See the v1.11.1 milestone for a complete list of changes.

Changed

• IPv6 packets whose next header is a protocol Nebula does not parse (SCTP, GRE, IP-in-IP, etc.) are now classified as that protocol with no ports, closing a firewall bypass where a crafted payload could steer the classifier into reading one as TCP/UDP and matching a TCP/UDP rule. These packets are now matched as their true protocol, so only a proto: any rule allows them. If you carry one of these protocols over the overlay, confirm a proto: any rule covers it before upgrading, it may have been passing only through this bypass. (#1840)
• Drop the dependency on github.com/cyberdelia/go-metrics-graphite, which has been unmaintained for over ten years, by inlining the small amount of code Nebula used. (#1832)

Fixed

• The ICMPv6 type was read from the wrong byte when classifying IPv6 packets, so the echo identifier used for conntrack was never picked up. (#1840)
• Enforce outbound message counter limits so a tunnel is rehandshaked before the counter can wrap, preventing nonce reuse. This is unreachable in practice, but is enforced as a defense-in-depth measure. (#1841)
• Prevent nebula-cert ca from running out of memory on 32bit systems when generating encrypted private keys. (#1834)
• Tolerate ErrDumpInterrupted when listing tun addresses on Linux, so a transient interrupted netlink dump no longer aborts startup. (#1835)