mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 07:06:52 +01:00
Matt RichardsonandClaude Fable 5.1
613c7e3061
Build slackhq/nebula#1821 ("who is this vpn address?" over a local HTTP+JSON socket) on the command registry, so the lookup is one command on every surface and the socket is one more local API. identity - `identity [-address <vpn addr>[:port]]`: no address reports this node; with one, this node or the peer behind an established tunnel - Certificate fields only: name, vpn addresses, networks, unsafe networks, groups, fingerprint, issuer, validity, cert version; a peer's fingerprint is the one nebula computed when it verified the cert - Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes straight through - No tunnel is a commands.NotFound; an empty -address is refused - Lighthouse TXT lookup shares the owner and peer lookups, keeps answering with the initiating certificate, and no longer panics without a default cert - Served on ssh and nebula ctl too Info API - Off until `local_api.info.enabled` with `socket` and optional quoted octal `socket_mode` (default "0600"); nothing derived - Serves commands declaring Command.Identity plus help; others 403 naming their surfaces. TestInfoAPISurface pins the set to identity - GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is the -json rendering via commands.Render; commands.PresentationFormat reads json/pretty from the query the way a line is read - 400 commands.ParamError, 403 commands.WithheldError (what Resolve now returns for a withheld name, so help and dispatch type-check it too), 404 NotFound or unknown, 500 Run error, refusal with no reason, or recovered panic with no detail; no redirects; every miss is JSON - listen takes a mode: bind under umask 0077 then chmod; "0660" plus a searchable dir opens it to a group - The chmod, at bind and on a mode-only reload, goes through chmodSocket, which never follows a link: a user who can write the socket's directory could otherwise swap the node for a link and have a root daemon put 0660 or 0666 on any file. Only a socket we own is chmoded. On linux the node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded through /proc/self/fd, so the check and the chmod land on one inode; fchmodat2 is the fallback without /proc. On darwin and the BSDs it is an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats too, so a dangling link is refused rather than followed by bind on darwin - One endpoint type owns bind under mutex, bind-before-release move, context watch and stop/unlink; each server supplies what it serves - Reloadable through the same reconcile shape as the control socket: mode applied in place, unparsable section keeps what runs, control socket path refused by name - Wire returns Endpoints{Control, Info} with one Stop - Windows unsupported for now (a pipe has no mode); warned once Tests: identity lookups and shapes; API filter, status codes, panic recovery, socket mode, rebind, cancellation; config parsing incl. bare 0660; Wire transitions; e2e of two nebulas with the info API resolving the peer by address and port, through shared test.HTTPDo/HTTPGet helpers. Goldens gain identity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
77 lines
2.2 KiB
Go
77 lines
2.2 KiB
Go
package test
|
|
|
|
import (
|
|
"context"
|
|
"flag"
|
|
"io"
|
|
"net"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// ShortTempDir returns a short private directory of the test's own, removed when the
|
|
// test ends. t.TempDir embeds the test name, which on darwin routinely pushes a unix
|
|
// socket path laid out under it past the 104 byte sun_path limit.
|
|
func ShortTempDir(t *testing.T) string {
|
|
t.Helper()
|
|
|
|
dir, err := os.MkdirTemp("", "la")
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() { _ = os.RemoveAll(dir) })
|
|
return dir
|
|
}
|
|
|
|
// Update is the -update flag: Golden rewrites its file instead of comparing against it.
|
|
var Update = flag.Bool("update", false, "rewrite golden files instead of comparing against them")
|
|
|
|
// Golden compares got with the file at path, or rewrites the file when -update is set.
|
|
func Golden(t *testing.T, path, got string) {
|
|
t.Helper()
|
|
|
|
if *Update {
|
|
require.NoError(t, os.MkdirAll(filepath.Dir(path), 0755))
|
|
require.NoError(t, os.WriteFile(path, []byte(got), 0644))
|
|
return
|
|
}
|
|
|
|
want, err := os.ReadFile(path)
|
|
require.NoError(t, err, "missing golden file, run with -update")
|
|
assert.Equal(t, string(want), got)
|
|
}
|
|
|
|
// HTTPDo sends one request to the HTTP server on the unix socket at socket and returns
|
|
// the status, body and headers of its answer. The host in the URL is a placeholder:
|
|
// every connection goes to the socket.
|
|
func HTTPDo(t *testing.T, socket, method, target string) (int, string, http.Header) {
|
|
t.Helper()
|
|
|
|
client := &http.Client{Transport: &http.Transport{
|
|
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
|
|
return (&net.Dialer{}).DialContext(ctx, "unix", socket)
|
|
},
|
|
}}
|
|
t.Cleanup(client.CloseIdleConnections)
|
|
|
|
req, err := http.NewRequest(method, "http://nebula"+target, nil)
|
|
require.NoError(t, err)
|
|
res, err := client.Do(req)
|
|
require.NoError(t, err)
|
|
defer res.Body.Close()
|
|
|
|
body, err := io.ReadAll(res.Body)
|
|
require.NoError(t, err)
|
|
return res.StatusCode, string(body), res.Header
|
|
}
|
|
|
|
// HTTPGet is HTTPDo for a GET whose headers the test does not read.
|
|
func HTTPGet(t *testing.T, socket, target string) (int, string) {
|
|
t.Helper()
|
|
status, body, _ := HTTPDo(t, socket, http.MethodGet, target)
|
|
return status, body
|
|
}
|