7138a05f9b
lint
2026-07-17 15:40:07 -05:00
aacb4e2334
datapath: fix 12 correctness findings from tun/UDP offload review
...
Multi-disciplinary correctness review of the batched tun / GSO-GRO / sendmmsg
rework. Each fix has a regression test; the merged tree builds on
linux/darwin/openbsd/windows/freebsd/netbsd, vets clean, passes the unit and
e2e suites, and is -race clean.
Critical:
- C1 zero-length inner UDP datagram no longer panics the process (remote DoS):
the UDP coalescer routes payLen==0 to passthrough instead of seeding a GSO
slot, and WriteGSO skips empty payload iovecs as defense in depth.
- C2 segmenter no longer corrupts inner headers when gsoSize < headerLen: the
L3+L4 header is snapshotted once and each segment stamped from the copy,
replacing the destructive overlapping in-place slide (SegmentTCP + SegmentUDP).
High:
- H1 applyOuterECN updates the IPv4 header checksum (RFC 1624 incremental) when
folding outer CE into the inner ToS, so passthrough packets are no longer
dropped by the peer stack.
- H2 the GRO reject path caps the borrowed RX segment ([:n:n]) so a reject can
no longer overrun into the next coalesced segment's Nebula header. Note:
oversized ICMPv6 rejects that need >16B beyond the segment are now refused
rather than sent under GRO (safe; see TOFIX.md for the scratch-buffer follow-up).
- H3 WriteBatch falls back to per-packet WriteTo for a chunk when writeSockaddr
fails, so one bad-family destination costs only its own packet, not the batch.
- H4 UserDevice.Readers returns N distinct queue wrappers with private buffers
(sharing the pipes) so concurrent readers no longer race/overwrite borrowed
packet bytes.
- H5 Poll.Close / Offload.Close no longer null t.fd (matching master's
tunFile.Close), removing the data race with a concurrent readOne load.
Medium/Low:
- M1 the UDP GSO 127-segment gate moved from kernel >=5.5 to >=6.9 (the real
UDP_MAX_SEGMENTS 64->128 threshold), avoiding EINVAL + per-packet fallback on
5.5-6.8 kernels.
- M2 NewMultiQueueReader replays the offload mask newTun actually negotiated
instead of the TSO-only mask, so adding a queue no longer disables USO
device-wide; the advertised USO capability derives from the same mask.
- M3 the shutdown eventfd is closed in pollQueueSet.Close / offloadQueueSet.Close
(double-close guarded), fixing the per-lifecycle fd leak.
- M4 dual-stack ECN selects the cmsg by address family, not socket family: RX
parseRecvCmsg reads both IP_TOS and IPV6_TCLASS; TX writeEntryCmsg stamps
IP_TOS for v4/v4-mapped dests and IPV6_TCLASS for v6 (on-host verified).
- L1 newPoll no longer closes the fd on failure (matching newOffload), removing
the double-close on QueueSet.Add error.
2026-07-17 15:40:07 -05:00
83a0a99f3f
make mobile happy
2026-07-17 15:40:07 -05:00
6eda8f1594
correctly shutdown the pprofserver
2026-07-17 15:40:07 -05:00
46a5c56802
SendVia: don't emit a zero-length packet when prepareSendVia fails
2026-07-17 15:40:07 -05:00
bd7ec8ab17
adapt Control lifecycle tests to the batched tio.Queue Device interface
2026-07-17 15:40:07 -05:00
c185a661d0
udp setsockopt correctness fixes
2026-07-17 15:40:07 -05:00
b263c42007
use less ram pls
2026-07-17 15:40:07 -05:00
ab89e713fe
clean up a comment a bit
2026-07-17 15:40:07 -05:00
4cd62302f5
drop in a logger
2026-07-17 15:40:07 -05:00
dd30af2523
go mod tidy
2026-07-17 15:40:07 -05:00
5b1a182548
lint
2026-07-17 15:40:07 -05:00
4e5df42a76
fix
2026-07-17 15:40:07 -05:00
2caabe2453
faster
...
grr heap usage!
