mirror of
https://github.com/yggdrasil-network/yggdrasil-go.git
synced 2025-04-30 07:05:06 +03:00
cleaned up develop branch
This commit is contained in:
vadym
parent
bfe42d8899
commit
2d36105eeb
17 changed files with 102 additions and 817 deletions
64
CHANGELOG.md
64
CHANGELOG.md
|
|
@ -27,9 +27,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
|
||||
## [0.4.0] - 2021-07-04
|
||||
### Added
|
||||
- New routing scheme, which is backwards incompatible with previous versions of Mesh
|
||||
- New routing scheme, which is backwards incompatible with previous versions of Yggdrasil
|
||||
- The wire protocol version number, exchanged as part of the peer setup handshake, has been increased to 0.4
|
||||
- Nodes running this new version **will not** be able to peer with earlier versions of Mesh
|
||||
- Nodes running this new version **will not** be able to peer with earlier versions of Yggdrasil
|
||||
- Please note that **the network may be temporarily unstable** while infrastructure is being upgraded to the new release
|
||||
- TLS connections now use public key pinning
|
||||
- If no public key was already pinned, then the public key received as part of the TLS handshake is pinned to the connection
|
||||
|
|
@ -38,7 +38,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
### Changed
|
||||
- IP addresses are now derived from ed25519 public (signing) keys
|
||||
- Previously, addresses were derived from a hash of X25519 (Diffie-Hellman) keys
|
||||
- Importantly, this means that **all internal IPv6 addresses will change with this release** — this will affect anyone running public services or relying on Mesh for remote access
|
||||
- Importantly, this means that **all internal IPv6 addresses will change with this release** — this will affect anyone running public services or relying on Yggdrasil for remote access
|
||||
- It is now recommended to peer over TLS
|
||||
- Link-local peers from multicast peer discovery will now connect over TLS, with the key from the multicast beacon pinned to the connection
|
||||
- `socks://` peers now expect the destination endpoint to be a `tls://` listener, instead of a `tcp://` listener
|
||||
|
|
@ -64,7 +64,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
### Removed
|
||||
- Tunnel routing (a.k.a. crypto-key routing or "CKR") has been removed
|
||||
- It was far too easy to accidentally break routing altogether by capturing the route to peers with the TUN adapter
|
||||
- We recommend tunnelling an existing standard over Mesh instead (e.g. `ip6gre`, `ip6gretap` or other similar encapsulations, using Mesh IPv6 addresses as the tunnel endpoints)
|
||||
- We recommend tunnelling an existing standard over Yggdrasil instead (e.g. `ip6gre`, `ip6gretap` or other similar encapsulations, using Yggdrasil IPv6 addresses as the tunnel endpoints)
|
||||
- All `TunnelRouting` configuration options will no longer take effect
|
||||
- Session firewall has been removed
|
||||
- This was never a true firewall — it didn't behave like a stateful IP firewall, often allowed return traffic unexpectedly and was simply a way to prevent a node from being flooded with unwanted sessions, so the name could be misleading and usually lead to a false sense of security
|
||||
|
|
@ -109,7 +109,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- By encryption public key: `tcp://host:port?curve25519=key`
|
||||
- By both: `tcp://host:port?ed25519=key&curve25519=key`
|
||||
- By multiple, in case of DNS round-robin or similar: `tcp://host:port?curve25519=key&curve25519=key&ed25519=key&ed25519=key`
|
||||
- Some checks to prevent Mesh-over-Mesh peerings have been added
|
||||
- Some checks to prevent Yggdrasil-over-Yggdrasil peerings have been added
|
||||
- Added support for SOCKS proxy authentication, e.g. `socks://user@password:host/...`
|
||||
|
||||
### Fixed
|
||||
|
|
@ -136,14 +136,14 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- Windows `.msi` installer files are now supported (bundling the Wireguard TUN driver)
|
||||
- NodeInfo code is now actorised, should be more reliable
|
||||
- The DHT now tries to store the two closest nodes in either direction instead of one, such that if a node goes offline, the replacement is already known
|
||||
- The Mesh API now supports dialing a remote node using the public key instead of the Node ID
|
||||
- The Yggdrasil API now supports dialing a remote node using the public key instead of the Node ID
|
||||
|
||||
### Changed
|
||||
- The `-loglevel` command line parameter is now cumulative and automatically includes all levels below the one specified
|
||||
- DHT search code has been significantly simplified and processes rumoured nodes in parallel, speeding up search time
|
||||
- DHT search results are now sorted
|
||||
- The systemd service now handles configuration generation in a different unit
|
||||
- The Mesh API now returns public keys instead of node IDs when querying for local and remote addresses
|
||||
- The Yggdrasil API now returns public keys instead of node IDs when querying for local and remote addresses
