v1.11.0 changelog

[nbrownus]

Update changelog for v1.11.0

See the v1.11.0 milestone.

There are six backwards compat breaking changes in this release, all called out in a new Breaking section at the
top of the 1.11.0 entry:

• Logging moved from logrus to slog, log output format changes and logging.timestamp_format is ignored. (Switch to slog, remove logrus #1672, Fix duplicate log fields which slog duplicates #1734, fix logging copy pasta #1621)
• firewall.inbound_action and firewall.outbound_action were each applied to the opposite direction, now corrected. (correct directionality of firewall.inbound_action and firewall.outbound_action #1798)
• Windows WDF is bypassed by default for the nebula adapter and the listener port. (Add a way to set the network type on windows + tests #1710)
• Windows nebula device is now set to the private network category. (Add a way to set the network type on windows + tests #1710)
• Non-TCP reject packets moved from ICMP code 3 to code 13. (add IPv6 reject packet generation #1766, cleanup ipv6 iputil helpers / skip reject for ICMP error packets and fragments #1768)
• SSH debug server profiling commands are confined to sshd.sandbox_dir. (add sshd.sandbox_dir config option #1622)

v1.11 specific changes

• f8775bb Use go 1.26 (latest 1.26.5) (Use go 1.26 (latest 1.26.5) #1818)
• 7902ce6 Rebind for MacOS (Rebind for MacOS #1816)
• c2fbe21 Fix a test race, make dns server reload/restart safer (Fix a test race, make dns server reload/restart safer #1815)
• a99699e before removing a pending hostinfo in handshake_manager, make sure it's the one we wanted to delete (before removing a pending hostinfo in handshake_manager, make sure it's the one we wanted to delete #1811)
• 15f0f0d Be less verbose with handshake send errors (Be less verbose with handshake send errors #1810)
• 147c202 Swap back to a blocking udp socket, test shutdown(2) (Swap back to a blocking udp socket, test shutdown(2) #1806)
• e290a68 Fix relay re-establishment for handshake on Disestablised entry (Fix relay re-establishment for handshake on Disestablised entry #1805)
• 3615a79 add locks around replay window updates (add locks around replay window updates #1802)
• 861d3aa correct directionality of firewall.inbound_action and firewall.outbound_action (correct directionality of firewall.inbound_action and firewall.outbound_action #1798)
• 8673386 don't make new relay state on a just-discarded tunnel (don't make new relay state on a just-discarded tunnel #1796)
• ab736e4 Make Control safe to stop and wait on from any lifecycle state (Make Control safe to stop and wait on from any lifecycle state #1794)
• 384610f hostmap: replace the shared next/prev hostinfo chain with independent per-address lists (hostmap: replace the shared next/prev hostinfo chain with independent per-address lists so divergent or overlapping vpnAddr sets cannot corrupt the map #1790)
• c1eea11 fix firewall port/proto bypass in parseV6 from uint8 extension-header length overflow (fix firewall port/proto bypass in parseV6 from uint8 extension-header length overflow #1789)
• 1e66c0d hostmap: unlink a multi-vpnAddr hostinfo from the shared chain exactly once on delete (hostmap: unlink a multi-vpnAddr hostinfo from the shared chain exactly once on delete #1788)
• e5c0fda Darwin and openbsd in line with the other bsds for tun support (Darwin and openbsd in line with the other bsds for tun support #1703)
• 7bd0bc2 sshd: guard trustedKeys/trustedCAs with a mutex to fix a concurrent map crash on reload (sshd: guard trustedKeys/trustedCAs with a mutex to fix a concurrent map crash on reload #1787)
• 942ee52 lighthouse: unmap 4-in-6 addresses so remote_allow_list v4 rules apply (lighthouse: unmap 4-in-6 addresses in protoV6AddrPortToNetAddrPort so remote_allow_list v4 rules apply #1786)
• 0a95391 Make HostInfo.remote atomic to fix torn reads on the send path (Make HostInfo.remote atomic to fix torn reads on the send path #1773)
• 184cdc8 Add OCI image labels with version info (Add OCI image labels with version info #1772)
• 7d3166a cleanup ipv6 iputil helpers / skip reject for ICMP error packets and fragments (cleanup ipv6 iputil helpers / skip reject for ICMP error packets and fragments #1768)
