diff --git a/localapi/info.go b/localapi/info.go index 600bc661..f71e0444 100644 --- a/localapi/info.go +++ b/localapi/info.go @@ -64,9 +64,6 @@ var ( infoReadTimeout = 15 * time.Second ) -// errInfoUnsupported is returned by Rebind on a platform without a socket mode to open. -var errInfoUnsupported = errors.New("the info API is not available on this platform") - // servedOnInfo decides what the info API will run: the commands that report identity // and nothing else, which the commands declare about themselves. Filter adds help to // the result, so a client can ask what is served; help on a filtered registry describes @@ -123,10 +120,6 @@ func (s *InfoServer) Rebind(ctx context.Context, path string, acc Access) error s.mu.Lock() defer s.mu.Unlock() - if !infoSupported { - return errInfoUnsupported - } - return s.rebindLocked(ctx, path, acc, func(ln net.Listener) io.Closer { srv := &http.Server{ Handler: s.handler(), diff --git a/localapi/platform_unix.go b/localapi/platform_unix.go index 48bae232..81e6e972 100644 --- a/localapi/platform_unix.go +++ b/localapi/platform_unix.go @@ -43,10 +43,6 @@ func withPeerFD(conn net.Conn, f func(fd int) error) error { // in for root, or for a stranger, without owning a second account on the host. var currentUID = func() uint32 { return uint32(os.Geteuid()) } -// infoSupported reports that the info API can be served here: a unix socket takes the -// mode an operator configures, which is the whole of its access control. -const infoSupported = true - // listen binds the socket at path with the given access. // // Access control is the socket's own mode and group, which the node is created no diff --git a/localapi/platform_windows.go b/localapi/platform_windows.go index eea82077..a634ea6d 100644 --- a/localapi/platform_windows.go +++ b/localapi/platform_windows.go @@ -33,11 +33,6 @@ const network = "pipe" // exists so a Server is built the same way on every platform. var currentUID = func() uint32 { return 0 } -// infoSupported is true here: the pipe's security descriptor is what a mode is on unix, -// and the group an operator names in the config is the way to open it to other -// accounts, as it is for the control pipe. The mode itself means nothing to a pipe. -const infoSupported = true - // listen creates the named pipe at path with a security descriptor that admits the user // nebula runs as, SYSTEM and Administrators, and the group acc names, if any, for // reading and writing, which is what connecting to a pipe takes. acc's mode means diff --git a/localapi/wire.go b/localapi/wire.go index 026e0701..f6b75919 100644 --- a/localapi/wire.go +++ b/localapi/wire.go @@ -200,10 +200,6 @@ func reportRebind(l *slog.Logger, what, old, want string, err error, now string) func wireInfo(ctx context.Context, l *slog.Logger, c *config.C, reg *commands.Registry) *InfoServer { srv := NewInfoServer(l, reg) - // Said once per process rather than on every reload: it is a platform limit, not - // something the next reload could fix. - saidUnsupported := false - reconcile := func(c *config.C) { cfg, err := infoConfigFrom(c) if err != nil { @@ -219,14 +215,6 @@ func wireInfo(ctx context.Context, l *slog.Logger, c *config.C, reg *commands.Re return } - if !infoSupported { - if !saidUnsupported { - l.Warn("Local info API is enabled in the config but is not served on this platform yet", "key", InfoEnabledKey) - saidUnsupported = true - } - return - } - // The two endpoints speak different protocols; one socket cannot be both. Caught // here, from the configured paths, because listen's own answer, that the socket is // in use by another nebula, would send the operator looking for a second process.