3a9 Recompute the transport checksum on self-forwarded packets (#1862)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 14s
Details
smoke-extra / netbsd-amd64 (push) Failing after 16s
Details
smoke-extra / openbsd-amd64 (push) Failing after 15s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m34s
Details
Build and test / Static checks (push) Successful in 43s
Details
Build and test / Test linux (push) Failing after 1m29s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m2s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m46s
Details
Build and test / Test linux-fips140 (push) Failing after 2m41s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m0s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m46s
Details
Build and test / Cross-build windows (push) Successful in 1m1s
Details
Build and test / Cross-build freebsd (push) Successful in 1m33s
Details
Build and test / Cross-build openbsd (push) Successful in 1m33s
Details
Build and test / Cross-build mobile (push) Successful in 3m16s
Details
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
smoke-extra / freebsd-amd64 (push) Failing after 16s
Details
Build and test / Cross-build linux-other (push) Successful in 3m8s
Details
Build and test / Cross-build netbsd (push) Successful in 1m32s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details
2026-08-27 16:10:32 -05:00
Jack Doan aaa2ff7fff respect setting for tun.pin_threads_key (#1861) 2026-08-27 12:31:08 -05:00
Nate Brown 657f6ad044 Fold the rebind counter and traffic flags into one atomic word (#1820)
smoke-extra / freebsd-amd64 (push) Failing after 23s
Details
smoke-extra / linux-amd64-ipv6disable (push) Failing after 14s
Details
smoke-extra / netbsd-amd64 (push) Failing after 13s
Details
smoke-extra / openbsd-amd64 (push) Failing after 13s
Details
smoke-extra / linux-386 (push) Failing after 11s
Details
smoke / Run multi node smoke test (push) Failing after 1m36s
Details
Build and test / Static checks (push) Successful in 2m15s
Details
Build and test / Test linux (push) Failing after 58s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m55s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m40s
Details
Build and test / Test linux-fips140 (push) Failing after 2m41s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m3s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m43s
Details
Build and test / Cross-build windows (push) Successful in 1m2s
Details
Build and test / Cross-build freebsd (push) Successful in 1m32s
Details
Build and test / Cross-build openbsd (push) Successful in 1m33s
Details
Build and test / Cross-build mobile (push) Successful in 3m18s
Details
Build and test / Test macos (push) Canceled after 0s
Details
Build and test / CI status (push) Canceled after 0s
Details
Build and test / Cross-build linux-other (push) Successful in 3m5s
Details
Build and test / Cross-build netbsd (push) Successful in 1m32s
Details
smoke-extra / Run windows smoke test (push) Canceled after 0s
Details
Build and test / Test windows (push) Canceled after 0s
Details
2026-08-26 15:15:37 -05:00
Jack Doan 19e04db115 disable offloads by default for first release (#1858) 2026-08-24 12:33:08 -05:00
Wade Simmons 9c5d701648 Support native Golang "fips140" mode (#1696) 
Add support for the "fips140" mode of Go:

- https://go.dev/doc/security/fips140
- https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247

You can build with `make fips140`, see the README changes for more info.

Some differences from the boringcrypto builds:

- We switch to using `go:linkname crypto/tls.aeadAESGCMTLS13`, which gives us the fips implementation for both `boringcrypto` and `fips140` modes. This means we also no longer need `-checklinkname=0`
- Go native `fips140` doesn't need CGO_ENABLED=1
- We decide if we should use the fips140 GCM at runtime, if `fips140.Enabled()` is true. If you use the `make release-fips140`, we build with build tag `fips140enforce` which ensures the binary is running with fips140 enabled and that only P256 / AES-GCM is being used. If you don't want this enforce mode, you can build without the build tag.
 2026-08-21 19:33:40 -04:00
Jack Doan edc3c5e018 the definitive tun offloads branch (#1704) 2026-08-21 11:57:38 -05:00
Nate Brown b8b159a486 release: retry the STS assume until the secret key survives Windows (#1855) 2026-08-21 11:03:43 -05:00
Nate Brown 49e35d1283 parseV6: only walk real ipv6 extension headers, fail closed on unknown protocols (#1840) 2026-08-20 13:21:08 -05:00
sn0w 6fcb926334 cmd/ca: prevent out-of-memory on 32bit systems (#1834) 2026-08-20 14:07:31 -04:00
Jay R. WrenandClaude 28d82f7b8a Drop dependency on github.com/cyberdelia/go-metrics-graphite (#1832) 
The go-metrics-graphite package has been unmaintained for 10+ years,
which is a packaging and supply-chain concern for downstream
distributors (see #1831). Nebula only used its Config struct and Once()
entrypoint, so inline just those (~65 lines) into a local graphite.go,
preserving the upstream BSD-2-Clause copyright notice, and remove the
dependency.

