just fetch all of origin

We need to ensure we have MERGE_SHA available too

.github/backport.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+#
+# Backport a merged PR to a release branch.
+#
+# Cherry-picks the merge commit of a merged PR onto release-1.11 and opens a
+# backport PR, mirroring the shape of #1842.
+#
+# Usage: ./backport.sh <pr-number> [target-version] [--continue]
+#   pr-number       The merged PR to backport
+#   target-version  Release version to target (default: 1.11)
+#   --continue      Resume after resolving cherry-pick conflicts: assumes the
+#                   fixes are staged, runs `git cherry-pick --continue`, and
+#                   proceeds to push and open the backport PR.
+#
+# Requires: gh (authenticated), git, jq.
+
+set -euo pipefail
+
+PR_NUMBER=${1:?usage: backport.sh <pr-number> [target-version] [--continue]}
+shift
+CONTINUE=0
+TARGET_VERSION=""
+for arg in "$@"; do
+  case "$arg" in
+    --continue) CONTINUE=1 ;;
+    *) TARGET_VERSION=$arg ;;
+  esac
+done
+
+for cmd in gh git jq; do
+  command -v "$cmd" >/dev/null || { echo "error: $cmd is required" >&2; exit 1; }
+done
+
+# Pull the source PR's metadata. Refuse to backport a PR that never merged.
+pr_json=$(gh pr view "$PR_NUMBER" --json title,body,mergedAt,mergeCommit,milestone)
+PR_TITLE=$(jq -r '.title' <<<"$pr_json")
+PR_BODY=$(jq -r '.body' <<<"$pr_json")
+MERGE_SHA=$(jq -r '.mergeCommit.oid // empty' <<<"$pr_json")
+PR_MILESTONE=$(jq -r '.milestone.title // empty' <<<"$pr_json")
+
+if [ "$(jq -r '.mergedAt // empty' <<<"$pr_json")" = "" ] || [ -z "$MERGE_SHA" ]; then
+  echo "error: PR #${PR_NUMBER} is not merged (no merge commit to cherry-pick)" >&2
+  exit 1
+fi
+
+# Default the target to one minor below the PR's milestone: a PR landing in
+# v1.12.0 backports to release-1.11. An explicit target-version arg overrides.
+if [ -z "$TARGET_VERSION" ]; then
+  if [[ $PR_MILESTONE =~ ^v?([0-9]+)\.([0-9]+) ]]; then
+    TARGET_VERSION="${BASH_REMATCH[1]}.$(( BASH_REMATCH[2] - 1 ))"
+  else
+    echo "error: PR #${PR_NUMBER} has no v<major>.<minor>.* milestone to infer the target from." >&2
+    echo "Pass the target version explicitly, e.g. $0 ${PR_NUMBER} 1.11" >&2
+    exit 1
+  fi
+fi
+TARGET_BRANCH="release-${TARGET_VERSION}"
+
+# Slug from the PR title: lower-case, non-alphanumerics to dashes, trimmed.
+slug=$(printf '%s' "$PR_TITLE" \
+  | tr '[:upper:]' '[:lower:]' \
+  | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//' \
+  | cut -c1-50 \
+  | sed -E 's/-+$//')
+BRANCH="backport-${TARGET_VERSION//./-}-${slug}"
+
+if [ "$CONTINUE" -eq 1 ]; then
+  # Resuming: the branch already exists and a cherry-pick is mid-conflict.
+  current=$(git rev-parse --abbrev-ref HEAD)
+  if [ "$current" != "$BRANCH" ]; then
+    echo "error: --continue expects to be on ${BRANCH}, but HEAD is ${current}" >&2
+    exit 1
+  fi
+  echo "Resuming backport of #${PR_NUMBER} on ${BRANCH}"
+  # Conflicts assumed resolved and staged; core.editor=true keeps the commit message.
+  git -c core.editor=true cherry-pick --continue
+else
+  # A fresh run switches branches and cherry-picks, so tracked changes must be
+  # clean. Untracked files are fine, and --continue is exempt (its resolved
+  # conflicts are meant to be staged).
+  if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
+    echo "error: working tree has uncommitted changes to tracked files; commit or stash them first." >&2
+    exit 1
+  fi
+
+  echo "Backporting #${PR_NUMBER} (${MERGE_SHA}) onto ${TARGET_BRANCH} as ${BRANCH}"
+
+  git fetch origin
+  git checkout -b "$BRANCH" "origin/${TARGET_BRANCH}"
+
+  # -m 1 handles a real merge commit; plain cherry-pick handles a squash merge.
+  if ! { git cherry-pick -x -m 1 "$MERGE_SHA" 2>/dev/null || git cherry-pick -x "$MERGE_SHA"; }; then
+    echo "error: ${MERGE_SHA} did not cherry-pick cleanly onto ${TARGET_BRANCH}." >&2
+    echo "Resolve the conflicts, 'git add' them, then re-run:" >&2
+    echo "  $0 ${PR_NUMBER} ${TARGET_VERSION} --continue" >&2
+    exit 1
+  fi
+fi
+
+title="backport v${TARGET_VERSION}: ${PR_TITLE}"
+body=$(printf 'Backport from #%s to release v%s\n\n---\n\n%s' \
+  "$PR_NUMBER" "$TARGET_VERSION" "$PR_BODY")
+
+# Highest open milestone matching v<version>.* (e.g. v1.11.1), if any.
+MILESTONE=$(gh api "repos/{owner}/{repo}/milestones?state=open" \
+  --jq ".[].title | select(startswith(\"v${TARGET_VERSION}.\"))" \
+  | sort -V | tail -n1)
+milestone_args=()
+if [ -n "$MILESTONE" ]; then
+  milestone_args=(--milestone "$MILESTONE")
+else
+  echo "warning: no open milestone matching v${TARGET_VERSION}.* found; PR will have no milestone" >&2
+fi
+
+echo
+echo "About to run:"
+printf '  git push -u --force-with-lease origin %q\n' "$BRANCH"
+printf '  gh pr create --base %q --head %q --title %q --body %q' \
+  "$TARGET_BRANCH" "$BRANCH" "$title" "$body"
+[ -n "$MILESTONE" ] && printf ' --milestone %q' "$MILESTONE"
+printf '\n'
+echo
+read -r -p "Open this pull request? [y/N] " reply
+case "$reply" in
+  [yY] | [yY][eE][sS]) ;;
+  *) echo "Aborted. The cherry-pick is on local branch ${BRANCH}; push it manually if desired."; exit 0 ;;
+esac
+
+git push -u --force-with-lease origin "$BRANCH"
+
+gh pr create \
+  --base "$TARGET_BRANCH" \
+  --head "$BRANCH" \
+  --title "$title" \
+  --body "$body" \
+  ${milestone_args[@]+"${milestone_args[@]}"}
+
+# The backport now exists, so drop the label that flagged this PR for one.
+gh pr edit "$PR_NUMBER" --remove-label needs-backport
+
+# Switch back to the original branch we were on before doing the backport
+git checkout -

