e386e290ab
lint
2026-07-14 11:00:55 -05:00
0a44376403
datapath: fix 12 correctness findings from tun/UDP offload review
...
Multi-disciplinary correctness review of the batched tun / GSO-GRO / sendmmsg
rework. Each fix has a regression test; the merged tree builds on
linux/darwin/openbsd/windows/freebsd/netbsd, vets clean, passes the unit and
e2e suites, and is -race clean.
Critical:
- C1 zero-length inner UDP datagram no longer panics the process (remote DoS):
the UDP coalescer routes payLen==0 to passthrough instead of seeding a GSO
slot, and WriteGSO skips empty payload iovecs as defense in depth.
- C2 segmenter no longer corrupts inner headers when gsoSize < headerLen: the
L3+L4 header is snapshotted once and each segment stamped from the copy,
replacing the destructive overlapping in-place slide (SegmentTCP + SegmentUDP).
High:
- H1 applyOuterECN updates the IPv4 header checksum (RFC 1624 incremental) when
folding outer CE into the inner ToS, so passthrough packets are no longer
dropped by the peer stack.
- H2 the GRO reject path caps the borrowed RX segment ([:n:n]) so a reject can
no longer overrun into the next coalesced segment's Nebula header. Note:
oversized ICMPv6 rejects that need >16B beyond the segment are now refused
rather than sent under GRO (safe; see TOFIX.md for the scratch-buffer follow-up).
- H3 WriteBatch falls back to per-packet WriteTo for a chunk when writeSockaddr
fails, so one bad-family destination costs only its own packet, not the batch.
- H4 UserDevice.Readers returns N distinct queue wrappers with private buffers
(sharing the pipes) so concurrent readers no longer race/overwrite borrowed
packet bytes.
- H5 Poll.Close / Offload.Close no longer null t.fd (matching master's
tunFile.Close), removing the data race with a concurrent readOne load.
Medium/Low:
- M1 the UDP GSO 127-segment gate moved from kernel >=5.5 to >=6.9 (the real
UDP_MAX_SEGMENTS 64->128 threshold), avoiding EINVAL + per-packet fallback on
5.5-6.8 kernels.
- M2 NewMultiQueueReader replays the offload mask newTun actually negotiated
instead of the TSO-only mask, so adding a queue no longer disables USO
device-wide; the advertised USO capability derives from the same mask.
- M3 the shutdown eventfd is closed in pollQueueSet.Close / offloadQueueSet.Close
(double-close guarded), fixing the per-lifecycle fd leak.
- M4 dual-stack ECN selects the cmsg by address family, not socket family: RX
parseRecvCmsg reads both IP_TOS and IPV6_TCLASS; TX writeEntryCmsg stamps
IP_TOS for v4/v4-mapped dests and IPV6_TCLASS for v6 (on-host verified).
- L1 newPoll no longer closes the fd on failure (matching newOffload), removing
the double-close on QueueSet.Add error.
2026-07-14 11:00:55 -05:00
9e61269935
make mobile happy
2026-07-14 11:00:55 -05:00
a0836aa819
correctly shutdown the pprofserver
2026-07-14 11:00:55 -05:00
cf2800f7bd
SendVia: don't emit a zero-length packet when prepareSendVia fails
2026-07-14 11:00:55 -05:00
fc89b9d14c
adapt Control lifecycle tests to the batched tio.Queue Device interface
2026-07-14 11:00:55 -05:00
3e5326e60a
udp setsockopt correctness fixes
2026-07-14 11:00:55 -05:00
840841a53c
use less ram pls
2026-07-14 11:00:55 -05:00
cfb4ab24c3
clean up a comment a bit
2026-07-14 11:00:55 -05:00
67f9cfad91
drop in a logger
2026-07-14 11:00:55 -05:00
1c78f5e500
go mod tidy
2026-07-14 11:00:55 -05:00
ad8ff2e45e
lint
2026-07-14 11:00:55 -05:00
c13a1ff4ec
fix
2026-07-14 11:00:55 -05:00
8b66ebaf72
faster
...
grr heap usage!