|
||||
|
||||
### Fixed
|
||||
- The multicast code no longer panics when shutting down the node
|
||||
|
|
@ -159,7 +159,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
### Added
|
||||
- New API functions `SetMaximumSessionMTU` and `GetMaximumSessionMTU`
|
||||
- New command line parameters `-address` and `-subnet` for getting the address/subnet from the config file, for use with `-useconffile` or `-useconf`
|
||||
- A warning is now produced in the Mesh output at startup when the MTU in the config is invalid or has been adjusted for some reason
|
||||
- A warning is now produced in the Yggdrasil output at startup when the MTU in the config is invalid or has been adjusted for some reason
|
||||
|
||||
### Changed
|
||||
- On Linux, outgoing `InterfacePeers` connections now use `SO_BINDTODEVICE` to prefer an outgoing interface
|
||||
|
|
@ -175,10 +175,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
|
||||
## [0.3.11] - 2019-10-25
|
||||
### Added
|
||||
- Support for TLS listeners and peers has been added, allowing the use of `tls://host:port` in `Peers`, `InterfacePeers` and `Listen` configuration settings - this allows hiding Mesh peerings inside regular TLS connections
|
||||
- Support for TLS listeners and peers has been added, allowing the use of `tls://host:port` in `Peers`, `InterfacePeers` and `Listen` configuration settings - this allows hiding Yggdrasil peerings inside regular TLS connections
|
||||
|
||||
### Changed
|
||||
- Go 1.13 or later is now required for building Mesh
|
||||
- Go 1.13 or later is now required for building Yggdrasil
|
||||
- Some exported API functions have been updated to work with standard Go interfaces:
|
||||
- `net.Conn` instead of `mesh.Conn`
|
||||
- `net.Dialer` (the interface it would satisfy if it wasn't a concrete type) instead of `mesh.Dialer`
|
||||
|
|
@ -195,17 +195,17 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- The core library now includes several unit tests for peering and `mesh.Conn` connections
|
||||
|
||||
### Changed
|
||||
- On recent Linux kernels, Mesh will now set the `tcp_congestion_control` algorithm used for its own TCP sockets to [BBR](https://github.com/google/bbr), which reduces latency under load
|
||||
- The systemd service configuration in `contrib` (and, by extension, some of our packages) now attempts to load the `tun` module, in case TUN/TAP support is available but not loaded, and it restricts Mesh to the `CAP_NET_ADMIN` capability for managing the TUN/TAP adapter, rather than letting it do whatever the (typically `root`) user can do
|
||||
- On recent Linux kernels, Yggdrasil will now set the `tcp_congestion_control` algorithm used for its own TCP sockets to [BBR](https://github.com/google/bbr), which reduces latency under load
|
||||
- The systemd service configuration in `contrib` (and, by extension, some of our packages) now attempts to load the `tun` module, in case TUN/TAP support is available but not loaded, and it restricts Yggdrasil to the `CAP_NET_ADMIN` capability for managing the TUN/TAP adapter, rather than letting it do whatever the (typically `root`) user can do
|
||||
|
||||
### Fixed
|
||||
- The `mesh.Conn.RemoteAddr()` function no longer blocks, fixing a deadlock when CKR is used while under heavy load
|
||||
|
||||
## [0.3.9] - 2019-09-27
|
||||
### Added
|
||||
- Mesh will now complain more verbosely when a peer URI is incorrectly formatted
|
||||
- Yggdrasil will now complain more verbosely when a peer URI is incorrectly formatted
|
||||
- Soft-shutdown methods have been added, allowing a node to shut down gracefully when terminated
|
||||
- New multicast interval logic which sends multicast beacons more often when Mesh is first started to increase the chance of finding nearby nodes quickly after startup
|
||||
- New multicast interval logic which sends multicast beacons more often when Yggdrasil is first started to increase the chance of finding nearby nodes quickly after startup
|
||||
|
||||
### Changed
|
||||
- The switch now buffers packets more eagerly in an attempt to give the best link a chance to send, which appears to reduce packet reordering when crossing aggregate sets of peerings
|
||||
|
|
@ -223,7 +223,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- A race condition when dialing a remote node by both the node address and routed prefix simultaneously has been fixed
|
||||
- A race condition between the router and the dial code resulting in a panic has been fixed
|
||||
- A panic which could occur when the TUN/TAP interface disappears (e.g. during soft-shutdown) has been fixed
|
||||
- A bug in the semantic versioning script which accompanies Mesh for builds has been fixed
|
||||
- A bug in the semantic versioning script which accompanies Yggdrasil for builds has been fixed
|
||||
- A panic which could occur when the TUN/TAP interface reads an undersized/corrupted packet has been fixed
|
||||
|
||||
### Removed
|
||||
|
|
@ -231,7 +231,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
|
||||
