105 Commits

Include renames

Author	SHA1	Message	Date
JackDoan	1d0281cba5	Document post-quantum handshakes as hybrid only, and the crossing window	2026-10-14 14:59:32 -05:00
JackDoan	4ce04760ae	Document version 3 certificates and hybrid handshakes	2026-10-14 11:08:51 -05:00
JackDoan	13658b74a0	Add handshakes.pq.require, and give new paths and responsive peers the PQ attempt	2026-10-14 10:18:00 -05:00
JackDoan	a36ce25af4	Speak post-quantum handshakes over fragments, alternating with classical until one answers	2026-10-13 22:42:07 -05:00
Ryan Huber	8a2de9b1b5	examples: set socket buffers and raise tun tx_queue (#1928) ... * examples: set socket buffers and raise tun tx_queue * examples: use the default tcp max window for socket buffers * examples: note buffers are linux only, clarify tx_queue default * tun: default tx_queue to 5000	2026-10-11 00:30:07 -04:00
Jack Doan	13af8dd6f3	Cap configured MTUs at 8937 so relayed sends never outgrow their buffers (#1899)	2026-10-08 15:41:08 -05:00
Nate Brown	d5062dacf0	lighthouse: Never block in QueryServer, drop queries when the channel is full (#1910)	2026-09-30 15:26:34 -05:00
Jack Doan	19e04db115	disable offloads by default for first release (#1858)	2026-08-24 12:33:08 -05:00
Jack Doan	edc3c5e018	the definitive tun offloads branch (#1704)	2026-08-21 11:57:38 -05:00
Nate BrownandJack Doan	7902ce674e	Rebind for MacOS (#1816) ... Co-authored-by: Jack Doan <me@jackdoan.com>	2026-07-23 09:26:24 -05:00
John Maguire	58f3b6fda7	Document rootless Nebula in example service script (#1814)	2026-07-21 19:32:33 -04:00
Wade Simmons	e4cc80aaca	add IPv6 reject packet generation (#1766) ... * add IPv6 reject packet generation (ICMPv6 Destination Unreachable and TCP RST) * use ICMPv6 code 1 (administratively prohibited) and cap body at 1000 bytes * cleanup, use ICMP error code 13 for ipv4 * better docs * cleanup	2026-06-16 13:04:21 -04:00
Nate Brown	696903d6d9	Add a way to set the network type on windows + tests (#1710)	2026-05-07 20:17:38 -05:00
Nate Brown	213dd46588	Stop leaking goroutines past Control.Stop, consolidate punching in Punchy (#1708)	2026-05-06 16:21:16 -05:00
Nate Brown	1ab1f71dba	Make stats a server we can reconfigure and start/stop (#1670)	2026-04-27 12:25:24 -05:00
Nate Brown	d0f02ba873	Switch to slog, remove logrus (#1672)	2026-04-27 09:41:47 -05:00
Jay R. WrenandClaude	f8587956ba	add sshd.sandbox_dir config option (#1622) ... * add sshd.sandbox_dir config option Sanitize SSH profile paths (ssh.go:514,683,719) — restrict os.Create(a[0]) to a safe directory. Add a config option in the config file to specify the sandbox directory. For backwards compatibility, if the config is not specified, keep the current behavior. * update default and example * use os.TempDir() for sshd.sandbox_dir default * split sandbox path validation into separate conditionals Separate the combined && check in sshSanitizeFilePath into two distinct conditionals with specific error messages: one for paths resolving to the sandbox directory itself, and one for paths outside the sandbox. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com> * fix: trim leading zeros from p256 signature swap result bigmod.Nat.Bytes() returns fixed-size 32-byte slices, but ASN.1 INTEGER parsing strips leading zeros. This caused a flaky test failure (~1/256 chance) when the S value's high byte was zero. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com> --------- Co-authored-by: Claude <svc-devxp-claude@slack-corp.com>	2026-04-03 09:37:18 -04:00
Jack Doan	353ad1f271	firewall: icmp no longer requires a port spec (#1609)	2026-02-13 11:10:40 -06:00
Nate Brown	1283ff0db4	Add option to control accepting recv_error (#1569)	2026-01-13 00:00:27 -06:00
