add a little context to dns

.github/ISSUE_TEMPLATE/config.yml

@@ -1,21 +1,13 @@
 blank_issues_enabled: true
 contact_links:
-  - name: 💨 Performance Issues
-    url: https://github.com/slackhq/nebula/discussions/new/choose
-    about: 'We ask that you create a discussion instead of an issue for performance-related questions. This allows us to have a more open conversation about the issue and helps us to better understand the problem.'
-
-  - name: 📄 Documentation Issues
-    url: https://github.com/definednet/nebula-docs
-    about: "If you've found an issue with the website documentation, please file it in the nebula-docs repository."
-
-  - name: 📱 Mobile Nebula Issues
-    url: https://github.com/definednet/mobile_nebula
-    about: "If you're using the mobile Nebula app and have found an issue, please file it in the mobile_nebula repository."
-
   - name: 📘 Documentation
     url: https://nebula.defined.net/docs/
-    about: 'The documentation is the best place to start if you are new to Nebula.'
+    about: Review documentation.
 
   - name: 💁 Support/Chat
-    url: https://join.slack.com/t/nebulaoss/shared_invite/zt-2xqe6e7vn-k_KGi8s13nsr7cvHVvHvuQ
+    url: https://join.slack.com/t/nebulaoss/shared_invite/enQtOTA5MDI4NDg3MTg4LTkwY2EwNTI4NzQyMzc0M2ZlODBjNWI3NTY1MzhiOThiMmZlZjVkMTI0NGY4YTMyNjUwMWEyNzNkZTJmYzQxOGU
-    about: 'For faster support, join us on Slack for assistance!'
+    about: 'This issue tracker is not for support questions. Join us on Slack for assistance!'
+
+  - name: 📱 Mobile Nebula
+    url: https://github.com/definednet/mobile_nebula
+    about: 'This issue tracker is not for mobile support. Try the Mobile Nebula repo instead!'

.github/pull_request_template.md

@@ -1,11 +0,0 @@
-<!--
-Thank you for taking the time to submit a pull request!
-
-Please be sure to provide a clear description of what you're trying to achieve with the change.
-
-- If you're submitting a new feature, please explain how to use it and document any new config options in the example config.
-- If you're submitting a bugfix, please link the related issue or describe the circumstances surrounding the issue.
-- If you're changing a default, explain why you believe the new default is appropriate for most users.
-
-P.S. If you're only updating the README or other docs, please file a pull request here instead: https://github.com/DefinedNet/nebula-docs
--->

README.md

@@ -4,7 +4,7 @@ It lets you seamlessly connect computers anywhere in the world. Nebula is portab
 It can be used to connect a small number of computers, but is also able to connect tens of thousands of computers.
 
 Nebula incorporates a number of existing concepts like encryption, security groups, certificates,
-and tunneling.
+and tunneling, and each of those individual pieces existed before Nebula in various forms.
 What makes Nebula different to existing offerings is that it brings all of these ideas together,
 resulting in a sum that is greater than its individual parts.
 
@@ -28,33 +28,33 @@ Check the [releases](https://github.com/slackhq/nebula/releases/latest) page for
 #### Distribution Packages
 
 - [Arch Linux](https://archlinux.org/packages/extra/x86_64/nebula/)
-    ```sh
+    ```
-    sudo pacman -S nebula
+    $ sudo pacman -S nebula
     ```
 
 - [Fedora Linux](https://src.fedoraproject.org/rpms/nebula)
-    ```sh
+    ```
-    sudo dnf install nebula
+    $ sudo dnf install nebula
     ```
 
 - [Debian Linux](https://packages.debian.org/source/stable/nebula)
-    ```sh
+    ```
-    sudo apt install nebula
+    $ sudo apt install nebula
     ```
 
 - [Alpine Linux](https://pkgs.alpinelinux.org/packages?name=nebula)
-    ```sh
+    ```
-    sudo apk add nebula
+    $ sudo apk add nebula
     ```
 
 - [macOS Homebrew](https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/n/nebula.rb)
-    ```sh
+    ```
-    brew install nebula
+    $ brew install nebula
     ```
 
