personal_interest_mirrors/nebula
1
0 Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-11-15 11:46:52 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
Files
2f1931dc36e71c02f8e0146242c5daf17deec0d7
nebula/e2e/testdata/commands_output.golden
T
Matt RichardsonandClaude Fable 5.1 613c7e3061 Add the identity command and serve it on an opt-in HTTP info API 
Build slackhq/nebula#1821 ("who is this vpn address?" over a local
HTTP+JSON socket) on the command registry, so the lookup is one command
on every surface and the socket is one more local API.

identity
- `identity [-address <vpn addr>[:port]]`: no address reports this node;
  with one, this node or the peer behind an established tunnel
- Certificate fields only: name, vpn addresses, networks, unsafe
  networks, groups, fingerprint, issuer, validity, cert version; a peer's
  fingerprint is the one nebula computed when it verified the cert
- Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes
  straight through
- No tunnel is a commands.NotFound; an empty -address is refused
- Lighthouse TXT lookup shares the owner and peer lookups, keeps answering
  with the initiating certificate, and no longer panics without a default cert
- Served on ssh and nebula ctl too

Info API
- Off until `local_api.info.enabled` with `socket` and optional quoted
  octal `socket_mode` (default "0600"); nothing derived
- Serves commands declaring Command.Identity plus help; others 403 naming
  their surfaces. TestInfoAPISurface pins the set to identity
- GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is
  the -json rendering via commands.Render; commands.PresentationFormat
  reads json/pretty from the query the way a line is read
- 400 commands.ParamError, 403 commands.WithheldError (what Resolve now
  returns for a withheld name, so help and dispatch type-check it too),
  404 NotFound or unknown, 500 Run error, refusal with no reason, or
  recovered panic with no detail; no redirects; every miss is JSON
- listen takes a mode: bind under umask 0077 then chmod; "0660" plus a
  searchable dir opens it to a group
- The chmod, at bind and on a mode-only reload, goes through chmodSocket,
  which never follows a link: a user who can write the socket's directory
  could otherwise swap the node for a link and have a root daemon put
  0660 or 0666 on any file. Only a socket we own is chmoded. On linux the
  node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded
  through /proc/self/fd, so the check and the chmod land on one inode;
  fchmodat2 is the fallback without /proc. On darwin and the BSDs it is
  an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats
  too, so a dangling link is refused rather than followed by bind on
  darwin
- One endpoint type owns bind under mutex, bind-before-release move,
  context watch and stop/unlink; each server supplies what it serves
- Reloadable through the same reconcile shape as the control socket:
  mode applied in place, unparsable section keeps what runs, control
  socket path refused by name
- Wire returns Endpoints{Control, Info} with one Stop
- Windows unsupported for now (a pipe has no mode); warned once

Tests: identity lookups and shapes; API filter, status codes, panic
recovery, socket mode, rebind, cancellation; config parsing incl. bare
0660; Wire transitions; e2e of two nebulas with the info API resolving
the peer by address and port, through shared test.HTTPDo/HTTPGet helpers.
