92d51c042e
fix it!
2026-07-24 16:44:51 -05:00
0a0b2404a2
put locks around the replay window
2026-07-24 16:44:51 -05:00
ef0e3015f9
decrypt in place
2026-07-24 16:44:05 -05:00
c6ebe71c08
silly optimization
2026-07-24 16:39:03 -05:00
1d768ac4e4
tio: accept VIRTIO_NET_HDR_GSO_ECN-qualified superpackets
...
TUN_F_TSO_ECN is negotiated, so once ECN feedback flows the kernel hands
us TSO superpackets typed TCPV4|GSO_ECN (CWR set). protoFromGSOType
treated the qualifier bit as an unknown type and the read path dropped
every such superpacket - a latent bug that only fires when a congested
hop CE-marks the flow, exactly when drops hurt most. The segmenter
already handles CWR (first segment only); just mask the bit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-24 16:39:03 -05:00
69fa9e4a2e
unslop some comments
2026-07-24 16:39:03 -05:00
ed55cf40d5
batch: back SendBatch with Arena instead of a hand-rolled slab
...
SendBatch.Reserve duplicated Arena's grow-on-demand logic byte for byte.
Use an Arena for the slot backing so the borrow/grow/recycle semantics
live in one place.
2026-07-24 16:39:03 -05:00
a6ae44ddb1
batch: move shared-arena Reset ownership from lanes to their owner
2026-07-24 16:39:03 -05:00
7cc37323a8
re-align to master
2026-07-24 16:39:03 -05:00
68e3fae870
some tests
2026-07-24 16:39:03 -05:00
720990ddcd
simplify making new Queues
2026-07-24 16:39:03 -05:00
05443523bd
make service test less annoying
2026-07-24 16:39:03 -05:00
99bf613a2c
checkpt
2026-07-24 16:39:03 -05:00
9e7c783eb3
checkpt
2026-07-24 16:39:03 -05:00
8b14a6ee56
more ram -> more speed
2026-07-24 16:39:03 -05:00
ae17513bbf
more fixes!
2026-07-24 16:39:03 -05:00
1aca2f75ae
more fixes!
2026-07-24 16:39:03 -05:00
c7918d1096
lint
2026-07-24 16:39:03 -05:00
44dd2e9ca4
datapath: fix 12 correctness findings from tun/UDP offload review
...
Multi-disciplinary correctness review of the batched tun / GSO-GRO / sendmmsg
rework. Each fix has a regression test; the merged tree builds on
linux/darwin/openbsd/windows/freebsd/netbsd, vets clean, passes the unit and
e2e suites, and is -race clean.
Critical:
- C1 zero-length inner UDP datagram no longer panics the process (remote DoS):
the UDP coalescer routes payLen==0 to passthrough instead of seeding a GSO
slot, and WriteGSO skips empty payload iovecs as defense in depth.
- C2 segmenter no longer corrupts inner headers when gsoSize < headerLen: the
L3+L4 header is snapshotted once and each segment stamped from the copy,
replacing the destructive overlapping in-place slide (SegmentTCP + SegmentUDP).
High:
- H1 applyOuterECN updates the IPv4 header checksum (RFC 1624 incremental) when
folding outer CE into the inner ToS, so passthrough packets are no longer
dropped by the peer stack.
- H2 the GRO reject path caps the borrowed RX segment ([:n:n]) so a reject can
no longer overrun into the next coalesced segment's Nebula header. Note:
oversized ICMPv6 rejects that need >16B beyond the segment are now refused
rather than sent under GRO (safe; see TOFIX.md for the scratch-buffer follow-up).
- H3 WriteBatch falls back to per-packet WriteTo for a chunk when writeSockaddr
fails, so one bad-family destination costs only its own packet, not the batch.
- H4 UserDevice.Readers returns N distinct queue wrappers with private buffers
(sharing the pipes) so concurrent readers no longer race/overwrite borrowed
packet bytes.
- H5 Poll.Close / Offload.Close no longer null t.fd (matching master's
tunFile.Close), removing the data race with a concurrent readOne load.