connection_manager.go

@@ -323,12 +323,6 @@ func (cm *connectionManager) makeTrafficDecision(localIndex uint32, now time.Tim
 		return closeTunnel, hostinfo, nil
 	}
 
-	if hostinfo.ConnectionState != nil && hostinfo.ConnectionState.messageCounter.Load() >= RejectAfterMessages {
-		// Send path can't encrypt a CloseTunnel notify, so just delete locally; the peer recovers via recv_error.
-		hostinfo.logger(cm.l).Error("Dropping tunnel, message counter is exhausted")
-		return deleteTunnel, hostinfo, nil
-	}
-
 	primary := cm.hostMap.Hosts[hostinfo.vpnAddrs[0]]
 	mainHostInfo := true
 	if primary != nil && primary != hostinfo {
@@ -454,11 +448,6 @@ func (cm *connectionManager) shouldSwapPrimary(current *HostInfo) bool {
 		return false
 	}
 
-	if current.ConnectionState.messageCounter.Load() >= RehandshakeAfterMessages {
-		// This tunnel is being rolled for counter exhaustion, never swap back onto its spent key.
-		return false
-	}
-
 	crt := cm.intf.pki.getCertState().getCertificate(current.ConnectionState.myCert.Version())
 	if crt == nil {
 		//my cert was reloaded away. We should definitely swap from this tunnel
@@ -555,15 +544,6 @@ func (cm *connectionManager) tryRehandshake(hostinfo *HostInfo) {
 			"reason", "current cert version < pki.initiatingVersion",
 		)
 
-		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
-		return
-	}
-	if hostinfo.ConnectionState.messageCounter.Load() >= RehandshakeAfterMessages {
-		cm.l.Info("Re-handshaking with remote",
-			"vpnAddrs", hostinfo.vpnAddrs,
-			"reason", "message counter rehandshake threshold reached",
-		)
-
 		cm.intf.handshakeManager.StartHandshake(hostinfo.vpnAddrs[0], nil)
 		return
 	}

connection_manager_test.go

@@ -199,79 +199,6 @@ func Test_NewConnectionManagerTest2(t *testing.T) {
 	assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnAddrs[0])
 }
 