Goldens gain identity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-21 12:26:09 -04:00

1350 lines
41 KiB
Plaintext
Raw Blame History

$ version
e2e-test
$ version -json
{"version":"e2e-test"}
$ version -pretty
{
"version": "e2e-test"
}
$ device-info
name= cidr=[10.222.0.1/24]
$ device-info -json
{"name":"","cidr":["10.222.0.1/24"]}
$ device-info -pretty
{
"name": "",
"cidr": [
"10.222.0.1/24"
]
}
$ list-hostmap
$ list-hostmap -json
[]
$ list-hostmap -pretty
[]
$ list-hostmap -by-index
$ list-hostmap -json -by-index
[]
$ list-hostmap -pretty -by-index
[]
$ list-pending-hostmap
[10.222.0.9]: []
$ list-pending-hostmap -json
[{"vpnAddrs":["10.222.0.9"],"localIndex":<n>,"remoteIndex":<n>,"remoteAddrs":[],"cert":null,"messageCounter":<n>,"currentRemote":"","currentRelaysToMe":[],"currentRelaysThroughMe":[]}]
$ list-pending-hostmap -pretty
[
{
"vpnAddrs": [
"10.222.0.9"
],
"localIndex": <n>,
"remoteIndex": <n>,
"remoteAddrs": [],
"cert": null,
"messageCounter": <n>,
"currentRemote": "",
"currentRelaysToMe": [],
"currentRelaysThroughMe": []
}
]
$ list-pending-hostmap -by-index
$ list-pending-hostmap -json -by-index
[]
$ list-pending-hostmap -pretty -by-index
[]
$ list-lighthouse-addrmap
10.222.0.9: {}
$ list-lighthouse-addrmap -json
[{"vpnAddr":"10.222.0.9","addrs":{}}]
$ list-lighthouse-addrmap -pretty
[
{
"vpnAddr": "10.222.0.9",
"addrs": {}
}
]
$ print-cert
{
"details": {
"curve": "CURVE25519",
"groups": [],
"isCa": false,
"issuer": "<hex>",
"name": "output-golden",
"networks": [
"10.222.0.1/24"
],
"notAfter": "<time>",
"notBefore": "<time>",
"publicKey": "<hex>",
"unsafeNetworks": []
},
"fingerprint": "<hex>",
"signature": "<hex>",
"version": 1
}
$ print-cert -json
{"details":{"curve":"CURVE25519","groups":[],"isCa":false,"issuer":"<hex>","name":"output-golden","networks":["10.222.0.1/24"],"notAfter":"<time>","notBefore":"<time>","publicKey":"<hex>","unsafeNetworks":[]},"fingerprint":"<hex>","signature":"<hex>","version":1}
$ print-cert -pretty
{
"details": {
"curve": "CURVE25519",
"groups": [],
"isCa": false,
"issuer": "<hex>",
"name": "output-golden",
"networks": [
"10.222.0.1/24"
],
"notAfter": "<time>",
"notBefore": "<time>",
"publicKey": "<hex>",
"unsafeNetworks": []
},
"fingerprint": "<hex>",
"signature": "<hex>",
"version": 1
}
$ print-cert -raw
-----BEGIN NEBULA CERTIFICATE-----
<pem>
-----END NEBULA CERTIFICATE-----
$ print-cert -json -raw
{"pem":"-----BEGIN NEBULA CERTIFICATE-----\n<pem>\n-----END NEBULA CERTIFICATE-----\n"}
$ print-cert -pretty -raw
{
"pem": "-----BEGIN NEBULA CERTIFICATE-----\n<pem>\n-----END NEBULA CERTIFICATE-----\n"
}
$ print-cert 10.222.0.9
Could not find tunnel for vpn addr: 10.222.0.9
exit status 1
$ print-cert -json 10.222.0.9
{"ok":false,"reason":"Could not find tunnel for vpn addr: 10.222.0.9"}
exit status 1
$ print-cert -pretty 10.222.0.9
{
"ok": false,
"reason": "Could not find tunnel for vpn addr: 10.222.0.9"
}
exit status 1
$ print-cert 10.222.0.9 -json
{"ok":false,"reason":"Could not find tunnel for vpn addr: 10.222.0.9"}
exit status 1
$ print-cert -json 10.222.0.9 -json
{"ok":false,"reason":"Could not find tunnel for vpn addr: 10.222.0.9"}
exit status 1
$ print-cert -pretty 10.222.0.9 -json
{
"ok": false,
"reason": "Could not find tunnel for vpn addr: 10.222.0.9"
}
exit status 1
$ print-cert 10.222.0.250
Could not find tunnel for vpn addr: 10.222.0.250
exit status 1
$ print-cert -json 10.222.0.250
{"ok":false,"reason":"Could not find tunnel for vpn addr: 10.222.0.250"}
exit status 1
$ print-cert -pretty 10.222.0.250
{
"ok": false,
"reason": "Could not find tunnel for vpn addr: 10.222.0.250"
}
exit status 1
$ print-cert not-an-address
The provided vpn addr could not be parsed: not-an-address
exit status 1
$ print-cert -json not-an-address
{"ok":false,"reason":"The provided vpn addr could not be parsed: not-an-address"}
exit status 1
$ print-cert -pretty not-an-address
{
"ok": false,
"reason": "The provided vpn addr could not be parsed: not-an-address"
}
exit status 1
$ whoami
name: output-golden
vpn addrs: 10.222.0.1
networks: 10.222.0.1/24
unsafe networks:
groups:
fingerprint: <hex>
issuer: <hex>
not before: <time>
not after: <time>
cert version: 1
$ whoami -json
{"name":"output-golden","vpnAddrs":["10.222.0.1"],"networks":["10.222.0.1/24"],"unsafeNetworks":[],"groups":[],"fingerprint":"<hex>","issuer":"<hex>","notBefore":"<time>","notAfter":"<time>","certVersion":1}
$ whoami -pretty
{
"name": "output-golden",