 - [Docker](https://hub.docker.com/r/nebulaoss/nebula)
-    ```sh
+    ```
-    docker pull nebulaoss/nebula
+    $ docker pull nebulaoss/nebula
     ```
 
 #### Mobile
@@ -64,10 +64,10 @@ Check the [releases](https://github.com/slackhq/nebula/releases/latest) page for
 
 ## Technical Overview
 
-Nebula is a mutually authenticated peer-to-peer software-defined network based on the [Noise Protocol Framework](https://noiseprotocol.org/).
+Nebula is a mutually authenticated peer-to-peer software defined network based on the [Noise Protocol Framework](https://noiseprotocol.org/).
 Nebula uses certificates to assert a node's IP address, name, and membership within user-defined groups.
 Nebula's user-defined groups allow for provider agnostic traffic filtering between nodes.
-Discovery nodes (aka lighthouses) allow individual peers to find each other and optionally use UDP hole punching to establish connections from behind most firewalls or NATs.
+Discovery nodes allow individual peers to find each other and optionally use UDP hole punching to establish connections from behind most firewalls or NATs.
 Users can move data between nodes in any number of cloud service providers, datacenters, and endpoints, without needing to maintain a particular addressing scheme.
 
 Nebula uses Elliptic-curve Diffie-Hellman (`ECDH`) key exchange and `AES-256-GCM` in its default configuration.
@@ -82,34 +82,28 @@ To set up a Nebula network, you'll need:
 
 #### 2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse.
 
-Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $6/mo [DigitalOcean](https://digitalocean.com) droplets as lighthouses.
+Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $5/mo [DigitalOcean](https://digitalocean.com) droplets as lighthouses.
+
+  Once you have launched an instance, ensure that Nebula udp traffic (default port udp/4242) can reach it over the internet.
 
-Once you have launched an instance, ensure that Nebula udp traffic (default port udp/4242) can reach it over the internet.
 
 #### 3. A Nebula certificate authority, which will be the root of trust for a particular Nebula network.
 
-```sh
+  ```
-./nebula-cert ca -name "Myorganization, Inc"
+  ./nebula-cert ca -name "Myorganization, Inc"
-```
+  ```
-
+  This will create files named `ca.key` and `ca.cert` in the current directory. The `ca.key` file is the most sensitive file you'll create, because it is the key used to sign the certificates for individual nebula nodes/hosts. Please store this file somewhere safe, preferably with strong encryption.
-This will create files named `ca.key` and `ca.cert` in the current directory. The `ca.key` file is the most sensitive file you'll create, because it is the key used to sign the certificates for individual nebula nodes/hosts. Please store this file somewhere safe, preferably with strong encryption.
-
-**Be aware!** By default, certificate authorities have a 1-year lifetime before expiration. See [this guide](https://nebula.defined.net/docs/guides/rotating-certificate-authority/) for details on rotating a CA.
 
 #### 4. Nebula host keys and certificates generated from that certificate authority
-
 This assumes you have four nodes, named lighthouse1, laptop, server1, host3. You can name the nodes any way you'd like, including FQDN. You'll also need to choose IP addresses and the associated subnet. In this example, we are creating a nebula network that will use 192.168.100.x/24 as its network range. This example also demonstrates nebula groups, which can later be used to define traffic rules in a nebula network.
-```sh
+```
 ./nebula-cert sign -name "lighthouse1" -ip "192.168.100.1/24"
 ./nebula-cert sign -name "laptop" -ip "192.168.100.2/24" -groups "laptop,home,ssh"
 ./nebula-cert sign -name "server1" -ip "192.168.100.9/24" -groups "servers"
 ./nebula-cert sign -name "host3" -ip "192.168.100.10/24"
 ```
 
-By default, host certificates will expire 1 second before the CA expires. Use the `-duration` flag to specify a shorter lifetime.
-
 #### 5. Configuration files for each host
-
 Download a copy of the nebula [example configuration](https://github.com/slackhq/nebula/blob/master/examples/config.yml).
 
 * On the lighthouse node, you'll need to ensure `am_lighthouse: true` is set.
@@ -124,13 +118,10 @@ For each host, copy the nebula binary to the host, along with `config.yml` from
 **DO NOT COPY `ca.key` TO INDIVIDUAL NODES.**
 
 #### 7. Run nebula on each host
-
+```
-```sh
 ./nebula -config /path/to/config.yml
 ```
 
