@@ -7,6 +7,88 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77
88## [ Unreleased]
99
10+ ## [ 1.11.0] - 2026-07-23
11+
12+ See the [ v1.11.0] ( https://github.com/slackhq/nebula/milestone/25?closed=1 ) milestone for a complete list of changes.
13+
14+ ### Breaking
15+
16+ - Logging has switched from logrus to Go's structured ` slog ` . Log output changes: levels are upper case
17+ (` level=INFO ` ), trace prints as ` level=DEBUG-4 ` , timestamps are always RFC3339Nano and ` logging.timestamp_format `
18+ is ignored, and some messages were reworded. Review any log parsing before upgrading. This is also an API break
19+ for embedders, as constructors now take a ` *slog.Logger ` . (#1672 , #1734 , #1621 )
20+ - ` firewall.inbound_action ` and ` firewall.outbound_action ` (used to set reject vs. drop policy) were each being
21+ applied to the opposite direction, that is now corrected. This only affects how blocked packets are answered, not
22+ which packets the firewall allows or denies. If you set either of these you are getting the behavior of the other
23+ one today and likely want to swap them before upgrading. (#1798 )
24+ - On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and the listener port by default. WFP
25+ sits below Windows Defender Firewall, so any WDF inbound rules you rely on for either will no longer apply. Set
26+ ` tun.windows_bypass_wdf ` and ` listen.windows_bypass_wdf ` to false to leave WDF in charge. (#1710 )
27+ - On Windows, the nebula device is now set to the ` private ` network category instead of whatever Windows decided,
28+ which is usually ` Public ` . This makes the host firewall less restrictive on the overlay. Set
29+ ` tun.network_category ` to ` unset ` to keep the old behavior. (#1710 )
30+ - Reject packets for non-TCP now use ICMP code 13, communication administratively prohibited, instead of code 3,
31+ port unreachable. Anything keying off the old code needs updating. (#1766 , #1768 )
32+ - The SSH debug server's profiling commands are now confined to ` sshd.sandbox_dir ` , which defaults to
33+ ` $TMP/nebula-debug ` . Relative paths resolve inside it and absolute paths outside it are rejected, so anything
34+ scripting ` start-cpu-profile ` , ` save-heap-profile ` , or ` save-mutex-profile ` with a path elsewhere needs the
35+ directory set. The directory is not created for you. (#1622 )
36+
37+ ### Added
38+
39+ - Sign the Windows release binaries. (#1718 )
40+ - Generate IPv6 reject packets, matching the existing IPv4 behavior. (#1766 , #1767 , #1768 )
41+ - Accept ` - ` in ` nebula-cert ` to read from stdin or write to stdout. (#1714 )
42+ - Search for both ` config.yml ` and ` config.yaml ` in service and command line modes. (#1717 )
43+ - Add version labels to the Docker/OCI images. (#1772 )
44+ - Rebind the listener and re-query lighthouses on macOS when the underlay network changes, so devices moving
45+ between wifi and wired or between networks recover without waiting for dead tunnel detection. Controlled by
46+ ` listen.rebind_on_network_change ` (default ` true ` , not reloadable). (#1816 )
47+
48+ ### Changed
49+
50+ - Reload the firewall when the unsafe networks in the certificate change. (#1719 )
51+ - Reconfigure, start, and stop the stats listener on a config reload instead of requiring a restart. (#1670 )
52+ - Update a static host's addresses when they change on reload. (#1713 )
53+ - Don't require a port on ICMP firewall rules. (#1609 )
54+ - Connection track ICMP traffic. (#1602 )
55+ - Return ` NODATA ` instead of ` NXDOMAIN ` from the DNS server for a name that exists but has no record of the
56+ requested type, so clients that query ` AAAA ` first (busybox/Alpine) fall through to ` A ` . (#1668 )
57+ - Record the local host's details in the DNS server. (#1716 )
58+ - Install Windows unsafe routes as link routes. (#1709 )
59+ - Reduce relay handshake log spam, and only log a handshake send error at error level when the remote list
60+ changes. (#1733 , #1765 , #1810 )
61+ - Start, stop, and reload subsystems (DNS, stats, conntrack, ssh, punchy) cleanly without leaking goroutines. (#1640 , #1654 , #1661 , #1667 , #1669 , #1708 , #1806 , #1815 )
62+ - ` Control ` is now safe to stop and wait on from any lifecycle state, and a new ` Control.Wait ` blocks until nebula
63+ has fully stopped and returns the first fatal reader error. Failed starts release the udp sockets and tun fd
64+ instead of leaking them. (#1794 )
65+ - Trigger an immediate lighthouse update when reconnecting to or adding a lighthouse instead of waiting for the next update tick. (#1645 )
66+ - Bring the Darwin and OpenBSD tun implementations in line with the other BSDs. (#1703 )
67+ - Update to build against go v1.26. (#1818 )
68+ - Various dependency updates. (#1586 , #1587 , #1604 , #1617 , #1618 , #1627 , #1628 , #1629 , #1652 , #1664 , #1665 , #1697 , #1721 , #1732 , #1742 , #1743 , #1750 , #1763 , #1771 , #1782 , #1800 , #1807 )
69+
70+ ### Fixed
71+
72+ - Fix a data race on a host's remote address that could send packets to the wrong address during a roam. (#1773 )
73+ - Fix tunnels that could permanently escape connection manager monitoring. (#1752 )
74+ - Fix a crash when reloading the SSH server's trusted keys. (#1787 )
75+ - Fix hostmap corruption when a host has multiple overlay addresses. Each address now gets its own list instead of
76+ a single shared chain, which also fixes two latent bugs on the add and makePrimary paths. (#1788 , #1790 )
77+ - Apply ` remote_allow_list ` IPv4 rules to 4-in-6 mapped addresses. (#1786 )
78+ - Don't panic in the DNS server on a short or empty query name. (#1635 )
79+ - Advance the replay window on relayed packets so a relay drops replayed frames instead of re-forwarding them. (#1751 )
80+ - Fix a race in relay state handling. (#1753 )
81+ - Lock replay window updates so concurrent readers can't corrupt it. (#1802 )
82+ - Reject malformed handshakes more reliably, including invalid ed25519 key lengths. (#1601 , #1756 )
83+ - Properly handle ` closetunnel ` packets. (#1638 )
84+ - Fix an IPv6 extension-header length overflow that could make the firewall parse the wrong protocol and ports. (#1789 )
85+ - Fix relay re-establishment when a handshake arrives over a relay entry that a one-sided teardown left
86+ ` Disestablished ` , which silently dropped every send until dead tunnel detection forced a re-handshake. (#1805 )
87+ - Don't build new relay state on a tunnel that was just discarded. (#1796 )
88+ - Don't delete the wrong pending hostinfo in the handshake manager. (#1811 )
89+ - Don't call the packet reader after a UDP error on Darwin. (#1755 )
90+ - Open the FreeBSD tun device non blocking. (#1666 )
91+
1092## [ 1.10.3] - 2026-02-06
1193
1294### Security
0 commit comments