John Maguire
5bf666dd90
Treat uppercase blocked fingerprints the same as lowercase ( #1964 )
...
- Error for invalid on startup
- Still block the valid blocklist entries when a reload has a bad one
2026-10-16 16:28:37 -04:00
John Maguire
49207da077
Remove the ssh debug profiling commands ( #1965 )
...
We plan to move this functionality into the debug socket.
2026-10-16 15:47:56 -04:00
Nate Brown
915495d5f4
Fail the reload on a startup only value that would fail a restart, and stop asking for tun.dev restarts that change nothing ( #1953 )
smoke-extra / freebsd-amd64 (push) Failing after 25s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 13s
smoke-extra / netbsd-amd64 (push) Failing after 11s
smoke-extra / openbsd-amd64 (push) Failing after 12s
smoke-extra / linux-386 (push) Failing after 14s
smoke / Run multi node smoke test (push) Failing after 1m43s
Build and test / Static checks (push) Successful in 2m25s
Build and test / Test linux (push) Failing after 1m28s
Build and test / Test linux-pkcs11 (push) Failing after 2m5s
Build and test / Test linux-boringcrypto (push) Failing after 2m56s
Build and test / Test linux-fips140 (push) Failing after 3m3s
Build and test / Cross-build linux-arm (push) Successful in 3m14s
Build and test / Cross-build linux-mips (push) Successful in 3m48s
Build and test / Cross-build linux-other (push) Successful in 3m13s
Build and test / Cross-build windows (push) Successful in 1m3s
Build and test / Cross-build freebsd (push) Successful in 1m34s
Build and test / Cross-build netbsd (push) Successful in 1m36s
Build and test / Cross-build openbsd (push) Successful in 1m37s
Build and test / Cross-build mobile (push) Successful in 3m33s
smoke / Run self traffic smoke test on macOS (push) Canceled after 0s
Build and test / Test macos (push) Canceled after 0s
Build and test / Test windows (push) Canceled after 0s
Build and test / CI status (push) Canceled after 0s
smoke-extra / Run windows smoke test (push) Canceled after 0s
2026-10-15 23:34:09 -05:00
Nate Brown
1a0ac25db0
Report how a config reload went: failures, restarts required, and the keys that need one ( #1935 )
2026-10-15 15:36:39 -05:00
Ryan Huber
8a2de9b1b5
examples: set socket buffers and raise tun tx_queue ( #1928 )
...
* examples: set socket buffers and raise tun tx_queue
* examples: use the default tcp max window for socket buffers
* examples: note buffers are linux only, clarify tx_queue default
* tun: default tx_queue to 5000
2026-10-11 00:30:07 -04:00
Jack Doan
13af8dd6f3
Cap configured MTUs at 8937 so relayed sends never outgrow their buffers ( #1899 )
2026-10-08 15:41:08 -05:00
Nate Brown
d5062dacf0
lighthouse: Never block in QueryServer, drop queries when the channel is full ( #1910 )
2026-09-30 15:26:34 -05:00
Jack Doan
19e04db115
disable offloads by default for first release ( #1858 )
2026-08-24 12:33:08 -05:00
Jack Doan
edc3c5e018
the definitive tun offloads branch ( #1704 )
2026-08-21 11:57:38 -05:00
Nate Brown and Jack Doan
7902ce674e
Rebind for MacOS ( #1816 )
...
Co-authored-by: Jack Doan <me@jackdoan.com >
2026-07-23 09:26:24 -05:00
John Maguire
58f3b6fda7
Document rootless Nebula in example service script ( #1814 )
2026-07-21 19:32:33 -04:00
Wade Simmons
e4cc80aaca
add IPv6 reject packet generation ( #1766 )
...
