pangolin_mirror/newt
1
0
Fork 0
mirror of https://github.com/fosrl/newt.git synced 2026-07-21 07:01:28 +02:00
Code Issues Packages Projects Releases Wiki Activity
870 Commits 5 Branches 75 Tags
b6f00a9500afbb518a3989c95348eb9fa217dea4
Commit Graph

870 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]
b6f00a9500 chore(nix): fix hash for updated go dependencies 2026-06-04 17:54:30 +00:00
dependabot[bot]
d1f4b5bc80 chore(deps): bump golang.zx2c4.com/wireguard/windows from 0.5.3 to 1.0.1 
Bumps golang.zx2c4.com/wireguard/windows from 0.5.3 to 1.0.1.

---
updated-dependencies:
- dependency-name: golang.zx2c4.com/wireguard/windows
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-04 17:53:25 +00:00
Owen Schwartz
f922155843 Merge pull request #350 from fosrl/dependabot/github_actions/sigstore/cosign-installer-4.1.2 
chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2
 2026-06-04 10:51:36 -07:00
Owen Schwartz
1f16708a05 Merge pull request #356 from fosrl/dependabot/go_modules/prod-patch-updates-d9ad24fc58 
chore(deps): bump the prod-patch-updates group across 1 directory with 2 updates
 2026-06-04 10:51:28 -07:00
dependabot[bot]
88c1c2e0b5 chore(nix): fix hash for updated go dependencies 2026-06-04 17:22:48 +00:00
dependabot[bot]
69ed08222f chore(deps): bump the prod-patch-updates group across 1 directory with 2 updates 
Bumps the prod-patch-updates group with 2 updates in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go) and software.sslmate.com/src/go-pkcs12.


Updates `google.golang.org/grpc` from 1.81.0 to 1.81.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1)

Updates `software.sslmate.com/src/go-pkcs12` from 0.7.0 to 0.7.1

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.81.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: software.sslmate.com/src/go-pkcs12
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-04 17:21:44 +00:00
Owen Schwartz
0169123d55 Merge pull request #371 from fosrl/fix/go-deps-security-updates 
Update golang.org/x modules for security fixes
 2026-06-04 10:19:31 -07:00
Marc Schäfer
ac9852a3cb fix(nix): update Go module vendor hash 2026-06-04 14:28:28 +02:00
Marc Schäfer
f91deeede7 fix(deps): update golang.org/x modules for security fixes 
Update golang.org/x/crypto, golang.org/x/net and golang.org/x/sys
to versions containing security fixes reported by Docker Scout.
 2026-06-04 12:53:53 +02:00
Owen Schwartz
c168ddac90 Merge pull request #362 from fosrl/ci/use-go-version-file 
Use Go version specified in go.mod for CI tests
 2026-05-20 20:07:16 -07:00
Marc Schäfer
88d946c9b4 ci(test): use Go version from go.mod 2026-05-21 02:42:59 +02:00
Owen Schwartz
c9be684b91 Merge pull request #358 from cwiggs/feat/ci-go-test 
feat(ci): run a go test before we build
 2026-05-20 14:51:17 -07:00
Owen Schwartz
8f321365d5 Merge pull request #361 from fosrl/dev 
Housekeeping
 2026-05-20 14:48:53 -07:00
Owen Schwartz
21e2a7b91f Merge pull request #349 from fosrl/issue-348 
Refactor Docker client imports and container handling logic
 2026-05-16 21:11:12 -07:00
dependabot[bot]
24f5d55cce chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v4.1.1...6f9f17788090df1f26f669e9d70d6ae9567deba6)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-16 21:57:19 +00:00
Owen Schwartz
2562bda187 Merge pull request #360 from fosrl/github-action-cosign 
Upgrade cosign installer to v4.1.2 and pin cosign version
 2026-05-16 14:55:22 -07:00
Marc Schäfer
8736f89291 fix(security): update cosign to v3.0.6 and installer to 4.1.2 2026-05-16 16:31:27 +02:00
Chris Wiggins
54a13b268e feat(ci): run a go test before we build 2026-05-15 11:48:50 -06:00
Owen Schwartz
37aff0daa5 Merge pull request #353 from rinseaid/fix/x-forwarded-proto-tls 
Fix X-Forwarded-Proto always set to "http" for TLS connections
 2026-05-13 20:54:06 -07:00
Owen Schwartz
55ca18a1db Delete .github/workflows/build-patched.yml 2026-05-13 20:53:27 -07:00
rinseaid
b6e2d61a18 Add workflow to build patched image to ghcr.io/rinseaid/newt:patched 2026-05-13 22:40:22 -04:00
rinseaid
817824bd6f Fix X-Forwarded-Proto always set to "http" for TLS connections 
httpConnCtx wraps *tls.Conn behind net.Conn, so Go's http.Server
cannot detect TLS via type assertion and r.TLS is always nil.
SetXForwarded() then always writes X-Forwarded-Proto: http.

