Add DNS resolver support

Fix encryption errors after restoring to a new phone (#143 )
When a user restores to a new phone, their TPM will no longer be able to decrypt the encrypted credentials. We have code already in place to delete "invalid" sites, which cleans these up by removing them. However, when trying to save a new site, Android continues to try to use the old keys which are no longer decryptable. So, when saving new encrypted files, simply reset the crypto keys if we are unable to encrypt.
2023-12-05 10:24:19 -05:00 · 2023-12-01 15:26:21 -05:00 · 2023-10-05 14:41:40 -04:00
21 changed files with 417 additions and 120 deletions
--- a/android/app/src/main/kotlin/net/defined/mobile_nebula/EncFile.kt
+++ b/android/app/src/main/kotlin/net/defined/mobile_nebula/EncFile.kt
@ -1,22 +1,57 @@
 package net.defined.mobile_nebula

 import android.content.Context
+import android.util.Log
 import androidx.security.crypto.EncryptedFile
 import androidx.security.crypto.MasterKeys
 import java.io.*
+import java.security.KeyStore

 class EncFile(private val context: Context) {
+    companion object {
+        // Borrowed from androidx.security.crypto.MasterKeys
+        private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+
+        // Borrowed from androidx.security.crypto.EncryptedFile
+        private const val KEYSET_PREF_NAME = "__androidx_security_crypto_encrypted_file_pref__"
+    }
+
    private val scheme = EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB
-    private val master: String = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC)
+    private val spec = MasterKeys.AES256_GCM_SPEC
+    private var master: String = MasterKeys.getOrCreate(spec)

    fun openRead(file: File): BufferedReader {
-        val eFile = EncryptedFile.Builder(file, context, master, scheme).build()
-        return eFile.openFileInput().bufferedReader()
+        // We may fail to decrypt the file, in which case we'll raise an exception.
+        // Callers should handle this exception by deleting the invalid file.
+        return build(file).openFileInput().bufferedReader()
    }

    fun openWrite(file: File): BufferedWriter {
-        val eFile = EncryptedFile.Builder(file, context, master, scheme).build()
-        return eFile.openFileOutput().bufferedWriter()
+        return try {
+            build(file).openFileOutput().bufferedWriter()
+        } catch (e: Exception) {
+            // If we fail to open the file, it's likely because the master key no longer works.
+            // We'll try to reset the master key and try again.
+            resetMasterKey()
+
+            build(file).openFileOutput().bufferedWriter()
+        }
    }

+    private fun build(file: File): EncryptedFile {
+        return EncryptedFile.Builder(file, context, master, scheme).build()
+    }
+
+    fun resetMasterKey() {
+        // Reset the master key
+        KeyStore.getInstance(ANDROID_KEYSTORE).apply {
+            load(null)
+            deleteEntry(master)
+        }
+        // And reset the shared preference containing the file encryption key
+        context.deleteSharedPreferences(KEYSET_PREF_NAME)
+
+        // Re-create the master key now so future calls don't fail
+        master = MasterKeys.getOrCreate(spec)
+    }
 }
--- a/android/app/src/main/kotlin/net/defined/mobile_nebula/MainActivity.kt
+++ b/android/app/src/main/kotlin/net/defined/mobile_nebula/MainActivity.kt
@ -84,6 +84,10 @@ class MainActivity: FlutterActivity() {
                "active.setRemoteForTunnel" -> activeSetRemoteForTunnel(call, result)
                "active.closeTunnel" -> activeCloseTunnel(call, result)

+                "debug.clearKeys" -> {
+                    EncFile(context).resetMasterKey()
+                }
+
                else -> result.notImplemented()
            }
        }
--- a/android/app/src/main/kotlin/net/defined/mobile_nebula/NebulaVpnService.kt
+++ b/android/app/src/main/kotlin/net/defined/mobile_nebula/NebulaVpnService.kt
@ -131,6 +131,11 @@ class NebulaVpnService : VpnService() {
            builder.addRoute(unsafeIPNet.network, unsafeIPNet.maskSize.toInt())
        }

+        // Add our DNS resolvers
+        site!!.dnsResolvers.forEach { dnsResolver ->
+            builder.addDnsServer(dnsResolver)
+        }
+
        try {
            vpnInterface = builder.establish()
            nebula = mobileNebula.MobileNebula.newNebula(site!!.config, site!!.getKey(this), site!!.logFile, vpnInterface!!.detachFd().toLong())
--- a/android/app/src/main/kotlin/net/defined/mobile_nebula/Sites.kt
+++ b/android/app/src/main/kotlin/net/defined/mobile_nebula/Sites.kt
@ -201,6 +201,7 @@ class Site(context: Context, siteDir: File) {
    val id: String
    val staticHostmap: HashMap<String, StaticHosts>
    val unsafeRoutes: List<UnsafeRoute>
+    val dnsResolvers: List<String>
    var cert: CertificateInfo? = null
    var ca: Array<CertificateInfo>
    val lhDuration: Int
@ -236,6 +237,7 @@ class Site(context: Context, siteDir: File) {
        id = incomingSite.id
        staticHostmap = incomingSite.staticHostmap
        unsafeRoutes = incomingSite.unsafeRoutes ?: ArrayList()
+        dnsResolvers = incomingSite.dnsResolvers ?: ArrayList()
        lhDuration = incomingSite.lhDuration
        port = incomingSite.port
        mtu = incomingSite.mtu ?: 1300
@ -340,6 +342,7 @@ class IncomingSite(
    val id: String,
    val staticHostmap: HashMap<String, StaticHosts>,
    val unsafeRoutes: List<UnsafeRoute>?,
+    val dnsResolvers: List<String>?,
    val cert: String,
    val ca: String,
    val lhDuration: Int,
--- a/android/build.gradle
+++ b/android/build.gradle
@ -30,6 +30,6 @@ subprojects {
    project.evaluationDependsOn(':app')
 }

-task clean(type: Delete) {
+tasks.register("clean", Delete) {
    delete rootProject.buildDir
 }
--- a/ios/NebulaNetworkExtension/PacketTunnelProvider.swift
+++ b/ios/NebulaNetworkExtension/PacketTunnelProvider.swift
@ -79,6 +79,11 @@ class PacketTunnelProvider: NEPacketTunnelProvider {
        tunnelNetworkSettings.ipv4Settings!.includedRoutes = routes
        tunnelNetworkSettings.mtu = _site.mtu as NSNumber
        
+        if !_site.dnsResolvers.isEmpty {
+            let dnsSettings = NEDNSSettings(servers: _site.dnsResolvers)
+            tunnelNetworkSettings.dnsSettings = dnsSettings
+        }
+
        self.setTunnelNetworkSettings(tunnelNetworkSettings, completionHandler: {(error:Error?) in
            if (error != nil) {
                return completionHandler(error!)
--- a/ios/NebulaNetworkExtension/Site.swift
+++ b/ios/NebulaNetworkExtension/Site.swift
@ -121,6 +121,7 @@ class Site: Codable {
    // Stored in proto
    var staticHostmap: Dictionary<String, StaticHosts>
    var unsafeRoutes: [UnsafeRoute]
+    var dnsResolvers: [String]
    var cert: CertificateInfo?
    var ca: [CertificateInfo]
    var lhDuration: Int
@ -194,6 +195,7 @@ class Site: Codable {
        id = incoming.id
        staticHostmap = incoming.staticHostmap
        unsafeRoutes = incoming.unsafeRoutes ?? []
+        dnsResolvers = incoming.dnsResolvers ?? []
        lhDuration = incoming.lhDuration
        port = incoming.port
        cipher = incoming.cipher
@ -340,6 +342,7 @@ class Site: Codable {
        case status
        case logFile
        case unsafeRoutes
+        case dnsResolvers
        case logVerbosity
        case errors
        case mtu
@ -394,6 +397,7 @@ struct IncomingSite: Codable {
    var id: String
    var staticHostmap: Dictionary<String, StaticHosts>
    var unsafeRoutes: [UnsafeRoute]?
+    vat dnsResolvers: [String]?
    var cert: String
    var ca: String
    var lhDuration: Int
--- a/lib/models/Site.dart
+++ b/lib/models/Site.dart
@ -4,6 +4,7 @@ import 'dart:convert';
 import 'package:flutter/services.dart';
 import 'package:mobile_nebula/models/HostInfo.dart';
 import 'package:mobile_nebula/models/UnsafeRoute.dart';
+import 'package:mobile_nebula/models/IPAndPort.dart';
 import 'package:uuid/uuid.dart';
 import 'Certificate.dart';
 import 'StaticHosts.dart';
@ -24,6 +25,7 @@ class Site {
  // static_host_map
  late Map<String, StaticHost> staticHostmap;
  late List<UnsafeRoute> unsafeRoutes;
+  late List<String> dnsResolvers;

  // pki fields
  late List<CertificateInfo> ca;
@ -69,6 +71,7 @@ class Site {
    String logVerbosity = 'info',
    List<String>? errors,
    List<UnsafeRoute>? unsafeRoutes,
+    List<String>? dnsResolvers,
    bool managed = false,
    String? rawConfig,
    DateTime? lastManagedUpdate,
@ -89,6 +92,7 @@ class Site {
    this.logVerbosity = logVerbosity;
    this.errors = errors ?? [];
    this.unsafeRoutes = unsafeRoutes ?? [];
+    this.dnsResolvers = dnsResolvers ?? [];
    this.managed = managed;
    this.rawConfig = rawConfig;
    this.lastManagedUpdate = lastManagedUpdate;
@ -128,6 +132,7 @@ class Site {
      logVerbosity: decoded['logVerbosity'],
      errors: decoded['errors'],
      unsafeRoutes: decoded['unsafeRoutes'],
+      dnsResolvers: decoded['dnsResolvers'],
      managed: decoded['managed'],
      rawConfig: decoded['rawConfig'],
      lastManagedUpdate: decoded['lastManagedUpdate'],
@ -152,6 +157,7 @@ class Site {
    this.logVerbosity = decoded['logVerbosity'];
    this.errors = decoded['errors'];
    this.unsafeRoutes = decoded['unsafeRoutes'];
+    this.dnsResolvers = decoded['dnsResolvers'];
    this.managed = decoded['managed'];
    this.rawConfig = decoded['rawConfig'];
    this.lastManagedUpdate = decoded['lastManagedUpdate'];
@ -170,6 +176,12 @@ class Site {
      unsafeRoutes.add(UnsafeRoute.fromJson(val));
    });

+    List<dynamic> rawDNSResolvers = json['dnsResolvers'];
+    List<String> dnsResolvers = [];
+    rawDNSResolvers.forEach((val) {
+      dnsResolvers.add(val);
+    });
+
    List<dynamic> rawCA = json['ca'];
    List<CertificateInfo> ca = [];
    rawCA.forEach((val) {
@ -204,6 +216,7 @@ class Site {
      "logVerbosity": json['logVerbosity'],
      "errors": errors,
      "unsafeRoutes": unsafeRoutes,
+      "dnsResolvers": dnsResolvers,
      "managed": json['managed'] ?? false,
      "rawConfig": json['rawConfig'],
      "lastManagedUpdate": json["lastManagedUpdate"] == null ?
@ -221,6 +234,7 @@ class Site {
      'id': id,
      'staticHostmap': staticHostmap,
      'unsafeRoutes': unsafeRoutes,
+      'dnsResolvers': dnsResolvers,
      'ca': ca.map((cert) {
        return cert.rawCert;
      }).join('\n'),
--- a/lib/screens/EnrollmentScreen.dart
+++ b/lib/screens/EnrollmentScreen.dart
@ -156,7 +156,7 @@ class _EnrollmentScreenState extends State<EnrollmentScreen> {

    final dnIcon = Theme.of(context).brightness == Brightness.dark ? 'images/dn-logo-dark.svg' : 'images/dn-logo-light.svg';
    return SimplePage(
-      title: Text('Enroll with DN', style: TextStyle(fontWeight: FontWeight.bold)),
+      title: Text('Enroll with Managed Nebula', style: TextStyle(fontWeight: FontWeight.bold)),
      child: Padding(child: child, padding: EdgeInsets.symmetric(horizontal: 10)),
      alignment: alignment
    );
--- a/lib/screens/MainScreen.dart
+++ b/lib/screens/MainScreen.dart
@ -119,7 +119,7 @@ class _MainScreenState extends State<MainScreen> {
        children: [
          _debugSave(badDebugSave),
          _debugSave(goodDebugSave),
-          _debugDNEnroll(),
+          _debugClearKeys(),
        ],
        mainAxisAlignment: MainAxisAlignment.center,
      );
@ -289,15 +289,16 @@ class _MainScreenState extends State<MainScreen> {
    );
  }

-  Widget _debugDNEnroll() {
+  Widget _debugClearKeys()  {
    return CupertinoButton(
-      child: Text('DN Enroll'),
-      onPressed: () => Utils.openPage(context, (context) {
-        return EnrollmentScreen(allowCodeEntry: true);
-      }),
+      child: Text("Clear Keys"),
+      onPressed: () async {
+            await platform.invokeMethod("debug.clearKeys", null);
+        },
    );
  }

+
  _loadSites() async {
    //TODO: This can throw, we need to show an error dialog
    Map<String, dynamic> rawSites = jsonDecode(await platform.invokeMethod('listSites'));
--- a/lib/screens/SettingsScreen.dart
+++ b/lib/screens/SettingsScreen.dart
@ -89,7 +89,7 @@ class _SettingsScreenState extends State<SettingsScreen> {
    final dnIcon = Theme.of(context).brightness == Brightness.dark ? 'images/dn-logo-dark.svg' : 'images/dn-logo-light.svg';
    items.add(ConfigSection(children: [
      ConfigPageItem(
-        label: Text('Enroll with DN'),
+        label: Text('Enroll with Managed Nebula'),
        labelWidth: 200,
        onPressed: () => Utils.openPage(context, (context) => EnrollmentScreen(stream: widget.stream, allowCodeEntry: true))
      )
--- a/lib/screens/siteConfig/AdvancedScreen.dart
+++ b/lib/screens/siteConfig/AdvancedScreen.dart
@ -10,6 +10,7 @@ import 'package:mobile_nebula/components/config/ConfigSection.dart';
 import 'package:mobile_nebula/models/Site.dart';
 import 'package:mobile_nebula/models/UnsafeRoute.dart';
 import 'package:mobile_nebula/screens/siteConfig/CipherScreen.dart';
+import 'package:mobile_nebula/screens/siteConfig/DNSResolversScreen.dart';
 import 'package:mobile_nebula/screens/siteConfig/LogVerbosityScreen.dart';
 import 'package:mobile_nebula/screens/siteConfig/RenderedConfigScreen.dart';
 import 'package:mobile_nebula/services/utils.dart';
@ -28,6 +29,7 @@ class Advanced {
  String verbosity;
  List<UnsafeRoute> unsafeRoutes;
  int mtu;
+  List<String> dnsResolvers;

  Advanced({
    required this.lhDuration,
@ -36,6 +38,7 @@ class Advanced {
    required this.verbosity,
    required this.unsafeRoutes,
    required this.mtu,
+    required this.dnsResolvers,
  });
 }

@ -66,6 +69,7 @@ class _AdvancedScreenState extends State<AdvancedScreen> {
      verbosity: widget.site.logVerbosity,
      unsafeRoutes: widget.site.unsafeRoutes,
      mtu: widget.site.mtu,
+      dnsResolvers: widget.site.dnsResolvers,
    );
    super.initState();
  }
@ -192,7 +196,26 @@ class _AdvancedScreenState extends State<AdvancedScreen> {
                        });
                  });
                },
-              )
+              ),
+              ConfigPageItem(
+                  label: Text('DNS Resolvers'),
+                  labelWidth: 150,
+                  content: Text(
+                      Utils.itemCountFormat(settings.dnsResolvers.length),
+                      textAlign: TextAlign.end),
+                  onPressed: () {
+                    Utils.openPage(context, (context) {
+                      return DNSResolversScreen(
+                          dnsResolvers: settings.dnsResolversmm
+                          onSave: (dnsResolvers) {
+                            setState(() {
+                              settings.dnsResolvers = dnsResolvers;
+                              changed = true;
+                            });
+                          });
+                    });
+                  },
+              ),
            ],
          ),
          ConfigSection(
--- a/lib/screens/siteConfig/DNSResolverScreen.dart
+++ b/lib/screens/siteConfig/DNSResolverScreen.dart
@ -0,0 +1,77 @@
+import 'package:flutter/cupertino.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
+import 'package:flutter/widgets.dart';
+import 'package:flutter_platform_widgets/flutter_platform_widgets.dart';
+import 'package:mobile_nebula/components/FormPage.dart';
+import 'package:mobile_nebula/components/IPFormField.dart';
+import 'package:mobile_nebula/components/config/ConfigItem.dart';
+import 'package:mobile_nebula/components/config/ConfigSection.dart';
+import 'package:mobile_nebula/services/utils.dart';
+
+lass DNSResolverScreen extends StatefulWidget {
+  const DNSResolverScreen({Key? key, required this.dnsResolver, required this.onDelete, required this.onSave}) : super(key: key);
+
+  final String dnsResolver;
+  final ValueChanged<String> onSave;
+  final Function onDelete;
+
+  @override
+  _DNSResolverScreenState createState() => _DNSResolverScreenState();
+}
+
+class _DNSResolverScreenState extends State<DNSResolverScreen> {
+  late String dnsResolver;
+  bool changed = false;
+
+  FocusNode dnsResolverFocus = FocusNode();
+
+  @override
+  void initState() {
+    dnsResolver = widget.dnsResolver;
+    super.initState();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return FormPage(
+        title: widget.onDelete == null ? 'New DNS Resolver' : 'Edit DNS Resolver',
+        changed: changed,
+        onSave: _onSave,
+        child: Column(children: [
+          ConfigSection(children: <Widget>[
+            ConfigItem(
+                label: Text('Address'),
+                content: IPFormField(
+                    initialValue: dnsResolver,
+                    ipOnly: true,
+                    textInputAction: TextInputAction.next,
+                    focusNode: dnsResolverFocus,
+                    onSaved: (v) {
+                      dnsResolver = v.toString();
+                    })),
+          ]),
+          widget.onDelete != null
+              ? Padding(
+                  padding: EdgeInsets.only(top: 50, bottom: 10, left: 10, right: 10),
+                  child: SizedBox(
+                      width: double.infinity,
+                      child: PlatformElevatedButton(
+                        child: Text('Delete'),
+                        color: CupertinoColors.systemRed.resolveFrom(context),
+                        onPressed: () => Utils.confirmDelete(context, 'Delete DNS Resolver?', () {
+                          Navigator.of(context).pop();
+                          widget.onDelete();
+                        }),
+                      )))
+              : Container()
+        ]));
+  }
+
+  _onSave() {
+    Navigator.pop(context);
+    if (widget.onSave != null) {
+      widget.onSave(dnsResolver);
+    }
+  }
+}
--- a/lib/screens/siteConfig/DNSResolversScreen.dart
+++ b/lib/screens/siteConfig/DNSResolversScreen.dart
@ -0,0 +1,103 @@
+import 'package:flutter/cupertino.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter/widgets.dart';
+import 'package:flutter/foundation.dart';
+import 'package:mobile_nebula/components/FormPage.dart';
+import 'package:mobile_nebula/components/config/ConfigButtonItem.dart';
+import 'package:mobile_nebula/components/config/ConfigPageItem.dart';
+import 'package:mobile_nebula/components/config/ConfigSection.dart';
+import 'package:mobile_nebula/screens/siteConfig/DNSResolverScreen.dart';
+import 'package:mobile_nebula/services/utils.dart';
+
+class DNSResolversScreen extends StatefulWidget {
+  const DNSResolversScreen(
+      {Key? key, required this.dnsResolvers, required this.onSave})
+      : super(key: key);
+
+  final List<String> dnsResolvers;
+  final ValueChanged<List<String>> onSave;
+
+  @override
+  _DNSResolversScreenState createState() => _DNSResolversScreenState();
+}
+
+class _DNSResolversScreenState extends State<DNSResolversScreen> {
+  late List<String> dnsResolvers = [];
+  bool changed = false;
+
+  @override
+  void initState() {
+    widget.dnsResolvers.forEach((dnsResolver) {
+      dnsResolvers.add(dnsResolver);
+    });
+    super.initState();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return FormPage(
+        title: 'DNS Resolvers',
+        changed: changed,
+        onSave: _onSave,
+        child: ConfigSection(
+          children: _build(),
+        ));
+  }
+
+  _onSave() {
+    Navigator.pop(context);
+    if (widget.onSave != null) {
+      widget.onSave(dnsResolvers);
+    }
+  }
+
+  List<Widget> _build() {
+    List<Widget> items = [];
+    for (var i=0; i<dnsResolvers.length;i++) {
+      final dnsResolver = dnsResolvers[i];
+      items.add(ConfigPageItem(
+        label: Text("Resolver"),
+        content: Text(dnsResolver, textAlign: TextAlign.end),
+        onPressed: () {
+          Utils.openPage(context, (context) {
+            return DNSResolverScreen(
+              dnsResolver: dnsResolver,
+              onSave: (dnsResolver) {
+                setState(() {
+                  changed = true;
+                  dnsResolvers[i] = dnsResolver;
+                });
+              },
+              onDelete: () {
+                setState(() {
+                  changed = true;
+                  dnsResolvers.removeAt(i);
+                });
+              },
+            );
+          });
+        },
+      ));
+    }
+
+    items.add(ConfigButtonItem(
+      content: Text('Add a new DNS resolver'),
+      onPressed: () {
+        Utils.openPage(context, (context) {
+          return DNSResolverScreen(
+              dnsResolver: "",
+              onSave: (dnsResolver) {
+                  setState(() {
+                      changed = true;
+                  });
+                  dnsResolvers.add(dnsResolver);
+              },
+              onDelete: () {},
+          );
+        });
+      },
+    ));
+
+    return items;
+  }
+}
--- a/lib/screens/siteConfig/SiteConfigScreen.dart
+++ b/lib/screens/siteConfig/SiteConfigScreen.dart
@ -292,6 +292,7 @@ class _SiteConfigScreenState extends State<SiteConfigScreen> {
                        site.port = settings.port;
                        site.logVerbosity = settings.verbosity;
                        site.unsafeRoutes = settings.unsafeRoutes;
+                        site.dnsResolvers = settings.dnsResolvers;
                        site.mtu = settings.mtu;
                      });
                    });
--- a/nebula/config.go
+++ b/nebula/config.go
@ -139,6 +139,7 @@ type configTun struct {
 	MTU                *int                `yaml:"mtu,omitempty"`
 	Routes             []configRoute       `yaml:"routes"`
 	UnsafeRoutes       []configUnsafeRoute `yaml:"unsafe_routes"`
+	DNSResolvers       []string            `yaml:"dns_resolvers"`
 }

 type configRoute struct {
--- a/nebula/control.go
+++ b/nebula/control.go
@ -53,7 +53,14 @@ func NewNebula(configData string, key string, logFile string, tunFd int) (*Nebul
 	//TODO: inject our version
 	ctrl, err := nebula.Main(c, false, "", l, &tunFd)
 	if err != nil {
-		util.LogWithContextIfNeeded("Failed to start", err, l)
+		switch v := err.(type) {
+		case util.ContextualError:
+			v.Log(l)
+			return nil, v.Unwrap()
+		default:
+			l.WithError(err).Error("Failed to start")
+			return nil, err
+		}
 	}

 	return &Nebula{ctrl, l, c}, nil
--- a/nebula/go.mod
+++ b/nebula/go.mod
@ -6,14 +6,13 @@ go 1.19

 require (
 	github.com/DefinedNet/dnapi v0.0.0-20221117210952-6f56f055f991
-	github.com/sirupsen/logrus v1.9.3
-	github.com/slackhq/nebula v1.7.3-0.20230907175741-280fa026ead8
-	golang.org/x/crypto v0.12.0
+	github.com/sirupsen/logrus v1.9.2
+	github.com/slackhq/nebula v1.7.2
+	golang.org/x/crypto v0.16.0
 	gopkg.in/yaml.v2 v2.4.0
 )

 require (
-	dario.cat/mergo v1.0.0 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@ -23,24 +22,26 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/gopacket v1.1.19 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/miekg/dns v1.1.55 // indirect
+	github.com/miekg/dns v1.1.54 // indirect
 	github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f // indirect
-	github.com/prometheus/client_golang v1.16.0 // indirect
+	github.com/prometheus/client_golang v1.15.1 // indirect
 	github.com/prometheus/client_model v0.4.0 // indirect
-	github.com/prometheus/common v0.44.0 // indirect
-	github.com/prometheus/procfs v0.11.1 // indirect
+	github.com/prometheus/common v0.43.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 // indirect
 	github.com/vishvananda/netlink v1.1.0 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
-	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.14.0 // indirect
-	golang.org/x/sys v0.12.0 // indirect
-	golang.org/x/term v0.12.0 // indirect
-	golang.org/x/tools v0.12.1-0.20230818130535-1517d1a3ba60 // indirect
+	golang.org/x/mobile v0.0.0-20231127183840-76ac6878050a // indirect
+	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/sync v0.5.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/tools v0.16.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	golang.zx2c4.com/wireguard v0.0.0-20230704135630-469159ecf7d1 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 )
--- a/nebula/go.sum
+++ b/nebula/go.sum
@ -1,6 +1,4 @@
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
-dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/DefinedNet/dnapi v0.0.0-20221117210952-6f56f055f991 h1:TVDFasW5VaUmEMQjwci7NevCXHfef8HCWvJfS6osFjs=
 github.com/DefinedNet/dnapi v0.0.0-20221117210952-6f56f055f991/go.mod h1:J+zO5WxmoN8/hJrP7dt78/1NJVJYXY2diwMPLgHMPtg=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@ -58,6 +56,8 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@ -78,8 +78,8 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/miekg/dns v1.1.55 h1:GoQ4hpsj0nFLYe+bWiCToyrBEJXkQfOOIvFGFy0lEgo=
-github.com/miekg/dns v1.1.55/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
+github.com/miekg/dns v1.1.54 h1:5jon9mWcb0sFJGpnI99tOMhCPyJ+RPVz5b63MQG0VWI=
+github.com/miekg/dns v1.1.54/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
@ -97,8 +97,8 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
-github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
+github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
+github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@ -107,26 +107,24 @@ github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJ
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY=
-github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY=
+github.com/prometheus/common v0.43.0 h1:iq+BVjvYLei5f27wiuNiB1DN6DYQkp1c8Bx0Vykh5us=
+github.com/prometheus/common v0.43.0/go.mod h1:NCvr5cQIh3Y/gy73/RdVtC9r8xxrxwJnB+2lB3BxrFc=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.11.1 h1:xRC8Iq1yyca5ypa9n1EZnWZkt7dwcoRPQwX/5gwaUuI=
-github.com/prometheus/procfs v0.11.1/go.mod h1:eesXgaPo1q7lBpVMoMy0ZOFTth9hBn4W/y0/p/ScXhY=
+github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
+github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/slackhq/nebula v1.7.3-0.20230901185046-70e5b3c945cb h1:gkqQ1Ywear4wM2pp0Ys6yROxSo85PC5aKm6oNMjNPv0=
-github.com/slackhq/nebula v1.7.3-0.20230901185046-70e5b3c945cb/go.mod h1:ecDuyvnaKHwXIR0FgWqSkerXF2fr5Apxvoalk0zZZts=
-github.com/slackhq/nebula v1.7.3-0.20230907175741-280fa026ead8 h1:7oO4U/aFVgfMFszTzW/JoMwxipUFnyGbypTAwirUnhE=
-github.com/slackhq/nebula v1.7.3-0.20230907175741-280fa026ead8/go.mod h1:mob5DY/BeFaE7DyjoHobCXzNQLi+/QLea49kf5FOVbU=
+github.com/sirupsen/logrus v1.9.2 h1:oxx1eChJGI6Uks2ZC4W1zpLlVgqB8ner4EuQwV4Ik1Y=
+github.com/sirupsen/logrus v1.9.2/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/slackhq/nebula v1.7.2 h1:Rko1Mlksz/nC0c919xjGpB8uOSrTJ5e6KPgZx+lVfYw=
+github.com/slackhq/nebula v1.7.2/go.mod h1:cnaoahkUipDs1vrNoIszyp0QPRIQN9Pm68ppQEW1Fhg=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@ -135,7 +133,7 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
 github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
@ -148,14 +146,24 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
-golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
+golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
+golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
+golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mobile v0.0.0-20231108233038-35478a0c49da h1:gS9sVMAeHM+gVBmM9bTM6vUi/NHv58O3QzJ3vjjN84M=
+golang.org/x/mobile v0.0.0-20231108233038-35478a0c49da/go.mod h1:IEceR0jfVklLJXrbUe90rfdAFAYDW0SQwKl4qvO1GBQ=
+golang.org/x/mobile v0.0.0-20231127183840-76ac6878050a h1:sYbmY3FwUWCBTodZL1S3JUuOvaW6kM2o+clDzzDNBWg=
+golang.org/x/mobile v0.0.0-20231127183840-76ac6878050a/go.mod h1:Ede7gF0KGoHlj822RtphAHK1jLdrcuRBZg0sF1Q+SPc=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@ -166,8 +174,12 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
+golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@ -175,7 +187,9 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@ -191,15 +205,19 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
+golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0=
-golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
-golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
+golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
+golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@ -208,16 +226,18 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.12.1-0.20230818130535-1517d1a3ba60 h1:o4bs4seAAlSiZQAZbO6/RP5XBCZCooQS3Pgc0AUjWts=
-golang.org/x/tools v0.12.1-0.20230818130535-1517d1a3ba60/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
+golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
+golang.org/x/tools v0.15.0 h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=
+golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
+golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
+golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
-golang.zx2c4.com/wireguard v0.0.0-20230704135630-469159ecf7d1 h1:EY138uSo1JYlDq+97u1FtcOUwPpIU6WL1Lkt7WpYjPA=
-golang.zx2c4.com/wireguard v0.0.0-20230704135630-469159ecf7d1/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
 golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@ -229,8 +249,8 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--- a/nebula/mobileNebula.go
+++ b/nebula/mobileNebula.go
@ -60,7 +60,7 @@ func RenderConfig(configData string, key string) (string, error) {
 		if err != nil {
 			return "", err
 		}
-		return "# DN-managed config\n" + string(yamlCfg), nil
+		return "# Managed Nebula Config (defined.net)\n" + string(yamlCfg), nil
 	}

 	// Otherwise, build the config
@ -116,6 +116,13 @@ func RenderConfig(configData string, key string) (string, error) {
 		}
 	}

+	if dnsResolvers, ok := d["dnsResolvers"].([]interface{}); ok {
+		cfg.Tun.DNSResolvers = make([]string, len(dnsResolvers))
+		for i, r := range dnsResolvers {
+			cfg.Tun.DNSResolvers[i] = r.(string)
+		}
+	}
+
 	finalConfig, err := yaml.Marshal(cfg)
 	if err != nil {
 		return "", err
@ -149,7 +156,7 @@ func TestConfig(configData string, key string) error {
 	_, err = nebula.Main(c, true, "", l, nil)
 	if err != nil {
 		switch v := err.(type) {
-		case *util.ContextualError:
+		case util.ContextualError:
 			return v.Unwrap()
 		default:
 			return err
--- a/pubspec.lock
+++ b/pubspec.lock
@ -42,21 +42,21 @@ packages:
      name: cross_file
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "0.3.3+2"
+    version: "0.3.3+4"
  crypto:
    dependency: transitive
    description:
      name: crypto
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "3.0.1"
+    version: "3.0.2"
  cupertino_icons:
    dependency: "direct main"
    description:
      name: cupertino_icons
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "1.0.4"
+    version: "1.0.5"
  fake_async:
    dependency: transitive
    description:
@ -70,21 +70,21 @@ packages:
      name: ffi
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.1"
+    version: "2.0.2"
  file:
    dependency: transitive
    description:
      name: file
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "6.1.2"
+    version: "6.1.4"
  file_picker:
    dependency: "direct main"
    description:
      name: file_picker
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "5.2.2"
+    version: "5.2.10"
  flutter:
    dependency: "direct main"
    description: flutter
@ -103,21 +103,21 @@ packages:
      name: flutter_platform_widgets
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.0"
+    version: "2.2.6"
  flutter_plugin_android_lifecycle:
    dependency: transitive
    description:
      name: flutter_plugin_android_lifecycle
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.7"
+    version: "2.0.15"
  flutter_svg:
    dependency: "direct main"
    description:
      name: flutter_svg
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "1.1.5"
+    version: "1.1.6"
  flutter_test:
    dependency: "direct dev"
    description: flutter
@ -169,7 +169,7 @@ packages:
      name: mime
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "1.0.2"
+    version: "1.0.4"
  package_info:
    dependency: "direct main"
    description:
@ -204,77 +204,63 @@ packages:
      name: path_provider
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.11"
+    version: "2.1.0"
  path_provider_android:
    dependency: transitive
    description:
      name: path_provider_android
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.11"
-  path_provider_ios:
+    version: "2.1.0"
+  path_provider_foundation:
    dependency: transitive
    description:
-      name: path_provider_ios
+      name: path_provider_foundation
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.7"
+    version: "2.3.0"
  path_provider_linux:
    dependency: transitive
    description:
      name: path_provider_linux
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.1.7"
-  path_provider_macos:
-    dependency: transitive
-    description:
-      name: path_provider_macos
-      url: "https://pub.dartlang.org"
-    source: hosted
-    version: "2.0.4"
+    version: "2.2.0"
  path_provider_platform_interface:
    dependency: transitive
    description:
      name: path_provider_platform_interface
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.2"
+    version: "2.1.0"
  path_provider_windows:
    dependency: transitive
    description:
      name: path_provider_windows
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.1.3"
+    version: "2.2.0"
  petitparser:
    dependency: transitive
    description:
      name: petitparser
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "5.0.0"
+    version: "5.1.0"
  platform:
    dependency: transitive
    description:
      name: platform
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "3.1.0"
+    version: "3.1.1"
  plugin_platform_interface:
    dependency: transitive
    description:
      name: plugin_platform_interface
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.1.2"
-  process:
-    dependency: transitive
-    description:
-      name: process
-      url: "https://pub.dartlang.org"
-    source: hosted
-    version: "4.2.4"
+    version: "2.1.5"
  pull_to_refresh:
    dependency: "direct main"
    description:
@ -288,14 +274,14 @@ packages:
      name: share_plus
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "6.3.0"
+    version: "6.3.4"
  share_plus_platform_interface:
    dependency: transitive
    description:
      name: share_plus_platform_interface
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "3.2.0"
+    version: "3.3.1"
  sky_engine:
    dependency: transitive
    description: flutter
@ -349,63 +335,63 @@ packages:
      name: typed_data
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "1.3.0"
+    version: "1.3.2"
  url_launcher:
    dependency: "direct main"
    description:
      name: url_launcher
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "6.1.6"
+    version: "6.1.11"
  url_launcher_android:
    dependency: transitive
    description:
      name: url_launcher_android
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "6.0.13"
+    version: "6.0.38"
  url_launcher_ios:
    dependency: transitive
    description:
      name: url_launcher_ios
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "6.0.13"
+    version: "6.1.4"
  url_launcher_linux:
    dependency: transitive
    description:
      name: url_launcher_linux
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "3.0.1"
+    version: "3.0.5"
  url_launcher_macos:
    dependency: transitive
    description:
      name: url_launcher_macos
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.2"
+    version: "3.0.6"
  url_launcher_platform_interface:
    dependency: transitive
    description:
      name: url_launcher_platform_interface
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.1.1"
+    version: "2.1.3"
  url_launcher_web:
    dependency: transitive
    description:
      name: url_launcher_web
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "2.0.13"
+    version: "2.0.18"
  url_launcher_windows:
    dependency: transitive
    description:
      name: url_launcher_windows
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "3.0.1"
+    version: "3.0.7"
  uuid:
    dependency: "direct main"
    description:
@ -426,14 +412,14 @@ packages:
      name: win32
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "3.1.1"
+    version: "3.1.4"
  xdg_directories:
    dependency: transitive
    description:
      name: xdg_directories
      url: "https://pub.dartlang.org"
    source: hosted
-    version: "0.2.0"
+    version: "1.0.2"
  xml:
    dependency: transitive
    description:
@ -443,4 +429,4 @@ packages:
    version: "6.1.0"
 sdks:
  dart: ">=2.18.1 <3.0.0"
-  flutter: ">=3.0.0"
+  flutter: ">=3.3.0"