V2 certificate format #1216

nbrownus · 2024-09-13T04:05:57Z

WIP based on cert-interface branch

johnmaguire · 2024-09-13T16:10:55Z

cert/cert_v2.asn1

+
+    -- At least 1 ipv4 or ipv6 address must be present if isCA is false
+    networks SEQUENCE OF Network,
+    unsafeNetworks SEQUENCE OF Network OPTIONAL,


Very happy to see this getting renamed from -ips and -subnets which were a bit confusing (many people believed subnets was essentially the CIDR part of -ips.) That being said, calling them both "networks" might also be confusing. I think I'd lean towards simply calling this unsafeRoutes to match the config option.

I'm not opposed to calling these unsafeRoutes, it doesn't quite feel right though since this field is describing a network that can be used to configure unsafe routes on another host.

cert/cert_v2.go

cert/cert_v2.asn1

JackDoanRivian · 2024-09-16T14:33:48Z

nebula.proto

@@ -62,6 +62,7 @@ message NebulaHandshakeDetails {
  uint32 ResponderIndex = 3;
  uint64 Cookie = 4;
  uint64 Time = 5;
+  uint32 CertVersion = 8;


thoughts on making this an enum to match cert.go?

It would be a cyclical import for the cert package or else we'd have to do silly type conversions between the two packages.

I will say using cert.Version* for protocol level stuff gave me the ick.

JackDoanRivian · 2024-09-16T14:38:21Z

cert/pem.go

 	default:
 		return nil, r, ErrInvalidPEMCertificateBanner
 	}
+
+	if err != nil {
+		return nil, r, err


semantics changed a little bit here -- we used to not return the pem-remainder on err, now we do. It's probably fine? It's more consistent with the default/ErrInvalidPEMCertificateBanner branch.

cert/cert_v2.asn1

JackDoanRivian · 2024-09-21T13:02:48Z

lighthouse.go

-func (lhh *LightHouseHandler) handleHostQueryReply(n *NebulaMeta, vpnIp netip.Addr) {
-	if !lhh.lh.IsLighthouseIP(vpnIp) {
+func (lhh *LightHouseHandler) handleHostQueryReply(n *NebulaMeta, reqHostinfo *HostInfo) {
+	//TODO: this is kind of dumb


it is dumb, but it raises some good questions about multi-IP stuff. Are we going to require users to put each IP for a lighthouse in their config file? If we do, does it make sense to group them?

lighthouse: hosts: - 10.0.0.1 # the old way - ["fc00::2", "10.0.0.2"] # a new way

similar ideas apply wrt the static host map

From a user perspective I would say no. I think it would be better to layer in learned lighthouse vpn addrs but as a stop gap I have included a IsAnyLighthouseIP (which the name is wrong ugh) that checks if any of the addrs are a lighthouse addr.

JackDoanRivian · 2024-09-21T13:27:35Z

overlay/tun_linux.go

-		return err
+	//set route MTU
+	for i := range t.vpnNetworks {
+		if err = t.setDefaultRoute(t.vpnNetworks[i]); err != nil {


this still races and errors sometimes on my proxmox host. Not sure why. On hosts that use systemd-networkd I haven't observed any issues.

…o to the lighthouse request handler

) * Add TBSCertificate.SignWith to abstract out sources-of-signatures * consistent signatures * eliminate SignPkcs11 * update comment

* send in relays on protocol v2 * remove old comment

* combine icmp and icmpv6 handling in the firewall * correct ipv6 port number interpretation * add unit test, fix orientation of ports * gofmt

* fix nebula-cert json printing * fix test

* dns support for v4 and v6 addresses * fix comment

* lighthouse updates with v2 tunnels * tweak message object location

nbrownus · 2024-10-17T01:35:04Z

udp/udp_rio_windows.go

-			q,
-			cache.Get(u.l),
-		)
+		r(netip.AddrPortFrom(netip.AddrFrom16(rua.Addr).Unmap(), (rua.Port>>8)|((rua.Port&0xff)<<8)), buffer[:n])


use binary to avoid endianness issues

nbrownus · 2024-10-17T04:55:58Z

cmd/nebula-cert/sign.go

-	}
+	if *sf.networks != "" {
+		for _, rs := range strings.Split(*sf.networks, ",") {
+			//TODO: error on duplicates? Mainly only addr matters, having two of the same addr in the same or different prefix space is strange


Also no 4in6

nbrownus · 2024-10-17T04:56:54Z

cmd/nebula-cert/sign.go

 				if err != nil {
-					return newHelpErrorf("invalid subnet definition: %s", rs)
+					return newHelpErrorf("invalid -unsafe-networks definition: %s", rs)