• fe1c568 add IPv6 support to CreateICMPEchoResponse (add IPv6 support to CreateICMPEchoResponse #1767)
• e4cc80a add IPv6 reject packet generation (add IPv6 reject packet generation #1766)
• 16b302c Relay log fix (Relay log fix #1765)
• 2e9117d fix tunnels that could permanently escape connection-manager monitoring (fix tunnels that could permanently escape connection-manager monitoring #1752)
• a690c90 improve rejection of malformed handshakes (improve rejection of malformed handshakes #1756)
• 3db406b fix a race in RelayState.CopyRelayIps (fix a race in RelayState.CopyRelayIps #1753)
• eaad489 udp_darwin: don't call the EncReader on a UDP error (udp_darwin: don't call the EncReader on a UDP error #1755)
• e6032f8 correctly record window counters for relayed packets in a tunnel (correctly record window counters for relayed packets in a tunnel #1751)
• 3a95495 Fix duplicate log fields which slog duplicates (Fix duplicate log fields which slog duplicates #1734)
• 873f94f Reduce relay log spam (Reduce relay handshake log spam #1733)
• 04dea41 Make firewall reload when unsafe networks in the cert changes (Make firewall reload when unsafe networks in the cert changes #1719)
• ffd5249 Search for config.yaml/yml in both service and cli mode (Search for config.yaml/yml in both service and cli mode #1717)
• 625f58b Record my local details in the dns server if enabled (Record my local details in the dns server if enabled #1716)
• 3c121e7 Allow for - to stand in for stdin/out (Allow for - to stand in for stdin/out #1714)
• 6c7ebb0 Reset static host list addresses on change (Reset static host list addresses on change #1713)
• 398d67e Windows code signing (Windows code signing #1718)
• 696903d Add a way to set the network type on windows + tests (Add a way to set the network type on windows + tests #1710)
• c82db21 Change windows unsafe routes to link routes, fix sshd reload bug (Change windows unsafe routes to link routes, fix sshd reload bug #1709)
• a82a8dc don't panic on bad ed25519 key lengths (don't panic on bad ed25519 key lengths #1601)
• 213dd46 Stop leaking goroutines past Control.Stop, consolidate punching in Punchy (Stop leaking goroutines past Control.Stop, consolidate punching in Punchy #1708)
• 1ab1f71 Make stats a server we can reconfigure and start/stop (Make stats a server we can reconfigure and start/stop #1670)
• d0f02ba Switch to slog, remove logrus (Switch to slog, remove logrus #1672)
• db85d61 SSH handshake in goroutine and defer close (SSH handshake in goroutine and defer close #1640)
• b319423 udp_linux: wrap socket operations with syscall.RawConn for clean teardown (udp_linux: wrap socket operations with syscall.RawConn for clean teardown #1654)
• 2a1cc62 fix: guard QueryCert against panic on short/empty QNAME (fix: guard QueryCert against panic on short/empty QNAME #1635)
• e753e6e Immediate Lighthouse update after reconfig/reconnect (Immediate Lighthouse update after reconfig/reconnect #1645)
• 32a7c04 Return NODATA instead of NXDOMAIN for missing record types (Return NODATA instead of NXDOMAIN for missing record types #1668)
• 8c50fc3 Plug the conntrack cache ticker leak and nebula-service log.Fatal calls (Plug the conntrack cache ticker leak and nebula-service log.Fatal calls #1669)
• 2f4532f No more dns globals, proper cleanup on shutdown (No more dns globals, proper cleanup on shutdown #1667)
• 8c71f2f FreeBSD tun needs to be non blocking as well (FreeBSD tun needs to be non blocking as well #1666)
• e80b983 Remove more os.Exit calls and give a more reliable wait for stop function (Remove more os.Exit calls and give a more reliable wait for stop function (attempt 3) #1661)
• f858795 add sshd.sandbox_dir config option (add sshd.sandbox_dir config option #1622)
• 91d1f46 properly handle closetunnel packets (properly handle closetunnel packets #1638)
• 7760cce fix logging copy pasta (fix logging copy pasta #1621)
• 51308b8 connection-track ICMP traffic (connection-track ICMP traffic #1602)
• 353ad1f firewall: icmp no longer requires a port spec (firewall: icmp no longer requires a port spec #1609)

PRs I chose not to document in the changelog:

Dependency bumps (covered collectively by the "Various dependency updates" line)

