mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 17:26:52 +01:00
Matt RichardsonandClaude Fable 5.1
660a271466
A program that verifies certificates against its own CAs, as
nebula-auth-request does, needs the certificate itself rather than the
parsed identity, and it asked the ssh debug server for it. The info API
now serves print-cert, so it can ask there instead.
- print-cert declares Identity: it reads a certificate from the hostmap or our own, and nothing operational
- -address names the vpn addr, with a port accepted and stripped and 4in6 unmapped, as identity takes it; the operand stays, and giving both is refused
- an address of our own answers with our own certificate, and a tunnel without one is not found, a 404 on the API
- with no address the certificate is the one whoami reports, the v2 when both versions are loaded, not the one handshakes start with
- GET /v1/print-cert?address=<addr>&raw=true answers {"pem": ...}; example config, CHANGELOG, surface test, goldens and an e2e check
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
161 lines
4.3 KiB
Plaintext
161 lines
4.3 KiB
Plaintext
change-remote
|
|
short: Changes the remote address used in the tunnel for the provided vpn addr
|
|
help:
|
|
flags:
|
|
-address string
|
|
The new remote address, ip:port
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
close-tunnel
|
|
short: Closes a tunnel for the provided vpn addr
|
|
help:
|
|
flags:
|
|
-local-only
|
|
Disables notifying the remote that the tunnel is shutting down
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
create-tunnel
|
|
short: Creates a tunnel for the provided vpn address
|
|
help: The lighthouses will be queried for real addresses but you can provide one as well.
|
|
flags:
|
|
-address string
|
|
Optionally provide a real remote address, ip:port
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
device-info
|
|
short: Prints information about the network device.
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
help
|
|
short: prints available commands or help <command> for specific usage info
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
identity
|
|
short: Prints the certificate identity of the host owning the provided vpn addr
|
|
help: Identity is what the certificate says: name, vpn addrs, networks, groups, fingerprint, issuer and validity. The address may carry a port, so a connection's remote address can be passed through as is. For this node's own identity use whoami.
|
|
flags:
|
|
-address string
|
|
The vpn addr to look up, optionally with a port
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
list-hostmap
|
|
short: List all known previously connected hosts
|
|
help:
|
|
flags:
|
|
-by-index
|
|
gets all hosts in the hostmap from the index table
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
list-lighthouse-addrmap
|
|
short: List all lighthouse map entries
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
list-pending-hostmap
|
|
short: List all handshaking hosts
|
|
help:
|
|
flags:
|
|
-by-index
|
|
gets all hosts in the hostmap from the index table
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
log-format
|
|
short: Gets or sets the current log format
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
log-level
|
|
short: Gets or sets the current log level
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
print-cert
|
|
short: Prints the current certificate being used or the certificate for the provided vpn addr
|
|
help: The vpn addr is an operand or -address, which may carry a port so a connection's remote address can be passed through as is. For a peer it is the certificate nebula verified when the tunnel came up; with no address it is this node's own, the v2 certificate when both versions are loaded. -raw prints the PEM.
|
|
flags:
|
|
-address string
|
|
The vpn addr to look up, optionally with a port
|
|
-raw
|
|
prints the PEM encoded certificate; with -json, an object holding it
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
print-relays
|
|
short: Prints json details about all relay info
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
print-tunnel
|
|
short: Prints json details about a tunnel for the provided vpn addr
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
query-lighthouse
|
|
short: Query the lighthouses for the provided vpn address
|
|
help: This command is asynchronous. Only currently known udp addresses will be printed.
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
reload
|
|
short: Reloads configuration from disk, same as sending HUP to the process
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
version
|
|
short: Prints the currently running version of nebula
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
whoami
|
|
short: Prints the certificate identity of this node
|
|
help: The fields identity prints, read from this node's own certificate.
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|