mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 06:36:52 +01:00
Matt RichardsonandClaude Fable 5.1
613c7e3061
Build slackhq/nebula#1821 ("who is this vpn address?" over a local HTTP+JSON socket) on the command registry, so the lookup is one command on every surface and the socket is one more local API. identity - `identity [-address <vpn addr>[:port]]`: no address reports this node; with one, this node or the peer behind an established tunnel - Certificate fields only: name, vpn addresses, networks, unsafe networks, groups, fingerprint, issuer, validity, cert version; a peer's fingerprint is the one nebula computed when it verified the cert - Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes straight through - No tunnel is a commands.NotFound; an empty -address is refused - Lighthouse TXT lookup shares the owner and peer lookups, keeps answering with the initiating certificate, and no longer panics without a default cert - Served on ssh and nebula ctl too Info API - Off until `local_api.info.enabled` with `socket` and optional quoted octal `socket_mode` (default "0600"); nothing derived - Serves commands declaring Command.Identity plus help; others 403 naming their surfaces. TestInfoAPISurface pins the set to identity - GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is the -json rendering via commands.Render; commands.PresentationFormat reads json/pretty from the query the way a line is read - 400 commands.ParamError, 403 commands.WithheldError (what Resolve now returns for a withheld name, so help and dispatch type-check it too), 404 NotFound or unknown, 500 Run error, refusal with no reason, or recovered panic with no detail; no redirects; every miss is JSON - listen takes a mode: bind under umask 0077 then chmod; "0660" plus a searchable dir opens it to a group - The chmod, at bind and on a mode-only reload, goes through chmodSocket, which never follows a link: a user who can write the socket's directory could otherwise swap the node for a link and have a root daemon put 0660 or 0666 on any file. Only a socket we own is chmoded. On linux the node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded through /proc/self/fd, so the check and the chmod land on one inode; fchmodat2 is the fallback without /proc. On darwin and the BSDs it is an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats too, so a dangling link is refused rather than followed by bind on darwin - One endpoint type owns bind under mutex, bind-before-release move, context watch and stop/unlink; each server supplies what it serves - Reloadable through the same reconcile shape as the control socket: mode applied in place, unparsable section keeps what runs, control socket path refused by name - Wire returns Endpoints{Control, Info} with one Stop - Windows unsupported for now (a pipe has no mode); warned once Tests: identity lookups and shapes; API filter, status codes, panic recovery, socket mode, rebind, cancellation; config parsing incl. bare 0660; Wire transitions; e2e of two nebulas with the info API resolving the peer by address and port, through shared test.HTTPDo/HTTPGet helpers. Goldens gain identity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
159 lines
3.9 KiB
Plaintext
159 lines
3.9 KiB
Plaintext
change-remote
|
|
short: Changes the remote address used in the tunnel for the provided vpn addr
|
|
help:
|
|
flags:
|
|
-address string
|
|
The new remote address, ip:port
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
close-tunnel
|
|
short: Closes a tunnel for the provided vpn addr
|
|
help:
|
|
flags:
|
|
-local-only
|
|
Disables notifying the remote that the tunnel is shutting down
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
create-tunnel
|
|
short: Creates a tunnel for the provided vpn address
|
|
help: The lighthouses will be queried for real addresses but you can provide one as well.
|
|
flags:
|
|
-address string
|
|
Optionally provide a real remote address, ip:port
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
device-info
|
|
short: Prints information about the network device.
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
help
|
|
short: prints available commands or help <command> for specific usage info
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
identity
|
|
short: Prints the certificate identity of the host owning the provided vpn addr
|
|
help: Identity is what the certificate says: name, vpn addrs, networks, groups, fingerprint, issuer and validity. The address may carry a port, so a connection's remote address can be passed through as is. For this node's own identity use whoami.
|
|
flags:
|
|
-address string
|
|
The vpn addr to look up, optionally with a port
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
list-hostmap
|
|
short: List all known previously connected hosts
|
|
help:
|
|
flags:
|
|
-by-index
|
|
gets all hosts in the hostmap from the index table
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
list-lighthouse-addrmap
|
|
short: List all lighthouse map entries
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
list-pending-hostmap
|
|
short: List all handshaking hosts
|
|
help:
|
|
flags:
|
|
-by-index
|
|
gets all hosts in the hostmap from the index table
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
log-format
|
|
short: Gets or sets the current log format
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
log-level
|
|
short: Gets or sets the current log level
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
print-cert
|
|
short: Prints the current certificate being used or the certificate for the provided vpn addr
|
|
help:
|
|
flags:
|
|
-raw
|
|
prints the PEM encoded certificate; with -json, an object holding it
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
print-relays
|
|
short: Prints json details about all relay info
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
print-tunnel
|
|
short: Prints json details about a tunnel for the provided vpn addr
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
query-lighthouse
|
|
short: Query the lighthouses for the provided vpn address
|
|
help: This command is asynchronous. Only currently known udp addresses will be printed.
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
reload
|
|
short: Reloads configuration from disk, same as sending HUP to the process
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
version
|
|
short: Prints the currently running version of nebula
|
|
help:
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|
|
whoami
|
|
short: Prints the certificate identity of this node
|
|
help: The fields identity prints, read from this node's own certificate.
|
|
flags:
|
|
-json
|
|
outputs as json
|
|
-pretty
|
|
pretty prints json, assumes -json
|