* add IPv6 reject packet generation (ICMPv6 Destination Unreachable and TCP RST)
* use ICMPv6 code 1 (administratively prohibited) and cap body at 1000 bytes
* cleanup, use ICMP error code 13 for ipv4
* better docs
* cleanup
2026-06-16 13:04:21 -04:00
Nate Brown
696903d6d9
Add a way to set the network type on windows + tests ( #1710 )
gofmt / Run gofmt (push) Failing after 2s
smoke-extra / freebsd-amd64 (push) Failing after 2s
smoke-extra / linux-amd64-ipv6disable (push) Failing after 3s
smoke-extra / netbsd-amd64 (push) Failing after 3s
smoke-extra / openbsd-amd64 (push) Failing after 3s
smoke-extra / linux-386 (push) Failing after 3s
smoke / Run multi node smoke test (push) Failing after 2s
Build and test / Build all and test on ubuntu-linux (push) Failing after 3s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
smoke-extra / Run windows smoke test (push) Has been cancelled
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2026-05-07 20:17:38 -05:00
Nate Brown
213dd46588
Stop leaking goroutines past Control.Stop, consolidate punching in Punchy ( #1708 )
2026-05-06 16:21:16 -05:00
Nate Brown
1ab1f71dba
Make stats a server we can reconfigure and start/stop ( #1670 )
gofmt / Run gofmt (push) Failing after 2s
smoke-extra / Run extra smoke tests (push) Failing after 2s
smoke / Run multi node smoke test (push) Failing after 3s
Build and test / Build all and test on ubuntu-linux (push) Failing after 2s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2026-04-27 12:25:24 -05:00
Nate Brown
d0f02ba873
Switch to slog, remove logrus ( #1672 )
2026-04-27 09:41:47 -05:00
Jay R. Wren and Claude
f8587956ba
add sshd.sandbox_dir config option ( #1622 )
...
* add sshd.sandbox_dir config option
Sanitize SSH profile paths (ssh.go:514,683,719) — restrict os.Create(a[0]) to a safe directory.
Add a config option in the config file to specify the sandbox directory. For backwards compatibility, if the config is not specified, keep the current behavior.
* update default and example
* use os.TempDir() for sshd.sandbox_dir default
* split sandbox path validation into separate conditionals
Separate the combined && check in sshSanitizeFilePath into two distinct
conditionals with specific error messages: one for paths resolving to the
sandbox directory itself, and one for paths outside the sandbox.
Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com >
* fix: trim leading zeros from p256 signature swap result
bigmod.Nat.Bytes() returns fixed-size 32-byte slices, but ASN.1 INTEGER
parsing strips leading zeros. This caused a flaky test failure (~1/256
chance) when the S value's high byte was zero.
Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com >
---------
Co-authored-by: Claude <svc-devxp-claude@slack-corp.com >
2026-04-03 09:37:18 -04:00
Jack Doan
353ad1f271
firewall: icmp no longer requires a port spec ( #1609 )
2026-02-13 11:10:40 -06:00
Nate Brown
1283ff0db4
Add option to control accepting recv_error ( #1569 )
2026-01-13 00:00:27 -06:00
Nate Brown
64f202fa17
Make 0.0.0.0/0 and ::/0 not mean any address family, add any for that ( #1538 )
gofmt / Run gofmt (push) Failing after 13s
smoke-extra / Run extra smoke tests (push) Failing after 2s
smoke / Run multi node smoke test (push) Failing after 2s
Build and test / Build all and test on ubuntu-linux (push) Failing after 2s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-11-21 13:46:36 -06:00
Nate Brown
52623820c2
Drop inactive tunnels ( #1427 )
2025-07-03 09:58:37 -05:00
maggie44
8536c57645
Allow configuration of logger and build version in gvisor service library ( #1239 )
gofmt / Run gofmt (push) Successful in 11s
smoke-extra / Run extra smoke tests (push) Failing after 20s
smoke / Run multi node smoke test (push) Failing after 1m23s
Build and test / Build all and test on ubuntu-linux (push) Failing after 18m26s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2m30s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m35s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-04-21 13:45:59 -04:00
Andriyanov Nikita
e5ce8966d6
add netlink options ( #1326 )
...
* add netlink options
* force use buffer
* fix namings and add config examples
* fix linter
2025-04-21 13:44:33 -04:00
John Maguire
d4a7df3083
Rename pki.default_version to pki.initiating_version ( #1381 )
gofmt / Run gofmt (push) Successful in 9s
smoke-extra / Run extra smoke tests (push) Failing after 20s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Build all and test on ubuntu-linux (push) Failing after 21m13s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3m19s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m47s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-04-07 18:08:29 -04:00
John Maguire
e136d1d47a
Update example config with default_local_cidr_any changes ( #1373 )
2025-04-01 16:08:03 -05:00
dioss-Machiel
f86953ca56
Implement ECMP for unsafe_routes ( #1332 )
gofmt / Run gofmt (push) Successful in 27s
smoke-extra / Run extra smoke tests (push) Failing after 18s
smoke / Run multi node smoke test (push) Failing after 1m26s
Build and test / Build all and test on ubuntu-linux (push) Failing after 21m43s
Build and test / Build and test on linux with boringcrypto (push) Failing after 3m45s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m59s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-03-24 17:15:59 -05:00
Caleb Jasik
50473bd2a8
Update example config to listen on :: by default ( #1351 )
gofmt / Run gofmt (push) Successful in 10s
smoke-extra / Run extra smoke tests (push) Failing after 19s
smoke / Run multi node smoke test (push) Failing after 1m27s
Build and test / Build all and test on ubuntu-linux (push) Failing after 19m16s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2m41s
Build and test / Build and test on linux with pkcs11 (push) Failing after 2m56s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-03-12 22:53:16 -05:00
jampe
1d3c85338c
add so_mark sockopt support ( #1331 )
gofmt / Run gofmt (push) Successful in 10s
smoke-extra / Run extra smoke tests (push) Failing after 20s
smoke / Run multi node smoke test (push) Failing after 1m29s
Build and test / Build all and test on ubuntu-linux (push) Failing after 19m23s
Build and test / Build and test on linux with boringcrypto (push) Failing after 2m45s
Build and test / Build and test on linux with pkcs11 (push) Failing after 3m39s
Build and test / Build and test on macos-latest (push) Has been cancelled
Build and test / Build and test on windows-latest (push) Has been cancelled
2025-03-12 09:35:33 -05:00
d97ed57a19
V2 certificate format ( #1216 )
...