Fixes #1831

Co-authored-by: Claude <svc-devxp-claude@slack-corp.com>
 2026-08-20 09:46:41 -04:00
Nate Brown f15d10fc54 Enforce outbound message counter limits to prevent nonce reuse (#1841) 2026-08-19 20:48:02 -05:00
dependabot[bot] bfe7790848 Bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1847) 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-19 20:19:10 -05:00
Nate Brown e7b4e094b9 Take Apple signing credentials from Secrets Manager (#1833) 2026-08-18 15:35:57 -05:00
Wade Simmons 6740518403 use stdlib maps.Values (#1843) 
* use stdlib maps.Values

This has been in stdlib since go1.23, no need to use golang.org/x/exp
anymore just for this:

- https://pkg.go.dev/maps#Values

* use slices.AppendSeq to match old behavior
 2026-08-18 14:49:41 -04:00
dependabot[bot]andWade Simmons 5cbf029d06 Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (#1828) 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.1.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.1)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Wade Simmons <wadey@slack-corp.com>
 2026-08-17 13:51:48 -04:00
dependabot[bot] 368855c2e8 Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#1827) 
Bumps [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml) from 3.0.4 to 3.0.5.
- [Commits](https://github.com/yaml/go-yaml/compare/v3.0.4...v3.0.5)