"vpnAddrs": [
"10.222.0.1"
],
"networks": [
"10.222.0.1/24"
],
"unsafeNetworks": [],
"groups": [],
"fingerprint": "<hex>",
"issuer": "<hex>",
"notBefore": "<time>",
"notAfter": "<time>",
"certVersion": 1
}
$ whoami x
whoami takes no arguments
exit status 1
$ whoami -json x
{"ok":false,"reason":"whoami takes no arguments"}
exit status 1
$ whoami -pretty x
{
"ok": false,
"reason": "whoami takes no arguments"
}
exit status 1
$ identity
No vpn addr was provided, use -address <vpn addr>[:port]; whoami prints this node's own identity
exit status 1
$ identity -json
{"ok":false,"reason":"No vpn addr was provided, use -address \u003cvpn addr\u003e[:port]; whoami prints this node's own identity"}
exit status 1
$ identity -pretty
{
"ok": false,
"reason": "No vpn addr was provided, use -address \u003cvpn addr\u003e[:port]; whoami prints this node's own identity"
}
exit status 1
$ identity -address 10.222.0.1
name: output-golden
vpn addrs: 10.222.0.1
networks: 10.222.0.1/24
unsafe networks:
groups:
fingerprint: <hex>
issuer: <hex>
not before: <time>
not after: <time>
cert version: 1
$ identity -json -address 10.222.0.1
{"name":"output-golden","vpnAddrs":["10.222.0.1"],"networks":["10.222.0.1/24"],"unsafeNetworks":[],"groups":[],"fingerprint":"<hex>","issuer":"<hex>","notBefore":"<time>","notAfter":"<time>","certVersion":1}
$ identity -pretty -address 10.222.0.1
{
"name": "output-golden",
"vpnAddrs": [
"10.222.0.1"
],
"networks": [
"10.222.0.1/24"
],
"unsafeNetworks": [],
"groups": [],
"fingerprint": "<hex>",
"issuer": "<hex>",
"notBefore": "<time>",
"notAfter": "<time>",
"certVersion": 1
}
$ identity -address 10.222.0.1:4242
name: output-golden
vpn addrs: 10.222.0.1
networks: 10.222.0.1/24
unsafe networks:
groups:
fingerprint: <hex>
issuer: <hex>
not before: <time>
not after: <time>
cert version: 1
$ identity -json -address 10.222.0.1:4242
{"name":"output-golden","vpnAddrs":["10.222.0.1"],"networks":["10.222.0.1/24"],"unsafeNetworks":[],"groups":[],"fingerprint":"<hex>","issuer":"<hex>","notBefore":"<time>","notAfter":"<time>","certVersion":1}
$ identity -pretty -address 10.222.0.1:4242
{
"name": "output-golden",
"vpnAddrs": [
"10.222.0.1"
],
"networks": [
"10.222.0.1/24"
],
"unsafeNetworks": [],
"groups": [],
"fingerprint": "<hex>",
"issuer": "<hex>",
"notBefore": "<time>",
"notAfter": "<time>",
"certVersion": 1
}
$ identity -address 10.222.0.9
No active tunnel for vpn addr: 10.222.0.9
exit status 1
$ identity -json -address 10.222.0.9
{"ok":false,"reason":"No active tunnel for vpn addr: 10.222.0.9"}
exit status 1
$ identity -pretty -address 10.222.0.9
{
"ok": false,
"reason": "No active tunnel for vpn addr: 10.222.0.9"
}
exit status 1
$ identity -address not-an-address
The provided vpn addr could not be parsed: not-an-address
exit status 1
$ identity -json -address not-an-address
{"ok":false,"reason":"The provided vpn addr could not be parsed: not-an-address"}
exit status 1
$ identity -pretty -address not-an-address
{
"ok": false,
"reason": "The provided vpn addr could not be parsed: not-an-address"
}
exit status 1
$ identity -address
The provided vpn addr could not be parsed:
exit status 1
$ identity -json -address
{"ok":false,"reason":"The provided vpn addr could not be parsed: "}
exit status 1
$ identity -pretty -address
{
"ok": false,
"reason": "The provided vpn addr could not be parsed: "
}
exit status 1
$ identity 10.222.0.9
identity takes the vpn addr as -address, not as an operand: identity -address 10.222.0.9
exit status 1
$ identity -json 10.222.0.9
{"ok":false,"reason":"identity takes the vpn addr as -address, not as an operand: identity -address 10.222.0.9"}
exit status 1
$ identity -pretty 10.222.0.9
{
"ok": false,
"reason": "identity takes the vpn addr as -address, not as an operand: identity -address 10.222.0.9"
}
exit status 1
$ print-tunnel
No vpn address was provided
exit status 1
$ print-tunnel -json
{"ok":false,"reason":"No vpn address was provided"}
exit status 1
$ print-tunnel -pretty
{
"ok": false,
"reason": "No vpn address was provided"
}
exit status 1
$ print-tunnel 10.222.0.9
Could not find tunnel for vpn addr: 10.222.0.9
exit status 1
$ print-tunnel -json 10.222.0.9
{"ok":false,"reason":"Could not find tunnel for vpn addr: 10.222.0.9"}
exit status 1
$ print-tunnel -pretty 10.222.0.9
{
"ok": false,
"reason": "Could not find tunnel for vpn addr: 10.222.0.9"
}
exit status 1
$ print-tunnel 10.222.0.250
Could not find tunnel for vpn addr: 10.222.0.250