-func Test_NewConnectionManager_CounterLimits(t *testing.T) {
-	l := test.NewLogger()
-	localrange := netip.MustParsePrefix("10.1.1.1/24")
-	vpnIp := netip.MustParseAddr("172.1.1.2")
-	preferredRanges := []netip.Prefix{localrange}
-
-	// Very incomplete mock objects
-	hostMap := newHostMap(l)
-	hostMap.preferredRanges.Store(&preferredRanges)
-
-	cs := &CertState{
-		initiatingVersion: cert.Version1,
-		privateKey:        []byte{},
-		v1Cert:            &dummyCert{version: cert.Version1},
-		v1Credential:      nil,
-	}
-
-	lh := newTestLighthouse()
-	ifce := &Interface{
-		hostMap:          hostMap,
-		inside:           &overlaytest.NoopTun{},
-		outside:          &udp.NoopConn{},
-		firewall:         &Firewall{},
-		lightHouse:       lh,
-		pki:              &PKI{},
-		myVpnAddrs:       []netip.Addr{netip.MustParseAddr("172.1.1.1")}, // sorts below vpnIp so shouldSwapPrimary can proceed
-		handshakeManager: NewHandshakeManager(l, hostMap, lh, &udp.NoopConn{}, defaultHandshakeConfig),
-		l:                l,
-	}
-	ifce.pki.cs.Store(cs)
-
-	conf := config.NewC(test.NewLogger())
-	punchy := NewPunchyFromConfig(test.NewLogger(), conf, nil)
-	nc := newConnectionManagerFromConfig(test.NewLogger(), conf, hostMap, punchy)
-	nc.intf = ifce
-
-	hostinfo := &HostInfo{
-		vpnAddrs:      []netip.Addr{vpnIp},
-		localIndexId:  1099,
-		remoteIndexId: 9901,
-	}
-	hostinfo.ConnectionState = &ConnectionState{
-		myCert: &dummyCert{version: cert.Version1},
-	}
-	nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
-
-	// Below the rehandshake threshold, no handshake is started
-	hostinfo.ConnectionState.messageCounter.Store(RehandshakeAfterMessages - 1)
-	nc.tryRehandshake(hostinfo)
-	assert.Nil(t, ifce.handshakeManager.QueryVpnAddr(vpnIp))
-
-	// A tunnel on its current cert would normally swap to primary
-	assert.True(t, nc.shouldSwapPrimary(hostinfo))
-
-	// At the rehandshake threshold, a new handshake is started
-	hostinfo.ConnectionState.messageCounter.Store(RehandshakeAfterMessages)
-	nc.tryRehandshake(hostinfo)
-	assert.NotNil(t, ifce.handshakeManager.QueryVpnAddr(vpnIp))
-
-	// An exhausted tunnel being rolled must never swap back to primary onto its spent key
-	assert.False(t, nc.shouldSwapPrimary(hostinfo))
-
-	// Still below the reject limit, the tunnel stays up
-	nc.In(hostinfo)
-	decision, _, _ := nc.makeTrafficDecision(hostinfo.localIndexId, time.Now())
-	assert.Equal(t, tryRehandshake, decision)
-
-	// At the reject limit, the tunnel is deleted locally without a doomed CloseTunnel notify
-	hostinfo.ConnectionState.messageCounter.Store(RejectAfterMessages)
-	decision, _, _ = nc.makeTrafficDecision(hostinfo.localIndexId, time.Now())
-	assert.Equal(t, deleteTunnel, decision)
-}
-
 func Test_NewConnectionManager_DisconnectInactive(t *testing.T) {
 	l := test.NewLogger()
 	localrange := netip.MustParsePrefix("10.1.1.1/24")

connection_state.go

@@ -2,7 +2,6 @@ package nebula
 
 import (
 	"encoding/json"
-	"fmt"
 	"log/slog"
 	"sync"
 	"sync/atomic"
@@ -13,18 +12,7 @@ import (
 	"github.com/slackhq/nebula/noiseutil"
 )
 
-const (
-	ReplayWindow = 1024
-
-	// RehandshakeAfterMessages rolls keys inside the AES-GCM data-volume margin (~2^-36 advantage at 64KB frames).
-	RehandshakeAfterMessages = uint64(1) << 34
-
-	// RejectAfterMessages is the nonce ceiling enforced by noiseutil; a tunnel here is deleted locally, not notified.
-	RejectAfterMessages = noiseutil.RejectAfterMessages
-)
-
-// RehandshakeAfterMessages must stay below RejectAfterMessages so tunnels roll before the hard send stop.
-const _ = RejectAfterMessages - RehandshakeAfterMessages
+const ReplayWindow = 1024
 
 type ConnectionState struct {
 	eKey           noiseutil.CipherState
@@ -42,12 +30,7 @@ type ConnectionState struct {
 // completed handshake.Result. It seeds messageCounter and the replay window so
 // that the post-handshake message indices already used on the wire don't count
 // as missed traffic in the data plane.
-func newConnectionStateFromResult(r *handshake.Result) (*ConnectionState, error) {
-	// Refuse a MessageIndex too big for the replay window: it can only be a bug, and would spin the seed loop below.
-	if r.MessageIndex >= ReplayWindow {
-		return nil, fmt.Errorf("handshake message index %d exceeds replay window", r.MessageIndex)
-	}
-
+func newConnectionStateFromResult(r *handshake.Result) *ConnectionState {
 	ci := &ConnectionState{
 		myCert:    r.MyCert,
 		initiator: r.Initiator,
@@ -60,7 +43,7 @@ func newConnectionStateFromResult(r *handshake.Result) (*ConnectionState, error)
 	for i := uint64(1); i <= r.MessageIndex; i++ {
 		ci.window.Update(nil, i)
 	}
-	return ci, nil
+	return ci
 }
 
 func (cs *ConnectionState) MarshalJSON() ([]byte, error) {
@@ -71,16 +54,6 @@ func (cs *ConnectionState) MarshalJSON() ([]byte, error) {
 	})
 }
 
