JackDoan
cb9ab9c516
handshake: Keep the static ML-KEM-1024 key expanded in the Credential, instead of expanding it from its seed in every handshake
2026-10-15 10:41:51 -05:00
JackDoan
6c6bf5e486
cert: Check an ML-KEM-1024 public key with the FIPS 203 modulus check alone, without expanding it
2026-10-15 10:41:41 -05:00
JackDoan
d102107f2e
e2e: A hybrid tunnel whose msg2 completed by the relay promotes to direct
2026-10-15 10:30:01 -05:00
JackDoan
b92806d199
Record accepting per-path msg2 resends to replayed msg1s
2026-10-15 10:26:37 -05:00
JackDoan
437d47ffc5
Send by the relay when hybrid msg3 came by one, the direct address learned from msg1 may only work toward us
2026-10-14 15:41:03 -05:00
JackDoan
bd82089a3f
Clock cached msg2 resends per path in the fragment table, so a copy of msg1 arriving by a relay or a second address is answered even when the direct path only works one way
2026-10-14 15:17:24 -05:00
JackDoan
1d0281cba5
Document post-quantum handshakes as hybrid only, and the crossing window
2026-10-14 14:59:32 -05:00
JackDoan
dff5c51dd6
Make post-quantum handshakes hybrid only: drop ix_psk2_mlkem1024, need a v3 certificate, and leave a classical msg1 crossing a hybrid one unanswered
2026-10-14 14:58:29 -05:00
JackDoan
656164b259
cert: Name the post-quantum algorithms of a version 3 certificate with a PQSuite, like its curve, and pick the hybrid subtype by the suite's KEM
2026-10-14 14:40:52 -05:00
JackDoan
84e28c62ea
Reassemble msg2 in a slot per responder FragID, so two hosts answering one msg1 do not wipe each other out
2026-10-14 14:35:45 -05:00
JackDoan
6885bac85d
Record the hybrid field test and the crossing-attempt race in open items
2026-10-14 14:22:07 -05:00
JackDoan
5c5d6e3314
Fold the 2026-10-14 crypto review into the spec: deterministic signing, which fingerprint to block, the skem oracle, the psk2 static key, pending responders, the sticky default and the fork's rollback gap
2026-10-14 14:00:43 -05:00
JackDoan
0aa15ef247
nebula-cert: Lead print output for a version 3 certificate with both fingerprints, and say the v2 one blocks both forms
2026-10-14 14:00:43 -05:00
JackDoan
2ecf2f738e
cert: Sign version 3 certificates with deterministic ML-DSA-87, so extending a certificate twice gives the same certificate
2026-10-14 14:00:43 -05:00
JackDoan
1bf0bf382c
Send hybrid msg3 without a repair delay, so the packets cached behind it do not reach the responder before it completes
2026-10-14 13:21:14 -05:00
JackDoan
19578b3b6b
Document remembering answered msg1s and crossing attempts
2026-10-14 12:56:22 -05:00
JackDoan
5edcaefa33
e2e: Back to back hybrid handshakes, and a classical attempt crossing a hybrid one
2026-10-14 12:56:12 -05:00
JackDoan
bbade4dc9a
Take a hybrid tunnel on msg3 even over a newer one, the initiator has committed to it
2026-10-14 12:56:12 -05:00
JackDoan
cbf8146bda
udp: Buffer a fragmented handshake burst in the tester, so crossing bursts cannot deadlock the e2e router
2026-10-14 12:56:12 -05:00
JackDoan
3b850c6ecf
handshake/fragment: Remember answered messages, so repair fragments trailing a completed msg1 do not eat the source quota
2026-10-14 12:56:12 -05:00
JackDoan
a508a4e22c
Update post-quantum open items
2026-10-14 12:37:30 -05:00
JackDoan
e7b2abb0b2
e2e: msg2 is 9 data fragments now
2026-10-14 12:31:59 -05:00
JackDoan
5cc53c22db
Document the classical-only responder e in hybrid IX, msg2 is now 9 fragments
2026-10-14 12:27:56 -05:00
JackDoan
70e7d3f2ea
Hold a pending hybrid responder locked until it is filled in
2026-10-14 11:09:18 -05:00
JackDoan
4ce04760ae
Document version 3 certificates and hybrid handshakes
2026-10-14 11:08:51 -05:00
JackDoan
1e6a95df15
Test loading v3 certificates and composite keys from config
2026-10-14 11:07:01 -05:00
JackDoan
4d37a3140f
nebula-cert: Make version 3 CAs, keys and certificates, and pq-extend v2 certificates in place
2026-10-14 11:06:40 -05:00
JackDoan
b26c1e9c3e
Run hybrid handshakes: v3 holders initiate them, responders wait for msg3, initiators resend it until confirmed
2026-10-14 11:03:04 -05:00
JackDoan
5c5254dc18
Load v3 certificates and composite keys, speak v2 messages over v3 tunnels, and match ca_sha on either CA fingerprint
2026-10-14 11:03:04 -05:00
JackDoan
ab89556c5c
handshake: Add ix_hybrid_mlkem1024, DefinedNet/noise hybrid IX with ML-KEM-1024 over version 3 certificates
2026-10-14 10:50:33 -05:00
JackDoan
1a8fb8d67e
cert: Add version 3 certificates, a v2 certificate extended with ML-KEM-1024 or ML-DSA-87 keys and an ML-DSA-87 CA signature
