Add the identity command and serve it on an opt-in HTTP info API

Build slackhq/nebula#1821 ("who is this vpn address?" over a local
HTTP+JSON socket) on the command registry, so the lookup is one command
on every surface and the socket is one more local API.

identity
- `identity [-address <vpn addr>[:port]]`: no address reports this node;
  with one, this node or the peer behind an established tunnel
- Certificate fields only: name, vpn addresses, networks, unsafe
  networks, groups, fingerprint, issuer, validity, cert version; a peer's
  fingerprint is the one nebula computed when it verified the cert
- Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes
  straight through
- No tunnel is a commands.NotFound; an empty -address is refused
- Lighthouse TXT lookup shares the owner and peer lookups, keeps answering
  with the initiating certificate, and no longer panics without a default cert
- Served on ssh and nebula ctl too

Info API
- Off until `local_api.info.enabled` with `socket` and optional quoted
  octal `socket_mode` (default "0600"); nothing derived
- Serves commands declaring Command.Identity plus help; others 403 naming
  their surfaces. TestInfoAPISurface pins the set to identity
- GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is
  the -json rendering via commands.Render; commands.PresentationFormat
  reads json/pretty from the query the way a line is read
- 400 commands.ParamError, 403 commands.WithheldError (what Resolve now
  returns for a withheld name, so help and dispatch type-check it too),
  404 NotFound or unknown, 500 Run error, refusal with no reason, or
  recovered panic with no detail; no redirects; every miss is JSON
- listen takes a mode: bind under umask 0077 then chmod; "0660" plus a
  searchable dir opens it to a group
- The chmod, at bind and on a mode-only reload, goes through chmodSocket,
  which never follows a link: a user who can write the socket's directory
  could otherwise swap the node for a link and have a root daemon put
  0660 or 0666 on any file. Only a socket we own is chmoded. On linux the
  node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded
  through /proc/self/fd, so the check and the chmod land on one inode;
  fchmodat2 is the fallback without /proc. On darwin and the BSDs it is
  an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats
  too, so a dangling link is refused rather than followed by bind on
  darwin
- One endpoint type owns bind under mutex, bind-before-release move,
  context watch and stop/unlink; each server supplies what it serves
- Reloadable through the same reconcile shape as the control socket:
  mode applied in place, unparsable section keeps what runs, control
  socket path refused by name
- Wire returns Endpoints{Control, Info} with one Stop
- Windows unsupported for now (a pipe has no mode); warned once

Tests: identity lookups and shapes; API filter, status codes, panic
recovery, socket mode, rebind, cancellation; config parsing incl. bare
0660; Wire transitions; e2e of two nebulas with the info API resolving
the peer by address and port, through shared test.HTTPDo/HTTPGet helpers.
Goldens gain identity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