-// NextMessageCounter reserves the next 1-based counter; RejectAfterMessages is the first we refuse, pinned to not wrap.
-func (cs *ConnectionState) NextMessageCounter() (uint64, bool) {
-	c := cs.messageCounter.Add(1)
-	if c >= RejectAfterMessages {
-		cs.messageCounter.Store(RejectAfterMessages)
-		return c, false
-	}
-	return c, true
-}
-
 func (cs *ConnectionState) Curve() cert.Curve {
 	return cs.myCert.Curve()
 }

connection_state_test.go

@@ -6,12 +6,10 @@ import (
 	"time"
 
 	"github.com/flynn/noise"
-	"github.com/rcrowley/go-metrics"
 	"github.com/slackhq/nebula/cert"
 	ct "github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/handshake"
 	"github.com/slackhq/nebula/header"
-	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -81,51 +79,11 @@ func runTestHandshake(t *testing.T) (initR, respR *handshake.Result) {
 	return initR, respR
 }
 
-func TestConnectionState_NextMessageCounter(t *testing.T) {
-	cs := &ConnectionState{}
-	cs.messageCounter.Store(RejectAfterMessages - 2)
-
-	c, ok := cs.NextMessageCounter()
-	assert.True(t, ok)
-	assert.Equal(t, RejectAfterMessages-1, c)
-
-	// Hitting the limit refuses and pins the counter there
-	c, ok = cs.NextMessageCounter()
-	assert.False(t, ok)
-	assert.Equal(t, RejectAfterMessages, c)
-	assert.Equal(t, RejectAfterMessages, cs.messageCounter.Load())
-
-	// Continued send attempts stay refused and the counter never wraps
-	for i := 0; i < 10; i++ {
-		_, ok = cs.NextMessageCounter()
-		assert.False(t, ok)
-	}
-	assert.Equal(t, RejectAfterMessages, cs.messageCounter.Load())
-}
-
-// TestSendNoMetricsDropsExhausted drives the send path to the exhausted drop; metric and out flag prove it.
-func TestSendNoMetricsDropsExhausted(t *testing.T) {
-	initR, _ := runTestHandshake(t)
-	ci, err := newConnectionStateFromResult(initR)
-	require.NoError(t, err)
-	ci.messageCounter.Store(RejectAfterMessages - 1)
-
-	f := &Interface{l: test.NewLogger(), messageMetrics: &MessageMetrics{txExhausted: metrics.NewCounter()}}
-	hostinfo := &HostInfo{vpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.1")}, ConnectionState: ci}
-
-	f.sendNoMetrics(header.Message, 0, ci, hostinfo, netip.AddrPort{}, []byte{}, make([]byte, 12), make([]byte, mtu), 0)
-
-	// The crossing send is refused: it records an exhaustion drop and never reaches connectionManager.Out.
-	assert.Equal(t, int64(1), f.messageMetrics.txExhausted.Count())
-	assert.False(t, hostinfo.out.Load())
-}
-
 func TestNewConnectionStateFromResult(t *testing.T) {
 	initR, respR := runTestHandshake(t)
 
 	t.Run("initiator", func(t *testing.T) {
-		ci, err := newConnectionStateFromResult(initR)
-		require.NoError(t, err)
+		ci := newConnectionStateFromResult(initR)
 		assert.True(t, ci.initiator)
 		assert.Equal(t, initR.MyCert, ci.myCert)
 		assert.Equal(t, initR.RemoteCert, ci.peerCert)
@@ -144,17 +102,8 @@ func TestNewConnectionStateFromResult(t *testing.T) {
 		assert.True(t, ci.window.Check(nil, 3), "counter 3 must not be pre-seeded")
 	})
 
-	t.Run("message index too large is refused", func(t *testing.T) {
-		bad := *initR
-		bad.MessageIndex = ReplayWindow
-		ci, err := newConnectionStateFromResult(&bad)
-		require.Error(t, err)
-		assert.Nil(t, ci)
-	})
-
 	t.Run("responder", func(t *testing.T) {
-		ci, err := newConnectionStateFromResult(respR)
-		require.NoError(t, err)
+		ci := newConnectionStateFromResult(respR)
 		assert.False(t, ci.initiator)
 		assert.Equal(t, respR.MyCert, ci.myCert)
 		assert.Equal(t, respR.RemoteCert, ci.peerCert)