2026-10-14 10:47:41 -05:00
JackDoan
73ddb56c34
Build with Go 1.27 and DefinedNet/noise, for crypto/mldsa and hybrid Noise patterns
2026-10-14 10:41:11 -05:00
JackDoan
13658b74a0
Add handshakes.pq.require, and give new paths and responsive peers the PQ attempt
2026-10-14 10:18:00 -05:00
JackDoan
22cdb0739a
Demand cookies for post-quantum msg1s while under load, and reload handshakes.pq settings
2026-10-13 22:50:28 -05:00
JackDoan
45e449a591
handshake/fragment: Carry an optional cookie, with room for it reserved in every fragment
2026-10-13 22:50:28 -05:00
JackDoan
a36ce25af4
Speak post-quantum handshakes over fragments, alternating with classical until one answers
2026-10-13 22:42:07 -05:00
JackDoan
2e5adfddc6
handshake: Add ix_psk2_mlkem1024, IX with an ephemeral ML-KEM-1024 exchange in the psk2 slot
2026-10-13 22:42:06 -05:00
JackDoan
31f3d6435e
handshake/fragment: Carry oversized handshake messages as FEC coded fragments
2026-10-13 22:42:06 -05:00
JackDoan
8f9a631f6e
handshake/fec: Systematic Cauchy Reed-Solomon erasure code over GF(2^8)
2026-10-13 22:42:06 -05:00
Ryan Huber
8a2de9b1b5
examples: set socket buffers and raise tun tx_queue ( #1928 )
...
* examples: set socket buffers and raise tun tx_queue
* examples: use the default tcp max window for socket buffers
* examples: note buffers are linux only, clarify tx_queue default
* tun: default tx_queue to 5000
2026-10-11 00:30:07 -04:00
Nate Brown
a8c52f5c13
overlay: Handle routes Windows already has, and parse quoted route numbers ( #1924 )
2026-10-08 18:52:53 -05:00
Jack Doan
13af8dd6f3
Cap configured MTUs at 8937 so relayed sends never outgrow their buffers ( #1899 )
2026-10-08 15:41:08 -05:00
Nate Brown
5bb0622192
stats: Follow stats.interval on reload, interface gauges ride the capture loop ( #1919 )
2026-10-08 10:00:48 -05:00
Nate Brown
f3705cbb67
graphite: Time out a send, and abandon it on stop ( #1920 )
2026-10-07 18:01:09 -05:00
Nate Brown
94be454f4f
lighthouse: Recompute relays for me when relay.am_relay changes ( #1917 )
2026-10-07 14:06:27 -05:00
Nate Brown
5f26c1a7e5
Add a simple rate limiter with a helper to use it in logging ( #1915 )
2026-10-07 10:53:37 -05:00
Nate Brown
d47c8c71f1
lighthouse: Send an update when the relays we advertise change on reload ( #1916 )
2026-10-07 10:52:42 -05:00
Nate Brown
f57539a163
overlay/linux: Keep unsafe routes when a reload only changes tun.mtu ( #1918 )
2026-10-07 10:43:11 -05:00
John Maguire
8d8ae0f744
Disable DNS registration on the Windows tunnel adapter ( #1914 )
...
On a domain-joined Windows host the DNS Client registers every adapter's
addresses under the host name in AD DNS when "Register this connection's
addresses in DNS" is on, which is the default for a new adapter. When the
Nebula adapter registers, LAN clients that are not on the overlay resolve
the host name to its overlay IP and RDP, SMB and PowerShell Remoting to it
fail intermittently, with nothing pointing at the tunnel as the cause.
Windows registers on address assignment, periodically, and on every
ipconfig /registerdns.
Right after the wintun adapter is created and before Activate assigns any
address, write RegistrationEnabled=0, DisableDynamicUpdate=1 and
MaxNumberOfAddressesToRegister=0 under both the Tcpip and Tcpip6
Parameters\Interfaces\{GUID} keys. The adapter checkbox alone has proven
insufficient in practice, as has disabling dynamic updates alone, so all
three are set, matching what Tailscale and NetBird do. A failure to write
the keys is logged as a warning and does not fail adapter creation.
2026-10-07 11:42:08 -04:00
Matt Richardson
f9b0853476
Attach a pending handshake's RemoteList when the handshake starts ( #1909 )
...
StartHandshake returned a hostinfo with no RemoteList; handleOutbound attached
one lazily on its first tick. Anything that touched the pending host before
then, notably create-tunnel -address, dereferenced nil and took the daemon
down. StartHandshake now attaches the lighthouse's list as it builds the
hostinfo. To keep the surrounding locking sound, a lighthouse now resolves a
punch target before taking the querier's RemoteList lock, and closeTunnel
deletes the host and evicts its RemoteList under a single hostmap write lock so
a completing handshake cannot land in between. The lock order, now documented
on the handshake manager mutex, is hostmap, then handshake manager, then
lighthouse, then RemoteList; no RemoteList lock is ever held across a hostmap
lookup.
2026-10-07 11:22:50 -04:00
JackDoan