mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 07:26:52 +01:00
Build slackhq/nebula#1821 ("who is this vpn address?" over a local HTTP+JSON socket) on the command registry, so the lookup is one command on every surface and the socket is one more local API. identity - `identity [-address <vpn addr>[:port]]`: no address reports this node; with one, this node or the peer behind an established tunnel - Certificate fields only: name, vpn addresses, networks, unsafe networks, groups, fingerprint, issuer, validity, cert version; a peer's fingerprint is the one nebula computed when it verified the cert - Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes straight through - No tunnel is a commands.NotFound; an empty -address is refused - Lighthouse TXT lookup shares the owner and peer lookups, keeps answering with the initiating certificate, and no longer panics without a default cert - Served on ssh and nebula ctl too Info API - Off until `local_api.info.enabled` with `socket` and optional quoted octal `socket_mode` (default "0600"); nothing derived - Serves commands declaring Command.Identity plus help; others 403 naming their surfaces. TestInfoAPISurface pins the set to identity - GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is the -json rendering via commands.Render; commands.PresentationFormat reads json/pretty from the query the way a line is read - 400 commands.ParamError, 403 commands.WithheldError (what Resolve now returns for a withheld name, so help and dispatch type-check it too), 404 NotFound or unknown, 500 Run error, refusal with no reason, or recovered panic with no detail; no redirects; every miss is JSON - listen takes a mode: bind under umask 0077 then chmod; "0660" plus a searchable dir opens it to a group - The chmod, at bind and on a mode-only reload, goes through chmodSocket, which never follows a link: a user who can write the socket's directory could otherwise swap the node for a link and have a root daemon put 0660 or 0666 on any file. Only a socket we own is chmoded. On linux the node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded through /proc/self/fd, so the check and the chmod land on one inode; fchmodat2 is the fallback without /proc. On darwin and the BSDs it is an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats too, so a dangling link is refused rather than followed by bind on darwin - One endpoint type owns bind under mutex, bind-before-release move, context watch and stop/unlink; each server supplies what it serves - Reloadable through the same reconcile shape as the control socket: mode applied in place, unparsable section keeps what runs, control socket path refused by name - Wire returns Endpoints{Control, Info} with one Stop - Windows unsupported for now (a pipe has no mode); warned once Tests: identity lookups and shapes; API filter, status codes, panic recovery, socket mode, rebind, cancellation; config parsing incl. bare 0660; Wire transitions; e2e of two nebulas with the info API resolving the peer by address and port, through shared test.HTTPDo/HTTPGet helpers. Goldens gain identity. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
124 lines
4.5 KiB
Go
124 lines
4.5 KiB
Go
package commands
|
|
|
|
import (
|
|
"bytes"
|
|
"io"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestRenderPrintsAnOutcomeWithoutText: a command that acts declares no Text. Its
|
|
// outcome renders as the reason, the same for every command, and as {ok, reason} in
|
|
// JSON, which is the shape these commands have always emitted.
|
|
func TestRenderPrintsAnOutcomeWithoutText(t *testing.T) {
|
|
c := &Command{Name: "act"}
|
|
|
|
out := &bytes.Buffer{}
|
|
require.NoError(t, Render(c, Did("Closed"), FormatText, out))
|
|
assert.Equal(t, "Closed\n", out.String())
|
|
|
|
out.Reset()
|
|
require.NoError(t, Render(c, Failed("No vpn address was provided"), FormatText, out))
|
|
assert.Equal(t, "No vpn address was provided\n", out.String())
|
|
|
|
out.Reset()
|
|
require.NoError(t, Render(c, Failed("nope"), FormatJSON, out))
|
|
assert.JSONEq(t, `{"ok":false,"reason":"nope"}`, out.String())
|
|
}
|
|
|
|
// TestRenderHandsTextOnlyTheValue pins the guarantee Result exists for: a command's
|
|
// renderer sees the type it returns on success and never the envelope or an outcome, so
|
|
// a report command that refuses its arguments needs nothing in its Text to cope.
