John Maguire
0a953915bb
Make HostInfo.remote atomic to fix torn reads on the send path ( #1773 )
2026-07-07 14:27:53 -04:00
John Maguire
184cdc8586
Add OCI image labels with version info ( #1772 )
smoke-extra / freebsd-amd64 (push) Failing after 19s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 16s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 17s
smoke / Run multi node smoke test (push) Failing after 1m31s
Build and test / Static checks (push) Successful in 1m47s
Build and test / Test linux (push) Failing after 2m12s
Build and test / Test linux-boringcrypto (push) Failing after 3m8s
Build and test / Test linux-pkcs11 (push) Failing after 3m1s
Build and test / Cross-build linux-arm (push) Successful in 3m6s
Build and test / Cross-build linux-mips (push) Successful in 3m52s
Build and test / Cross-build linux-other (push) Successful in 3m10s
Build and test / Cross-build windows (push) Successful in 1m5s
Build and test / Cross-build freebsd (push) Successful in 1m35s
Build and test / Cross-build netbsd (push) Successful in 1m36s
Build and test / Cross-build openbsd (push) Successful in 1m36s
Build and test / Cross-build mobile (push) Successful in 3m18s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-06-23 14:21:28 -04:00
John Maguire
e753e6e93c
Immediate Lighthouse update after reconfig/reconnect ( #1645 )
gofmt / Run gofmt (push) Failing after 3s
smoke-extra / Run extra smoke tests (push) Failing after 3s
smoke / Run multi node smoke test (push) Failing after 2s
Build and test / Build all and test on ubuntu-linux (push) Failing after 3s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2026-04-21 16:33:32 -04:00
John Maguire
32a7c04498
Return NODATA instead of NXDOMAIN for missing record types ( #1668 )
...
The DNS responder was setting RCODE=NXDOMAIN (Name Error) any time the
answer section was empty, including for names that exist in the
lighthouse but lack a record of the requested type (e.g. an AAAA query
for a v4-only host). Per RFC 2308 §2.1, NXDOMAIN means "the domain
referred to by the QNAME does not exist", and per RFC 2308 §2.2 a name
that exists with no record of the requested type must be answered with
RCODE=NOERROR and an empty answer section (NODATA).
The practical fallout: busybox ping in Alpine issues AAAA first, treats
NXDOMAIN as a hard failure, and never falls through to A. Returning
NODATA lets the resolver continue to the A query as it should.
Track whether any queried A/AAAA name is known in either map and only
set RcodeNameError when no queried name exists at all.
2026-04-21 16:32:48 -04:00
0ad5c771e9
Refactor CA pool handling to use streaming ( #1644 )
...
gofmt / Run gofmt (push) Failing after 3s
smoke-extra / Run extra smoke tests (push) Failing after 3s
smoke / Run multi node smoke test (push) Failing after 3s
Build and test / Build all and test on ubuntu-linux (push) Failing after 2s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
Co-authored-by: maggie44 <64841595+maggie44@users.noreply.github.com >
Co-authored-by: JackDoan <me@jackdoan.com >
2026-04-13 13:19:55 -04:00
John Maguire
951d368faf
Add a small link to DN Managed Nebula ( #1641 )
...
* Add a small link to DN Managed Nebula
Also link the mobile source code
2026-03-30 16:20:21 -04:00
John Maguire
9f1aef53fa
Fix dissector logic ( #1626 )
...
* Fix typo in Wireshark dissector
* Fix wireshark dissector prefs_changed logic
The previous logic had several issues:
- Changing only the port number (without toggling all_ports) would
not re-register the dissector on the new port.
- Turning all_ports off would remove all registrations but only
re-add the specific port inside a branch that also required
all_ports to have changed, and never updated default_settings.port.
Simplify to: remove all registrations, then register based on current
prefs, then update the cached state.
