v1.10.2 (#1584)

Update CHANGELOG for Nebula v1.10.2

CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.10.2] - 2026-01-21
+
+### Fixed
+
+- Fix panic when using `use_system_route_table` that was introduced in v1.10.1. (#1580)
+
+### Changed
+
+- Fix some typos in comments. (#1582)
+- Dependency updates. (#1581)
+
 ## [1.10.1] - 2026-01-16
 
 See the [v1.10.1](https://github.com/slackhq/nebula/milestone/26?closed=1) milestone for a complete list of changes.
@@ -764,7 +775,8 @@ created.)
 
 - Initial public release.
 
-[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.1...HEAD
+[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.2...HEAD
+[1.10.2]: https://github.com/slackhq/nebula/releases/tag/v1.10.2
 [1.10.1]: https://github.com/slackhq/nebula/releases/tag/v1.10.1
 [1.10.0]: https://github.com/slackhq/nebula/releases/tag/v1.10.0
 [1.9.7]: https://github.com/slackhq/nebula/releases/tag/v1.9.7

cert/cert_v2.go

@@ -396,6 +396,7 @@ func (c *certificateV2) validate() error {
 		return NewErrInvalidCertificateProperties("non-CA certificate must contain at least 1 network")
 	}
 
+	hasV4Networks := false
 	hasV6Networks := false
 	for _, network := range c.details.networks {
 		if !network.IsValid() || !network.Addr().IsValid() {
@@ -414,6 +415,7 @@ func (c *certificateV2) validate() error {
 			return NewErrInvalidCertificateProperties("4in6 networks are not allowed: %s", network)
 		}
 
+		hasV4Networks = hasV4Networks || network.Addr().Is4()
 		hasV6Networks = hasV6Networks || network.Addr().Is6()
 	}
 
@@ -437,6 +439,10 @@ func (c *certificateV2) validate() error {
 				if !hasV6Networks {
 					return NewErrInvalidCertificateProperties("IPv6 unsafe networks require an IPv6 address assignment: %s", network)
 				}
+			} else if network.Addr().Is4() {
+				if !hasV4Networks {
+					return NewErrInvalidCertificateProperties("IPv4 unsafe networks require an IPv4 address assignment: %s", network)
+				}
 			}
 		}
 	}

overlay/tun_linux.go

@@ -137,6 +137,7 @@ func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []n
 		TXQueueLen:                c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
 		useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0),
+		routesFromSystem:          map[netip.Prefix]routing.Gateways{},
 		l:                         l,
 	}