|
|
func TestRenderHandsTextOnlyTheValue(t *testing.T) {
|
|
var got any
|
|
c := &Command{
|
|
Name: "report",
|
|
Text: func(v any, w io.Writer) error {
|
|
got = v
|
|
_, err := io.WriteString(w, "rendered\n")
|
|
return err
|
|
},
|
|
}
|
|
|
|
out := &bytes.Buffer{}
|
|
require.NoError(t, Render(c, Value("data"), FormatText, out))
|
|
assert.Equal(t, "data", got)
|
|
assert.Equal(t, "rendered\n", out.String())
|
|
|
|
got, out = nil, &bytes.Buffer{}
|
|
require.NoError(t, Render(c, Failed("refused"), FormatText, out))
|
|
assert.Nil(t, got, "Text must not be called for an outcome")
|
|
assert.Equal(t, "refused\n", out.String())
|
|
|
|
out.Reset()
|
|
require.NoError(t, Render(c, Value("data"), FormatJSON, out))
|
|
assert.JSONEq(t, `"data"`, out.String(), "JSON carries the value, never the envelope")
|
|
}
|
|
|
|
// TestRenderRefusesTextForAValueWithoutText: leaving Text nil is a statement that no
|
|
// human form of the value exists yet, and asking for one is an error that says so.
|
|
func TestRenderRefusesTextForAValueWithoutText(t *testing.T) {
|
|
out := &bytes.Buffer{}
|
|
err := Render(&Command{Name: "print-tunnel"}, Value(map[string]int{"index": 7}), FormatText, out)
|
|
require.ErrorIs(t, err, ErrNoTextRendering)
|
|
require.ErrorContains(t, err, "print-tunnel has no human readable output yet")
|
|
assert.Empty(t, out.String())
|
|
}
|
|
|
|
// TestTypedNamesTheTypeOnce: Typed replaces the assertion at the top of every renderer.
|
|
// The right type reaches the renderer; the wrong one is reported, naming both.
|
|
func TestTypedNamesTheTypeOnce(t *testing.T) {
|
|
type info struct{ Name string }
|
|
render := Typed(func(i info, w io.Writer) error {
|
|
_, err := io.WriteString(w, i.Name+"\n")
|
|
return err
|
|
})
|
|
|
|
out := &bytes.Buffer{}
|
|
require.NoError(t, render(info{Name: "tun0"}, out))
|
|
assert.Equal(t, "tun0\n", out.String())
|
|
|
|
err := render("not an info", out)
|
|
require.Error(t, err)
|
|
assert.ErrorContains(t, err, "expected commands.info, got string")
|
|
}
|
|
|
|
// TestResultShapes pins what each constructor means to a surface: Empty is the one that
|
|
// renders nothing, Payload is what a program receives, and OK is set wherever a reason
|
|
// or value says the command worked.
|
|
func TestResultShapes(t *testing.T) {
|
|
assert.True(t, Nothing().Empty())
|
|
assert.True(t, Result{}.Empty(), "the zero Result says nothing rather than failing silently")
|
|
assert.False(t, Did("done").Empty())
|
|
assert.False(t, Failed("no").Empty())
|
|
assert.False(t, Value("x").Empty())
|
|
|
|
assert.True(t, Value("x").OK)
|
|
assert.True(t, Did("done").OK)
|
|
assert.False(t, Failed("no").OK)
|
|
|
|
assert.Equal(t, "x", Value("x").Payload())
|
|
assert.Equal(t, Outcome{OK: true, Reason: "done"}, Did("done").Payload())
|
|
assert.Equal(t, Outcome{Reason: "no"}, Failed("no").Payload())
|
|
}
|
|
|
|
// TestNotFoundIsARefusalLikeAnyOther: NotFound renders and marshals exactly as Failed
|
|
// does, so no surface's output changes by a command adopting it. The mark is on the
|
|
// Result alone, for a surface whose protocol has a word for it.
|
|
func TestNotFoundIsARefusalLikeAnyOther(t *testing.T) {
|
|
r := NotFound("No active tunnel for vpn addr: %s", "10.0.0.5")
|
|
assert.False(t, r.OK)
|
|
assert.True(t, r.NotFound)
|
|
assert.False(t, Failed("nope").NotFound)
|
|
|
|
out := &bytes.Buffer{}
|
|
require.NoError(t, Render(&Command{Name: "look"}, r, FormatText, out))
|
|
assert.Equal(t, "No active tunnel for vpn addr: 10.0.0.5\n", out.String())
|
|
|
|
out.Reset()
|
|
require.NoError(t, Render(&Command{Name: "look"}, r, FormatJSON, out))
|
|
assert.JSONEq(t, `{"ok":false,"reason":"No active tunnel for vpn addr: 10.0.0.5"}`, out.String(), "the mark never reaches the wire")
|
|
}
|