LoginSign Up
← Back to all sparks
N

Nebula

INFRA · APIS
Velocity2.5

Scalable overlay networking tool built on the Noise protocol framework

github.com/slackhq/nebula ↗

Nebula closes a firewall bypass that let unparsed IPv6 protocols match TCP rules

mesh-vpnoverlay-networkcertificatesipv6firewallsecurity
◆Current state
Nebula is a peer-to-peer mesh VPN built around a certificate authority model. v1.10.0 was the pivot — IPv6 and multiple addresses in the overlay, plus a v2 ASN.1 certificate format with a unified interface for external implementations — and everything since has been consequence management. v1.11.0 shifted to the operational surface with structured slog logging, corrected firewall reject-versus-drop semantics, and Windows WFP filters by default. v1.11.1 returns to the packet classifier: IPv6 packets whose next header Nebula does not parse were being misread as TCP or UDP and matched against TCP/UDP firewall rules, and are now classified as their true protocol with no ports.
◆Where it's heading
The security findings since v1.10.0 map onto the same seam — the IPv6 support that release added widened what the classifier and the certificate validator have to handle, and each subsequent release has closed another gap in that widened surface. v1.11.1 is notable for making the fix a deliberate operational break: carrying SCTP, GRE or IP-in-IP over the overlay may have been working only through the bypass, so operators must add a proto: any rule before upgrading. That the project chose correct classification over compatibility, and said so plainly in the notes, is consistent with how the firewall direction fix was handled one release earlier.
◆Prediction
The stated plan to assert low-s signature form when validating certificates remains the concrete next step visible in these entries; expect it as a breaking validation change. The classifier work suggests remaining IPv6 extension-header handling is the other likely source of findings.

◆Recent moves

  1. 25d ago

    IPv6 firewall bypass: unparsed protocols matched TCP/UDP rules

    A crafted IPv6 payload could steer the classifier into reading an unparsed protocol such as SCTP, GRE or IP-in-IP as TCP or UDP, letting it match a TCP/UDP allow rule. These are now matched as their true protocol with no ports, which means only a proto: any rule passes them — an operational break for anyone whose traffic was flowing through the bypass. The release also enforces outbound message counter limits so a tunnel rehandshakes before nonce reuse becomes possible.

    View source ↗
  2. 1mo ago

    Breaking: slog logging, corrected firewall reject/drop direction

    Logging moves to Go's structured slog, breaking log parsing and the embedder API, and the inbound and outbound firewall action settings are corrected after each had been applied to the opposite direction. Windows gains WFP permit filters and a private network category by default. A release almost entirely about operational surface rather than the overlay itself.

    View source ↗
  3. 7mo ago

    P256 signature malleability allowed blocklist bypass

    Signature malleability in P256 let a blocked certificate be re-presented in altered form and evade the blocklist. One of the findings that traces directly back to the certificate work in v1.10.0.

    View source ↗
  4. 7mo ago

    Fix panic in use_system_route_table introduced by the previous release

    A single-panic regression fix cleaning up after the preceding release's route table changes.

    View source ↗
  5. 8mo ago

    Route-reload, handshake, and Windows listener fixes after the v1.10 rework

    A batch of fixes across route reloading, handshaking and the Windows listener, all in surfaces the v1.10.0 addressing rework touched.

    View source ↗
  6. 9mo ago

    IPv6 and multiple addresses in the overlay, plus a v2 certificate format

    ⚡ SPARK

    The release the rest of this window is still absorbing: it widened both the addressing model and the certificate format, and each subsequent security fix has landed in surfaces it expanded — most recently the IPv6 classifier bypass in v1.11.1.

    View source ↗