-For more detailed instructions, [find the full documentation here](https://nebula.defined.net/docs/).
-
 ## Building Nebula from source
 
 Make sure you have [go](https://go.dev/doc/install) installed and clone this repo. Change to the nebula directory.
@@ -149,10 +140,8 @@ The default curve used for cryptographic handshakes and signatures is Curve25519
 
 In addition, Nebula can be built using the [BoringCrypto GOEXPERIMENT](https://github.com/golang/go/blob/go1.20/src/crypto/internal/boring/README.md) by running either of the following make targets:
 
-```sh
+    make bin-boringcrypto
-make bin-boringcrypto
+    make release-boringcrypto
-make release-boringcrypto
-```
 
 This is not the recommended default deployment, but may be useful based on your compliance requirements.
 
@@ -160,3 +149,5 @@ This is not the recommended default deployment, but may be useful based on your
 
 Nebula was created at Slack Technologies, Inc by Nate Brown and Ryan Huber, with contributions from Oliver Fross, Alan Lam, Wade Simmons, and Lining Wang.
 
+
+

cert/crypto_test.go

@@ -26,21 +26,21 @@ func TestNewArgon2Parameters(t *testing.T) {
 }
 
 func TestDecryptAndUnmarshalSigningPrivateKey(t *testing.T) {
-	passphrase := []byte("DO NOT USE")
+	passphrase := []byte("DO NOT USE THIS KEY")
 	privKey := []byte(`# A good key
 -----BEGIN NEBULA ED25519 ENCRYPTED PRIVATE KEY-----
-CjsKC0FFUy0yNTYtR0NNEiwIExCAgAQYAyAEKiCPoDfGQiosxNPTbPn5EsMlc2MI
+CjwKC0FFUy0yNTYtR0NNEi0IExCAgIABGAEgBCognnjujd67Vsv99p22wfAjQaDT
-c0Bt4oz6gTrFQhX3aBJcimhHKeAuhyTGvllD0Z19fe+DFPcLH3h5VrdjVfIAajg0
+oCMW1mdjkU3gACKNW4MSXOWR9Sts4C81yk1RUku2gvGKs3TB9LYoklLsIizSYOLl
-KrbV3n9UHif/Au5skWmquNJzoW1E4MTdRbvpti6o+WdQ49DxjBFhx0YH8LBqrbPU
++Vs//O1T0I1Xbml2XBAROsb/VSoDln/6LMqR4B6fn6B3GOsLBBqRI8daDl9lRMPB
-0BGkUHmIO7daP24=
+qrlJ69wer3ZUHFXA
 -----END NEBULA ED25519 ENCRYPTED PRIVATE KEY-----
 `)
 	shortKey := []byte(`# A key which, once decrypted, is too short
 -----BEGIN NEBULA ED25519 ENCRYPTED PRIVATE KEY-----
-CjsKC0FFUy0yNTYtR0NNEiwIExCAgAQYAyAEKiAVJwdfl3r+eqi/vF6S7OMdpjfo
+CjwKC0FFUy0yNTYtR0NNEi0IExCAgIABGAEgBCoga5h8owMEBWRSMMJKzuUvWce7
-hAzmTCRnr58Su4AqmBJbCv3zleYCEKYJP6UI3S8ekLMGISsgO4hm5leukCCyqT0Z
+k0qlBkQmCxiuLh80MuASW70YcKt8jeEIS2axo2V6zAKA9TSMcCsJW1kDDXEtL/xe
-cQ76yrberpzkJKoPLGisX8f+xdy4aXSZl7oEYWQte1+vqbtl/eY9PGZhxUQdcyq7
+GLF5T7sDl5COp4LU3pGxpV+KoeQ/S3gQCAAcnaOtnJQX+aSDnbO3jCHyP7U9CHbs
-hqzIyrRqfUgVuA==
+rQr3bdH3Oy/WiYU=
 -----END NEBULA ED25519 ENCRYPTED PRIVATE KEY-----
 `)
 	invalidBanner := []byte(`# Invalid banner (not encrypted)

connection_manager.go

@@ -11,7 +11,6 @@ import (
 	"github.com/rcrowley/go-metrics"
 	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/header"
 )
 