Nate Brown	64f202fa17	Make 0.0.0.0/0 and ::/0 not mean any address family, add any for that (#1538)	2025-11-21 13:46:36 -06:00
Nate Brown	52623820c2	Drop inactive tunnels (#1427)	2025-07-03 09:58:37 -05:00
maggie44	8536c57645	Allow configuration of logger and build version in gvisor service library (#1239)	2025-04-21 13:45:59 -04:00
Andriyanov Nikita	e5ce8966d6	add netlink options (#1326) ... * add netlink options * force use buffer * fix namings and add config examples * fix linter	2025-04-21 13:44:33 -04:00
John Maguire	d4a7df3083	Rename pki.default_version to pki.initiating_version (#1381)	2025-04-07 18:08:29 -04:00
John Maguire	e136d1d47a	Update example config with default_local_cidr_any changes (#1373)	2025-04-01 16:08:03 -05:00
dioss-Machiel	f86953ca56	Implement ECMP for unsafe_routes (#1332)	2025-03-24 17:15:59 -05:00
Caleb Jasik	50473bd2a8	Update example config to listen on :: by default (#1351)	2025-03-12 22:53:16 -05:00
jampe	1d3c85338c	add so_mark sockopt support (#1331)	2025-03-12 09:35:33 -05:00
4 people	d97ed57a19	V2 certificate format (#1216) ... Co-authored-by: Nate Brown <nbrown.us@gmail.com> Co-authored-by: Jack Doan <jackdoan@rivian.com> Co-authored-by: brad-defined <77982333+brad-defined@users.noreply.github.com> Co-authored-by: Jack Doan <me@jackdoan.com>	2025-03-06 11:28:26 -06:00
Jack Doan	3dc56e1184	Support UDP dialling with gvisor (#1181)	2024-08-26 12:38:32 -05:00
Wade SimmonsandJohn Maguire	50b24c102e	v1.9.0 (#1137) ... Update CHANGELOG for Nebula v1.9.0 Co-authored-by: John Maguire <john@defined.net>	2024-05-08 10:31:24 -04:00
John Maguire	f31bab5f1a	Add support for SSH CAs (#1098) ... - Accept certs signed by trusted CAs - Username must match the cert principal if set - Any username can be used if cert principal is empty - Don't allow removed pubkeys/CAs to be used after reload	2024-04-30 10:50:17 -04:00
John Maguire	f7db0eb5cc	Remove Vagrant example (#1129)	2024-04-30 09:40:24 -05:00
Andrew Kraut	df78158cfa	Create service script for open-rc (#711)	2024-04-30 09:53:00 -04:00
Nate Brown	a99618e95c	Don't log invalid certificates (#1116)	2024-04-29 15:21:00 -05:00
Nate Brown	cc8b3cc961	Add config option for local_cidr control	2024-02-15 11:46:45 -06:00
Nate Brown	f346cf4109	At the end	2024-02-05 10:23:10 -06:00
Nate Brown	072edd56b3	Fix re-entrant GetOrHandshake issues (#1044)	2023-12-19 11:58:31 -06:00
Tristan Rice	1083279a45	add gvisor based service library (#965) ... * add service/ library	2023-11-21 11:50:18 -05:00
Nate Brown	3356e03d85	Default pki.disconnect_invalid to true and make it reloadable (#859)	2023-11-13 12:39:38 -06:00
John Maguire	87b628ba24	Fix truncated comment in config.yml (#999)	2023-10-27 08:39:34 -04:00
c0repwn3r	03e70210a5	Add support for NetBSD (#916)	2023-07-27 13:44:47 -05:00
Nate Brown	1e3c155896	Attempt to notify systemd of service readiness on linux (#929)	2023-07-24 11:30:18 -05:00
John Maguire	7e380bde7e	Document new DNS config options (#879)	2023-07-10 15:19:05 -04:00
John Maguire	8ba5d64dbc	Add support for naming FreeBSD tun devices (#903)	2023-06-22 12:13:31 -04:00
Ilya Lukyanov	1701087035	Add destination CIDR checking (#507)	2023-05-09 10:37:23 -05:00
Nate Brown	a9cb2e06f4	Add ability to respect the system route table for unsafe route on linux (#839)	2023-05-09 10:36:55 -05:00
Nate Brown	397fe5f879	Add ability to skip installing unsafe routes on the os routing table (#831)	2023-04-10 12:32:37 -05:00
Nate Brown	3cb4e0ef57	Allow listen.host to contain names (#825)	2023-04-05 11:29:26 -05:00
Wade Simmons	3e5c7e6860	add punchy.respond_delay config option (#721)	2023-03-29 14:32:35 -05:00