mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 07:36:52 +01:00
Matt RichardsonandClaude Fable 5.1
613c7e3061
Build slackhq/nebula#1821 ("who is this vpn address?" over a local HTTP+JSON socket) on the command registry, so the lookup is one command on every surface and the socket is one more local API. identity - `identity [-address <vpn addr>[:port]]`: no address reports this node; with one, this node or the peer behind an established tunnel - Certificate fields only: name, vpn addresses, networks, unsafe networks, groups, fingerprint, issuer, validity, cert version; a peer's fingerprint is the one nebula computed when it verified the cert - Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes straight through - No tunnel is a commands.NotFound; an empty -address is refused - Lighthouse TXT lookup shares the owner and peer lookups, keeps answering with the initiating certificate, and no longer panics without a default cert - Served on ssh and nebula ctl too Info API - Off until `local_api.info.enabled` with `socket` and optional quoted octal `socket_mode` (default "0600"); nothing derived - Serves commands declaring Command.Identity plus help; others 403 naming their surfaces. TestInfoAPISurface pins the set to identity - GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is the -json rendering via commands.Render; commands.PresentationFormat reads json/pretty from the query the way a line is read - 400 commands.ParamError, 403 commands.WithheldError (what Resolve now returns for a withheld name, so help and dispatch type-check it too), 404 NotFound or unknown, 500 Run error, refusal with no reason, or recovered panic with no detail; no redirects; every miss is JSON - listen takes a mode: bind under umask 0077 then chmod; "0660" plus a searchable dir opens it to a group - The chmod, at bind and on a mode-only reload, goes through chmodSocket, which never follows a link: a user who can write the socket's directory could otherwise swap the node for a link and have a root daemon put 0660 or 0666 on any file. Only a socket we own is chmoded. On linux the node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded through /proc/self/fd, so the check and the chmod land on one inode; fchmodat2 is the fallback without /proc. On darwin and the BSDs it is an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats too, so a dangling link is refused rather than followed by bind on darwin - One endpoint type owns bind under mutex, bind-before-release move, context watch and stop/unlink; each server supplies what it serves - Reloadable through the same reconcile shape as the control socket: mode applied in place, unparsable section keeps what runs, control socket path refused by name - Wire returns Endpoints{Control, Info} with one Stop - Windows unsupported for now (a pipe has no mode); warned once Tests: identity lookups and shapes; API filter, status codes, panic recovery, socket mode, rebind, cancellation; config parsing incl. bare 0660; Wire transitions; e2e of two nebulas with the info API resolving the peer by address and port, through shared test.HTTPDo/HTTPGet helpers. Goldens gain identity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
83 lines
3.1 KiB
Go
83 lines
3.1 KiB
Go
package nebula
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"io"
|
|
"net/netip"
|
|
"testing"
|
|
|
|
"github.com/slackhq/nebula/commands"
|
|
"github.com/slackhq/nebula/logging"
|
|
"github.com/slackhq/nebula/test"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestLogFormatRefusalIsShown: a format the logger does not know is a refusal the user
|
|
// sees, rather than a bare error, which over ssh was silence.
|
|
func TestLogFormatRefusalIsShown(t *testing.T) {
|
|
l := logging.NewLogger(io.Discard)
|
|
|
|
res, err := runLogFormat(l, []string{"bogus"})
|
|
require.NoError(t, err)
|
|
assert.False(t, res.OK)
|
|
assert.Equal(t, "Unable to set log format: unknown log format `bogus`. possible formats: [text json]", res.Reason)
|
|
|
|
res, err = runLogFormat(l, []string{"JSON"})
|
|
require.NoError(t, err)
|
|
out := &bytes.Buffer{}
|
|
require.NoError(t, commands.Typed(textLogFormat)(res.Value, out))
|
|
assert.Equal(t, "Log format is: json\n", out.String())
|
|
}
|
|
|
|
// TestPrintRelaysReportsErrorsAsText: the Error field was an error value, which encodes
|
|
// as {} and lost the message. It is the message now, and absent when there is none.
|
|
func TestPrintRelaysReportsErrorsAsText(t *testing.T) {
|
|
l := test.NewLogger()
|
|
hm := newHostMap(l)
|
|
relay := netip.MustParseAddr("10.0.0.1")
|
|
peer := netip.MustParseAddr("10.0.0.2")
|
|
|
|
// A relay host that is in Relays but not in Hosts, so its hostinfo cannot be found.
|
|
hm.Relays[1] = &HostInfo{vpnAddrs: []netip.Addr{relay}}
|
|
ifce := &Interface{hostMap: hm}
|
|
|
|
marshal := func() string {
|
|
b, err := json.Marshal(runPrintRelays(ifce))
|
|
require.NoError(t, err)
|
|
return string(b)
|
|
}
|
|
assert.JSONEq(t, `{"Relays":[{"NebulaAddr":"10.0.0.1","RelayForAddrs":[{"Error":"could not find hostinfo","Type":"","State":"","PeerAddr":"","LocalIndex":0,"RemoteIndex":0,"RelayedThrough":null}]}]}`, marshal())
|
|
|
|
// The same relay host, found, relaying for a peer whose index matches: no Error key.
|
|
hi := hm.Relays[1]
|
|
r := &Relay{Type: ForwardingType, State: Established, PeerAddr: peer, LocalIndex: 1, RemoteIndex: 2}
|
|
hi.relayState = RelayState{
|
|
relayForByAddr: map[netip.Addr]*Relay{peer: r},
|
|
relayForByIdx: map[uint32]*Relay{r.LocalIndex: r},
|
|
}
|
|
hm.Hosts[relay] = hi
|
|
assert.JSONEq(t, `{"Relays":[{"NebulaAddr":"10.0.0.1","RelayForAddrs":[{"Type":"forwarding","State":"established","PeerAddr":"10.0.0.2","LocalIndex":1,"RemoteIndex":2,"RelayedThrough":null}]}]}`, marshal())
|
|
|
|
// And an index mismatch names it.
|
|
hm.Relays[7] = hi
|
|
delete(hm.Relays, 1)
|
|
assert.Contains(t, marshal(), `"Error":"hostmap LocalIndex '7' does not match RelayState LocalIndex"`)
|
|
}
|
|
|
|
// TestPrintCertOfATunnelWithoutACertificate: a tunnel still handshaking, or one being
|
|
// torn down, has no certificate, and print-cert refuses rather than panicking.
|
|
func TestPrintCertOfATunnelWithoutACertificate(t *testing.T) {
|
|
f, _ := identityFixture(t)
|
|
|
|
r, err := runPrintCert(f, &printCertFlags{}, []string{"10.0.0.3"})
|
|
require.NoError(t, err)
|
|
assert.False(t, r.OK)
|
|
assert.Equal(t, "Could not find tunnel for vpn addr: 10.0.0.3", r.Reason)
|
|
|
|
r, err = runPrintCert(f, &printCertFlags{}, []string{"10.0.0.2"})
|
|
require.NoError(t, err)
|
|
assert.True(t, r.OK, "a tunnel with a certificate is printed")
|
|
}
|