@@ -27,12 +26,6 @@ const (
 	sendTestPacket trafficDecision = 6
 )
 
-// LastCommunication tracks when we last communicated with a host
-type LastCommunication struct {
-	timestamp time.Time
-	vpnIp     netip.Addr // To help with logging
-}
-
 type connectionManager struct {
 	in     map[uint32]struct{}
 	inLock *sync.RWMutex
@@ -44,12 +37,6 @@ type connectionManager struct {
 	relayUsed     map[uint32]struct{}
 	relayUsedLock *sync.RWMutex
 
-	// Track last communication with hosts
-	lastCommMap       map[uint32]time.Time
-	lastCommLock      *sync.RWMutex
-	inactivityTimer   *LockingTimerWheel[uint32]
-	inactivityTimeout time.Duration
-
 	hostMap                 *HostMap
 	trafficTimer            *LockingTimerWheel[uint32]
 	intf                    *Interface
@@ -78,9 +65,6 @@ func newConnectionManager(ctx context.Context, l *logrus.Logger, intf *Interface
 		outLock:                 &sync.RWMutex{},
 		relayUsed:               make(map[uint32]struct{}),
 		relayUsedLock:           &sync.RWMutex{},
-		lastCommMap:             make(map[uint32]time.Time),
-		lastCommLock:            &sync.RWMutex{},
-		inactivityTimeout:       1 * time.Minute, // Default inactivity timeout: 10 minutes
 		trafficTimer:            NewLockingTimerWheel[uint32](time.Millisecond*500, max),
 		intf:                    intf,
 		pendingDeletion:         make(map[uint32]struct{}),
@@ -91,31 +75,10 @@ func newConnectionManager(ctx context.Context, l *logrus.Logger, intf *Interface
 		l:                       l,
 	}
 
-	// Initialize the inactivity timer wheel - make wheel duration slightly longer than the timeout
-	nc.inactivityTimer = NewLockingTimerWheel[uint32](time.Minute, nc.inactivityTimeout+time.Minute)
-
 	nc.Start(ctx)
 	return nc
 }
 
-func (n *connectionManager) updateLastCommunication(localIndex uint32) {
-	// Get host info to record VPN IP for better logging
-	hostInfo := n.hostMap.QueryIndex(localIndex)
-	if hostInfo == nil {
-		return
-	}
-
-	now := time.Now()
-	n.lastCommLock.Lock()
-	n.lastCommMap[localIndex] = now
-	n.lastCommLock.Unlock()
-
-	// Reset the inactivity timer for this host
-	n.inactivityTimer.m.Lock()
-	n.inactivityTimer.t.Add(localIndex, n.inactivityTimeout)
-	n.inactivityTimer.m.Unlock()
-}
-
 func (n *connectionManager) In(localIndex uint32) {
 	n.inLock.RLock()
 	// If this already exists, return
@@ -127,9 +90,6 @@ func (n *connectionManager) In(localIndex uint32) {
 	n.inLock.Lock()
 	n.in[localIndex] = struct{}{}
 	n.inLock.Unlock()
-
-	// Update last communication time
-	n.updateLastCommunication(localIndex)
 }
 
 func (n *connectionManager) Out(localIndex uint32) {
@@ -143,9 +103,6 @@ func (n *connectionManager) Out(localIndex uint32) {
 	n.outLock.Lock()
 	n.out[localIndex] = struct{}{}
 	n.outLock.Unlock()
-
-	// Update last communication time
-	n.updateLastCommunication(localIndex)
 }
 
 func (n *connectionManager) RelayUsed(localIndex uint32) {
@@ -187,134 +144,6 @@ func (n *connectionManager) AddTrafficWatch(localIndex uint32) {
 	n.outLock.Unlock()
 }
 
