mirrors/nebula
1
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-03-07 22:33:29 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

log if UnsafeNetworks assignment changes across reload

Browse source
This commit is contained in:
JackDoan 2026-03-04 12:33:16 -06:00
parent 09fe406dba
commit 36bbc515d2
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
pki.go
View file

@ -102,7 +102,7 @@ func (p *PKI) reloadCerts(c *config.C, initial bool) *util.ContextualError {
if currentState.v1Cert == nil {
//adding certs is fine, actually. Networks-in-common confirmed in newCertState().
} else {
// did IP in cert change? if so, don't set
// did IP in cert change? if so, don't set. If we ever allow this, need to set p.firewallReloadNeeded
if !slices.Equal(currentState.v1Cert.Networks(), newState.v1Cert.Networks()) {
return util.NewContextualError(
"Networks in new cert was different from old",
@ -158,6 +158,14 @@ func (p *PKI) reloadCerts(c *config.C, initial bool) *util.ContextualError {
}
}
newUN := newState.GetDefaultCertificate().UnsafeNetworks()
oldUN := currentState.GetDefaultCertificate().UnsafeNetworks()
if !slices.Equal(newUN, oldUN) {
//todo I don't love this, because other clients will see the new assignments and act on them, but we will not be able to.
//I think we need to wire this into the firewall reload.
p.l.WithFields(m{"previous": oldUN, "new": newUN}).Warning("UnsafeNetworks assignments differ. A restart is required in order for this to take effect.")
}
// Cipher cant be hot swapped so just leave it at what it was before
newState.cipher = currentState.cipher