4 Commits

Include renames

Author	SHA1	Message	Date
Matt RichardsonandClaude Fable 5.1	660a271466	Serve print-cert on the info API, with -address and preferring our v2 certificate ... A program that verifies certificates against its own CAs, as nebula-auth-request does, needs the certificate itself rather than the parsed identity, and it asked the ssh debug server for it. The info API now serves print-cert, so it can ask there instead. - print-cert declares Identity: it reads a certificate from the hostmap or our own, and nothing operational - -address names the vpn addr, with a port accepted and stripped and 4in6 unmapped, as identity takes it; the operand stays, and giving both is refused - an address of our own answers with our own certificate, and a tunnel without one is not found, a 404 on the API - with no address the certificate is the one whoami reports, the v2 when both versions are loaded, not the one handshakes start with - GET /v1/print-cert?address=<addr>&raw=true answers {"pem": ...}; example config, CHANGELOG, surface test, goldens and an e2e check Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-21 12:27:12 -04:00
Matt RichardsonandClaude Fable 5.1	613c7e3061	Add the identity command and serve it on an opt-in HTTP info API ... Build slackhq/nebula#1821 ("who is this vpn address?" over a local HTTP+JSON socket) on the command registry, so the lookup is one command on every surface and the socket is one more local API. identity - `identity [-address <vpn addr>[:port]]`: no address reports this node; with one, this node or the peer behind an established tunnel - Certificate fields only: name, vpn addresses, networks, unsafe networks, groups, fingerprint, issuer, validity, cert version; a peer's fingerprint is the one nebula computed when it verified the cert - Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes straight through - No tunnel is a commands.NotFound; an empty -address is refused - Lighthouse TXT lookup shares the owner and peer lookups, keeps answering with the initiating certificate, and no longer panics without a default cert - Served on ssh and nebula ctl too Info API - Off until `local_api.info.enabled` with `socket` and optional quoted octal `socket_mode` (default "0600"); nothing derived - Serves commands declaring Command.Identity plus help; others 403 naming their surfaces. TestInfoAPISurface pins the set to identity - GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is the -json rendering via commands.Render; commands.PresentationFormat reads json/pretty from the query the way a line is read - 400 commands.ParamError, 403 commands.WithheldError (what Resolve now returns for a withheld name, so help and dispatch type-check it too), 404 NotFound or unknown, 500 Run error, refusal with no reason, or recovered panic with no detail; no redirects; every miss is JSON - listen takes a mode: bind under umask 0077 then chmod; "0660" plus a searchable dir opens it to a group - The chmod, at bind and on a mode-only reload, goes through chmodSocket, which never follows a link: a user who can write the socket's directory could otherwise swap the node for a link and have a root daemon put 0660 or 0666 on any file. Only a socket we own is chmoded. On linux the node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded through /proc/self/fd, so the check and the chmod land on one inode; fchmodat2 is the fallback without /proc. On darwin and the BSDs it is an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats too, so a dangling link is refused rather than followed by bind on darwin - One endpoint type owns bind under mutex, bind-before-release move, context watch and stop/unlink; each server supplies what it serves - Reloadable through the same reconcile shape as the control socket: mode applied in place, unparsable section keeps what runs, control socket path refused by name - Wire returns Endpoints{Control, Info} with one Stop - Windows unsupported for now (a pipe has no mode); warned once Tests: identity lookups and shapes; API filter, status codes, panic recovery, socket mode, rebind, cancellation; config parsing incl. bare 0660; Wire transitions; e2e of two nebulas with the info API resolving the peer by address and port, through shared test.HTTPDo/HTTPGet helpers. Goldens gain identity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-21 12:26:09 -04:00
Matt RichardsonandClaude Fable 5.1	0f767ce529	Add a local control socket and nebula ctl (#1975) ... Add support for accessing the previously ssh-only debug commands via `nebula ctl <command>.` - unix socket (named pipe on windows) for communication - sockets scoped to the user + an optional group - in cmd/nebula and cmd/nebula-service, but not nebula.Main Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-21 11:16:00 -04:00
Matt RichardsonandClaude Fable 5.1	8a4bd8b10f	Report ssh command failures to the surface (#1959) ... Report ssh command failures to the surface (#1959) The ssh debug commands told the user when something went wrong but never told the surface that ran them, so `ssh host cmd` always exited 0 and a few failures were not reported at all. A failed command now returns its error, a failure the user has already heard about is a commands.Failure, and the ssh exec path exits 1 for either. The command bodies also lose their ssh prefixes and the duplication they carried over from ssh.go; both goldens pin that nothing else changed. - Dispatch returns the callback's error, or shlex's; the ssh session logs it at debug, and not at all for a Failure the user already saw - commands.Fail writes a message and returns it as a Failure in one step; an unknown command, `help` for a command that is not there, a failed reload and an unbalanced quote are failures - ssh exec exit-status is 1 for a command, flag or failure error, 0 otherwise; the e2e golden records the exit status for every case - Clone rebinds help to the copy, so an ssh session's help lists logout and `help logout` and `logout -h` answer; sshd.LogoutCommand is the session's logout, exported for tests - "did not understand" names the first word only, the one looked up; DispatchArgs takes just the tokens - log-format writes its refusal to the user, as log-level does - print-relays emits the relay error as a string and omits the key when there is none, where it printed {} or "Error":null - list-hostmap and list-lighthouse-addrmap -json return the encode error; print-cert reports a certificate that will not marshal - a flags type that is not the one registered is an internal error, not a silent success - command functions and flag types are <name>Command and <name>Flags; parseVpnAddr and listHostMapFlagSet replace the repeated parse block and flag set; close-tunnel sends through sendCloseTunnel Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-19 10:48:26 -04:00