exit status 1
$ print-tunnel -json 10.222.0.250
{"ok":false,"reason":"Could not find tunnel for vpn addr: 10.222.0.250"}
exit status 1
$ print-tunnel -pretty 10.222.0.250
{
"ok": false,
"reason": "Could not find tunnel for vpn addr: 10.222.0.250"
}
exit status 1
$ print-relays
{"Relays":null}
$ print-relays -json
{"Relays":null}
$ print-relays -pretty
{
"Relays": null
}
$ query-lighthouse
No vpn address was provided
exit status 1
$ query-lighthouse -json
{"ok":false,"reason":"No vpn address was provided"}
exit status 1
$ query-lighthouse -pretty
{
"ok": false,
"reason": "No vpn address was provided"
}
exit status 1
$ query-lighthouse 10.222.0.9
{}
$ query-lighthouse -json 10.222.0.9
{}
$ query-lighthouse -pretty 10.222.0.9
{}
$ query-lighthouse not-an-address
The provided vpn address could not be parsed: not-an-address
exit status 1
$ query-lighthouse -json not-an-address
{"ok":false,"reason":"The provided vpn address could not be parsed: not-an-address"}
exit status 1
$ query-lighthouse -pretty not-an-address
{
"ok": false,
"reason": "The provided vpn address could not be parsed: not-an-address"
}
exit status 1
$ log-level
Log level is not reconfigurable on this logger
exit status 1
$ log-level -json
{"ok":false,"reason":"Log level is not reconfigurable on this logger"}
exit status 1
$ log-level -pretty
{
"ok": false,
"reason": "Log level is not reconfigurable on this logger"
}
exit status 1
$ log-level debug
Log level is not reconfigurable on this logger
exit status 1
$ log-level -json debug
{"ok":false,"reason":"Log level is not reconfigurable on this logger"}
exit status 1
$ log-level -pretty debug
{
"ok": false,
"reason": "Log level is not reconfigurable on this logger"
}
exit status 1
$ log-level bogus
Log level is not reconfigurable on this logger
exit status 1
$ log-level -json bogus
{"ok":false,"reason":"Log level is not reconfigurable on this logger"}
exit status 1
$ log-level -pretty bogus
{
"ok": false,
"reason": "Log level is not reconfigurable on this logger"
}
exit status 1
$ log-level info
Log level is not reconfigurable on this logger
exit status 1
$ log-level -json info
{"ok":false,"reason":"Log level is not reconfigurable on this logger"}
exit status 1
$ log-level -pretty info
{
"ok": false,
"reason": "Log level is not reconfigurable on this logger"
}
exit status 1
$ log-format
Log format is not reconfigurable on this logger
exit status 1
$ log-format -json
{"ok":false,"reason":"Log format is not reconfigurable on this logger"}
exit status 1
$ log-format -pretty
{
"ok": false,
"reason": "Log format is not reconfigurable on this logger"
}
exit status 1
$ log-format json
Log format is not reconfigurable on this logger
exit status 1
$ log-format -json json
{"ok":false,"reason":"Log format is not reconfigurable on this logger"}
exit status 1
$ log-format -pretty json
{
"ok": false,
"reason": "Log format is not reconfigurable on this logger"
}
exit status 1
$ log-format text
Log format is not reconfigurable on this logger
exit status 1
$ log-format -json text
{"ok":false,"reason":"Log format is not reconfigurable on this logger"}
exit status 1
$ log-format -pretty text
{
"ok": false,
"reason": "Log format is not reconfigurable on this logger"
}
exit status 1
$ change-remote
No vpn address was provided
exit status 1
$ change-remote -json
{"ok":false,"reason":"No vpn address was provided"}
exit status 1
$ change-remote -pretty
{
"ok": false,
"reason": "No vpn address was provided"
}
exit status 1
$ change-remote 10.222.0.9
No address was provided
exit status 1
$ change-remote -json 10.222.0.9
{"ok":false,"reason":"No address was provided"}
exit status 1
$ change-remote -pretty 10.222.0.9
{
"ok": false,
"reason": "No address was provided"
}
exit status 1
$ change-remote -address 10.94.0.10:4242 10.222.0.9
Could not find tunnel for vpn address: 10.222.0.9
exit status 1
$ change-remote -json -address 10.94.0.10:4242 10.222.0.9
{"ok":false,"reason":"Could not find tunnel for vpn address: 10.222.0.9"}
exit status 1
$ change-remote -pretty -address 10.94.0.10:4242 10.222.0.9
{
"ok": false,
"reason": "Could not find tunnel for vpn address: 10.222.0.9"
}
exit status 1
$ change-remote -address 10.94.0.10:4242 10.222.0.250
Could not find tunnel for vpn address: 10.222.0.250
exit status 1
$ change-remote -json -address 10.94.0.10:4242 10.222.0.250
{"ok":false,"reason":"Could not find tunnel for vpn address: 10.222.0.250"}