e2e/info_api_test.go

@@ -0,0 +1,118 @@
+//go:build e2e_testing
+
+package e2e
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/netip"
+	"path/filepath"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/slackhq/nebula/cert"
+	"github.com/slackhq/nebula/cert_test"
+	"github.com/slackhq/nebula/e2e/router"
+	"github.com/slackhq/nebula/localapi"
+	"github.com/slackhq/nebula/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestIdentityOverTheInfoAPI is the info API's reason to exist, end to end: a program on
+// this host has a connection arriving over the overlay and asks who is behind its
+// source address, and the answer is the identity in the certificate the tunnel was
+// established with.
+func TestIdentityOverTheInfoAPI(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("the info API is not served on windows")
+	}
+
+	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Now(), time.Now().Add(10*time.Minute), nil, nil, []string{})
+	myControl, myVpnIpNet, _, _ := newSimpleServer(cert.Version2, ca, caKey, "me", "10.128.0.1/24", nil)
+	theirControl, theirVpnIpNet, theirUdpAddr, _ := newSimpleServer(cert.Version2, ca, caKey, "them", "10.128.0.2/24", nil)
+
+	myControl.InjectLightHouseAddr(theirVpnIpNet[0].Addr(), theirUdpAddr)
+
+	r := router.NewR(t, myControl, theirControl)
+	defer r.RenderFlow()
+
+	myControl.Start()
+	theirControl.Start()
+	t.Cleanup(func() {
+		myControl.Stop()
+		theirControl.Stop()
+	})
+
+	// Before the tunnel is up their address is unknown to us.
+	path := infoSocket(t)
+	info := localapi.NewInfoServer(NewTestLogger(), myControl.Commands())
+	require.NoError(t, info.Rebind(context.Background(), path, localapi.Access{Mode: 0600}))
+	t.Cleanup(info.Stop)
+
+	status, body := test.HTTPGet(t, path, "/v1/identity?address="+theirVpnIpNet[0].Addr().String())
+	assert.Equal(t, http.StatusNotFound, status)
+	assert.JSONEq(t, `{"error":"No active tunnel for vpn addr: 10.128.0.2"}`, body)
+
+	// Only we know how to reach them, so the first packet has to be ours; once the tunnel
+	// is up both directions work and assertTunnel can check it.
+	myControl.InjectTunPacket(BuildTunUDPPacket(theirVpnIpNet[0].Addr(), 80, myVpnIpNet[0].Addr(), 80, []byte("Hi from me")))
+	p := r.RouteForAllUntilTxTun(theirControl)
+	assertUdpPacket(t, []byte("Hi from me"), p, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), 80, 80)
+	assertTunnel(t, myVpnIpNet[0].Addr(), theirVpnIpNet[0].Addr(), myControl, theirControl, r)
+
+	type identity struct {
+		Name     string         `json:"name"`
+		VpnAddrs []netip.Addr   `json:"vpnAddrs"`
+		Networks []netip.Prefix `json:"networks"`
+		Groups   []string       `json:"groups"`
+		Issuer   string         `json:"issuer"`
+	}
+
+	// A connection's RemoteAddr, port and all, resolves to the peer.
+	status, body = test.HTTPGet(t, path, "/v1/identity?address="+netip.AddrPortFrom(theirVpnIpNet[0].Addr(), 51234).String())
+	require.Equal(t, http.StatusOK, status, body)
+	var them identity
+	require.NoError(t, json.Unmarshal([]byte(body), &them))
+	assert.Equal(t, "them", them.Name)
+	assert.Equal(t, []netip.Addr{theirVpnIpNet[0].Addr()}, them.VpnAddrs)
+	assert.Equal(t, theirVpnIpNet, them.Networks)
+	assert.Equal(t, []string{}, them.Groups)
+	caFP, err := ca.Fingerprint()
+	require.NoError(t, err)
+	assert.Equal(t, caFP, them.Issuer)
+
+	// No address is a caller that forgot the parameter, and is refused rather than handed
+	// this node's identity to authorize against; whoami is the command for that.
+	status, body = test.HTTPGet(t, path, "/v1/identity")
+	assert.Equal(t, http.StatusBadRequest, status, body)
+	assert.Contains(t, body, "whoami")
+
+	status, body = test.HTTPGet(t, path, "/v1/whoami")
+	require.Equal(t, http.StatusOK, status, body)
+	var me identity
+	require.NoError(t, json.Unmarshal([]byte(body), &me))
+	assert.Equal(t, "me", me.Name)
+	assert.Equal(t, []netip.Addr{myVpnIpNet[0].Addr()}, me.VpnAddrs)
+
+	// An empty address is a caller's bug, and is told so rather than handed our identity.
+	status, body = test.HTTPGet(t, path, "/v1/identity?address=")
+	assert.Equal(t, http.StatusBadRequest, status)
+	assert.JSONEq(t, `{"error":"The provided vpn addr could not be parsed: "}`, body)
+
+	// Nothing else nebula serves is reachable here.
+	status, body = test.HTTPGet(t, path, "/v1/list-hostmap")
+	assert.Equal(t, http.StatusForbidden, status)
+	assert.Contains(t, body, "identity lookups only")
+
+	r.RenderHostmaps("Final hostmaps", myControl, theirControl)
+}
+
+// infoSocket returns a short socket path in a private directory, one level below it
+// so that listen has a directory of its own to create.
+func infoSocket(t *testing.T) string {
+	t.Helper()
+	return filepath.Join(test.ShortTempDir(t), "n", "info.sock")
+}