go.mod

@@ -7,8 +7,9 @@ require (
 	filippo.io/bigmod v0.1.0
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be
 	github.com/armon/go-radix v1.0.0
+	github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432
 	github.com/flynn/noise v1.1.0
-	github.com/gaissmai/bart v0.29.0
+	github.com/gaissmai/bart v0.28.0
 	github.com/gogo/protobuf v1.3.2
 	github.com/google/gopacket v1.1.19
 	github.com/kardianos/service v1.3.0
@@ -19,7 +20,7 @@ require (
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
-	github.com/stretchr/testify v1.12.0
+	github.com/stretchr/testify v1.11.1
 	github.com/vishvananda/netlink v1.3.1
 	go.uber.org/goleak v1.3.0
 	go.yaml.in/yaml/v3 v3.0.5
@@ -39,8 +40,10 @@ require (
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/btree v1.1.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect

go.sum

@@ -19,12 +19,15 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432 h1:M5QgkYacWj0Xs8MhpIK/5uwU02icXpEoSo9sM2aRCps=
+github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432/go.mod h1:xwIwAxMvYnVrGJPe2FKx5prTrnAjGOD8zvDOnxnrrkM=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg=
 github.com/flynn/noise v1.1.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
-github.com/gaissmai/bart v0.29.0 h1:wO6HGE8g9YE0Wm0bCpYxwRzfQ4+fbJKOhL64e5ACGCI=
-github.com/gaissmai/bart v0.29.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
+github.com/gaissmai/bart v0.28.0 h1:89yZLo8NmyqD0RYgJ3QO9HhqqGGw+oWhf90cZm69Lko=
+github.com/gaissmai/bart v0.28.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -98,6 +101,7 @@ github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f/go.
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
@@ -136,8 +140,8 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=
-github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=

graphite.go

@@ -1,117 +0,0 @@
-package nebula
-
-// This file is a trimmed, inlined copy of the graphite exporter from
-// github.com/cyberdelia/go-metrics-graphite, retaining only the Config type and
-// the Once entrypoint that Nebula uses. The upstream package has been
-// unmaintained for 10+ years, so it was vendored here to drop the dependency.
-// See https://github.com/slackhq/nebula/issues/1831.
-//
-// Copyright 2015 Timothée Peignier. All rights reserved.
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are met:
-//
-//  1. Redistributions of source code must retain the above copyright notice,
-//     this list of conditions and the following disclaimer.
-//
-//  2. Redistributions in binary form must reproduce the above copyright notice,
-//     this list of conditions and the following disclaimer in the documentation
-//     and/or other materials provided with the distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-import (
-	"bufio"
-	"fmt"
-	"net"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/rcrowley/go-metrics"
-)
-
-// graphiteConfigExport provides a container with configuration parameters for
-// the Graphite exporter.
-type graphiteConfigExport struct {
-	Addr          *net.TCPAddr     // Network address to connect to
-	Registry      metrics.Registry // Registry to be exported
-	FlushInterval time.Duration    // Flush interval
-	DurationUnit  time.Duration    // Time conversion unit for durations
-	Prefix        string           // Prefix to be prepended to metric names
-	Percentiles   []float64        // Percentiles to export from timers and histograms
-}
-
-// graphiteOnce performs a single submission to Graphite, returning a non-nil
-// error on failed connections.
-func graphiteOnce(c graphiteConfigExport) error {
-	now := time.Now().Unix()
-	du := float64(c.DurationUnit)
-	flushSeconds := float64(c.FlushInterval) / float64(time.Second)
-	conn, err := net.DialTCP("tcp", nil, c.Addr)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-	w := bufio.NewWriter(conn)
-	c.Registry.Each(func(name string, i any) {
-		switch metric := i.(type) {
-		case metrics.Counter:
-			count := metric.Count()
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, count, now)
-			fmt.Fprintf(w, "%s.%s.count_ps %.2f %d\n", c.Prefix, name, float64(count)/flushSeconds, now)
-		case metrics.Gauge:
-			fmt.Fprintf(w, "%s.%s.value %d %d\n", c.Prefix, name, metric.Value(), now)
-		case metrics.GaugeFloat64:
-			fmt.Fprintf(w, "%s.%s.value %f %d\n", c.Prefix, name, metric.Value(), now)
-		case metrics.Histogram:
-			h := metric.Snapshot()
-			ps := h.Percentiles(c.Percentiles)
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, h.Count(), now)
-			fmt.Fprintf(w, "%s.%s.min %d %d\n", c.Prefix, name, h.Min(), now)
-			fmt.Fprintf(w, "%s.%s.max %d %d\n", c.Prefix, name, h.Max(), now)
-			fmt.Fprintf(w, "%s.%s.mean %.2f %d\n", c.Prefix, name, h.Mean(), now)
-			fmt.Fprintf(w, "%s.%s.std-dev %.2f %d\n", c.Prefix, name, h.StdDev(), now)
-			for psIdx, psKey := range c.Percentiles {
-				key := strings.Replace(strconv.FormatFloat(psKey*100.0, 'f', -1, 64), ".", "", 1)
-				fmt.Fprintf(w, "%s.%s.%s-percentile %.2f %d\n", c.Prefix, name, key, ps[psIdx], now)
-			}
-		case metrics.Meter:
-			m := metric.Snapshot()
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, m.Count(), now)
-			fmt.Fprintf(w, "%s.%s.one-minute %.2f %d\n", c.Prefix, name, m.Rate1(), now)
-			fmt.Fprintf(w, "%s.%s.five-minute %.2f %d\n", c.Prefix, name, m.Rate5(), now)
-			fmt.Fprintf(w, "%s.%s.fifteen-minute %.2f %d\n", c.Prefix, name, m.Rate15(), now)
-			fmt.Fprintf(w, "%s.%s.mean %.2f %d\n", c.Prefix, name, m.RateMean(), now)
-		case metrics.Timer:
-			t := metric.Snapshot()
-			ps := t.Percentiles(c.Percentiles)
-			count := t.Count()
-			fmt.Fprintf(w, "%s.%s.count %d %d\n", c.Prefix, name, count, now)
-			fmt.Fprintf(w, "%s.%s.count_ps %.2f %d\n", c.Prefix, name, float64(count)/flushSeconds, now)
-			fmt.Fprintf(w, "%s.%s.min %d %d\n", c.Prefix, name, t.Min()/int64(du), now)
-			fmt.Fprintf(w, "%s.%s.max %d %d\n", c.Prefix, name, t.Max()/int64(du), now)
-			fmt.Fprintf(w, "%s.%s.mean %.2f %d\n", c.Prefix, name, t.Mean()/du, now)
-			fmt.Fprintf(w, "%s.%s.std-dev %.2f %d\n", c.Prefix, name, t.StdDev()/du, now)
-			for psIdx, psKey := range c.Percentiles {
-				key := strings.Replace(strconv.FormatFloat(psKey*100.0, 'f', -1, 64), ".", "", 1)
-				fmt.Fprintf(w, "%s.%s.%s-percentile %.2f %d\n", c.Prefix, name, key, ps[psIdx]/du, now)
-			}
-			fmt.Fprintf(w, "%s.%s.one-minute %.2f %d\n", c.Prefix, name, t.Rate1(), now)
-			fmt.Fprintf(w, "%s.%s.five-minute %.2f %d\n", c.Prefix, name, t.Rate5(), now)
-			fmt.Fprintf(w, "%s.%s.fifteen-minute %.2f %d\n", c.Prefix, name, t.Rate15(), now)
-			fmt.Fprintf(w, "%s.%s.mean-rate %.2f %d\n", c.Prefix, name, t.RateMean(), now)
-		}
-		w.Flush()
-	})
-	return nil
-}