2026-07-14 11:00:55 -05:00
bbdaf5c3f3
no
2026-07-14 11:00:55 -05:00
a515aeaf39
use clear()
2026-07-14 11:00:55 -05:00
0f6f14eaf6
remove udp-level RX reorder buf
2026-07-14 11:00:55 -05:00
dafdd34af9
make relays take the fast path maybe
2026-07-14 11:00:55 -05:00
f6791130df
scoot pinning around
2026-07-14 11:00:55 -05:00
145a6267fa
scoot stuff around for e2e
2026-07-14 11:00:55 -05:00
7716f1da23
disable sort-on-RX, CPU pinning seems to work for now
2026-07-14 11:00:55 -05:00
beb1d7d89f
switch to ASM vector checksum
2026-07-14 11:00:55 -05:00
fa0d593f28
GSO/GRO offloads, with TCP+ECN and UDP support
2026-07-14 11:00:55 -05:00
ff48040c78
better and batched tun interface
2026-07-14 11:00:55 -05:00
6c3972f464
code-sign: default the S3 key-prefix to the calling repo ( #1799 )
2026-07-13 11:49:59 -05:00
861d3aabd7
correct directionality of firewall.inbound_action and firewall.outbound_action ( #1798 )
2026-07-13 08:40:42 -05:00
86733864fe
don't make new relay state on a just-discarded tunnel ( #1796 )
2026-07-10 12:02:17 -05:00
ab736e4c6b
Make Control safe to stop and wait on from any lifecycle state ( #1794 )
2026-07-10 10:35:17 -05:00
5ecdd4eaa9
Fix e2e test races when looking at hostmap counts ( #1795 )
2026-07-09 18:48:14 -05:00
1b84bd0050
Remove dev fmt.Println ( #1793 )
2026-07-09 11:04:25 -05:00
384610f81a
hostmap: replace the shared next/prev hostinfo chain with independent per-address lists so divergent or overlapping vpnAddr sets cannot corrupt the map ( #1790 )
2026-07-09 09:34:30 -05:00
c1eea118f4
fix firewall port/proto bypass in parseV6 from uint8 extension-header length overflow ( #1789 )
2026-07-07 20:43:26 -05:00
1e66c0d3ee
hostmap: unlink a multi-vpnAddr hostinfo from the shared chain exactly once on delete ( #1788 )
2026-07-07 17:32:25 -05:00
e5c0fdad8d
Darwin and openbsd in line with the other bsds for tun support ( #1703 )
2026-07-07 17:05:12 -05:00
7bd0bc285a
sshd: guard trustedKeys/trustedCAs with a mutex to fix a concurrent map crash on reload ( #1787 )
2026-07-07 15:50:06 -05:00
942ee522e0
lighthouse: unmap 4-in-6 addresses in protoV6AddrPortToNetAddrPort so remote_allow_list v4 rules apply ( #1786 )
2026-07-07 15:23:39 -05:00
32149f3a93
Bump github.com/kardianos/service from 1.2.4 to 1.3.0 ( #1782 )
...
Bumps [github.com/kardianos/service](https://github.com/kardianos/service ) from 1.2.4 to 1.3.0.
- [Commits](https://github.com/kardianos/service/compare/v1.2.4...v1.3.0 )
---
updated-dependencies:
- dependency-name: github.com/kardianos/service
dependency-version: 1.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 14:42:33 -05:00
19ad3bb904
correctly discard nil proto addresses ( #1785 )
2026-07-07 14:41:01 -05:00
647775d8c3
Bump golang.zx2c4.com/wireguard/windows ( #1665 )
...
Bumps the zx2c4-dependencies group with 1 update in the / directory: golang.zx2c4.com/wireguard/windows.
