mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 11:36:52 +01:00
Build slackhq/nebula#1821 ("who is this vpn address?" over a local HTTP+JSON socket) on the command registry, so the lookup is one command on every surface and the socket is one more local API. identity - `identity [-address <vpn addr>[:port]]`: no address reports this node; with one, this node or the peer behind an established tunnel - Certificate fields only: name, vpn addresses, networks, unsafe networks, groups, fingerprint, issuer, validity, cert version; a peer's fingerprint is the one nebula computed when it verified the cert - Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes straight through - No tunnel is a commands.NotFound; an empty -address is refused - Lighthouse TXT lookup shares the owner and peer lookups, keeps answering with the initiating certificate, and no longer panics without a default cert - Served on ssh and nebula ctl too Info API - Off until `local_api.info.enabled` with `socket` and optional quoted octal `socket_mode` (default "0600"); nothing derived - Serves commands declaring Command.Identity plus help; others 403 naming their surfaces. TestInfoAPISurface pins the set to identity - GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is the -json rendering via commands.Render; commands.PresentationFormat reads json/pretty from the query the way a line is read - 400 commands.ParamError, 403 commands.WithheldError (what Resolve now returns for a withheld name, so help and dispatch type-check it too), 404 NotFound or unknown, 500 Run error, refusal with no reason, or recovered panic with no detail; no redirects; every miss is JSON - listen takes a mode: bind under umask 0077 then chmod; "0660" plus a searchable dir opens it to a group - The chmod, at bind and on a mode-only reload, goes through chmodSocket, which never follows a link: a user who can write the socket's directory could otherwise swap the node for a link and have a root daemon put 0660 or 0666 on any file. Only a socket we own is chmoded. On linux the node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded through /proc/self/fd, so the check and the chmod land on one inode; fchmodat2 is the fallback without /proc. On darwin and the BSDs it is an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats too, so a dangling link is refused rather than followed by bind on darwin - One endpoint type owns bind under mutex, bind-before-release move, context watch and stop/unlink; each server supplies what it serves - Reloadable through the same reconcile shape as the control socket: mode applied in place, unparsable section keeps what runs, control socket path refused by name - Wire returns Endpoints{Control, Info} with one Stop - Windows unsupported for now (a pipe has no mode); warned once Tests: identity lookups and shapes; API filter, status codes, panic recovery, socket mode, rebind, cancellation; config parsing incl. bare 0660; Wire transitions; e2e of two nebulas with the info API resolving the peer by address and port, through shared test.HTTPDo/HTTPGet helpers. Goldens gain identity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
144 lines
5.2 KiB
Go
144 lines
5.2 KiB
Go
package commands
|
|
|
|
import (
|
|
"flag"
|
|
"maps"
|
|
"slices"
|
|
)
|
|
|
|
// Request is one command to run, as every surface hands it to Invoke: the command, its
|
|
// options by name in the form their flags parse, its operands, and the rendering the
|
|
// line asked for, if any.
|
|
//
|
|
// nebula ctl builds one with ParseLine and it travels as a JSON object to the control
|
|
// socket. An ssh line never becomes one: it is parsed straight into the command's own
|
|
// FlagSet; see execLine.
|
|
type Request struct {
|
|
// Command is the command to run, resolved by the surface at its edge. See
|
|
// Registry.Resolve for the one that tells an unknown name from a withheld one.
|
|
Command *Command
|
|
|
|
// Params carries the options the line set, by flag name, each in the form its flag
|
|
// parses from. An option left alone is absent, so the command's default applies.
|
|
Params map[string]string
|
|
|
|
// Args carries the operands: whatever the line did not consume as a flag.
|
|
Args []string
|
|
|
|
// Format is the rendering the line asked for with -json or -pretty, or FormatUnset
|
|
// when it expressed no preference. It is ParseLine's reading of the line for the
|
|
// client that sends the Request; Invoke does not read it, since the surface that
|
|
// runs a Request renders with the format it agreed with its caller.
|
|
Format Format
|
|
}
|
|
|
|
// ParseLine reads a FlagSet that ParseArgs has filled, and the operands it returned,
|
|
// into a Request to send over the wire. Command is left for the caller to set.
|
|
//
|
|
// Every flag the line set other than the presentation flags travels by name, as its
|
|
// flag's String, which is what the daemon's Set parses. That round trip is exact for
|
|
// the bool and string flags a client builds from the schema; it is the client's to make,
|
|
// and the ssh path does not make it, since it runs the FlagSet it parsed.