handshake_manager.go

@@ -749,14 +749,8 @@ func (hm *HandshakeManager) beginHandshake(via ViaSender, packet []byte, h *head
 		return
 	}
 
-	connState, err := newConnectionStateFromResult(result)
-	if err != nil {
-		f.l.Error("Discarding handshake with an invalid message index", "error", err, "vpnAddrs", vpnAddrs)
-		return
-	}
-
 	hostinfo := &HostInfo{
-		ConnectionState:   connState,
+		ConnectionState:   newConnectionStateFromResult(result),
 		localIndexId:      result.LocalIndex,
 		remoteIndexId:     result.RemoteIndex,
 		vpnAddrs:          vpnAddrs,
@@ -874,13 +868,7 @@ func (hm *HandshakeManager) continueHandshake(via ViaSender, hh *HandshakeHostIn
 	}
 
 	// Handshake complete; build the ConnectionState now that we have keys and a verified peer cert.
-	cs, err := newConnectionStateFromResult(result)
-	if err != nil {
-		f.l.Error("Discarding handshake with an invalid message index", "error", err, "vpnAddrs", hostinfo.vpnAddrs)
-		hm.DeleteHostInfo(hostinfo)
-		return
-	}
-	hostinfo.ConnectionState = cs
+	hostinfo.ConnectionState = newConnectionStateFromResult(result)
 
 	remoteCert := result.RemoteCert
 	if remoteCert == nil {

inside.go

@@ -275,14 +275,6 @@ func (f *Interface) sendTo(t header.MessageType, st header.MessageSubType, ci *C
 	f.sendNoMetrics(t, st, ci, hostinfo, remote, p, nb, out, 0)
 }
 
-// dropExhausted records an exhaustion drop and logs once, on the crossing send, for a spent tunnel.
-func (f *Interface) dropExhausted(hostinfo *HostInfo, c uint64, msg string) {
-	f.messageMetrics.TxExhausted(1)
-	if c == RejectAfterMessages {
-		hostinfo.logger(f.l).Error(msg)
-	}
-}
-
 // SendVia sends a payload through a Relay tunnel. No authentication or encryption is done
 // to the payload for the ultimate target host, making this a useful method for sending
 // handshake messages to peers through relay tunnels.
@@ -302,14 +294,7 @@ func (f *Interface) SendVia(via *HostInfo,
 		// NOTE: for goboring AESGCMTLS we need to lock because of the nonce check
 		via.ConnectionState.writeLock.Lock()
 	}
-	c, ok := via.ConnectionState.NextMessageCounter()
-	if !ok {
-		if noiseutil.EncryptLockNeeded {
-			via.ConnectionState.writeLock.Unlock()
-		}
-		f.dropExhausted(via, c, "Dropping outbound relay packets, tunnel message counter is exhausted")
-		return
-	}
+	c := via.ConnectionState.messageCounter.Add(1)
 