Updates `golang.zx2c4.com/wireguard/windows` from 0.6.1 to 1.0.1
---
updated-dependencies:
- dependency-name: golang.zx2c4.com/wireguard/windows
dependency-version: 1.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: zx2c4-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 13:40:12 -05:00
abfeb502a8
iputil: fix infinite loop in ipv6FindUpperProtocol from uint8 extension-header length overflow ( #1784 )
2026-07-07 13:28:52 -05:00
0a953915bb
Make HostInfo.remote atomic to fix torn reads on the send path ( #1773 )
2026-07-07 14:27:53 -04:00
6aa3363d85
Add explicit unmarshaller for signing and key agreement public keys ( #1777 )
2026-07-07 13:16:57 -05:00
95d98b1f4b
firewall: move conntrack check after cert+IP verification ( #1779 )
2026-07-07 13:10:11 -05:00
6afca0f461
correctly handle a test packet with a payload longer than the header ( #1778 )
smoke-extra / freebsd-amd64 (push) Failing after 16s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 14s
smoke-extra / netbsd-amd64 (push) Failing after 15s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 15s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Static checks (push) Successful in 1m44s
Build and test / Test linux (push) Failing after 1m39s
Build and test / Test linux-boringcrypto (push) Failing after 3m3s
Build and test / Test linux-pkcs11 (push) Failing after 3m11s
Build and test / Cross-build linux-arm (push) Successful in 3m3s
Build and test / Cross-build linux-mips (push) Successful in 3m44s
Build and test / Cross-build linux-other (push) Successful in 3m8s
Build and test / Cross-build windows (push) Successful in 1m1s
Build and test / Cross-build freebsd (push) Successful in 1m38s
Build and test / Cross-build netbsd (push) Successful in 1m35s
Build and test / Cross-build openbsd (push) Successful in 1m34s
Build and test / Cross-build mobile (push) Successful in 3m17s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-07-03 11:06:22 -05:00
02471b4121
wireshark: fix Lua 5.4 bitwise operation ( #1776 )
...
smoke-extra / freebsd-amd64 (push) Failing after 16s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 16s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 14s
smoke / Run multi node smoke test (push) Failing after 1m27s
Build and test / Static checks (push) Successful in 1m46s
Build and test / Test linux (push) Failing after 1m41s
Build and test / Test linux-boringcrypto (push) Failing after 2m49s
Build and test / Test linux-pkcs11 (push) Failing after 2m49s
Build and test / Cross-build linux-arm (push) Successful in 3m1s
Build and test / Cross-build linux-mips (push) Successful in 3m41s
Build and test / Cross-build linux-other (push) Successful in 3m4s
Build and test / Cross-build windows (push) Successful in 1m1s
Build and test / Cross-build freebsd (push) Successful in 1m32s
Build and test / Cross-build netbsd (push) Successful in 1m33s
Build and test / Cross-build openbsd (push) Successful in 1m31s
Build and test / Cross-build mobile (push) Successful in 3m12s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
The Nebula Wireshark dissector uses bit32.band() when parsing the
Nebula packet type. On Wireshark builds using Lua 5.4, bit32 is not
available, which causes dissection to fail with:
Lua Error: nebula.lua:65: attempt to index a nil value (global 'bit32')
Wireshark bundles Lua BitOp and exposes it globally as bit for Lua
dissectors. This is the documented API for maximum backwards
compatibility across supported Lua versions.
Use bit.band() instead of bit32.band().
2026-07-01 16:12:14 -05:00
58ab7250f5
Bump actions/checkout from 6 to 7 ( #1771 )
...
smoke-extra / freebsd-amd64 (push) Failing after 22s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 15s
smoke / Run multi node smoke test (push) Failing after 1m28s
Build and test / Static checks (push) Successful in 1m47s
Build and test / Test linux (push) Failing after 1m29s
Build and test / Test linux-boringcrypto (push) Failing after 2m41s
Build and test / Test linux-pkcs11 (push) Failing after 3m14s
Build and test / Cross-build linux-arm (push) Successful in 2m58s
Build and test / Cross-build linux-mips (push) Successful in 3m44s
Build and test / Cross-build linux-other (push) Successful in 3m1s
Build and test / Cross-build windows (push) Successful in 58s
Build and test / Cross-build freebsd (push) Successful in 1m31s
Build and test / Cross-build netbsd (push) Successful in 1m31s
Build and test / Cross-build openbsd (push) Successful in 1m30s
Build and test / Cross-build mobile (push) Successful in 3m14s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 12:47:13 -05:00
184cdc8586
Add OCI image labels with version info ( #1772 )
smoke-extra / freebsd-amd64 (push) Failing after 19s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 16s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 17s
smoke / Run multi node smoke test (push) Failing after 1m31s
Build and test / Static checks (push) Successful in 1m47s
Build and test / Test linux (push) Failing after 2m12s
Build and test / Test linux-boringcrypto (push) Failing after 3m8s
Build and test / Test linux-pkcs11 (push) Failing after 3m1s
Build and test / Cross-build linux-arm (push) Successful in 3m6s
Build and test / Cross-build linux-mips (push) Successful in 3m52s
Build and test / Cross-build linux-other (push) Successful in 3m10s
Build and test / Cross-build windows (push) Successful in 1m5s
Build and test / Cross-build freebsd (push) Successful in 1m35s
Build and test / Cross-build netbsd (push) Successful in 1m36s
Build and test / Cross-build openbsd (push) Successful in 1m36s
Build and test / Cross-build mobile (push) Successful in 3m18s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
2026-06-23 14:21:28 -04:00
7d3166a19d
cleanup ipv6 iputil helpers / skip reject for ICMP error packets and fragments ( #1768 )
...