exit status 1
$ change-remote -pretty -address 10.94.0.10:4242 10.222.0.250
{
"ok": false,
"reason": "Could not find tunnel for vpn address: 10.222.0.250"
}
exit status 1
$ create-tunnel
No vpn address was provided
exit status 1
$ create-tunnel -json
{"ok":false,"reason":"No vpn address was provided"}
exit status 1
$ create-tunnel -pretty
{
"ok": false,
"reason": "No vpn address was provided"
}
exit status 1
$ create-tunnel 10.222.0.9
Tunnel already handshaking
exit status 1
$ create-tunnel -json 10.222.0.9
{"ok":false,"reason":"Tunnel already handshaking"}
exit status 1
$ create-tunnel -pretty 10.222.0.9
{
"ok": false,
"reason": "Tunnel already handshaking"
}
exit status 1
$ create-tunnel -address 10.94.0.10:4242 10.222.0.10
Created
$ create-tunnel -json -address 10.94.0.10:4242 10.222.0.10
{"ok":false,"reason":"Tunnel already handshaking"}
exit status 1
$ create-tunnel -pretty -address 10.94.0.10:4242 10.222.0.10
{
"ok": false,
"reason": "Tunnel already handshaking"
}
exit status 1
$ create-tunnel not-an-address
The provided vpn address could not be parsed: not-an-address
exit status 1
$ create-tunnel -json not-an-address
{"ok":false,"reason":"The provided vpn address could not be parsed: not-an-address"}
exit status 1
$ create-tunnel -pretty not-an-address
{
"ok": false,
"reason": "The provided vpn address could not be parsed: not-an-address"
}
exit status 1
$ close-tunnel
No vpn address was provided
exit status 1
$ close-tunnel -json
{"ok":false,"reason":"No vpn address was provided"}
exit status 1
$ close-tunnel -pretty
{
"ok": false,
"reason": "No vpn address was provided"
}
exit status 1
$ close-tunnel 10.222.0.250
Could not find tunnel for vpn address: 10.222.0.250
exit status 1
$ close-tunnel -json 10.222.0.250
{"ok":false,"reason":"Could not find tunnel for vpn address: 10.222.0.250"}
exit status 1
$ close-tunnel -pretty 10.222.0.250
{
"ok": false,
"reason": "Could not find tunnel for vpn address: 10.222.0.250"
}
exit status 1
$ close-tunnel not-an-address
The provided vpn address could not be parsed: not-an-address
exit status 1
$ close-tunnel -json not-an-address
{"ok":false,"reason":"The provided vpn address could not be parsed: not-an-address"}
exit status 1
$ close-tunnel -pretty not-an-address
{
"ok": false,
"reason": "The provided vpn address could not be parsed: not-an-address"
}
exit status 1
$ help
Available commands:
change-remote - Changes the remote address used in the tunnel for the provided vpn addr
close-tunnel - Closes a tunnel for the provided vpn addr
create-tunnel - Creates a tunnel for the provided vpn address
device-info - Prints information about the network device.
help - prints available commands or help <command> for specific usage info
identity - Prints the certificate identity of the host owning the provided vpn addr
list-hostmap - List all known previously connected hosts
list-lighthouse-addrmap - List all lighthouse map entries
list-pending-hostmap - List all handshaking hosts
log-format - Gets or sets the current log format
log-level - Gets or sets the current log level
logout - Ends the current session
print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
print-relays - Prints json details about all relay info
print-tunnel - Prints json details about a tunnel for the provided vpn addr
query-lighthouse - Query the lighthouses for the provided vpn address
reload - Reloads configuration from disk, same as sending HUP to the process
version - Prints the currently running version of nebula
whoami - Prints the certificate identity of this node
$ help -json
[{"name":"change-remote","short":"Changes the remote address used in the tunnel for the provided vpn addr","flags":[{"name":"address","usage":"The new remote address, ip:port"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"close-tunnel","short":"Closes a tunnel for the provided vpn addr","flags":[{"name":"local-only","bool":true,"default":"false","usage":"Disables notifying the remote that the tunnel is shutting down"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"create-tunnel","short":"Creates a tunnel for the provided vpn address","help":"The lighthouses will be queried for real addresses but you can provide one as well.","flags":[{"name":"address","usage":"Optionally provide a real remote address, ip:port "},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"device-info","short":"Prints information about the network