 	out = header.Encode(out, header.Version, header.Message, header.MessageRelay, relay.RemoteIndex, c)
 	f.connectionManager.Out(via)
@@ -376,14 +361,7 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 		// NOTE: for goboring AESGCMTLS we need to lock because of the nonce check
 		ci.writeLock.Lock()
 	}
-	c, ok := ci.NextMessageCounter()
-	if !ok {
-		if noiseutil.EncryptLockNeeded {
-			ci.writeLock.Unlock()
-		}
-		f.dropExhausted(hostinfo, c, "Dropping outbound packets, tunnel message counter is exhausted")
-		return
-	}
+	c := ci.messageCounter.Add(1)
 
 	//l.WithField("trace", string(debug.Stack())).Error("out Header ", &Header{Version, t, st, 0, hostinfo.remoteIndexId, c}, p)
 	out = header.Encode(out, header.Version, t, st, hostinfo.remoteIndexId, c)

main.go

@@ -11,7 +11,6 @@ import (
 	"time"
 
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/noiseutil"
 	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/sshd"
 	"github.com/slackhq/nebula/udp"
@@ -21,12 +20,6 @@ import (
 
 type m = map[string]any
 
-// maxRoutines caps routines below the RejectHeadroom nonce gap so concurrent senders can't race the counter past wrap.
-const maxRoutines = 1 << 16
-
-// The reject headroom must exceed every sender that can be mid-reservation at once, about two per routine.
-const _ = noiseutil.RejectHeadroom - 4*maxRoutines
-
 func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, deviceFactory overlay.DeviceFactory) (retcon *Control, reterr error) {
 	ctx, cancel := context.WithCancel(context.Background())
 	// Automatically cancel the context if Main returns an error, to signal all created goroutines to quit.
@@ -88,6 +81,9 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 		if routines < 1 {
 			routines = 1
 		}
+		if routines > 1 {
+			l.Info("Using multiple routines", "routines", routines)
+		}
 	} else {
 		// deprecated and undocumented
 		tunQueues := c.GetInt("tun.routines", 1)
@@ -97,12 +93,6 @@ func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, dev
 			l.Warn("Setting tun.routines and listen.routines is deprecated. Use `routines` instead", "routines", routines)
 		}
 	}
-	if routines > maxRoutines {
-		l.Warn("Using multiple routines", "routines", maxRoutines, "clamped", true, "requestedRoutines", routines)
-		routines = maxRoutines
-	} else if routines > 1 {
-		l.Info("Using multiple routines", "routines", routines)
-	}
 
 	// EXPERIMENTAL
 	// Intentionally not documented yet while we do more testing and determine

message_metrics.go

@@ -14,8 +14,7 @@ type MessageMetrics struct {
 	rxUnknown metrics.Counter
 	txUnknown metrics.Counter
 
-	rxInvalid   metrics.Counter
-	txExhausted metrics.Counter
+	rxInvalid metrics.Counter
 }
 
 func (m *MessageMetrics) Rx(t header.MessageType, s header.MessageSubType, i int64) {
@@ -42,13 +41,6 @@ func (m *MessageMetrics) RxInvalid(i int64) {
 	}
 }
 
-// TxExhausted counts outbound packets dropped because the tunnel's message counter is spent.
-func (m *MessageMetrics) TxExhausted(i int64) {
-	if m != nil && m.txExhausted != nil {
-		m.txExhausted.Inc(i)
-	}
-}
-
 func newMessageMetrics() *MessageMetrics {
 	gen := func(t string) [][]metrics.Counter {
 		return [][]metrics.Counter{
@@ -69,10 +61,9 @@ func newMessageMetrics() *MessageMetrics {
 		rx: gen("rx"),
 		tx: gen("tx"),
 
-		rxUnknown:   metrics.GetOrRegisterCounter("messages.rx.other", nil),
-		txUnknown:   metrics.GetOrRegisterCounter("messages.tx.other", nil),
-		rxInvalid:   metrics.GetOrRegisterCounter("messages.rx.invalid", nil),
-		txExhausted: metrics.GetOrRegisterCounter("messages.tx.exhausted", nil),
+		rxUnknown: metrics.GetOrRegisterCounter("messages.rx.other", nil),
+		txUnknown: metrics.GetOrRegisterCounter("messages.tx.other", nil),
+		rxInvalid: metrics.GetOrRegisterCounter("messages.rx.invalid", nil),
 	}
 }
 

noiseutil/aesgcm.go

@@ -25,9 +25,6 @@ func (s *CipherStateAESGCM) EncryptDanger(out, ad, plaintext []byte, n uint64, n
 	if s == nil {
 		return nil, errors.New("no cipher state available to encrypt")
 	}
-	if n >= RejectAfterMessages {
-		return nil, ErrMessageCounterExhausted
-	}
 	nb[0] = 0
 	nb[1] = 0
 	nb[2] = 0