-// checkInactiveTunnels checks for tunnels that have been inactive for too long and drops them
-func (n *connectionManager) checkInactiveTunnels() {
-	now := time.Now()
-
-	// First, advance the timer wheel to the current time
-	n.inactivityTimer.m.Lock()
-	n.inactivityTimer.t.Advance(now)
-	n.inactivityTimer.m.Unlock()
-
-	// Check for expired timers (inactive connections)
-	for {
-		// Get the next expired tunnel
-		n.inactivityTimer.m.Lock()
-		localIndex, ok := n.inactivityTimer.t.Purge()
-		n.inactivityTimer.m.Unlock()
-
-		if !ok {
-			// No more expired timers
-			break
-		}
-
-		n.lastCommLock.RLock()
-		lastComm, exists := n.lastCommMap[localIndex]
-		n.lastCommLock.RUnlock()
-
-		if !exists {
-			// No last communication record, odd but skip
-			continue
-		}
-
-		// Calculate inactivity duration
-		inactiveDuration := now.Sub(lastComm)
-
-		// Check if we've exceeded the inactivity timeout
-		if inactiveDuration >= n.inactivityTimeout {
-			// Get the host info (if it still exists)
-			hostInfo := n.hostMap.QueryIndex(localIndex)
-			if hostInfo == nil {
-				// Host info is gone, remove from our tracking map
-				n.lastCommLock.Lock()
-				delete(n.lastCommMap, localIndex)
-				n.lastCommLock.Unlock()
-				continue
-			}
-
-			// Log the inactivity and drop the tunnel
-			n.l.WithField("vpnIp", hostInfo.vpnAddrs[0]).
-				WithField("localIndex", localIndex).
-				WithField("inactiveDuration", inactiveDuration).
-				WithField("timeout", n.inactivityTimeout).
-				Info("Dropping tunnel due to inactivity")
-
-			// Close the tunnel using the existing mechanism
-			n.intf.closeTunnel(hostInfo)
-
-			// Clean up our tracking map
-			n.lastCommLock.Lock()
-			delete(n.lastCommMap, localIndex)
-			n.lastCommLock.Unlock()
-		} else {
-			// Re-add to the timer wheel with the remaining time
-			remainingTime := n.inactivityTimeout - inactiveDuration
-			n.inactivityTimer.m.Lock()
-			n.inactivityTimer.t.Add(localIndex, remainingTime)
-			n.inactivityTimer.m.Unlock()
-		}
-	}
-}
-
-// CleanupDeletedHostInfos removes entries from our lastCommMap for hosts that no longer exist
-func (n *connectionManager) CleanupDeletedHostInfos() {
-	n.lastCommLock.Lock()
-	defer n.lastCommLock.Unlock()
-
-	// Find indexes to delete
-	var toDelete []uint32
-	for localIndex := range n.lastCommMap {
-		if n.hostMap.QueryIndex(localIndex) == nil {
-			toDelete = append(toDelete, localIndex)
-		}
-	}
-
-	// Delete them
-	for _, localIndex := range toDelete {
-		delete(n.lastCommMap, localIndex)
-	}
-
-	if len(toDelete) > 0 && n.l.Level >= logrus.DebugLevel {
-		n.l.WithField("count", len(toDelete)).Debug("Cleaned up deleted host entries from lastCommMap")
-	}
-}
-
-// ReloadConfig updates the connection manager configuration
-func (n *connectionManager) ReloadConfig(c *config.C) {
-	// Get the inactivity timeout from config
-	inactivityTimeout := c.GetDuration("timers.inactivity_timeout", 10*time.Minute)
-
-	// Only update if different
-	if inactivityTimeout != n.inactivityTimeout {
-		n.l.WithField("old", n.inactivityTimeout).
-			WithField("new", inactivityTimeout).
-			Info("Updating inactivity timeout")
-
-		n.inactivityTimeout = inactivityTimeout
-
-		// Recreate the inactivity timer wheel with the new timeout
-		n.inactivityTimer = NewLockingTimerWheel[uint32](time.Minute, n.inactivityTimeout+time.Minute)
-
-		// Re-add all existing hosts to the new timer wheel
-		n.lastCommLock.RLock()
-		for localIndex, lastComm := range n.lastCommMap {
-			// Calculate remaining time based on last communication
-			now := time.Now()
-			elapsed := now.Sub(lastComm)
-
-			// If the elapsed time exceeds the new timeout, this will be caught
-			// in the next inactivity check. Otherwise, add with remaining time.
-			if elapsed < n.inactivityTimeout {
-				remainingTime := n.inactivityTimeout - elapsed
-				n.inactivityTimer.m.Lock()
-				n.inactivityTimer.t.Add(localIndex, remainingTime)
-				n.inactivityTimer.m.Unlock()
-			}
-		}
-		n.lastCommLock.RUnlock()
-	}
-}
-
 func (n *connectionManager) Start(ctx context.Context) {
 	go n.Run(ctx)
 }
@@ -324,14 +153,6 @@ func (n *connectionManager) Run(ctx context.Context) {
 	clockSource := time.NewTicker(500 * time.Millisecond)
 	defer clockSource.Stop()
 
-	// Create ticker for inactivity checks (every minute)
-	inactivityTicker := time.NewTicker(time.Minute)
-	defer inactivityTicker.Stop()
-
-	// Create ticker for cleanup (every 5 minutes)
-	cleanupTicker := time.NewTicker(5 * time.Minute)
-	defer cleanupTicker.Stop()
-
 	p := []byte("")
 	nb := make([]byte, 12, 12)
 	out := make([]byte, mtu)
@@ -351,14 +172,6 @@ func (n *connectionManager) Run(ctx context.Context) {
 
 				n.doTrafficCheck(localIndex, p, nb, out, now)
 			}
-
-		case <-inactivityTicker.C:
-			// Check for inactive tunnels
-			n.checkInactiveTunnels()
-
-		case <-cleanupTicker.C:
-			// Periodically clean up deleted hosts
-			n.CleanupDeletedHostInfos()
 		}
 	}
 }
@@ -672,12 +485,12 @@ func (n *connectionManager) sendPunch(hostinfo *HostInfo) {
 	if n.punchy.GetTargetEverything() {
 		hostinfo.remotes.ForEach(n.hostMap.GetPreferredRanges(), func(addr netip.AddrPort, preferred bool) {
 			n.metricsTxPunchy.Inc(1)
-			_ = n.intf.outside.WriteTo([]byte{1}, addr)
+			n.intf.outside.WriteTo([]byte{1}, addr)
 		})
 
 	} else if hostinfo.remote.IsValid() {
 		n.metricsTxPunchy.Inc(1)
-		_ = n.intf.outside.WriteTo([]byte{1}, hostinfo.remote)
+		n.intf.outside.WriteTo([]byte{1}, hostinfo.remote)
 	}
 }
 

dns_server.go

@@ -1,6 +1,7 @@
 package nebula
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"net/netip"
@@ -39,7 +40,7 @@ func newDnsRecords(l *logrus.Logger, cs *CertState, hostMap *HostMap) *dnsRecord
 	}
 }
 
-func (d *dnsRecords) Query(q uint16, data string) netip.Addr {
+func (d *dnsRecords) query(q uint16, data string) netip.Addr {
 	data = strings.ToLower(data)
 	d.RLock()
 	defer d.RUnlock()
@@ -57,7 +58,7 @@ func (d *dnsRecords) Query(q uint16, data string) netip.Addr {
 	return netip.Addr{}
 }
 
-func (d *dnsRecords) QueryCert(data string) string {
+func (d *dnsRecords) queryCert(data string) string {
 	ip, err := netip.ParseAddr(data[:len(data)-1])
 	if err != nil {
 		return ""
@@ -122,7 +123,7 @@ func (d *dnsRecords) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 		case dns.TypeA, dns.TypeAAAA:
 			qType := dns.TypeToString[q.Qtype]
 			d.l.Debugf("Query for %s %s", qType, q.Name)
-			ip := d.Query(q.Qtype, q.Name)
+			ip := d.query(q.Qtype, q.Name)
 			if ip.IsValid() {
 				rr, err := dns.NewRR(fmt.Sprintf("%s %s %s", q.Name, qType, ip))
 				if err == nil {
@@ -135,7 +136,7 @@ func (d *dnsRecords) parseQuery(m *dns.Msg, w dns.ResponseWriter) {
 				return
 			}
 			d.l.Debugf("Query for TXT %s", q.Name)
-			ip := d.QueryCert(q.Name)
+			ip := d.queryCert(q.Name)
 			if ip != "" {
 				rr, err := dns.NewRR(fmt.Sprintf("%s TXT %s", q.Name, ip))
 				if err == nil {
@@ -163,18 +164,18 @@ func (d *dnsRecords) handleDnsRequest(w dns.ResponseWriter, r *dns.Msg) {
 	w.WriteMsg(m)
 }
 