device.","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"help","short":"prints available commands or help \u003ccommand\u003e for specific usage info","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"identity","short":"Prints the certificate identity of the host owning the provided vpn addr","help":"Identity is what the certificate says: name, vpn addrs, networks, groups, fingerprint, issuer and validity. The address may carry a port, so a connection's remote address can be passed through as is. For this node's own identity use whoami.","flags":[{"name":"address","usage":"The vpn addr to look up, optionally with a port"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-hostmap","short":"List all known previously connected hosts","flags":[{"name":"by-index","bool":true,"default":"false","usage":"gets all hosts in the hostmap from the index table"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-lighthouse-addrmap","short":"List all lighthouse map entries","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"list-pending-hostmap","short":"List all handshaking hosts","flags":[{"name":"by-index","bool":true,"default":"false","usage":"gets all hosts in the hostmap from the index table"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"log-format","short":"Gets or sets the current log format","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"log-level","short":"Gets or sets the current log level","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"logout","short":"Ends the current session","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-cert","short":"Prints the current certificate being used or the certificate for the provided vpn addr","flags":[{"name":"raw","bool":true,"default":"false","usage":"prints the PEM encoded certificate; with -json, an object holding it"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-relays","short":"Prints json details about all relay info","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"print-tunnel","short":"Prints json details about a tunnel for the provided vpn addr","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"query-lighthouse","short":"Query the lighthouses for the provided vpn address","help":"This command is asynchronous. Only currently known udp addresses will be printed.","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"reload","short":"Reloads configuration from disk, same as sending HUP to the process","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"version","short":"Prints the currently running version of nebula","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]},{"name":"whoami","short":"Prints the certificate identity of this node","help":"The fields identity prints, read from this node's own certificate.","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]}]
$ help -pretty
[
{
"name": "change-remote",
"short": "Changes the remote address used in the tunnel for the provided vpn addr",
"flags": [
{
"name": "address",
"usage": "The new remote address, ip:port"
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "close-tunnel",
"short": "Closes a tunnel for the provided vpn addr",
"flags": [
{
"name": "local-only",
"bool": true,
"default": "false",
"usage": "Disables notifying the remote that the tunnel is shutting down"
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "create-tunnel",
"short": "Creates a tunnel for the provided vpn address",
"help": "The lighthouses will be queried for real addresses but you can provide one as well.",
"flags": [
{
"name": "address",
"usage": "Optionally provide a real remote address, ip:port "
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "device-info",
"short": "Prints information about the network device.",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "help",
"short": "prints available commands or help \u003ccommand\u003e for specific usage info",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "identity",
"short": "Prints the certificate identity of the host owning the provided vpn addr",
"help": "Identity is what the certificate says: name, vpn addrs, networks, groups, fingerprint, issuer and validity. The address may carry a port, so a connection's remote address can be passed through as is. For this node's own identity use whoami.",
"flags": [
{
"name": "address",
"usage": "The vpn addr to look up, optionally with a port"
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "list-hostmap",