Medium/Low:
- M1 the UDP GSO 127-segment gate moved from kernel >=5.5 to >=6.9 (the real
UDP_MAX_SEGMENTS 64->128 threshold), avoiding EINVAL + per-packet fallback on
5.5-6.8 kernels.
- M2 NewMultiQueueReader replays the offload mask newTun actually negotiated
instead of the TSO-only mask, so adding a queue no longer disables USO
device-wide; the advertised USO capability derives from the same mask.
- M3 the shutdown eventfd is closed in pollQueueSet.Close / offloadQueueSet.Close
(double-close guarded), fixing the per-lifecycle fd leak.
- M4 dual-stack ECN selects the cmsg by address family, not socket family: RX
parseRecvCmsg reads both IP_TOS and IPV6_TCLASS; TX writeEntryCmsg stamps
IP_TOS for v4/v4-mapped dests and IPV6_TCLASS for v6 (on-host verified).
- L1 newPoll no longer closes the fd on failure (matching newOffload), removing
the double-close on QueueSet.Add error.
2026-07-24 16:39:03 -05:00
733dc06192
make mobile happy
2026-07-24 16:39:03 -05:00
7fee3a97b2
correctly shutdown the pprofserver
2026-07-24 16:39:03 -05:00
1e218737dc
SendVia: don't emit a zero-length packet when prepareSendVia fails
2026-07-24 16:39:03 -05:00
243c920f88
adapt Control lifecycle tests to the batched tio.Queue Device interface
2026-07-24 16:39:03 -05:00
9bdab873f2
udp setsockopt correctness fixes
2026-07-24 16:39:03 -05:00
a081fba023
use less ram pls
2026-07-24 16:39:03 -05:00
b50d6276e3
clean up a comment a bit
2026-07-24 16:39:03 -05:00
3b16f1adb6
drop in a logger
2026-07-24 16:39:03 -05:00
410bac9688
go mod tidy
2026-07-24 16:39:03 -05:00
22adae0b8c
lint
2026-07-24 16:39:03 -05:00
f7cc437d88
fix
2026-07-24 16:39:03 -05:00
a66af843d1
faster
...
grr heap usage!
2026-07-24 16:38:32 -05:00
67a742ddfb
no
2026-07-24 16:38:32 -05:00
5681e510c4
use clear()
2026-07-24 16:38:32 -05:00
9104dc4c34
remove udp-level RX reorder buf
2026-07-24 16:38:32 -05:00
f31f6c5d1f
make relays take the fast path maybe
2026-07-24 16:37:30 -05:00
264a25337b
scoot pinning around
2026-07-24 16:37:30 -05:00
694414771c
scoot stuff around for e2e
2026-07-24 16:37:30 -05:00
ca84bcb38f
disable sort-on-RX, CPU pinning seems to work for now
2026-07-24 16:37:30 -05:00
f04dd3bcc3
switch to ASM vector checksum
2026-07-24 16:37:30 -05:00
187afac7b5
GSO/GRO offloads, with TCP+ECN and UDP support
2026-07-24 16:37:30 -05:00
e7b121c82f
better and batched tun interface
2026-07-24 16:33:52 -05:00
72bf111209
Add an e2e Drop exit type and a roaming recovery measurement ( #1819 )
smoke-extra / freebsd-amd64 (push) Failing after 15s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 15s
smoke-extra / linux-386 (push) Failing after 16s
smoke / Run multi node smoke test (push) Failing after 1m37s
Build and test / Static checks (push) Successful in 18s
Build and test / Test linux (push) Failing after 58s
Build and test / Test linux-boringcrypto (push) Failing after 2m45s
Build and test / Test linux-pkcs11 (push) Failing after 2m10s
Build and test / Cross-build linux-arm (push) Successful in 3m11s
Build and test / Cross-build linux-mips (push) Successful in 3m53s
Build and test / Cross-build linux-other (push) Successful in 3m16s
Build and test / Cross-build windows (push) Successful in 1m2s
Build and test / Cross-build freebsd (push) Successful in 1m36s
Build and test / Cross-build netbsd (push) Successful in 1m36s
Build and test / Cross-build openbsd (push) Successful in 1m37s
Build and test / Cross-build mobile (push) Successful in 3m23s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-07-23 17:02:02 -05:00
1617897043
v1.11.0 changelog ( #1792 )
smoke-extra / freebsd-amd64 (push) Failing after 25s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 13s
smoke-extra / netbsd-amd64 (push) Failing after 13s
smoke-extra / openbsd-amd64 (push) Failing after 11s