-func dnsMain(l *logrus.Logger, cs *CertState, hostMap *HostMap, c *config.C) func() {
+func dnsMain(ctx context.Context, l *logrus.Logger, cs *CertState, hostMap *HostMap, c *config.C) func() {
 	dnsR = newDnsRecords(l, cs, hostMap)
 
 	// attach request handler func
 	dns.HandleFunc(".", dnsR.handleDnsRequest)
 
 	c.RegisterReloadCallback(func(c *config.C) {
-		reloadDns(l, c)
+		reloadDns(ctx, l, c)
 	})
 
 	return func() {
-		startDns(l, c)
+		startDns(ctx, l, c)
 	}
 }
 
@@ -187,24 +188,24 @@ func getDnsServerAddr(c *config.C) string {
 	return net.JoinHostPort(dnsHost, strconv.Itoa(c.GetInt("lighthouse.dns.port", 53)))
 }
 
-func startDns(l *logrus.Logger, c *config.C) {
+func startDns(ctx context.Context, l *logrus.Logger, c *config.C) {
 	dnsAddr = getDnsServerAddr(c)
 	dnsServer = &dns.Server{Addr: dnsAddr, Net: "udp"}
 	l.WithField("dnsListener", dnsAddr).Info("Starting DNS responder")
 	err := dnsServer.ListenAndServe()
-	defer dnsServer.Shutdown()
+	defer dnsServer.ShutdownContext(ctx)
 	if err != nil {
 		l.Errorf("Failed to start server: %s\n ", err.Error())
 	}
 }
 
-func reloadDns(l *logrus.Logger, c *config.C) {
+func reloadDns(ctx context.Context, l *logrus.Logger, c *config.C) {
 	if dnsAddr == getDnsServerAddr(c) {
 		l.Debug("No DNS server config change detected")
 		return
 	}
 
 	l.Debug("Restarting DNS server")
-	dnsServer.Shutdown()
+	dnsServer.ShutdownContext(ctx)
-	go startDns(l, c)
+	go startDns(ctx, l, c)
 }

examples/config.yml

@@ -275,10 +275,6 @@ tun:
   # On linux only, set to true to manage unsafe routes directly on the system route table with gateway routes instead of
   # in nebula configuration files. Default false, not reloadable.
   #use_system_route_table: false
-  # Buffer size for reading routes updates. 0 means default system buffer size. (/proc/sys/net/core/rmem_default).
-  # If using massive routes updates, for example BGP, you may need to increase this value to avoid packet loss.
-  # SO_RCVBUFFORCE is used to avoid having to raise the system wide max
-  #use_system_route_table_buffer_size: 0
 
 # Configure logging level
 logging:

examples/go_service/main.go

@@ -5,12 +5,8 @@ import (
 	"fmt"
 	"log"
 	"net"
-	"os"
 
-	"github.com/sirupsen/logrus"
-	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay"
 	"github.com/slackhq/nebula/service"
 )
 