Override using the isTLS context flag already set by ConnContext.
 2026-05-13 22:38:35 -04:00
Owen
efa1ecf61e Remove test 2026-05-11 18:04:51 -07:00
Owen
d28c2aaa87 Update log message 2026-05-11 10:34:30 -07:00
Marc Schäfer
0e2d7057b6 refactor: update Docker client imports and adjust container handling logic 
Signed-off-by: Marc Schäfer <git@marcschaeferger.de>
 2026-05-10 10:50:38 +02:00
Marc Schäfer
ae48df97c8 Merge pull request #312 from fosrl/dependabot/github_actions/softprops/action-gh-release-3.0.0 
chore(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
 2026-05-09 15:57:52 +02:00
Marc Schäfer
df125affe4 Merge pull request #313 from fosrl/dependabot/github_actions/aws-actions/configure-aws-credentials-6.1.0 
chore(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0
 2026-05-09 15:57:40 +02:00
Marc Schäfer
848a23a535 Merge pull request #314 from fosrl/dependabot/github_actions/docker/build-push-action-7.1.0 
chore(deps): bump docker/build-push-action from 7.0.0 to 7.1.0
 2026-05-09 15:57:29 +02:00
Marc Schäfer
1a1d58c4dc Merge pull request #315 from fosrl/dependabot/github_actions/actions/setup-go-6.4.0 
chore(deps): bump actions/setup-go from 6.2.0 to 6.4.0
 2026-05-09 15:57:15 +02:00
Owen Schwartz
0da8a29a61 Merge pull request #346 from fosrl/dev 
Fix redirect
v1.12.5 		2026-05-08 11:06:31 -07:00
Owen
a1218ab67a Bump version 2026-05-08 11:05:24 -07:00
Owen
bb84762b16 Merge branch 'main' into dev 2026-05-08 11:05:07 -07:00
Owen
86155072de Fix the redirect 2026-05-08 11:03:00 -07:00
Owen Schwartz
4a9a4c4eec Merge pull request #345 from LaurenceJJones/investigate/https-permanent-redirect-loop 
fix(http): populate Request.TLS for private HTTPS via httpConnCtx
 2026-05-08 09:48:22 -07:00
Owen Schwartz
21c744fe84 Merge pull request #344 from LaurenceJJones/investigate/private-http-redirect-500 
fix(http): Set host header based on in
 2026-05-08 09:47:09 -07:00
Laurence
146e7835eb fix(http): populate Request.TLS for private HTTPS via httpConnCtx 
net/http only sets Request.TLS for *tls.Conn or conns implementing ConnectionState(). Our listener wrapped tls.Server in httpConnCtx with an embedded net.Conn, so TLS was never surfaced and r.TLS stayed nil. That triggered the HTTP→HTTPS permanent redirect on every request for HTTPS rules.

Add ConnectionState() on httpConnCtx delegating to the underlying TLS conn.
Add tests for TLS forwarding and plain TCP.
 2026-05-08 15:17:31 +01:00
Laurence
6aa94c0c2a fix(http): Set host header based on in 
fix https://github.com/fosrl/pangolin/issues/2952 issue by setting the incoming host header to the outgoing one by the reverse proxy, this was the default behaviour when using single proxy but now since we use more features it now rewrites the host header
 2026-05-08 13:45:50 +01:00
Owen Schwartz
542c70b326 Merge pull request #342 from fosrl/dev 
1.12.4
v1.12.4 		2026-05-07 17:41:03 -07:00
Owen
663e98af60 Retry interval while we are disconnected 2026-05-07 17:27:01 -07:00
Owen
901ec71baf Increase max attempts 2026-05-07 17:25:13 -07:00
Owen
9bc0204f57 Merge branch 'main' into dev 2026-05-07 17:24:34 -07:00
Daniel Snider
1e77b09e3b fix(ping): decouple data-plane recovery trigger from backoff ramp 
The trigger condition that decides whether to fire the data-plane
recovery flow in startPingCheck was AND-ed with `currentInterval <
maxInterval`. That clause was meant to throttle the *backoff ramp*
(don't widen the interval past 6s), but it also gated the recovery
trigger itself — a conflation that became invisibly load-bearing
once commit 8161fa6 (March 2026) bumped the default pingInterval
from 3s to 15s while leaving maxInterval at 6s. Under the new
defaults `currentInterval` starts at 15s and `15 < 6` is permanently
false, so the recovery branch never executed. Pings just kept
failing and the failure counter climbed forever, with no
"Connection to server lost" log line and no newt/ping/request
emitted on the websocket. Real-world recovery only happened when
the underlying network came back fast enough that a periodic ping
naturally succeeded again — which doesn't happen if the WireGuard
state on either end has rotated, so users were left stuck until
they restarted newt.

This is the proximate cause of the user reports in
fosrl/newt#284 (and dups #310, fosrl/pangolin#1004). Logs in
those issues all show ping-failure counters growing without ever
emitting "Connection to server lost", which is exactly the
fingerprint of this gate being false.

The fix is to extract the trigger decision into shouldFireRecovery
and remove currentInterval from it. Backoff is now computed in a
separate `if` in the caller, still gated by `currentInterval <
maxInterval` so the ramp is a no-op under default settings (which
is the existing behaviour, just no longer entangled with the
recovery trigger). Fixing the backoff ramp itself — making it
useful when pingInterval >= maxInterval — is a follow-up: the
priority is restoring recovery, not improving the dampening
schedule.

The new shouldFireRecovery helper is unit-tested. Its signature
intentionally omits currentInterval, so a future refactor that
re-introduces the interval-dependent gate would need to change
the function signature, which makes the historical bug harder
to reintroduce silently.
 2026-05-07 16:57:31 -07:00
Owen
74fd3f3aa3 Bump version 2026-05-07 16:24:30 -07:00
Owen
e8dc19a62b Attempt to fix nix issue 2026-05-07 16:23:59 -07:00
Owen
9ff32b8a8b Fix not logging when rewriting nat 2026-05-07 16:16:47 -07:00
dependabot[bot]
9edaac9c11 chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.35.0 to 0.36.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](57a97c7e78...ed142fd067)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-05 18:11:26 -07:00
dependabot[bot]
ced87b1d5e chore(nix): fix hash for updated go dependencies 2026-05-05 18:11:21 -07:00
dependabot[bot]
3aaebe64fb chore(deps): bump the prod-minor-updates group across 1 directory with 4 updates 
Bumps the prod-minor-updates group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `golang.org/x/crypto` from 0.49.0 to 0.50.0
- [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.50.0)

Updates `golang.org/x/net` from 0.52.0 to 0.53.0
- [Commits](https://github.com/golang/net/compare/v0.52.0...v0.53.0)

Updates `golang.org/x/sys` from 0.42.0 to 0.43.0
- [Commits](https://github.com/golang/sys/compare/v0.42.0...v0.43.0)

Updates `google.golang.org/grpc` from 1.80.0 to 1.81.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.80.0...v1.81.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: golang.org/x/net
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: golang.org/x/sys
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
- dependency-name: google.golang.org/grpc
  dependency-version: 1.81.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-05 18:11:21 -07:00
Owen
27f7ca6bb9 Try to fix failover not working 2026-05-05 11:40:39 -07:00
Owen
5090907307 Update status code 2026-04-30 15:55:52 -07:00