---
updated-dependencies:
- dependency-name: go.yaml.in/yaml/v3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 13:24:15 -04:00
John Maguire 6d124d0441 Tolerate ErrDumpInterrupted when listing tun addresses (#1835)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 11s
Details
smoke-extra / netbsd-amd64 (push) Failing after 12s
Details
smoke-extra / openbsd-amd64 (push) Failing after 13s
Details
smoke-extra / linux-386 (push) Failing after 14s
Details
smoke / Run multi node smoke test (push) Failing after 1m41s
Details
Build and test / Static checks (push) Successful in 2m10s
Details
Build and test / Test linux (push) Failing after 1m32s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m45s
Details
Build and test / Test linux-pkcs11 (push) Failing after 1m57s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m8s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m49s
Details
Build and test / Cross-build linux-other (push) Successful in 3m10s
Details
Build and test / Cross-build windows (push) Successful in 1m3s
Details
Build and test / Cross-build freebsd (push) Successful in 1m35s
Details
Build and test / Cross-build netbsd (push) Successful in 1m33s
Details
Build and test / Cross-build openbsd (push) Successful in 1m36s
Details
Build and test / Cross-build mobile (push) Successful in 3m22s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 37s
Details
2026-07-31 19:09:28 +00:00
Nate Brown 72bf111209 Add an e2e Drop exit type and a roaming recovery measurement (#1819)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
Details
smoke-extra / netbsd-amd64 (push) Failing after 14s
Details
smoke-extra / openbsd-amd64 (push) Failing after 15s
Details
smoke-extra / linux-386 (push) Failing after 16s
Details
smoke / Run multi node smoke test (push) Failing after 1m37s
Details
Build and test / Static checks (push) Successful in 18s
Details
Build and test / Test linux (push) Failing after 58s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m45s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m10s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m11s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m53s
Details
Build and test / Cross-build linux-other (push) Successful in 3m16s
Details
Build and test / Cross-build windows (push) Successful in 1m2s
Details
Build and test / Cross-build freebsd (push) Successful in 1m36s
Details
Build and test / Cross-build netbsd (push) Successful in 1m36s
Details
Build and test / Cross-build openbsd (push) Successful in 1m37s
Details
Build and test / Cross-build mobile (push) Successful in 3m23s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 15s
Details
2026-07-23 17:02:02 -05:00
Nate Brown 1617897043 v1.11.0 changelog (#1792)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 13s
Details
smoke-extra / netbsd-amd64 (push) Failing after 13s
Details
smoke-extra / openbsd-amd64 (push) Failing after 11s
Details
smoke-extra / linux-386 (push) Failing after 12s
Details
smoke / Run multi node smoke test (push) Failing after 1m39s
Details
Build and test / Static checks (push) Successful in 2m9s
Details
Build and test / Test linux (push) Failing after 1m3s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m48s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m0s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m17s
Details
Build and test / Cross-build linux-mips (push) Successful in 4m5s
Details
Build and test / Cross-build linux-other (push) Successful in 3m23s
Details
Build and test / Cross-build windows (push) Successful in 1m4s
Details
Build and test / Cross-build freebsd (push) Successful in 1m42s
Details
Build and test / Cross-build netbsd (push) Successful in 1m38s
Details
Build and test / Cross-build openbsd (push) Successful in 1m43s
Details
Build and test / Cross-build mobile (push) Successful in 3m34s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 25s
Details
v1.11.0 		2026-07-23 13:13:45 -05:00
Nate Brown f8775bb6ca Use go 1.26 (latest 1.26.5) (#1818) 2026-07-23 10:36:20 -05:00
Nate Brown 15f0f0d5d0 Be less verbose with handshake send errors (#1810) 2026-07-23 09:26:45 -05:00
Nate BrownandJack Doan 7902ce674e Rebind for MacOS (#1816) 
Co-authored-by: Jack Doan <me@jackdoan.com>
 2026-07-23 09:26:24 -05:00
Nate Brown c2fbe215e6 Fix a test race, make dns server reload/restart safer (#1815)
smoke-extra / linux-amd64-ipv6disable (push) Failing after 11s
Details
smoke-extra / netbsd-amd64 (push) Failing after 11s
Details
smoke-extra / openbsd-amd64 (push) Failing after 22s
Details
smoke-extra / linux-386 (push) Failing after 23s
Details
smoke / Run multi node smoke test (push) Failing after 1m26s
Details
Build and test / Static checks (push) Successful in 2m11s
Details
Build and test / Test linux (push) Failing after 1m7s
Details
Build and test / Test linux-boringcrypto (push) Failing after 2m41s
Details
Build and test / Test linux-pkcs11 (push) Failing after 2m2s
Details
Build and test / Cross-build linux-arm (push) Successful in 3m5s
Details
Build and test / Cross-build linux-mips (push) Successful in 3m48s
Details
Build and test / Cross-build linux-other (push) Successful in 3m8s
Details
Build and test / Cross-build windows (push) Successful in 1m4s
Details
Build and test / Cross-build freebsd (push) Successful in 1m36s
Details
Build and test / Cross-build netbsd (push) Successful in 1m33s
Details
Build and test / Cross-build openbsd (push) Successful in 1m32s
Details
Build and test / Cross-build mobile (push) Successful in 3m16s
Details
smoke-extra / Run windows smoke test (push) Has been cancelled
Details
Build and test / Test macos (push) Has been cancelled
Details
Build and test / Test windows (push) Has been cancelled
Details
Build and test / CI status (push) Has been cancelled
Details
smoke-extra / freebsd-amd64 (push) Failing after 54s
Details
2026-07-22 15:05:10 -05:00
dependabot[bot] 94ac6db4ca Bump the golang-x-dependencies group across 1 directory with 5 updates (#1800) 
Bumps the golang-x-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/sync](https://github.com/golang/sync).


Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0)

Updates `golang.org/x/net` from 0.56.0 to 0.57.0
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0)

Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0)

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-x-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 15:51:22 -04:00
dependabot[bot] a60350e34e Bump actions/setup-go from 6 to 7 (#1807) 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 15:49:45 -04:00
John Maguire 58f3b6fda7 Document rootless Nebula in example service script (#1814) 2026-07-21 19:32:33 -04:00