@@ -63,16 +59,7 @@ pki:
 	if err := cfg.LoadString(configStr); err != nil {
 		return err
 	}
-
+	svc, err := service.New(&cfg)
-	logger := logrus.New()
-	logger.Out = os.Stdout
-
-	ctrl, err := nebula.Main(&cfg, false, "custom-app", logger, overlay.NewUserDeviceFromConfig)
-	if err != nil {
-		return err
-	}
-
-	svc, err := service.New(ctrl)
 	if err != nil {
 		return err
 	}

main.go

@@ -284,7 +284,7 @@ func Main(c *config.C, configTest bool, buildVersion string, logger *logrus.Logg
 	var dnsStart func()
 	if lightHouse.amLighthouse && serveDns {
 		l.Debugln("Starting dns server")
-		dnsStart = dnsMain(l, pki.getCertState(), hostMap, c)
+		dnsStart = dnsMain(ctx, l, pki.getCertState(), hostMap, c)
 	}
 
 	return &Control{

overlay/tun_linux.go

@@ -38,7 +38,6 @@ type tun struct {
 	routeTree       atomic.Pointer[bart.Table[routing.Gateways]]
 	routeChan       chan struct{}
 	useSystemRoutes bool
-	useSystemRoutesBufferSize int
 
 	l *logrus.Logger
 }
@@ -130,7 +129,6 @@ func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []n
 		vpnNetworks:     vpnNetworks,
 		TXQueueLen:      c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes: c.GetBool("tun.use_system_route_table", false),
-		useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0),
 		l:               l,
 	}
 
@@ -533,13 +531,7 @@ func (t *tun) watchRoutes() {
 	rch := make(chan netlink.RouteUpdate)
 	doneChan := make(chan struct{})
 
-	netlinkOptions := netlink.RouteSubscribeOptions{
+	if err := netlink.RouteSubscribe(rch, doneChan); err != nil {
-		ReceiveBufferSize:      t.useSystemRoutesBufferSize,
-		ReceiveBufferForceSize: t.useSystemRoutesBufferSize != 0,
-		ErrorCallback:          func(e error) { t.l.WithError(e).Errorf("netlink error") },
-	}
-
-	if err := netlink.RouteSubscribeWithOptions(rch, doneChan, netlinkOptions); err != nil {
 		t.l.WithError(err).Errorf("failed to subscribe to system route changes")
 		return
 	}
@@ -549,14 +541,8 @@ func (t *tun) watchRoutes() {
 	go func() {
 		for {
 			select {
-			case r, ok := <-rch:
+			case r := <-rch:
-				if ok {
 				t.updateRoutes(r)
-				} else {
-					// may be should do something here as
-					// netlink stops sending updates
-					return
-				}
 			case <-doneChan:
 				// netlink.RouteSubscriber will close the rch for us
 				return

service/service.go

@@ -9,10 +9,13 @@ import (
 	"math"
 	"net"
 	"net/netip"
+	"os"
 	"strings"
 	"sync"
 
+	"github.com/sirupsen/logrus"
 	"github.com/slackhq/nebula"
+	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/overlay"
 	"golang.org/x/sync/errgroup"
 	"gvisor.dev/gvisor/pkg/buffer"
@@ -43,7 +46,14 @@ type Service struct {
 	}
 }
 
-func New(control *nebula.Control) (*Service, error) {
+func New(config *config.C) (*Service, error) {
+	logger := logrus.New()
+	logger.Out = os.Stdout
+
+	control, err := nebula.Main(config, false, "custom-app", logger, overlay.NewUserDeviceFromConfig)
+	if err != nil {
+		return nil, err
+	}
 	control.Start()
 
 	ctx := control.Context()

service/service_test.go

@@ -5,17 +5,13 @@ import (
 	"context"
 	"errors"
 	"net/netip"
-	"os"
 	"testing"
 	"time"
 
 	"dario.cat/mergo"
-	"github.com/sirupsen/logrus"
-	"github.com/slackhq/nebula"
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/overlay"
 	"golang.org/x/sync/errgroup"
 	"gopkg.in/yaml.v3"
 )
@@ -75,15 +71,7 @@ func newSimpleService(caCrt cert.Certificate, caKey []byte, name string, udpIp n
 		panic(err)
 	}
 
-	logger := logrus.New()
+	s, err := New(&c)
-	logger.Out = os.Stdout
-
-	control, err := nebula.Main(&c, false, "custom-app", logger, overlay.NewUserDeviceFromConfig)
-	if err != nil {
-		panic(err)
-	}
-
-	s, err := New(control)
 	if err != nil {
 		panic(err)
 	}