noiseutil/chachapoly.go

@@ -24,9 +24,6 @@ func (s *CipherStateChaChaPoly) EncryptDanger(out, ad, plaintext []byte, n uint6
 	if s == nil {
 		return nil, errors.New("no cipher state available to encrypt")
 	}
-	if n >= RejectAfterMessages {
-		return nil, ErrMessageCounterExhausted
-	}
 	nb[0] = 0
 	nb[1] = 0
 	nb[2] = 0

noiseutil/cipher_state.go

@@ -1,22 +1,11 @@
 package noiseutil
 
 import (
-	"errors"
 	"fmt"
-	"math"
 
 	"github.com/flynn/noise"
 )
 
-// RejectHeadroom is the wrap gap for senders racing the counter, sized large enough for any routine count.
-const RejectHeadroom = uint64(1) << 40
-
-// RejectAfterMessages is the nonce ceiling: encrypting stops RejectHeadroom short of the wrap.
-const RejectAfterMessages = math.MaxUint64 - RejectHeadroom
-
-// ErrMessageCounterExhausted is returned by EncryptDanger once the nonce reaches RejectAfterMessages.
-var ErrMessageCounterExhausted = errors.New("message counter exhausted")
-
 // CipherState is the post-handshake AEAD cipher used for the data plane.
 // Each supported cipher has its own concrete implementation in this package with the nonce endianness hardcoded,
 // so the encrypt/decrypt fast path avoids interface dispatch on the byte order.

noiseutil/cipher_state_test.go

@@ -1,7 +1,6 @@
 package noiseutil
 
 import (
-	"math"
 	"testing"
 
 	"github.com/flynn/noise"
@@ -90,24 +89,6 @@ func roundtrip(t *testing.T, enc, dec CipherState) {
 	assert.Equal(t, 16, enc.Overhead())
 }
 
-func TestEncryptRejectsExhaustedCounter(t *testing.T) {
-	// Pin the headroom below the uint64 wrap so a typo can't silently move the ceiling.
-	require.Equal(t, uint64(1)<<40, RejectHeadroom)
-	require.Equal(t, math.MaxUint64-RejectHeadroom, RejectAfterMessages)
-
-	encA, _ := buildCipherStates(t, CipherAESGCM)
-	encC, _ := buildCipherStates(t, noise.CipherChaChaPoly)
-	nb := make([]byte, 12)
-
-	for _, cs := range []CipherState{NewCipherStateAESGCM(encA), NewCipherStateChaChaPoly(encC)} {
-		_, err := cs.EncryptDanger(nil, nil, []byte("x"), RejectAfterMessages-1, nb)
-		require.NoError(t, err)
-
-		_, err = cs.EncryptDanger(nil, nil, []byte("x"), RejectAfterMessages, nb)
-		require.ErrorIs(t, err, ErrMessageCounterExhausted)
-	}
-}
-
 func BenchmarkCipherStateEncryptAESGCM(b *testing.B) {
 	enc, _ := buildCipherStatesB(b, CipherAESGCM)
 	benchEncryptCipherState(b, NewCipherState(enc, CipherAESGCM))

stats.go

@@ -13,6 +13,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	graphite "github.com/cyberdelia/go-metrics-graphite"
 	mp "github.com/nbrownus/go-metrics-prometheus"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -252,7 +253,7 @@ func (s *statsServer) buildRuntime(cfg statsConfig) ([]func(), *http.Server) {
 		// loadStatsConfig already resolved and validated the address; re-parse
 		// the resolved form (no DNS lookup) to get a *net.TCPAddr.
 		addr, _ := net.ResolveTCPAddr(cfg.graphite.protocol, cfg.graphite.resolvedAddr)
-		gcfg := graphiteConfigExport{
+		gcfg := graphite.Config{
 			Addr:          addr,
 			Registry:      metrics.DefaultRegistry,
 			FlushInterval: cfg.interval,
@@ -261,7 +262,7 @@ func (s *statsServer) buildRuntime(cfg statsConfig) ([]func(), *http.Server) {
 			Percentiles:   []float64{0.5, 0.75, 0.95, 0.99, 0.999},
 		}
 		captureFns = append(captureFns, func() {
-			if err := graphiteOnce(gcfg); err != nil {
+			if err := graphite.Once(gcfg); err != nil {
 				s.l.Error("Graphite export failed", "error", err)
 			}
 		})

stats_test.go

@@ -371,7 +371,7 @@ func waitForListening(t *testing.T, addr string) {
 	})
 }
 
-// graphiteSink is a minimal TCP accept-and-discard server so graphiteOnce
+// graphiteSink is a minimal TCP accept-and-discard server so graphite.Once
 // calls in tests don't spam error logs or wedge on connection refused.
 type graphiteSink struct {
 	ln net.Listener