## [0.3.8] - 2019-08-21
|
||||
### Changed
|
||||
- Mesh can now send multiple packets from the switch at once, which results in improved throughput with smaller packets or lower MTUs
|
||||
- Yggdrasil can now send multiple packets from the switch at once, which results in improved throughput with smaller packets or lower MTUs
|
||||
- Performance has been slightly improved by not allocating cancellations where not necessary
|
||||
- Crypto-key routing options have been renamed for clarity
|
||||
- `IPv4Sources` is now named `IPv4LocalSubnets`
|
||||
|
|
@ -243,10 +243,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- New nonce tracking should help to reduce the number of packets dropped as a result of multiple/aggregate paths or congestion control in the switch
|
||||
|
||||
### Fixed
|
||||
- A deadlock was fixed in the session code which could result in Mesh failing to pass traffic after some time
|
||||
- A deadlock was fixed in the session code which could result in Yggdrasil failing to pass traffic after some time
|
||||
|
||||
### Security
|
||||
- Address verification was not strict enough, which could result in a malicious session sending traffic with unexpected or spoofed source or destination addresses which Mesh could fail to reject
|
||||
- Address verification was not strict enough, which could result in a malicious session sending traffic with unexpected or spoofed source or destination addresses which Yggdrasil could fail to reject
|
||||
- Versions `0.3.6` and `0.3.7` are vulnerable - users of these versions should upgrade as soon as possible
|
||||
- Versions `0.3.5` and earlier are not affected
|
||||
|
||||
|
|
@ -259,7 +259,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
### Fixed
|
||||
- A number of significant performance regressions introduced in version 0.3.6 have been fixed, resulting in better performance
|
||||
- Flow labels are now used to prioritise traffic flows again correctly
|
||||
- In low-traffic scenarios where there are multiple peerings between a pair of nodes, Mesh now prefers the most active peering instead of the least active, helping to reduce packet reordering
|
||||
- In low-traffic scenarios where there are multiple peerings between a pair of nodes, Yggdrasil now prefers the most active peering instead of the least active, helping to reduce packet reordering
|
||||
- The `Listen` statement, when configured as a string rather than an array, will now be parsed correctly
|
||||
- The admin socket now returns `coords` as a correct array of unsigned 64-bit integers, rather than the internal representation
|
||||
- The admin socket now returns `box_pub_key` in string format again
|
||||
|
|
@ -271,18 +271,18 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
|
||||
## [0.3.6] - 2019-08-03
|
||||
### Added
|
||||
- Mesh now has a public API with interfaces such as `mesh.ConnDialer`, `mesh.ConnListener` and `mesh.Conn` for using Mesh as a transport directly within applications
|
||||
- Yggdrasil now has a public API with interfaces such as `mesh.ConnDialer`, `mesh.ConnListener` and `mesh.Conn` for using Yggdrasil as a transport directly within applications
|
||||
- Session gatekeeper functions, part of the API, which can be used to control whether to allow or reject incoming or outgoing sessions dynamically (compared to the previous fixed whitelist/blacklist approach)
|
||||
- Support for logging to files or syslog (where supported)
|
||||
- Platform defaults now include the ability to set sane defaults for multicast interfaces
|
||||
|
||||
### Changed
|
||||
- Following a massive refactoring exercise, Mesh's codebase has now been broken out into modules
|
||||
- Following a massive refactoring exercise, Yggdrasil's codebase has now been broken out into modules
|
||||
- Core node functionality in the `mesh` package with a public API
|
||||
- This allows Mesh to be integrated directly into other applications and used as a transport
|
||||
- IP-specific code has now been moved out of the core `mesh` package, making Mesh effectively protocol-agnostic
|
||||
- This allows Yggdrasil to be integrated directly into other applications and used as a transport
|
||||
- IP-specific code has now been moved out of the core `mesh` package, making Yggdrasil effectively protocol-agnostic
|
||||
- Multicast peer discovery functionality is now in the `multicast` package
|
||||
- Admin socket functionality is now in the `admin` package and uses the Mesh public API
|
||||
- Admin socket functionality is now in the `admin` package and uses the Yggdrasil public API
|
||||
- TUN/TAP, ICMPv6 and all IP-specific functionality is now in the `tuntap` package
|
||||
- `PPROF` debug output is now sent to `stderr` instead of `stdout`
|
||||
- Node IPv6 addresses on macOS are now configured as `secured`
|
||||
|
|
@ -290,7 +290,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
|
||||
### Fixed
|
||||
- Multicast discovery is no longer disabled if the nominated interfaces aren't available on the system yet, e.g. during boot
|
||||