"short": "List all known previously connected hosts",
"flags": [
{
"name": "by-index",
"bool": true,
"default": "false",
"usage": "gets all hosts in the hostmap from the index table"
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "list-lighthouse-addrmap",
"short": "List all lighthouse map entries",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "list-pending-hostmap",
"short": "List all handshaking hosts",
"flags": [
{
"name": "by-index",
"bool": true,
"default": "false",
"usage": "gets all hosts in the hostmap from the index table"
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "log-format",
"short": "Gets or sets the current log format",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "log-level",
"short": "Gets or sets the current log level",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "logout",
"short": "Ends the current session",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "print-cert",
"short": "Prints the current certificate being used or the certificate for the provided vpn addr",
"flags": [
{
"name": "raw",
"bool": true,
"default": "false",
"usage": "prints the PEM encoded certificate; with -json, an object holding it"
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "print-relays",
"short": "Prints json details about all relay info",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "print-tunnel",
"short": "Prints json details about a tunnel for the provided vpn addr",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "query-lighthouse",
"short": "Query the lighthouses for the provided vpn address",
"help": "This command is asynchronous. Only currently known udp addresses will be printed.",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "reload",
"short": "Reloads configuration from disk, same as sending HUP to the process",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "version",
"short": "Prints the currently running version of nebula",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
},
{
"name": "whoami",
"short": "Prints the certificate identity of this node",
"help": "The fields identity prints, read from this node's own certificate.",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
}
]
$ help print-cert
print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
-raw
prints the PEM encoded certificate; with -json, an object holding it
-json
outputs as json
-pretty
pretty prints json, assumes -json
$ help -json print-cert
{"name":"print-cert","short":"Prints the current certificate being used or the certificate for the provided vpn addr","flags":[{"name":"raw","bool":true,"default":"false","usage":"prints the PEM encoded certificate; with -json, an object holding it"},{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]}
$ help -pretty print-cert
{
"name": "print-cert",
"short": "Prints the current certificate being used or the certificate for the provided vpn addr",
"flags": [
{
"name": "raw",
"bool": true,
"default": "false",
"usage": "prints the PEM encoded certificate; with -json, an object holding it"
},
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
}
$ help logout
logout - Ends the current session
-json
outputs as json
-pretty
pretty prints json, assumes -json
$ help -json logout
{"name":"logout","short":"Ends the current session","flags":[{"name":"json","bool":true,"default":"false","usage":"outputs as json"},{"name":"pretty","bool":true,"default":"false","usage":"pretty prints json, assumes -json"}]}
$ help -pretty logout
{
"name": "logout",
"short": "Ends the current session",
"flags": [
{
"name": "json",
"bool": true,
"default": "false",
"usage": "outputs as json"
},
{
"name": "pretty",
"bool": true,
"default": "false",
"usage": "pretty prints json, assumes -json"
}
]
}
$ logout -h
logout - Ends the current session
-json
outputs as json
-pretty
pretty prints json, assumes -json
$ logout -json -h
logout - Ends the current session
-json
outputs as json
-pretty
pretty prints json, assumes -json
$ logout -pretty -h
logout - Ends the current session
-json
outputs as json
-pretty
pretty prints json, assumes -json
$ not-a-command 10.222.0.9
did not understand: not-a-command
Available commands:
change-remote - Changes the remote address used in the tunnel for the provided vpn addr
close-tunnel - Closes a tunnel for the provided vpn addr
create-tunnel - Creates a tunnel for the provided vpn address
device-info - Prints information about the network device.
