Mirrors
/
nebula
mirror of https://github.com/slackhq/nebula.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
506 Commits 16 Branches 20 Tags 5.3 MiB
Commit Graph

34 Commits

Author SHA1 Message Date
John Maguire f31bab5f1a
Add support for SSH CAs (#1098) 
- Accept certs signed by trusted CAs
- Username must match the cert principal if set
- Any username can be used if cert principal is empty
- Don't allow removed pubkeys/CAs to be used after reload
 2024-04-30 10:50:17 -04:00
Jon Rafkind 7ed9f2a688
add ssh command to print device info (#763) 2024-04-29 16:09:34 -05:00
Caleb Jasik 8e94eb974e
Add suggested filenames for collected profiles in the ssh commands (#1109) 2024-04-29 15:20:46 -05:00
Nate Brown a390125935
Support reloading preferred_ranges (#1043) 2024-04-03 22:14:51 -05:00
Lingfeng Zhang 1f83d1758d
Support inlined sshd host key (#1054) 2024-01-22 13:58:44 -05:00
Nate Brown 072edd56b3
Fix re-entrant `GetOrHandshake` issues (#1044) 2023-12-19 11:58:31 -06:00
guangwu 276978377a
chore: remove refs to deprecated io/ioutil (#987) 
Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>
 2023-10-31 10:35:13 -04:00
Nate Brown 076ebc6c6e
Simplify getting a hostinfo or starting a handshake with one (#954) 2023-08-21 18:51:45 -05:00
Nate Brown 7edcf620c0
We only need the certificate in ConnectionState (#953) 2023-08-21 14:11:06 -05:00
Nate Brown 5a131b2975
Combine ca, cert, and key handling (#952) 2023-08-14 21:32:40 -05:00
Nate Brown a10baeee92
Pull hostmap and pending hostmap apart, remove unused functions (#843) 2023-07-24 12:37:52 -05:00
Nate Brown 6b3d42efa5
Use atomic.Pointer for certState (#833) 2023-03-30 13:04:09 -05:00
Wade Simmons 8a82e0fb16
ssh: add save-mutex-profile (#737) 2023-03-29 14:30:28 -05:00
Nate Brown 92cc32f844
Remove handshake race avoidance (#820) 
Co-authored-by: Wade Simmons <wadey@slack-corp.com>
 2023-03-13 12:35:14 -05:00
Caleb Jasik 12dbbd3dd3
Fix typos found by https://github.com/crate-ci/typos (#735) 2022-12-19 11:28:27 -06:00
Jon Rafkind c2259f14a7
explicitly reload config from ssh command (#725) 2022-08-08 12:44:09 -05:00
brad-defined 1a7c575011
Relay (#678) 
Co-authored-by: Wade Simmons <wsimmons@slack-corp.com>
 2022-06-21 13:35:23 -05:00
Wade Simmons 304b12f63f
create ConnectionState before adding to HostMap (#535) 
We have a few small race conditions with creating the HostInfo.ConnectionState
since we add the host info to the pendingHostMap before we set this
field. We can make everything a lot easier if we just add an "init"
function so that we can set this field in the hostinfo before we add it
to the hostmap.
 2021-11-08 14:46:22 -05:00
Nate Brown bcabcfdaca
Rework some things into packages (#489) 2021-11-03 20:54:04 -05:00
Nate Brown c726d20578
Fix single command ssh exec (#483) 2021-06-07 17:06:59 -05:00
Nathan Brown 6f37280e8e
Fully close tunnels when CloseAllTunnels is called (#448) 2021-04-26 10:42:24 -05:00
brad-defined 17106f83a0
Ensure the Nebula device exists before attempting to bind to the Nebula IP (#375) 2021-04-16 10:34:28 -05:00
Nathan Brown ab08be1e3e
Don't panic on a nil response from the lighthouse (#442) 2021-04-15 09:12:21 -05:00
Nathan Brown 710df6a876
Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
Nathan Brown 75f7bda0a4
Lighthouse performance pass (#418) 2021-03-31 17:32:02 -05:00
Nathan Brown 0c2e5973e1
Simple lie test (#427) 2021-03-31 10:26:35 -05:00
Nathan Brown 3ea7e1b75f
Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
Nathan Brown 7073d204a8
IPv6 support for outside (udp) (#369) 2021-03-18 20:37:24 -05:00
Wade Simmons d604270966
Fix most known data races (#396) 
This change fixes all of the known data races that `make smoke-docker-race` finds, except for one.

Most of these races are around the handshake phase for a hostinfo, so we add a RWLock to the hostinfo and Lock during each of the handshake stages.

Some of the other races are around consistently using `atomic` around the `messageCounter` field. To make this harder to mess up, I have renamed the field to `atomicMessageCounter` (I also removed the unnecessary extra pointer deference as we can just point directly to the struct field).

The last remaining data race is around reading `ConnectionInfo.ready`, which is a boolean that is only written to once when the handshake has finished. Due to it being in the hot path for packets and the rare case that this could actually be an issue, holding off on fixing that one for now.

here is the results of `make smoke-docker-race`:

before:

    lighthouse1: Found 2 data race(s)
    host2:       Found 36 data race(s)
    host3:       Found 17 data race(s)
    host4:       Found 31 data race(s)

after:

    host2: Found 1 data race(s)
    host4: Found 1 data race(s)

Fixes: #147
Fixes: #226
Fixes: #283
Fixes: #316
 2021-03-05 21:18:33 -05:00
Brian Luong 6238f1550b
Handle panic when invalid IP entered in sshd (#296) 2020-09-18 10:10:25 -04:00
forfuncsake 50b04413c7
Block nebula ssh server from listening on port 22 (#266) 
Port 22 is blocked as a safety mechanism. In a case where nebula is
started before sshd, a system may be rendered unreachable if nebula
is holding the system ssh port and there is no other connectivity.

This commit enforces the restriction, which could previously be worked
around by listening on an IPv6 address, e.g.  "[::]:22".
 2020-09-15 09:57:32 -04:00
Wade Simmons aba42f9fa6
enforce the use of goimports (#248) 
* enforce the use of goimports

Instead of enforcing `gofmt`, enforce `goimports`, which also asserts
a separate section for non-builtin packages.

* run `goimports` everywhere

* exclude generated .pb.go files
 2020-06-30 18:53:30 -04:00
Wade Simmons df43f6466e gofmt 2019-12-11 23:15:57 -05:00
Slack Security Team f22b4b584d Public Release 2019-11-19 17:00:20 +00:00