2026-07-17 15:40:07 -05:00
92df52a068
no
2026-07-17 15:40:07 -05:00
03fbdfee6e
use clear()
2026-07-17 15:40:07 -05:00
3a9d8bca38
remove udp-level RX reorder buf
2026-07-17 15:40:07 -05:00
f54922f134
make relays take the fast path maybe
2026-07-17 15:40:07 -05:00
866ee3798a
scoot pinning around
2026-07-17 15:40:07 -05:00
b3086ec9b6
scoot stuff around for e2e
2026-07-17 15:40:07 -05:00
bed2840376
disable sort-on-RX, CPU pinning seems to work for now
2026-07-17 15:40:07 -05:00
e56b92aef8
switch to ASM vector checksum
2026-07-17 15:40:07 -05:00
a7740f5b64
GSO/GRO offloads, with TCP+ECN and UDP support
2026-07-17 15:40:07 -05:00
58b204407f
better and batched tun interface
2026-07-17 15:40:07 -05:00
147c202c27
Swap back to a blocking udp socket, test shutdown(2) ( #1806 )
...
Co-authored-by: Jack Doan <me@jackdoan.com >
2026-07-17 15:16:45 -05:00
e290a6892f
Fix relay re-establishment for handshake on Disestablised entry ( #1805 )
...
handleOutsideRelayPacket filled ViaSender.remoteIdx with relay.RemoteIndex,
an index from the relay peer's index space, but the rescue in
sendHandshakeResponse looks that value up in relayForByIdx, which is keyed
by local index. The lookup could never hit, so a terminal relay entry left
Disestablished by a one-sided teardown stayed Disestablished even after a
valid handshake arrived over it. The responder's first transmit then failed
to find an Established relay, deleted its only relay entry, and every
subsequent send was silently dropped until dead-tunnel detection forced a
re-handshake.
2026-07-17 11:57:47 -04:00
6c3972f464
code-sign: default the S3 key-prefix to the calling repo ( #1799 )
2026-07-13 11:49:59 -05:00
861d3aabd7
correct directionality of firewall.inbound_action and firewall.outbound_action ( #1798 )
2026-07-13 08:40:42 -05:00
86733864fe
don't make new relay state on a just-discarded tunnel ( #1796 )
2026-07-10 12:02:17 -05:00
ab736e4c6b
Make Control safe to stop and wait on from any lifecycle state ( #1794 )
2026-07-10 10:35:17 -05:00
5ecdd4eaa9
Fix e2e test races when looking at hostmap counts ( #1795 )
2026-07-09 18:48:14 -05:00
1b84bd0050
Remove dev fmt.Println ( #1793 )
2026-07-09 11:04:25 -05:00
384610f81a
hostmap: replace the shared next/prev hostinfo chain with independent per-address lists so divergent or overlapping vpnAddr sets cannot corrupt the map ( #1790 )
2026-07-09 09:34:30 -05:00
c1eea118f4
fix firewall port/proto bypass in parseV6 from uint8 extension-header length overflow ( #1789 )
2026-07-07 20:43:26 -05:00
1e66c0d3ee
hostmap: unlink a multi-vpnAddr hostinfo from the shared chain exactly once on delete ( #1788 )
2026-07-07 17:32:25 -05:00
e5c0fdad8d
Darwin and openbsd in line with the other bsds for tun support ( #1703 )
2026-07-07 17:05:12 -05:00
7bd0bc285a
sshd: guard trustedKeys/trustedCAs with a mutex to fix a concurrent map crash on reload ( #1787 )
2026-07-07 15:50:06 -05:00
942ee522e0
lighthouse: unmap 4-in-6 addresses in protoV6AddrPortToNetAddrPort so remote_allow_list v4 rules apply ( #1786 )
2026-07-07 15:23:39 -05:00
32149f3a93
Bump github.com/kardianos/service from 1.2.4 to 1.3.0 ( #1782 )
...
Bumps [github.com/kardianos/service](https://github.com/kardianos/service ) from 1.2.4 to 1.3.0.
- [Commits](https://github.com/kardianos/service/compare/v1.2.4...v1.3.0 )
---
updated-dependencies:
- dependency-name: github.com/kardianos/service
dependency-version: 1.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 14:42:33 -05:00
19ad3bb904
correctly discard nil proto addresses ( #1785 )
2026-07-07 14:41:01 -05:00
647775d8c3
Bump golang.zx2c4.com/wireguard/windows ( #1665 )
...
Bumps the zx2c4-dependencies group with 1 update in the / directory: golang.zx2c4.com/wireguard/windows.
Updates `golang.zx2c4.com/wireguard/windows` from 0.6.1 to 1.0.1
---
updated-dependencies:
- dependency-name: golang.zx2c4.com/wireguard/windows
dependency-version: 1.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: zx2c4-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 13:40:12 -05:00
abfeb502a8
iputil: fix infinite loop in ipv6FindUpperProtocol from uint8 extension-header length overflow ( #1784 )
2026-07-07 13:28:52 -05:00
0a953915bb
Make HostInfo.remote atomic to fix torn reads on the send path ( #1773 )
2026-07-07 14:27:53 -04:00
6aa3363d85
Add explicit unmarshaller for signing and key agreement public keys ( #1777 )
2026-07-07 13:16:57 -05:00
95d98b1f4b
firewall: move conntrack check after cert+IP verification ( #1779 )
2026-07-07 13:10:11 -05:00
6afca0f461
correctly handle a test packet with a payload longer than the header ( #1778 )
smoke-extra / freebsd-amd64 (push) Failing after 16s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 14s
smoke-extra / netbsd-amd64 (push) Failing after 15s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 15s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Static checks (push) Successful in 1m44s
Build and test / Test linux (push) Failing after 1m39s
Build and test / Test linux-boringcrypto (push) Failing after 3m3s
Build and test / Test linux-pkcs11 (push) Failing after 3m11s
Build and test / Cross-build linux-arm (push) Successful in 3m3s
Build and test / Cross-build linux-mips (push) Successful in 3m44s
Build and test / Cross-build linux-other (push) Successful in 3m8s
Build and test / Cross-build windows (push) Successful in 1m1s
Build and test / Cross-build freebsd (push) Successful in 1m38s
Build and test / Cross-build netbsd (push) Successful in 1m35s
Build and test / Cross-build openbsd (push) Successful in 1m34s
Build and test / Cross-build mobile (push) Successful in 3m17s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-07-03 11:06:22 -05:00
02471b4121
wireshark: fix Lua 5.4 bitwise operation ( #1776 )
...
smoke-extra / freebsd-amd64 (push) Failing after 16s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 16s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 14s
smoke / Run multi node smoke test (push) Failing after 1m27s
Build and test / Static checks (push) Successful in 1m46s
Build and test / Test linux (push) Failing after 1m41s
Build and test / Test linux-boringcrypto (push) Failing after 2m49s
Build and test / Test linux-pkcs11 (push) Failing after 2m49s
Build and test / Cross-build linux-arm (push) Successful in 3m1s
Build and test / Cross-build linux-mips (push) Successful in 3m41s
Build and test / Cross-build linux-other (push) Successful in 3m4s
Build and test / Cross-build windows (push) Successful in 1m1s
Build and test / Cross-build freebsd (push) Successful in 1m32s
Build and test / Cross-build netbsd (push) Successful in 1m33s
Build and test / Cross-build openbsd (push) Successful in 1m31s
Build and test / Cross-build mobile (push) Successful in 3m12s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
The Nebula Wireshark dissector uses bit32.band() when parsing the
Nebula packet type. On Wireshark builds using Lua 5.4, bit32 is not
available, which causes dissection to fail with:
Lua Error: nebula.lua:65: attempt to index a nil value (global 'bit32')
Wireshark bundles Lua BitOp and exposes it globally as bit for Lua
dissectors. This is the documented API for maximum backwards
compatibility across supported Lua versions.
Use bit.band() instead of bit32.band().