2026-03-23 11:15:40 -04:00
John Maguire
83ff2461e2
Mention CA expiration in the README ( #1378 )
gofmt / Run gofmt (push) Successful in 10s
smoke-extra / Run extra smoke tests (push) Failing after 20s
smoke / Run multi node smoke test (push) Failing after 1m21s
Build and test / Build all and test on ubuntu-linux (push) Failing after 17m44s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2m20s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m27s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-04-28 13:36:06 -04:00
John Maguire
15b5a43300
Update issue and PR templates ( #1376 )
2025-04-21 13:45:48 -04:00
John Maguire
2dc30fc300
Support 32-bit machines in crypto test ( #1394 )
2025-04-21 13:28:43 -04:00
John Maguire
d4a7df3083
Rename pki.default_version to pki.initiating_version ( #1381 )
gofmt / Run gofmt (push) Successful in 9s
smoke-extra / Run extra smoke tests (push) Failing after 20s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Build all and test on ubuntu-linux (push) Failing after 21m13s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3m19s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m47s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-04-07 18:08:29 -04:00
John Maguire
e136d1d47a
Update example config with default_local_cidr_any changes ( #1373 )
2025-04-01 16:08:03 -05:00
John Maguire
b5c3486796
Push Docker images as part of the release workflow ( #1037 )
2024-05-02 09:37:11 -04:00
John Maguire
f31bab5f1a
Add support for SSH CAs ( #1098 )
...
- Accept certs signed by trusted CAs
- Username must match the cert principal if set
- Any username can be used if cert principal is empty
- Don't allow removed pubkeys/CAs to be used after reload
2024-04-30 10:50:17 -04:00
John Maguire
f7db0eb5cc
Remove Vagrant example ( #1129 )
2024-04-30 09:40:24 -05:00
John Maguire and Oliver Marriott
d7f52dec41
Fix errant capitalisation in DNS TXT response ( #1127 )
...
Co-authored-by: Oliver Marriott <hello@omarriott.com >
2024-04-30 09:58:56 -04:00
John Maguire
41e2e1de02
Remove Fedora nebula.service file ( #1128 )
2024-04-29 15:30:22 -04:00
John Maguire
8b68a08723
Fix "any" firewall rules for unsafe_routes ( #1099 )
2024-03-28 15:17:12 -05:00
John Maguire
8822f1366c
Add link to logs guide in bug report template ( #1065 )
2024-02-01 12:40:23 -05:00
John Maguire
af2fc48378
Fix mobile builds ( #1035 )
2023-12-06 16:18:21 -05:00
John Maguire
87b628ba24
Fix truncated comment in config.yml ( #999 )
2023-10-27 08:39:34 -04:00
John Maguire
7e380bde7e
Document new DNS config options ( #879 )
2023-07-10 15:19:05 -04:00
John Maguire
8ba5d64dbc
Add support for naming FreeBSD tun devices ( #903 )
2023-06-22 12:13:31 -04:00
John Maguire
165b671e70
v1.7.1 ( #878 )
...
Update CHANGELOG for Nebula v1.7.1
2023-05-18 15:39:24 -04:00
John Maguire
a56a97e5c3
Add ability to encrypt CA private key at rest ( #386 )
...
Fixes #8 .
`nebula-cert ca` now supports encrypting the CA's private key with a
passphrase. Pass `-encrypt` in order to be prompted for a passphrase.
Encryption is performed using AES-256-GCM and Argon2id for KDF. KDF
parameters default to RFC recommendations, but can be overridden via CLI
flags `-argon-memory`, `-argon-parallelism`, and `-argon-iterations`.
2023-04-03 13:59:38 -04:00
John Maguire
5bd8712946
Immediately forward packets from self to self on FreeBSD ( #808 )
2023-01-23 15:51:54 -06:00
John Maguire
c44da3abee
Make DNS queries case insensitive ( #793 )
2022-12-20 16:59:11 -05:00
John Maguire
b7e73da943
Add note indicating modes have usage text ( #794 )
2022-12-20 16:53:56 -05:00
John Maguire
ff54bfd9f3
Add nebula-cert.exe and cert files to .gitignore ( #722 )
2022-12-20 16:52:51 -05:00
John Maguire
b5a85a6eb8
Update example config with IPv6 note for allow lists ( #742 )
2022-12-20 16:50:02 -05:00
John Maguire