- Multicast interfaces are now re-evaluated more frequently so that Mesh doesn't need to be restarted to use interfaces that have become available since startup
|
||||
- Multicast interfaces are now re-evaluated more frequently so that Yggdrasil doesn't need to be restarted to use interfaces that have become available since startup
|
||||
- Admin socket error cases are now handled better
|
||||
- Various fixes in the TUN/TAP module, particularly surrounding Windows platform support
|
||||
- Invalid keys will now cause the node to fail to start, rather than starting but silently not working as before
|
||||
|
|
@ -313,9 +313,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- New multicast behaviour where each multicast interface is given its own link-local listener and does not depend on the `Listen` configuration
|
||||
- Blocking detection in the switch to avoid parenting a blocked peer
|
||||
- Support for adding and removing listeners and multicast interfaces when reloading configuration during runtime
|
||||
- Mesh will now attempt to clean up UNIX admin sockets on startup if left behind by a previous crash
|
||||
- Yggdrasil will now attempt to clean up UNIX admin sockets on startup if left behind by a previous crash
|
||||
- Admin socket `getTunnelRouting` and `setTunnelRouting` calls for enabling and disabling crypto-key routing during runtime
|
||||
- On macOS, Mesh will now try to wake up AWDL on start-up when `awdl0` is a configured multicast interface, to keep it awake after system sleep, and to stop waking it when no longer needed
|
||||
- On macOS, Yggdrasil will now try to wake up AWDL on start-up when `awdl0` is a configured multicast interface, to keep it awake after system sleep, and to stop waking it when no longer needed
|
||||
- Added `LinkLocalTCPPort` option for controlling the port number that link-local TCP listeners will listen on by default when setting up `MulticastInterfaces` (a node restart is currently required for changes to `LinkLocalTCPPort` to take effect - it cannot be updated by reloading config during runtime)
|
||||
|
||||
### Changed
|
||||
|
|
@ -331,14 +331,14 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- Handling of `getRoutes` etc in `meshctl` is now working
|
||||
- Local interface names are no longer leaked in multicast packets
|
||||
- Link-local TCP connections, particularly those initiated because of multicast beacons, are now always correctly scoped for the target interface
|
||||
- Mesh now correctly responds to multicast interfaces going up and down during runtime
|
||||
- Yggdrasil now correctly responds to multicast interfaces going up and down during runtime
|
||||
|
||||
## [0.3.3] - 2019-02-18
|
||||
### Added
|
||||
- Dynamic reconfiguration, which allows reloading the configuration file to make changes during runtime by sending a `SIGHUP` signal (note: this only works with `-useconffile` and not `-useconf` and currently reconfiguring TUN/TAP is not supported)
|
||||
- Support for building Mesh as an iOS or Android framework if the appropriate tools (e.g. `gomobile`/`gobind` + SDKs) are available
|
||||
- Support for building Yggdrasil as an iOS or Android framework if the appropriate tools (e.g. `gomobile`/`gobind` + SDKs) are available
|
||||
- Connection contexts used for TCP connections which allow more exotic socket options to be set, e.g.
|
||||
- Reusing the multicast socket to allow multiple running Mesh instances without having to disable multicast
|
||||
- Reusing the multicast socket to allow multiple running Yggdrasil instances without having to disable multicast
|
||||
- Allowing supported Macs to peer with other nearby Macs that aren't even on the same Wi-Fi network using AWDL
|
||||
- Flexible logging support, which allows for logging at different levels of verbosity
|
||||
|
||||
|
|
@ -392,7 +392,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
|
||||
## [0.3.0] - 2018-12-12
|
||||
### Added
|
||||
- Crypto-key routing support for tunnelling both IPv4 and IPv6 over Mesh
|
||||
- Crypto-key routing support for tunnelling both IPv4 and IPv6 over Yggdrasil
|
||||
- Add advanced `SwitchOptions` in configuration file for tuning the switch
|
||||
- Add `dhtPing` to the admin socket to aid in crawling the network
|
||||
- New macOS .pkgs built automatically by CircleCI
|
||||
|
|
@ -409,7 +409,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
|||
- Cleaned up some of the parameter naming in the admin socket
|
||||
- Latency-based parent selection for the switch instead of uptime-based (should help to avoid high latency links somewhat)
|
||||
- Real peering endpoints now shown in the admin socket `getPeers` call to help identify peerings
|
||||
- Reuse the multicast port on supported platforms so that multiple Mesh processes can run
|
||||
- Reuse the multicast port on supported platforms so that multiple Yggdrasil processes can run
|
||||
- `meshctl` now has more useful help text (with `-help` or when no arguments passed)
|
||||
|
||||
### Fixed
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue