mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 11:06:52 +01:00
Add the identity command and serve it on an opt-in HTTP info API
Build slackhq/nebula#1821 ("who is this vpn address?" over a local HTTP+JSON socket) on the command registry, so the lookup is one command on every surface and the socket is one more local API. identity - `identity [-address <vpn addr>[:port]]`: no address reports this node; with one, this node or the peer behind an established tunnel - Certificate fields only: name, vpn addresses, networks, unsafe networks, groups, fingerprint, issuer, validity, cert version; a peer's fingerprint is the one nebula computed when it verified the cert - Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes straight through - No tunnel is a commands.NotFound; an empty -address is refused - Lighthouse TXT lookup shares the owner and peer lookups, keeps answering with the initiating certificate, and no longer panics without a default cert - Served on ssh and nebula ctl too Info API - Off until `local_api.info.enabled` with `socket` and optional quoted octal `socket_mode` (default "0600"); nothing derived - Serves commands declaring Command.Identity plus help; others 403 naming their surfaces. TestInfoAPISurface pins the set to identity - GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is the -json rendering via commands.Render; commands.PresentationFormat reads json/pretty from the query the way a line is read - 400 commands.ParamError, 403 commands.WithheldError (what Resolve now returns for a withheld name, so help and dispatch type-check it too), 404 NotFound or unknown, 500 Run error, refusal with no reason, or recovered panic with no detail; no redirects; every miss is JSON - listen takes a mode: bind under umask 0077 then chmod; "0660" plus a searchable dir opens it to a group - The chmod, at bind and on a mode-only reload, goes through chmodSocket, which never follows a link: a user who can write the socket's directory could otherwise swap the node for a link and have a root daemon put 0660 or 0666 on any file. Only a socket we own is chmoded. On linux the node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded through /proc/self/fd, so the check and the chmod land on one inode; fchmodat2 is the fallback without /proc. On darwin and the BSDs it is an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats too, so a dangling link is refused rather than followed by bind on darwin - One endpoint type owns bind under mutex, bind-before-release move, context watch and stop/unlink; each server supplies what it serves - Reloadable through the same reconcile shape as the control socket: mode applied in place, unparsable section keeps what runs, control socket path refused by name - Wire returns Endpoints{Control, Info} with one Stop - Windows unsupported for now (a pipe has no mode); warned once Tests: identity lookups and shapes; API filter, status codes, panic recovery, socket mode, rebind, cancellation; config parsing incl. bare 0660; Wire transitions; e2e of two nebulas with the info API resolving the peer by address and port, through shared test.HTTPDo/HTTPGet helpers. Goldens gain identity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Matt RichardsonandClaude Fable 5.1 committed
1 parent
92c67a52b2
commit
613c7e3061
38 files changed
+2937
-332
No files matched your search
@@ -101,6 +101,18 @@ func TestCommandOutput(t *testing.T) {
|
||||
{"print-cert", []string{"10.222.0.9", "-json"}},
|
||||
{"print-cert", []string{"10.222.0.250"}},
|
||||
{"print-cert", []string{"not-an-address"}},
|
||||
{"whoami", nil},
|
||||
{"whoami", []string{"x"}},
|
||||
// No address is a refusal that names whoami, never this node's identity.
|
||||
{"identity", nil},
|
||||
// Our own address, which the hostmap never holds, answers from our certificate.
|
||||
{"identity", []string{"-address", "10.222.0.1"}},
|
||||
{"identity", []string{"-address", "10.222.0.1:4242"}},
|
||||
// A pending tunnel has no certificate yet.
|
||||
{"identity", []string{"-address", "10.222.0.9"}},
|
||||
{"identity", []string{"-address", "not-an-address"}},
|
||||
{"identity", []string{"-address", ""}},
|
||||
{"identity", []string{"10.222.0.9"}},
|
||||
{"print-tunnel", nil},
|
||||
{"print-tunnel", []string{"10.222.0.9"}},
|
||||
{"print-tunnel", []string{"10.222.0.250"}},
|
||||
|
||||
@@ -0,0 +1,118 @@
|
||||
//go:build e2e_testing
|
||||
|
||||
package e2e
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/slackhq/nebula/cert"
|
||||
"github.com/slackhq/nebula/cert_test"
|
||||
"github.com/slackhq/nebula/e2e/router"
|
||||
"github.com/slackhq/nebula/localapi"
|
||||
"github.com/slackhq/nebula/test"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// TestIdentityOverTheInfoAPI is the info API's reason to exist, end to end: a program on
|
||||
// this host has a connection arriving over the overlay and asks who is behind its
|
||||
// source address, and the answer is the identity in the certificate the tunnel was
|
||||
// established with.
|
||||
func TestIdentityOverTheInfoAPI(t *testing.T) {
|
||||
if runtime.GOOS == "windows" {
|
||||
t.Skip("the info API is not served on windows")
|
||||
}
|
||||
|
||||
ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
|
||||
myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24", nil)
|
||||
theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.2/24", nil)
|
||||
|
||||
myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
|
||||
|
||||
r := router.NewR(t, myControl, theirControl)
|
||||
defer r.RenderFlow()
|
||||
|
||||
myControl.Start()
|
||||
theirControl.Start()
|
||||
t.Cleanup(func() {
|
||||
myControl.Stop()
|
||||
theirControl.Stop()
|
||||
})
|
||||
|
||||
// Before the tunnel is up their address is unknown to us.
|
||||
path := infoSocket(t)
|
||||
info := localapi.NewInfoServer(NewTestLogger(), myControl.Commands())
|
||||
require.NoError(t, info.Rebind(context.Background(), path, localapi.Access{Mode: 0600}))
|
||||
t.Cleanup(info.Stop)
|
||||
|
||||
status, body := test.HTTPGet(t, path, "/v1/identity?address="+theirVpnIpNet[0].Addr().String())
|
||||
assert.Equal(t, http.StatusNotFound, status)
|
||||
assert.JSONEq(t, `{"error":"No active tunnel for vpn addr: 10.128.0.2"}`, body)
|
||||
|
||||
// Only we know how to reach them, so the first packet has to be ours; once the tunnel
|
||||
// is up both directions work and assertTunnel can check it.
|
||||
myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
|
||||
p := r.RouteForAllUntilTxTun(theirControl)
|
||||
assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
|
||||
assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
|
||||
|
||||
type identity struct {
|
||||
Name string `json:"name"`
|
||||
VpnAddrs []netip.Addr `json:"vpnAddrs"`
|
||||
Networks []netip.Prefix `json:"networks"`
|
||||
Groups []string `json:"groups"`
|
||||
Issuer string `json:"issuer"`
|
||||
}
|
||||
|
||||
// A connection's RemoteAddr, port and all, resolves to the peer.
|
||||
status, body = test.HTTPGet(t, path, "/v1/identity?address="+netip.AddrPortFrom(theirVpnIpNet[0].Addr(), 51234).String())
|
||||
require.Equal(t, http.StatusOK, status, body)
|
||||
var them identity
|
||||
require.NoError(t, json.Unmarshal([]byte(body), &them))
|
||||
assert.Equal(t, "them", them.Name)
|
||||
assert.Equal(t, []netip.Addr{theirVpnIpNet[0].Addr()}, them.VpnAddrs)
|
||||
assert.Equal(t, theirVpnIpNet, them.Networks)
|
||||
assert.Equal(t, []string{}, them.Groups)
|
||||
caFP, err := ca.Fingerprint()
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, caFP, them.Issuer)
|
||||
|
||||
// No address is a caller that forgot the parameter, and is refused rather than handed
|
||||
// this node's identity to authorize against; whoami is the command for that.
|
||||
status, body = test.HTTPGet(t, path, "/v1/identity")
|
||||
assert.Equal(t, http.StatusBadRequest, status, body)
|
||||
assert.Contains(t, body, "whoami")
|
||||
|
||||
status, body = test.HTTPGet(t, path, "/v1/whoami")
|
||||
require.Equal(t, http.StatusOK, status, body)
|
||||
var me identity
|
||||
require.NoError(t, json.Unmarshal([]byte(body), &me))
|
||||
assert.Equal(t, "me", me.Name)
|
||||
assert.Equal(t, []netip.Addr{myVpnIpNet[0].Addr()}, me.VpnAddrs)
|
||||
|
||||
// An empty address is a caller's bug, and is told so rather than handed our identity.
|
||||
status, body = test.HTTPGet(t, path, "/v1/identity?address=")
|
||||
assert.Equal(t, http.StatusBadRequest, status)
|
||||
assert.JSONEq(t, `{"error":"The provided vpn addr could not be parsed: "}`, body)
|
||||
|
||||
// Nothing else nebula serves is reachable here.
|
||||
status, body = test.HTTPGet(t, path, "/v1/list-hostmap")
|
||||
assert.Equal(t, http.StatusForbidden, status)
|
||||
assert.Contains(t, body, "identity lookups only")
|
||||
|
||||
r.RenderHostmaps("Final hostmaps", myControl, theirControl)
|
||||
}
|
||||
|
||||
// infoSocket returns a short socket path in a private directory, one level below it
|
||||
// so that listen has a directory of its own to create.
|
||||
func infoSocket(t *testing.T) string {
|
||||
t.Helper()
|
||||
return filepath.Join(test.ShortTempDir(t), "n", "info.sock")
|
||||
}
|
||||
Vendored
+240
-1
@@ -202,6 +202,195 @@ $ print-cert -pretty not-an-address
|
||||
}
|
||||
exit status 1
|
||||
|
||||
$ whoami
|
||||
name: output-golden
|
||||
vpn addrs: 10.222.0.1
|
||||
networks: 10.222.0.1/24
|
||||
unsafe networks:
|
||||
groups:
|
||||
fingerprint: <hex>
|
||||
issuer: <hex>
|
||||
not before: <time>
|
||||
not after: <time>
|
||||
cert version: 1
|
||||
|
||||
$ whoami -json
|
||||
{"name":"output-golden","vpnAddrs":["10.222.0.1"],"networks":["10.222.0.1/24"],"unsafeNetworks":[],"groups":[],"fingerprint":"<hex>","issuer":"<hex>","notBefore":"<time>","notAfter":"<time>","certVersion":1}
|
||||
|
||||
$ whoami -pretty
|
||||
{
|
||||
"name": "output-golden",
|
||||
"vpnAddrs": [
|
||||
"10.222.0.1"
|
||||
],
|
||||
"networks": [
|
||||
"10.222.0.1/24"
|
||||
],
|
||||
"unsafeNetworks": [],
|
||||
"groups": [],
|
||||
"fingerprint": "<hex>",
|
||||
"issuer": "<hex>",
|
||||
"notBefore": "<time>",
|
||||
"notAfter": "<time>",
|
||||
"certVersion": 1
|
||||
}
|
||||
|
||||
$ whoami x
|
||||
whoami takes no arguments
|
||||
exit status 1
|
||||
|
||||
$ whoami -json x
|
||||
{"ok":false,"reason":"whoami takes no arguments"}
|
||||
exit status 1
|
||||
|
||||
$ whoami -pretty x
|
||||
{
|
||||
"ok": false,
|
||||
"reason": "whoami takes no arguments"
|
||||
}
|
||||
exit status 1
|
||||
|
||||
$ identity
|
||||
No vpn addr was provided, use -address <vpn addr>[:port]; whoami prints this node's own identity
|
||||
exit status 1
|
||||
|
||||
$ identity -json
|
||||
{"ok":false,"reason":"No vpn addr was provided, use -address \u003cvpn addr\u003e[:port]; whoami prints this node's own identity"}
|
||||
exit status 1
|
||||
|
||||
$ identity -pretty
|
||||
{
|
||||
"ok": false,
|
||||
"reason": "No vpn addr was provided, use -address \u003cvpn addr\u003e[:port]; whoami prints this node's own identity"
|
||||
}
|
||||
exit status 1
|
||||
|
||||
$ identity -address 10.222.0.1
|
||||
name: output-golden
|
||||
vpn addrs: 10.222.0.1
|
||||
networks: 10.222.0.1/24
|
||||
unsafe networks:
|
||||
groups:
|
||||
fingerprint: <hex>
|
||||
issuer: <hex>
|
||||
not before: <time>
|
||||
not after: <time>
|
||||
cert version: 1
|
||||
|
||||
$ identity -json -address 10.222.0.1
|
||||
{"name":"output-golden","vpnAddrs":["10.222.0.1"],"networks":["10.222.0.1/24"],"unsafeNetworks":[],"groups":[],"fingerprint":"<hex>","issuer":"<hex>","notBefore":"<time>","notAfter":"<time>","certVersion":1}
|
||||
|
||||
$ identity -pretty -address 10.222.0.1
|
||||
{
|
||||
"name": "output-golden",
|
||||
"vpnAddrs": [
|
||||
"10.222.0.1"
|
||||
],
|
||||
"networks": [
|
||||
"10.222.0.1/24"
|
||||
],
|
||||
"unsafeNetworks": [],
|
||||
"groups": [],
|
||||
"fingerprint": "<hex>",
|
||||
"issuer": "<hex>",
|
||||
"notBefore": "<time>",
|
||||
"notAfter": "<time>",
|
||||
"certVersion": 1
|
||||
}
|
||||
|
||||
$ identity -address 10.222.0.1:4242
|
||||
name: output-golden
|
||||
vpn addrs: 10.222.0.1
|
||||
networks: 10.222.0.1/24
|
||||
unsafe networks:
|
||||
groups:
|
||||
fingerprint: <hex>
|
||||
issuer: <hex>
|
||||
not before: <time>
|
||||
not after: <time>
|
||||
cert version: 1
|
||||
|
||||
$ identity -json -address 10.222.0.1:4242
|
||||
{"name":"output-golden","vpnAddrs":["10.222.0.1"],"networks":["10.222.0.1/24"],"unsafeNetworks":[],"groups":[],"fingerprint":"<hex>","issuer":"<hex>","notBefore":"<time>","notAfter":"<time>","certVersion":1}
|
||||
|
||||
$ identity -pretty -address 10.222.0.1:4242
|
||||
{
|
||||
"name": "output-golden",
|
||||
"vpnAddrs": [
|
||||
"10.222.0.1"
|
||||
],
|
||||
"networks": [
|
||||
"10.222.0.1/24"
|
||||
],
|
||||
"unsafeNetworks": [],
|
||||
"groups": [],
|
||||
"fingerprint": "<hex>",
|
||||
"issuer": "<hex>",
|
||||
"notBefore": "<time>",
|
||||
"notAfter": "<time>",
|
||||
"certVersion": 1
|
||||
}
|
||||
|
||||
$ identity -address 10.222.0.9
|
||||
No active tunnel for vpn addr: 10.222.0.9
|
||||
exit status 1
|
||||
|
||||
$ identity -json -address 10.222.0.9
|
||||
{"ok":false,"reason":"No active tunnel for vpn addr: 10.222.0.9"}
|
||||
exit status 1
|
||||
|
||||
$ identity -pretty -address 10.222.0.9
|
||||
{
|
||||
"ok": false,
|
||||
"reason": "No active tunnel for vpn addr: 10.222.0.9"
|
||||
}
|
||||
exit status 1
|
||||
|
||||
$ identity -address not-an-address
|
||||
The provided vpn addr could not be parsed: not-an-address
|
||||
exit status 1
|
||||
|
||||
$ identity -json -address not-an-address
|
||||
{"ok":false,"reason":"The provided vpn addr could not be parsed: not-an-address"}
|
||||
exit status 1
|
||||
|
||||
$ identity -pretty -address not-an-address
|
||||
{
|
||||
"ok": false,
|
||||
"reason": "The provided vpn addr could not be parsed: not-an-address"
|
||||
}
|
||||
exit status 1
|
||||
|
||||
$ identity -address
|
||||
The provided vpn addr could not be parsed:
|
||||
exit status 1
|
||||
|
||||
$ identity -json -address
|
||||
{"ok":false,"reason":"The provided vpn addr could not be parsed: "}
|
||||
exit status 1
|
||||
|
||||
$ identity -pretty -address
|
||||
{
|
||||
"ok": false,
|
||||
"reason": "The provided vpn addr could not be parsed: "
|
||||
}
|
||||
exit status 1
|
||||
|
||||
$ identity 10.222.0.9
|
||||
identity takes the vpn addr as -address, not as an operand: identity -address 10.222.0.9
|
||||
exit status 1
|
||||
|
||||
$ identity -json 10.222.0.9
|
||||
{"ok":false,"reason":"identity takes the vpn addr as -address, not as an operand: identity -address 10.222.0.9"}
|
||||
exit status 1
|
||||
|
||||
$ identity -pretty 10.222.0.9
|
||||
{
|
||||
"ok": false,
|
||||
"reason": "identity takes the vpn addr as -address, not as an operand: identity -address 10.222.0.9"
|
||||
}
|
||||
exit status 1
|
||||
|
||||
$ print-tunnel
|
||||
No vpn address was provided
|
||||
exit status 1
|
||||
@@ -573,6 +762,7 @@ close-tunnel - Closes a tunnel for the provided vpn addr
|
||||
create-tunnel - Creates a tunnel for the provided vpn address
|
||||
device-info - Prints information about the network device.
|
||||
help - prints available commands or help <command> for specific usage info
|
||||
identity - Prints the certificate identity of the host owning the provided vpn addr
|
||||
list-hostmap - List all known previously connected hosts
|
||||
list-lighthouse-addrmap - List all lighthouse map entries
|
||||
list-pending-hostmap - List all handshaking hosts
|
||||
@@ -585,10 +775,11 @@ print-tunnel - Prints json details about a tunnel for the provided vpn addr
|
||||
query-lighthouse - Query the lighthouses for the provided vpn address
|
||||
reload - Reloads configuration from disk, same as sending HUP to the process
|
||||
version - Prints the currently running version of nebula
|
||||
whoami - Prints the certificate identity of this node
|
||||
|
||||
|
||||
$ help -json
|
||||
[{"name":"change-remote","short":"Changes the remote address used in the tunnel for the provided vpn addr","flags":[{"name":"address","usage":"The new remote address, ip:port"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"close-tunnel","short":"Closes a tunnel for the provided vpn addr","flags":[{"name":"local-only","bool":true,"default":"false","usage":"Disables notifying the remote that the tunnel is shutting down"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"create-tunnel","short":"Creates a tunnel for the provided vpn address","help":"The lighthouses will be queried for real addresses but you can provide one as well.","flags":[{"name":"address","usage":"Optionally provide a real remote address, ip:port "},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"device-info","short":"Prints information about the network device.","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"help","short":"prints available commands or help \u003ccommand\u003e for specific usage info","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-hostmap","short":"List all known previously connected hosts","flags":[{"name":"by-index","bool":true,"default":"false","usage":"gets all hosts in the hostmap from the index table"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-lighthouse-addrmap","short":"List all lighthouse map entries","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-pending-hostmap","short":"List all handshaking hosts","flags":[{"name":"by-index","bool":true,"default":"false","usage":"gets all hosts in the hostmap from the index table"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"log-format","short":"Gets or sets the current log format","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"log-level","short":"Gets or sets the current log level","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"logout","short":"Ends the current session","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-cert","short":"Prints the current certificate being used or the certificate for the provided vpn addr","flags":[{"name":"raw","bool":true,"default":"false","usage":"prints the PEM encoded certificate; with -json, an object holding it"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-relays","short":"Prints json details about all relay info","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-tunnel","short":"Prints json details about a tunnel for the provided vpn addr","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"query-lighthouse","short":"Query the lighthouses for the provided vpn address","help":"This command is asynchronous. Only currently known udp addresses will be printed.","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"reload","short":"Reloads configuration from disk, same as sending HUP to the process","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"version","short":"Prints the currently running version of nebula","flags":[{"namLine truncated
|
||||
[{"name":"change-remote","short":"Changes the remote address used in the tunnel for the provided vpn addr","flags":[{"name":"address","usage":"The new remote address, ip:port"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"close-tunnel","short":"Closes a tunnel for the provided vpn addr","flags":[{"name":"local-only","bool":true,"default":"false","usage":"Disables notifying the remote that the tunnel is shutting down"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"create-tunnel","short":"Creates a tunnel for the provided vpn address","help":"The lighthouses will be queried for real addresses but you can provide one as well.","flags":[{"name":"address","usage":"Optionally provide a real remote address, ip:port "},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"device-info","short":"Prints information about the network device.","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"help","short":"prints available commands or help \u003ccommand\u003e for specific usage info","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"identity","short":"Prints the certificate identity of the host owning the provided vpn addr","help":"Identity is what the certificate says: name, vpn addrs, networks, groups, fingerprint, issuer and validity. The address may carry a port, so a connection's remote address can be passed through as is. For this node's own identity use whoami.","flags":[{"name":"address","usage":"The vpn addr to look up, optionally with a port"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-hostmap","short":"List all known previously connected hosts","flags":[{"name":"by-index","bool":true,"default":"false","usage":"gets all hosts in the hostmap from the index table"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-lighthouse-addrmap","short":"List all lighthouse map entries","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-pending-hostmap","short":"List all handshaking hosts","flags":[{"name":"by-index","bool":true,"default":"false","usage":"gets all hosts in the hostmap from the index table"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"log-format","short":"Gets or sets the current log format","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"log-level","short":"Gets or sets the current log level","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"logout","short":"Ends the current session","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-cert","short":"Prints the current certificate being used or the certificate for the provided vpn addr","flags":[{"name":"raw","bool":true,"default":"false","usage":"prints the PEM encoded certificate; with -json, an object holding it"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-relays","short":"Prints json details about all relay info","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-tunnel","short":"Prints json details about a tunnel for the provided vpn addr","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"query-lighthouse","short":"Query the lighthouses for the provided vpn address","help":"This command Line truncated
|
||||
|
||||
$ help -pretty
|
||||
[
|
||||
@@ -697,6 +888,29 @@ $ help -pretty
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "identity",
|
||||
"short": "Prints the certificate identity of the host owning the provided vpn addr",
|
||||
"help": "Identity is what the certificate says: name, vpn addrs, networks, groups, fingerprint, issuer and validity. The address may carry a port, so a connection's remote address can be passed through as is. For this node's own identity use whoami.",
|
||||
"flags": [
|
||||
{
|
||||
"name": "address",
|
||||
"usage": "The vpn addr to look up, optionally with a port"
|
||||
},
|
||||
{
|
||||
"name": "json",
|
||||
"bool": true,
|
||||
"default": "false",
|
||||
"usage": "outputs as json"
|
||||
},
|
||||
{
|
||||
"name": "pretty",
|
||||
"bool": true,
|
||||
"default": "false",
|
||||
"usage": "pretty prints json, assumes -json"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "list-hostmap",
|
||||
"short": "List all known previously connected hosts",
|
||||
@@ -931,6 +1145,25 @@ $ help -pretty
|
||||
"usage": "pretty prints json, assumes -json"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "whoami",
|
||||
"short": "Prints the certificate identity of this node",
|
||||
"help": "The fields identity prints, read from this node's own certificate.",
|
||||
"flags": [
|
||||
{
|
||||
"name": "json",
|
||||
"bool": true,
|
||||
"default": "false",
|
||||
"usage": "outputs as json"
|
||||
},
|
||||
{
|
||||
"name": "pretty",
|
||||
"bool": true,
|
||||
"default": "false",
|
||||
"usage": "pretty prints json, assumes -json"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
|
||||
@@ -1031,6 +1264,7 @@ close-tunnel - Closes a tunnel for the provided vpn addr
|
||||
create-tunnel - Creates a tunnel for the provided vpn address
|
||||
device-info - Prints information about the network device.
|
||||
help - prints available commands or help <command> for specific usage info
|
||||
identity - Prints the certificate identity of the host owning the provided vpn addr
|
||||
list-hostmap - List all known previously connected hosts
|
||||
list-lighthouse-addrmap - List all lighthouse map entries
|
||||
list-pending-hostmap - List all handshaking hosts
|
||||
@@ -1043,6 +1277,7 @@ print-tunnel - Prints json details about a tunnel for the provided vpn addr
|
||||
query-lighthouse - Query the lighthouses for the provided vpn address
|
||||
reload - Reloads configuration from disk, same as sending HUP to the process
|
||||
version - Prints the currently running version of nebula
|
||||
whoami - Prints the certificate identity of this node
|
||||
|
||||
exit status 1
|
||||
|
||||
@@ -1054,6 +1289,7 @@ close-tunnel - Closes a tunnel for the provided vpn addr
|
||||
create-tunnel - Creates a tunnel for the provided vpn address
|
||||
device-info - Prints information about the network device.
|
||||
help - prints available commands or help <command> for specific usage info
|
||||
identity - Prints the certificate identity of the host owning the provided vpn addr
|
||||
list-hostmap - List all known previously connected hosts
|
||||
list-lighthouse-addrmap - List all lighthouse map entries
|
||||
list-pending-hostmap - List all handshaking hosts
|
||||
@@ -1066,6 +1302,7 @@ print-tunnel - Prints json details about a tunnel for the provided vpn addr
|
||||
query-lighthouse - Query the lighthouses for the provided vpn address
|
||||
reload - Reloads configuration from disk, same as sending HUP to the process
|
||||
version - Prints the currently running version of nebula
|
||||
whoami - Prints the certificate identity of this node
|
||||
|
||||
exit status 1
|
||||
|
||||
@@ -1077,6 +1314,7 @@ close-tunnel - Closes a tunnel for the provided vpn addr
|
||||
create-tunnel - Creates a tunnel for the provided vpn address
|
||||
device-info - Prints information about the network device.
|
||||
help - prints available commands or help <command> for specific usage info
|
||||
identity - Prints the certificate identity of the host owning the provided vpn addr
|
||||
list-hostmap - List all known previously connected hosts
|
||||
list-lighthouse-addrmap - List all lighthouse map entries
|
||||
list-pending-hostmap - List all handshaking hosts
|
||||
@@ -1089,6 +1327,7 @@ print-tunnel - Prints json details about a tunnel for the provided vpn addr
|
||||
query-lighthouse - Query the lighthouses for the provided vpn address
|
||||
reload - Reloads configuration from disk, same as sending HUP to the process
|
||||
version - Prints the currently running version of nebula
|
||||
whoami - Prints the certificate identity of this node
|
||||
|
||||
exit status 1
|
||||
|
||||
|
||||
Reference in new issue
Block a user