Co-authored-by: Nate Brown <nbrown.us@gmail.com >
Co-authored-by: Jack Doan <jackdoan@rivian.com >
Co-authored-by: brad-defined <77982333+brad-defined@users.noreply.github.com >
Co-authored-by: Jack Doan <me@jackdoan.com >
2025-03-06 11:28:26 -06:00
Jack Doan
3dc56e1184
Support UDP dialling with gvisor ( #1181 )
2024-08-26 12:38:32 -05:00
Wade Simmons and John Maguire
50b24c102e
v1.9.0 ( #1137 )
...
Update CHANGELOG for Nebula v1.9.0
Co-authored-by: John Maguire <john@defined.net >
2024-05-08 10:31:24 -04:00
John Maguire
f31bab5f1a
Add support for SSH CAs ( #1098 )
...
- Accept certs signed by trusted CAs
- Username must match the cert principal if set
- Any username can be used if cert principal is empty
- Don't allow removed pubkeys/CAs to be used after reload
2024-04-30 10:50:17 -04:00
John Maguire
f7db0eb5cc
Remove Vagrant example ( #1129 )
2024-04-30 09:40:24 -05:00
Andrew Kraut
df78158cfa
Create service script for open-rc ( #711 )
2024-04-30 09:53:00 -04:00
Nate Brown
a99618e95c
Don't log invalid certificates ( #1116 )
2024-04-29 15:21:00 -05:00
Nate Brown
cc8b3cc961
Add config option for local_cidr control
2024-02-15 11:46:45 -06:00
Nate Brown
f346cf4109
At the end
2024-02-05 10:23:10 -06:00
Nate Brown
072edd56b3
Fix re-entrant GetOrHandshake issues ( #1044 )
2023-12-19 11:58:31 -06:00
Tristan Rice
1083279a45
add gvisor based service library ( #965 )
...
* add service/ library
2023-11-21 11:50:18 -05:00
Nate Brown
3356e03d85
Default pki.disconnect_invalid to true and make it reloadable ( #859 )
2023-11-13 12:39:38 -06:00
John Maguire
87b628ba24
Fix truncated comment in config.yml ( #999 )
2023-10-27 08:39:34 -04:00
c0repwn3r
03e70210a5
Add support for NetBSD ( #916 )
2023-07-27 13:44:47 -05:00
Nate Brown
1e3c155896
Attempt to notify systemd of service readiness on linux ( #929 )
2023-07-24 11:30:18 -05:00
John Maguire
7e380bde7e
Document new DNS config options ( #879 )
2023-07-10 15:19:05 -04:00
John Maguire
8ba5d64dbc
Add support for naming FreeBSD tun devices ( #903 )
2023-06-22 12:13:31 -04:00
Ilya Lukyanov
1701087035
Add destination CIDR checking ( #507 )
2023-05-09 10:37:23 -05:00
Nate Brown
a9cb2e06f4
Add ability to respect the system route table for unsafe route on linux ( #839 )
2023-05-09 10:36:55 -05:00
Nate Brown
397fe5f879
Add ability to skip installing unsafe routes on the os routing table ( #831 )
2023-04-10 12:32:37 -05:00
Nate Brown
3cb4e0ef57
Allow listen.host to contain names ( #825 )
2023-04-05 11:29:26 -05:00
Wade Simmons
3e5c7e6860
add punchy.respond_delay config option ( #721 )
2023-03-29 14:32:35 -05:00
John Maguire