nebula

Security

• Fix an issue where blocklist bypass is possible when using curve P256 since the signature can have 2 valid representations. Both fingerprint representations will be tested against the blocklist. Any newly issued P256 based certificates will have their signature clamped to the low-s form. Nebula will assert the low-s signature form when validating certificates in a future...

Fixed

• Fix panic when using use_system_route_table that was introduced in v1.10.1. (#1580)

Changed

• Fix some typos in comments. (#1582)
• Dependency updates. (#1581)

See the v1.10.1 milestone for a complete list of changes.

Fixed

• Fix a bug where an unsafe route derived from the system route table could be lost on a config reload. (#1573)
• Fix the PEM banner for ECDSA P256 public keys. (#1552)
• Fix a regression on Windows from 1.9.x where nebula could fall back to a less performant UDP l...

See the v1.10.0 milestone for a complete list of changes.

NOTE: If you use unsafe_routes, please read the note in the Changed section about default_local_cidr_any. You may need to update your firewall rules in order to maintain connectivity.

Added

• Support for ipv6 and multiple ipv4/6 addresses in the overlay. A ne...

Security

• Fix an issue where Nebula could incorrectly accept and process a packet from an erroneous source IP when the sender's certificate is configured with unsafe_routes (cert v1/v2) or multiple IPs (cert v2). (#1494)

Changed

• Disable sending recv_error messages when a packet is received outside the allowable counter window. (#1459)
• Improve error messages and remo...