A program reading the info API opens the pipe by name and has no owner
check of its own, so for a name any local user could create first,
whoever did would be answering its queries. nebula refuses to serve a
held name and logs it, but the program cannot tell. The daemon now warns
at bind when the configured name is not under
\\.\pipe\ProtectedPrefix\Administrators\, and the example config and
CHANGELOG say to put it there.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
It is served there now, on a pipe, so nothing set the flag any more. It
was also a plain bool written by the first reconcile and by the reload
callback, which was the review's point about it.
- infoSupported, errInfoUnsupported, the Rebind check and the reload
branch that warned once go
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The info API is for other programs on the host, and on unix the only
setting between "the user nebula runs as" and "everyone" was a manual
chgrp that the next bind undid; on windows it was not served at all,
because which accounts a pipe admits had not been decided. The control
socket's `group` decides it, and the info API takes the same key.
- `local_api.info.group`: the socket is handed to the group at 0660
unless `socket_mode` says otherwise, and a mode that gives a named
group nothing is refused with the mode that would
- windows: served on a named pipe, the group an ACE on it as on the
control pipe; the e2e test's helpers dial unix sockets, so it still
skips there
- a changed group or mode on a reload is applied to the socket in place
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Build slackhq/nebula#1821 ("who is this vpn address?" over a local
HTTP+JSON socket) on the command registry, so the lookup is one command
on every surface and the socket is one more local API.
identity
- `identity [-address <vpn addr>[:port]]`: no address reports this node;
with one, this node or the peer behind an established tunnel
- Certificate fields only: name, vpn addresses, networks, unsafe
networks, groups, fingerprint, issuer, validity, cert version; a peer's
fingerprint is the one nebula computed when it verified the cert
- Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes
straight through
- No tunnel is a commands.NotFound; an empty -address is refused
- Lighthouse TXT lookup shares the owner and peer lookups, keeps answering
with the initiating certificate, and no longer panics without a default cert
- Served on ssh and nebula ctl too
Info API
- Off until `local_api.info.enabled` with `socket` and optional quoted
octal `socket_mode` (default "0600"); nothing derived
- Serves commands declaring Command.Identity plus help; others 403 naming
their surfaces. TestInfoAPISurface pins the set to identity
- GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is
the -json rendering via commands.Render; commands.PresentationFormat
reads json/pretty from the query the way a line is read
- 400 commands.ParamError, 403 commands.WithheldError (what Resolve now
returns for a withheld name, so help and dispatch type-check it too),
404 NotFound or unknown, 500 Run error, refusal with no reason, or
recovered panic with no detail; no redirects; every miss is JSON
- listen takes a mode: bind under umask 0077 then chmod; "0660" plus a
searchable dir opens it to a group
- The chmod, at bind and on a mode-only reload, goes through chmodSocket,
which never follows a link: a user who can write the socket's directory
could otherwise swap the node for a link and have a root daemon put
0660 or 0666 on any file. Only a socket we own is chmoded. On linux the
node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded
through /proc/self/fd, so the check and the chmod land on one inode;
fchmodat2 is the fallback without /proc. On darwin and the BSDs it is
an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats
too, so a dangling link is refused rather than followed by bind on
darwin
- One endpoint type owns bind under mutex, bind-before-release move,
context watch and stop/unlink; each server supplies what it serves
- Reloadable through the same reconcile shape as the control socket:
mode applied in place, unparsable section keeps what runs, control
socket path refused by name
- Wire returns Endpoints{Control, Info} with one Stop
- Windows unsupported for now (a pipe has no mode); warned once
Tests: identity lookups and shapes; API filter, status codes, panic
recovery, socket mode, rebind, cancellation; config parsing incl. bare
0660; Wire transitions; e2e of two nebulas with the info API resolving
the peer by address and port, through shared test.HTTPDo/HTTPGet helpers.
Goldens gain identity.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add support for accessing the previously ssh-only debug commands via
`nebula ctl <command>.`
- unix socket (named pipe on windows) for communication
- sockets scoped to the user + an optional group
- in cmd/nebula and cmd/nebula-service, but not nebula.Main
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