smoke-extra / linux-386 (push) Failing after 12s
smoke / Run multi node smoke test (push) Failing after 1m39s
Build and test / Static checks (push) Successful in 2m9s
Build and test / Test linux (push) Failing after 1m3s
Build and test / Test linux-boringcrypto (push) Failing after 2m48s
Build and test / Test linux-pkcs11 (push) Failing after 2m0s
Build and test / Cross-build linux-arm (push) Successful in 3m17s
Build and test / Cross-build linux-mips (push) Successful in 4m5s
Build and test / Cross-build linux-other (push) Successful in 3m23s
Build and test / Cross-build windows (push) Successful in 1m4s
Build and test / Cross-build freebsd (push) Successful in 1m42s
Build and test / Cross-build netbsd (push) Successful in 1m38s
Build and test / Cross-build openbsd (push) Successful in 1m43s
Build and test / Cross-build mobile (push) Successful in 3m34s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-07-23 13:13:45 -05:00
f8775bb6ca
Use go 1.26 (latest 1.26.5) ( #1818 )
2026-07-23 10:36:20 -05:00
15f0f0d5d0
Be less verbose with handshake send errors ( #1810 )
2026-07-23 09:26:45 -05:00
7902ce674e
Rebind for MacOS ( #1816 )
...
Co-authored-by: Jack Doan <me@jackdoan.com >
2026-07-23 09:26:24 -05:00
c2fbe215e6
Fix a test race, make dns server reload/restart safer ( #1815 )
smoke-extra / freebsd-amd64 (push) Failing after 54s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 11s
smoke-extra / netbsd-amd64 (push) Failing after 11s
smoke-extra / openbsd-amd64 (push) Failing after 22s
smoke-extra / linux-386 (push) Failing after 23s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Static checks (push) Successful in 2m11s
Build and test / Test linux (push) Failing after 1m7s
Build and test / Test linux-boringcrypto (push) Failing after 2m41s
Build and test / Test linux-pkcs11 (push) Failing after 2m2s
Build and test / Cross-build linux-arm (push) Successful in 3m5s
Build and test / Cross-build linux-mips (push) Successful in 3m48s
Build and test / Cross-build linux-other (push) Successful in 3m8s
Build and test / Cross-build windows (push) Successful in 1m4s
Build and test / Cross-build freebsd (push) Successful in 1m36s
Build and test / Cross-build netbsd (push) Successful in 1m33s
Build and test / Cross-build openbsd (push) Successful in 1m32s
Build and test / Cross-build mobile (push) Successful in 3m16s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-07-22 15:05:10 -05:00
94ac6db4ca
Bump the golang-x-dependencies group across 1 directory with 5 updates ( #1800 )
...
Bumps the golang-x-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto ), [golang.org/x/net](https://github.com/golang/net ) and [golang.org/x/sync](https://github.com/golang/sync ).
Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0 )
Updates `golang.org/x/net` from 0.56.0 to 0.57.0
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0 )
Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0 )
Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0 )
Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/net
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sync
dependency-version: 0.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/sys
dependency-version: 0.47.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
- dependency-name: golang.org/x/term
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: golang-x-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-22 15:51:22 -04:00
a60350e34e
Bump actions/setup-go from 6 to 7 ( #1807 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6 to 7.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-22 15:49:45 -04:00
58f3b6fda7
Document rootless Nebula in example service script ( #1814 )
2026-07-21 19:32:33 -04:00
JackDoan