smoke-extra / freebsd-amd64 (push) Failing after 23s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 15s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 15s
smoke-extra / linux-386 (push) Failing after 17s
smoke / Run multi node smoke test (push) Failing after 1m27s
Build and test / Static checks (push) Successful in 53s
Build and test / Test linux (push) Failing after 1m16s
Build and test / Test linux-boringcrypto (push) Failing after 3m9s
Build and test / Test linux-pkcs11 (push) Failing after 2m21s
Build and test / Cross-build linux-arm (push) Successful in 3m5s
Build and test / Cross-build linux-mips (push) Successful in 3m57s
Build and test / Cross-build linux-other (push) Successful in 3m8s
Build and test / Cross-build windows (push) Successful in 1m2s
Build and test / Cross-build freebsd (push) Successful in 1m34s
Build and test / Cross-build netbsd (push) Successful in 1m34s
Build and test / Cross-build openbsd (push) Successful in 1m35s
Build and test / Cross-build mobile (push) Successful in 3m19s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
* cleanup ipv6 iputil helpers
With my refactoring in this PR I accidentally had some duplicate logic,
this PR cleans it up:
- https://github.com/slackhq/nebula/pull/1766
* skip ICMP reject for ICMP error packets and fragments
Per RFC 1122, ICMP error messages must not be generated in response to
other ICMP error messages to prevent infinite error loops. This applies
to both IPv4 (types 3, 4, 5, 11, 12) and IPv6 (types 1-4).
Do not generate reject packets for IPv4 or IPv6 fragments. For IPv4,
check MF flag and fragment offset. For IPv6, add isFragment return to
ipv6FindUpperProtocol so a single traversal handles both protocol
lookup and fragment detection.
* do send rejects for the initial fragment
RFC says "non-initial fragment"s
* fix fragment checks
2026-06-16 16:51:14 -04:00
fe1c5682f0
add IPv6 support to CreateICMPEchoResponse ( #1767 )
...
smoke-extra / freebsd-amd64 (push) Failing after 16s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 17s
smoke-extra / netbsd-amd64 (push) Failing after 14s
smoke-extra / openbsd-amd64 (push) Failing after 14s
smoke-extra / linux-386 (push) Failing after 15s
smoke / Run multi node smoke test (push) Failing after 1m28s
Build and test / Static checks (push) Successful in 42s
Build and test / Test linux (push) Failing after 1m29s
Build and test / Test linux-boringcrypto (push) Failing after 2m51s
Build and test / Test linux-pkcs11 (push) Failing after 2m51s
Build and test / Cross-build linux-arm (push) Successful in 3m9s
Build and test / Cross-build linux-mips (push) Successful in 3m51s
Build and test / Cross-build linux-other (push) Successful in 3m16s
Build and test / Cross-build windows (push) Successful in 1m3s
Build and test / Cross-build freebsd (push) Successful in 1m38s
Build and test / Cross-build netbsd (push) Successful in 1m36s
Build and test / Cross-build openbsd (push) Successful in 1m36s
Build and test / Cross-build mobile (push) Successful in 3m20s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Test macos (push) Has been cancelled
Build and test / Test windows (push) Has been cancelled
Build and test / CI status (push) Has been cancelled
The function previously only handled IPv4 ICMP Echo Request packets.
This adds handling for IPv6 ICMPv6 Echo Request (type 128) by generating
a proper Echo Reply (type 129) with correct pseudo-header checksum.
2026-06-16 13:16:47 -04:00
e4cc80aaca
add IPv6 reject packet generation ( #1766 )
...
* add IPv6 reject packet generation (ICMPv6 Destination Unreachable and TCP RST)
* use ICMPv6 code 1 (administratively prohibited) and cap body at 1000 bytes
* cleanup, use ICMP error code 13 for ipv4
* better docs
* cleanup
2026-06-16 13:04:21 -04:00
JackDoan