2026-07-01 16:12:14 -05:00
58ab7250f5
Bump actions/checkout from 6 to 7 ( #1771 )
...
smoke-extra / freebsd-amd64 (push) Failing after 22s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 15s
smoke / Run multi node smoke test (push) Failing after 1m28s
Build and test / Static checks (push) Successful in 1m47s
Build and test / Test linux (push) Failing after 1m29s
Build and test / Test linux-boringcrypto (push) Failing after 2m41s
Build and test / Test linux-pkcs11 (push) Failing after 3m14s
Build and test / Cross-build linux-arm (push) Successful in 2m58s
Build and test / Cross-build linux-mips (push) Successful in 3m44s
Build and test / Cross-build linux-other (push) Successful in 3m1s
Build and test / Cross-build windows (push) Successful in 58s
Build and test / Cross-build freebsd (push) Successful in 1m31s
Build and test / Cross-build netbsd (push) Successful in 1m31s
Build and test / Cross-build openbsd (push) Successful in 1m30s
Build and test / Cross-build mobile (push) Successful in 3m14s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 12:47:13 -05:00
184cdc8586
Add OCI image labels with version info ( #1772 )
smoke-extra / freebsd-amd64 (push) Failing after 19s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 16s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 17s
smoke / Run multi node smoke test (push) Failing after 1m31s
Build and test / Static checks (push) Successful in 1m47s
Build and test / Test linux (push) Failing after 2m12s
Build and test / Test linux-boringcrypto (push) Failing after 3m8s
Build and test / Test linux-pkcs11 (push) Failing after 3m1s
Build and test / Cross-build linux-arm (push) Successful in 3m6s
Build and test / Cross-build linux-mips (push) Successful in 3m52s
Build and test / Cross-build linux-other (push) Successful in 3m10s
Build and test / Cross-build windows (push) Successful in 1m5s
Build and test / Cross-build freebsd (push) Successful in 1m35s
Build and test / Cross-build netbsd (push) Successful in 1m36s
Build and test / Cross-build openbsd (push) Successful in 1m36s
Build and test / Cross-build mobile (push) Successful in 3m18s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-06-23 14:21:28 -04:00
7d3166a19d
cleanup ipv6 iputil helpers / skip reject for ICMP error packets and fragments ( #1768 )
...
smoke-extra / freebsd-amd64 (push) Failing after 23s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 15s
smoke-extra / linux-386 (push) Failing after 17s
smoke / Run multi node smoke test (push) Failing after 1m27s
Build and test / Static checks (push) Successful in 53s
Build and test / Test linux (push) Failing after 1m16s
Build and test / Test linux-boringcrypto (push) Failing after 3m9s
Build and test / Test linux-pkcs11 (push) Failing after 2m21s
Build and test / Cross-build linux-arm (push) Successful in 3m5s
Build and test / Cross-build linux-mips (push) Successful in 3m57s
Build and test / Cross-build linux-other (push) Successful in 3m8s
Build and test / Cross-build windows (push) Successful in 1m2s
Build and test / Cross-build freebsd (push) Successful in 1m34s
Build and test / Cross-build netbsd (push) Successful in 1m34s
Build and test / Cross-build openbsd (push) Successful in 1m35s
Build and test / Cross-build mobile (push) Successful in 3m19s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
* cleanup ipv6 iputil helpers
With my refactoring in this PR I accidentally had some duplicate logic,
this PR cleans it up:
- https://github.com/slackhq/nebula/pull/1766
* skip ICMP reject for ICMP error packets and fragments
Per RFC 1122, ICMP error messages must not be generated in response to
other ICMP error messages to prevent infinite error loops. This applies
to both IPv4 (types 3, 4, 5, 11, 12) and IPv6 (types 1-4).
Do not generate reject packets for IPv4 or IPv6 fragments. For IPv4,
check MF flag and fragment offset. For IPv6, add isFragment return to
ipv6FindUpperProtocol so a single traversal handles both protocol
lookup and fragment detection.
* do send rejects for the initial fragment
RFC says "non-initial fragment"s
* fix fragment checks
2026-06-16 16:51:14 -04:00
JackDoan