help - prints available commands or help <command> for specific usage info
identity - Prints the certificate identity of the host owning the provided vpn addr
list-hostmap - List all known previously connected hosts
list-lighthouse-addrmap - List all lighthouse map entries
list-pending-hostmap - List all handshaking hosts
log-format - Gets or sets the current log format
log-level - Gets or sets the current log level
logout - Ends the current session
print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
print-relays - Prints json details about all relay info
print-tunnel - Prints json details about a tunnel for the provided vpn addr
query-lighthouse - Query the lighthouses for the provided vpn address
reload - Reloads configuration from disk, same as sending HUP to the process
version - Prints the currently running version of nebula
whoami - Prints the certificate identity of this node
exit status 1
$ not-a-command -json 10.222.0.9
did not understand: not-a-command
Available commands:
change-remote - Changes the remote address used in the tunnel for the provided vpn addr
close-tunnel - Closes a tunnel for the provided vpn addr
create-tunnel - Creates a tunnel for the provided vpn address
device-info - Prints information about the network device.
help - prints available commands or help <command> for specific usage info
identity - Prints the certificate identity of the host owning the provided vpn addr
list-hostmap - List all known previously connected hosts
list-lighthouse-addrmap - List all lighthouse map entries
list-pending-hostmap - List all handshaking hosts
log-format - Gets or sets the current log format
log-level - Gets or sets the current log level
logout - Ends the current session
print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
print-relays - Prints json details about all relay info
print-tunnel - Prints json details about a tunnel for the provided vpn addr
query-lighthouse - Query the lighthouses for the provided vpn address
reload - Reloads configuration from disk, same as sending HUP to the process
version - Prints the currently running version of nebula
whoami - Prints the certificate identity of this node
exit status 1
$ not-a-command -pretty 10.222.0.9
did not understand: not-a-command
Available commands:
change-remote - Changes the remote address used in the tunnel for the provided vpn addr
close-tunnel - Closes a tunnel for the provided vpn addr
create-tunnel - Creates a tunnel for the provided vpn address
device-info - Prints information about the network device.
help - prints available commands or help <command> for specific usage info
identity - Prints the certificate identity of the host owning the provided vpn addr
list-hostmap - List all known previously connected hosts
list-lighthouse-addrmap - List all lighthouse map entries
list-pending-hostmap - List all handshaking hosts
log-format - Gets or sets the current log format
log-level - Gets or sets the current log level
logout - Ends the current session
print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
print-relays - Prints json details about all relay info
print-tunnel - Prints json details about a tunnel for the provided vpn addr
query-lighthouse - Query the lighthouses for the provided vpn address
reload - Reloads configuration from disk, same as sending HUP to the process
version - Prints the currently running version of nebula
whoami - Prints the certificate identity of this node
exit status 1
$ reload
Reloading config
Config reload failed, the new config did not load: no config files found at
exit status 1
$ reload -json
{"ok":false,"reason":"Config reload failed, the new config did not load: no config files found at "}
exit status 1
$ reload -pretty
{
"ok": false,
"reason": "Config reload failed, the new config did not load: no config files found at "
}
exit status 1
Reference in new issue View Git Blame Copy Permalink