And no 4in6

nbrownus · 2024-10-17T04:57:28Z

cmd/nebula-cert/sign.go

-			return fmt.Errorf("error while signing with PKCS#11: %w", err)
+
+		if version == cert.Version1 {
+			// If we are asked to mint a v1 certificate only then we cant just ignore any v6 addresses


We arent ignoring them

salesforce-cla bot added the cla:signed label Sep 13, 2024

johnmaguire reviewed Sep 13, 2024

View reviewed changes

JackDoanRivian reviewed Sep 13, 2024

View reviewed changes

cert/cert_v2.go Outdated Show resolved Hide resolved

JackDoanRivian reviewed Sep 16, 2024

View reviewed changes

cert/cert_v2.asn1 Outdated Show resolved Hide resolved

JackDoanRivian reviewed Sep 16, 2024

View reviewed changes

JackDoanRivian reviewed Sep 20, 2024

View reviewed changes

cert/cert_v2.asn1 Show resolved Hide resolved

JackDoanRivian reviewed Sep 21, 2024

View reviewed changes

nbrownus mentioned this pull request Oct 4, 2024

Cert interface #1212

Merged

nbrownus force-pushed the cert-v2 branch from 9d15808 to f1fca4d Compare October 8, 2024 03:40

Base automatically changed from cert-interface to master October 10, 2024 23:00

nbrownus and others added 18 commits October 11, 2024 16:44

Add in v2 certificate

bf2bfae

Ignore private key verification for pkcs11 private keys

81a4080

Fixup nebula-cert tests for v1 certs

c744e94

Initial dual cert version nebula-cert support

7522a00

Dual cert handling

4074163

Fixes

3098480

Fix v2 handshaking

bf6c454

Fix v2 cert copying

6fbf64e

Copy darwin tun handling from other branch

c383c44

Copy device and route files over

e910166

Port over more of the ipv6 tun device changes

e39b8e7

Fixup tests

debcc16

Cert v2 + tun changes for Linux (#1224)

fd20fc3

Shed the layers of indirection on udp listeners, get the full hostinf…

c9acce2

…o to the lighthouse request handler

Support multiple vpn addrs in lighthouse and hostmap

554f849

Mostly working

35b67b0

Better e2e errors

b3f2d49

Fix hostmap deletion and lighthouse version choice

c00422f

JackDoanRivian and others added 6 commits October 11, 2024 16:44

Add TBSCertificate.SignWith to abstract out sources-of-signatures (#1233

af0b881

) * Add TBSCertificate.SignWith to abstract out sources-of-signatures * consistent signatures * eliminate SignPkcs11 * update comment

Cert-v2 submit v2 relays to lighthouse (#1244)

d77278a

* send in relays on protocol v2 * remove old comment

Cert V2 firewall fixes (#1242)

aea09f8

* combine icmp and icmpv6 handling in the firewall * correct ipv6 port number interpretation * add unit test, fix orientation of ports * gofmt

fix nebula-cert json printing (#1243)

f7f246f

* fix nebula-cert json printing * fix test

cert-v2: backwards compatibility trickery for ipv6 (#1245)

d5f2619

Fix flaky e2e test

d6f1b51

nbrownus force-pushed the cert-v2 branch from c4ef068 to d6f1b51 Compare October 11, 2024 21:44

JackDoanRivian and others added 3 commits October 11, 2024 17:02

cert-v2: dns support for v4 and v6 addresses (#1249)

8ccdced

* dns support for v4 and v6 addresses * fix comment

cert-v2: more lighthousing (#1251)

a56521e

* lighthouse updates with v2 tunnels * tweak message object location

Fix calculated remotes, clean up some todos

5a72a56

nbrownus commented Oct 17, 2024

View reviewed changes

nbrownus added 4 commits October 16, 2024 21:30

More ip -> addr

df3b751

Fix firewall for assigned networks and more ip -> addr

1377b84

Fixup hostinfo RemoteCIDR

2067e52

Update documentation and add some new work todos

48b7f5a

nbrownus commented Oct 17, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

V2 certificate format #1216

V2 certificate format #1216

nbrownus commented Sep 13, 2024

johnmaguire Sep 13, 2024

nbrownus Sep 13, 2024

JackDoanRivian Sep 16, 2024

nbrownus Sep 20, 2024

JackDoanRivian Sep 16, 2024

JackDoanRivian Sep 21, 2024 •

edited

Loading

nbrownus Sep 22, 2024

JackDoanRivian Sep 21, 2024

nbrownus Oct 17, 2024

nbrownus Oct 17, 2024

nbrownus Oct 17, 2024

nbrownus Oct 17, 2024

V2 certificate format #1216

Are you sure you want to change the base?

V2 certificate format #1216

Conversation

nbrownus commented Sep 13, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JackDoanRivian Sep 21, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JackDoanRivian Sep 21, 2024 •

edited

Loading