|
|
func ParseLine(fl *flag.FlagSet, operands []string) Request {
|
|
req := Request{Args: operands, Format: presentationFormat(fl)}
|
|
|
|
fl.Visit(func(f *flag.Flag) {
|
|
if isPresentationFlag(f.Name) {
|
|
return
|
|
}
|
|
if req.Params == nil {
|
|
req.Params = map[string]string{}
|
|
}
|
|
req.Params[f.Name] = f.Value.String()
|
|
})
|
|
|
|
return req
|
|
}
|
|
|
|
// presentationFormat is the one reading of -json and -pretty from a parsed line, so a
|
|
// line means the same on every surface: only a flag set to true asks for JSON, since one
|
|
// set to false expresses no preference, and -pretty implies -json. FormatUnset means the
|
|
// line expressed no preference and the surface's own default applies.
|
|
func presentationFormat(fl *flag.FlagSet) Format {
|
|
var asJSON, pretty bool
|
|
fl.Visit(func(f *flag.Flag) {
|
|
switch f.Name {
|
|
case FlagJSON:
|
|
asJSON = flagIsTrue(f)
|
|
case FlagPretty:
|
|
pretty = flagIsTrue(f)
|
|
}
|
|
})
|
|
|
|
switch {
|
|
case pretty:
|
|
return FormatPrettyJSON
|
|
case asJSON:
|
|
return FormatJSON
|
|
default:
|
|
return FormatUnset
|
|
}
|
|
}
|
|
|
|
// PresentationFormat is presentationFormat for a surface that takes a command's options
|
|
// by name rather than from a line: the info API's query string. Only the two presentation
|
|
// flags are read from params; the command's own parameters are the caller's to pass to
|
|
// Invoke, which refuses these two among them. A flag given with no value counts as set,
|
|
// as -pretty does on a line, and one that is not a boolean is a ParamError.
|
|
func PresentationFormat(params map[string]string) (Format, error) {
|
|
fl := flag.NewFlagSet("", flag.ContinueOnError)
|
|
addPresentationFlags(fl)
|
|
|
|
for _, k := range []string{FlagJSON, FlagPretty} {
|
|
v, ok := params[k]
|
|
if !ok {
|
|
continue
|
|
}
|
|
if v == "" {
|
|
v = "true"
|
|
}
|
|
if err := setFlag(fl, fl.Lookup(k), v); err != nil {
|
|
return FormatUnset, err
|
|
}
|
|
}
|
|
|
|
return presentationFormat(fl), nil
|
|
}
|
|
|
|
// flagIsTrue reports whether a bool flag was set to true. The flag package's bool value
|
|
// is a flag.Getter whose Get returns the bool, so this never falls back to parsing text.
|
|
func flagIsTrue(f *flag.Flag) bool {
|
|
g, ok := f.Value.(flag.Getter)
|
|
if !ok {
|
|
return false
|
|
}
|
|
b, _ := g.Get().(bool)
|
|
return b
|
|
}
|
|
|
|
// Invoke runs one Request and returns the command's Result, unrendered.
|
|
//
|
|
// The parameters are applied by flag name, in name order: a request from the wire is a
|
|
// JSON object with no order of its own, and which of two bad parameters is reported must
|
|
// not change from one request to the next. An unknown parameter is an error rather than
|
|
// something quietly ignored, because a caller that misspells one deserves to hear about
|
|
// it instead of getting a default. A bad parameter means Run is never called, and the
|
|
// FlagSet is fresh for this call, so nothing set before it is seen by anyone.
|
|
//
|
|
// Nothing here writes anywhere and nothing here renders. What a surface does with the
|
|
// Result, marshal its Payload or run the command's own text rendering through Render,
|
|
// is the surface's decision, and keeping that out of here is what lets a caller tell a
|
|
// refusal from a success after the text has been produced. The presentation flags are
|
|
// not parameters: a Request says how it wants rendering in Format, and sending them as
|
|
// parameters is refused rather than read as a preference.
|
|
func Invoke(req Request) (Result, error) {
|
|
c := req.Command
|
|
|
|
fl, fs, own := commandFlags(c)
|
|
if err := setParams(fl, string(c.Name), slices.Sorted(maps.Keys(req.Params)), req.Params, own); err != nil {
|
|
return Result{}, err
|
|
}
|
|
|
|
return c.Run(fs, req.Args)
|
|
}
|