remove the requirement for a cert-v2 certificate to have an IPv4 Network to have IPv4 UnsafeNetworks

CHANGELOG.md

@@ -7,17 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [1.10.2] - 2026-01-21
-
-### Fixed
-
-- Fix panic when using `use_system_route_table` that was introduced in v1.10.1. (#1580)
-
-### Changed
-
-- Fix some typos in comments. (#1582)
-- Dependency updates. (#1581)
-
 ## [1.10.1] - 2026-01-16
 
 See the [v1.10.1](https://github.com/slackhq/nebula/milestone/26?closed=1) milestone for a complete list of changes.
@@ -775,8 +764,7 @@ created.)
 
 - Initial public release.
 
-[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.2...HEAD
-[1.10.2]: https://github.com/slackhq/nebula/releases/tag/v1.10.2
+[Unreleased]: https://github.com/slackhq/nebula/compare/v1.10.1...HEAD
 [1.10.1]: https://github.com/slackhq/nebula/releases/tag/v1.10.1
 [1.10.0]: https://github.com/slackhq/nebula/releases/tag/v1.10.0
 [1.9.7]: https://github.com/slackhq/nebula/releases/tag/v1.9.7

cert/cert_v2.go

@@ -396,7 +396,6 @@ func (c *certificateV2) validate() error {
 		return NewErrInvalidCertificateProperties("non-CA certificate must contain at least 1 network")
 	}
 
-	hasV4Networks := false
 	hasV6Networks := false
 	for _, network := range c.details.networks {
 		if !network.IsValid() || !network.Addr().IsValid() {
@@ -415,7 +414,6 @@ func (c *certificateV2) validate() error {
 			return NewErrInvalidCertificateProperties("4in6 networks are not allowed: %s", network)
 		}
 
-		hasV4Networks = hasV4Networks || network.Addr().Is4()
 		hasV6Networks = hasV6Networks || network.Addr().Is6()
 	}
 
@@ -439,10 +437,6 @@ func (c *certificateV2) validate() error {
 				if !hasV6Networks {
 					return NewErrInvalidCertificateProperties("IPv6 unsafe networks require an IPv6 address assignment: %s", network)
 				}
-			} else if network.Addr().Is4() {
-				if !hasV4Networks {
-					return NewErrInvalidCertificateProperties("IPv4 unsafe networks require an IPv4 address assignment: %s", network)
-				}
 			}
 		}
 	}

overlay/tun_linux.go

@@ -137,7 +137,6 @@ func newTunGeneric(c *config.C, l *logrus.Logger, file *os.File, vpnNetworks []n
 		TXQueueLen:                c.GetInt("tun.tx_queue", 500),
 		useSystemRoutes:           c.GetBool("tun.use_system_route_table", false),
 		useSystemRoutesBufferSize: c.GetInt("tun.use_system_route_table_buffer_size", 0),
-		routesFromSystem:          map[netip.Prefix]routing.Gateways{},
 		l:                         l,
 	}