Proto commits in slackhq/nebula

These 22 commits are when the Protocol Buffers files have changed:

2026-10-01

multiport: fix review findings in lane probing and recv_error - Don't probe lanes on a tunnel idle in both directions, and don't count lane probes or their acks as tunnel traffic. A lane's own keepalive was keeping idle tunnels from ever being dropped by tunnels.drop_inactive. - Accept a recv_error from an up lane's target. The peer answers lane traffic from the lane socket it arrived on, and the spoof guard only accepted the base remote, so recv_errors for lane traffic were ignored. - Keep the probe generation across a lane reset, so an ack for a probe sent before a roam can't promote the lane on the new path. - Bring handshake.proto in line with payload.go: field 3 is reserved and TxLanes is field 4.

2026-09-02

handshake: move lane fields to 9 and 10 Fields 6 and 7 are reserved for work in progress, so the multiport lane adverts move up to 9 and 10. Both are still single-byte tags, so the encoded payload size does not change. Also emit the lane fields after CertVersion so MarshalPayload stays in ascending field-number order, matching what protoc-gen-go would produce and keeping the hand-built expectations in payload_test.go straightforward. Field numbers are the only thing that identifies a lane advert, so a node on this build and one on the previous numbering will each skip the other's adverts as unknown fields and fall back to a single vanilla tunnel.

crazy multiport stuff (cherry picked from commit 0488793a626fa2681dc17d7f3bc44f56d8d98c7f)

2026-07-21

crazy multiport stuff

2026-05-06

Merge remote-tracking branch 'origin/master' into multiport

2026-05-01

Handshake state machine (#1656)

2025-03-06

Merge remote-tracking branch 'origin/master' into multiport

V2 certificate format (#1216) Co-authored-by: Nate Brown <nbrown.us@gmail.com> Co-authored-by: Jack Doan <jackdoan@rivian.com> Co-authored-by: brad-defined <77982333+brad-defined@users.noreply.github.com> Co-authored-by: Jack Doan <me@jackdoan.com>

The documentation is generated from this commit.

2024-10-24

Support for ipv6 in the overlay with v2 certificates --------- Co-authored-by: Jack Doan <jackdoan@rivian.com>

The documentation is generated from this commit.

2024-10-10

Cert interface (#1212)

2023-05-09

Merge branch 'master' into multiport

2023-05-05

Have lighthouses ack updates to reduce test packet traffic (#851)

2023-05-04

Support NIST curve P256 (#769) * Support NIST curve P256 This change adds support for NIST curve P256. When you use `nebula-cert ca` or `nebula-cert keygen`, you can specify `-curve P256` to enable it. The curve to use is based on the curve defined in your CA certificate. Internally, we use ECDSA P256 to sign certificates, and ECDH P256 to do Noise handshakes. P256 is not supported natively in Noise Protocol, so we define `DHP256` in the `noiseutil` package to implement support for it. You cannot have a mixed network of Curve25519 and P256 certificates, since the Noise protocol will only attempt to parse using the Curve defined in the host's certificate. * verify the curves match in VerifyPrivateKey This would have failed anyways once we tried to actually use the bytes in the private key, but its better to detect the issue up front with a better error message. * add cert.Curve argument to Sign method * fix mismerge * use crypto/ecdh This is the preferred method for doing ECDH functions now, and also has a boringcrypto specific codepath. * remove other ecdh uses of crypto/elliptic use crypto/ecdh instead

2023-05-03

Merge remote-tracking branch 'origin/master' into multiport

2023-04-03

Add ability to encrypt CA private key at rest (#386) Fixes #8. `nebula-cert ca` now supports encrypting the CA's private key with a passphrase. Pass `-encrypt` in order to be prompted for a passphrase. Encryption is performed using AES-256-GCM and Argon2id for KDF. KDF parameters default to RFC recommendations, but can be overridden via CLI flags `-argon-memory`, `-argon-parallelism`, and `-argon-iterations`.

2022-10-17

Support multiple UDP source ports (multiport) The goal of this work is to send packets between two hosts using more than one 5-tuple. When running on networks like AWS where the underlying network driver and overlay fabric makes routing, load balancing, and failover decisions based on the flow hash, this enables more than one flow between pairs of hosts. Multiport spreads outgoing UDP packets across multiple UDP send ports, which allows nebula to work around any issues on the underlay network. Some example issues this could work around: - UDP rate limits on a per flow basis. - Partial underlay network failure in which some flows work and some don't Agreement is done during the handshake to decide if multiport mode will be used for a given tunnel (one side must have tx_enabled set, the other side must have rx_enabled set) NOTE: you cannot use multiport on a host if you are relying on UDP hole punching to get through a NAT or firewall. NOTE: Linux only (uses raw sockets to send). Also currently only works with IPv4 underlay network remotes. This is implemented by opening a raw socket and sending packets with a source port that is based on a hash of the overlay source/destiation port. For ICMP and Nebula metadata packets, we use a random source port. Example configuration: multiport: # This host support sending via multiple UDP ports. tx_enabled: false # This host supports receiving packets sent from multiple UDP ports. rx_enabled: false # How many UDP ports to use when sending. The lowest source port will be # listen.port and go up to (but not including) listen.port + tx_ports. tx_ports: 100 # NOTE: All of your hosts must be running a version of Nebula that supports # multiport if you want to enable this feature. Older versions of Nebula # will be confused by these multiport handshakes. # # If handshakes are not getting a response, attempt to transmit handshakes # using random UDP source ports (to get around partial underlay network # failures). tx_handshake: false # How many unresponded handshakes we should send before we attempt to # send multiport handshakes. tx_handshake_delay: 2

2022-06-27

reserve NebulaHandshakeDetails fields for multiport (#674) We are currently testing changes for multiport (related to #497) that use fields 6 and 7 in the protobuf. Reserved these fields so that when we eventually open the PR we are backwards compatible with any future changes.

2022-06-21

Relay (#678) Co-authored-by: Wade Simmons <wsimmons@slack-corp.com>

2021-04-01

More LH cleanup (#429)

2021-03-31

Lighthouse performance pass (#418)

2021-03-19

IPv6 support for outside (udp) (#369)

2019-11-19

Public Release