• Bump actions/setup-go from 6 to 7 #1807
• Bump the golang-x-dependencies group across 1 directory with 5 updates #1800
• Bump github.com/kardianos/service from 1.2.4 to 1.3.0 #1782
• Bump actions/checkout from 6 to 7 #1771
• Bump golang.org/x/net from 0.55.0 to 0.56.0 in the golang-x-dependencies group #1763
• Bump the golang-x-dependencies group with 4 updates #1750
• Bump github.com/gaissmai/bart from 0.27.1 to 0.28.0 #1743
• Bump the golang-x-dependencies group with 3 updates #1742
• Bump github.com/gaissmai/bart from 0.26.1 to 0.27.1 #1732
• Bump the golang-x-dependencies group with 4 updates #1721
• Bump Apple-Actions/import-codesign-certs from 6 to 7 #1697
• Bump golang.zx2c4.com/wireguard/windows from 0.6.1 to 1.0.1 in the zx2c4-dependencies group across 1 directory #1665
• Bump golang.org/x/net from 0.52.0 to 0.53.0 in the golang-x-dependencies group across 1 directory #1664
• Bump golang.zx2c4.com/wireguard/windows from 0.5.3 to 0.6.1 in the zx2c4-dependencies group across 1 directory #1652
• Bump the golang-x-dependencies group across 1 directory with 5 updates #1629
• Bump docker/login-action from 3 to 4 #1628
• Bump docker/setup-buildx-action from 3 to 4 #1627
• Bump actions/upload-artifact from 6 to 7 #1618
• Bump actions/download-artifact from 7 to 8 #1617
• Bump github.com/gaissmai/bart from 0.26.0 to 0.26.1 #1604
• Bump github.com/miekg/dns from 1.1.70 to 1.1.72 #1587
• Bump github.com/miekg/pkcs11 from 1.1.2-0.20231115102856-9078ad6b9d4b to 1.1.2 #1586

Input validation, refactors, tests, CI, and tooling

• Document rootless Nebula in example service script #1814 (rootless nebula docs in the example service script)
• code-sign: default the S3 key-prefix to the calling repo #1799
• Fix e2e test races when looking at hostmap counts #1795
• Remove dev fmt.Println #1793 (removes a stray Println from unreleased Darwin and openbsd in line with the other bsds for tun support #1703)
• correctly discard nil proto addresses #1785
• iputil: fix infinite loop in ipv6FindUpperProtocol from uint8 extension-header length overflow #1784 (fixes unreleased add IPv6 reject packet generation #1766)
• firewall: move conntrack check after cert+IP verification #1779
• correctly handle a test packet with a payload longer than the header #1778
• Add explicit unmarshaller for signing and key agreement public keys #1777
• wireshark: fix Lua 5.4 bitwise operation #1776
• Add smoke test for ipv6 #1764
• disallow negative stats intervals #1754
• Parallelize the tests a bit more #1730
• Fix flakey cert tests #1728
• Reject port numbers outside [0, 65535] in firewall rule parsing #1724
• Prime some critical stats before the first scrape #1715
• Use DefinedNets fancy new netbsd10 vagrant box for smokes #1711
• Remove the global noiseEndianness var #1707
• switch Bits to a packed u64 #1705
• More stable e2e test harness, better for benchmarking #1702
• Reduce HandshakeManager complexity a little bit #1701
• Run e2e tests in parallel, include a goroutine leak detector test #1700
• noise: only type-assert once #1691
• Another shot at the flakey smoke test #1688
• Fix e2e tests writing after the tester tun is closed causing a panic #1681
• Try to make smoke less flakey #1663
• Try the hot new DefinedNet openbsd78 box #1657
• Handshake state machine #1656
• Fix OpenBSD smoke tests in CI #1655
• Additional e2e tests to assert current handshake behavior #1653
• gh workflow release: protect from ref_name attack #1650
• Refactor CA pool handling to use streaming #1644
• refactor readOutsidePackets #1642
• Add a small link to DN Managed Nebula #1641
• #ECCN:Open Source in CODEOWNERS #1632
• Fix dissector logic #1626
• smoke-extra: try AMD-V workaround #1610
• Apply go fix #1608

Still open on the milestone, not yet merged (revisit before tagging):

• Support native Golang "fips140" mode #1696 native Golang fips140 mode