0.3.0-alpha2: fix edge case where trifid would issue certs that outlive the CA sometimes

.forgejo/workflows/trifid_api.yml

@@ -1,73 +0,0 @@
-on:
-  push:
-    branches:
-      master
-env:
-  CARGO_TERM_COLOR: always
-jobs:
-  build_x64:
-    runs_on: docker
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Setup Rust toolchain
-        uses: https://github.com/actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-      - name: Install additional dependencies
-        run: apt update && apt-get install -y libclang-dev clang sshpass rsync
-      - name: Compile release binary
-        uses: https://github.com/actions-rs/cargo@v1
-        with:
-          command: build
-          args: --bin trifid-api --profile release-ci
-      - name: Upload binary
-        run: sshpass -p "${{ secrets.TRIFID_DLCDN_PASSWORD }}" rsync --mkpath -e 'ssh -p ${{ secrets.TRIFID_DLCDN_PORT }} -o StrictHostKeyChecking=no' target/release-ci/trifid-api ${{ secrets.TRIFID_DLCDN_USER }}@${{ secrets.TRIFID_DLCDN_IP }}:${{ secrets.TRIFID_DLCDN_PATH }}/trifid-api/amd64/$GITHUB_SHA/trifid-api
-  build_arm64:
-    runs_on: docker-arm64
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Setup Rust toolchain
-        uses: https://github.com/actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-      - name: Install aarch64 target
-        run: rustup target add aarch64-unknown-linux-gnu
-      - name: Install additional dependencies
-        run: apt update && apt-get install -y libclang-dev clang sshpass rsync gcc-arm-linux-gnueabi gcc-aarch64-linux-gnu
-      - name: Compile release binary
-        uses: https://github.com/actions-rs/cargo@v1
-        env:
-          RUSTFLAGS: "-C linker=aarch64-linux-gnu-gcc"
-        with:
-          command: build
-          args: --bin trifid-api --target aarch64-unknown-linux-gnu --profile release-ci
-      - name: Upload binary
-        run: sshpass -p "${{ secrets.TRIFID_DLCDN_PASSWORD }}" rsync --mkpath -e 'ssh -p ${{ secrets.TRIFID_DLCDN_PORT }} -o StrictHostKeyChecking=no' target/aarch64-unknown-linux-gnu/release-ci/trifid-api ${{ secrets.TRIFID_DLCDN_USER }}@${{ secrets.TRIFID_DLCDN_IP }}:${{ secrets.TRIFID_DLCDN_PATH }}/trifid-api/arm64/$GITHUB_SHA/trifid-api
-  build_win64:
-    runs_on: docker
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Setup Rust toolchain
-        uses: https://github.com/actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-      - name: Install cross-compilation toolchain
-        run: rustup target add x86_64-pc-windows-gnu
-      - name: Install additional dependencies
-        run: apt update && apt-get install -y libclang-dev clang sshpass rsync mingw-w64 zip
-      - name: Compile release binary
-        uses: https://github.com/actions-rs/cargo@v1
-        with:
-          command: build
-          args: --bin trifid-api --target x86_64-pc-windows-gnu --profile release-ci
-      - name: Upload binary
-        run: sshpass -p "${{ secrets.TRIFID_DLCDN_PASSWORD }}" rsync --mkpath -e 'ssh -p ${{ secrets.TRIFID_DLCDN_PORT }} -o StrictHostKeyChecking=no' target/x86_64-pc-windows-gnu/release-ci/trifid-api.exe ${{ secrets.TRIFID_DLCDN_USER }}@${{ secrets.TRIFID_DLCDN_IP }}:${{ secrets.TRIFID_DLCDN_PATH }}/trifid-api/win64/$GITHUB_SHA/trifid-api.exe

.idea/trifid.iml

@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <module type="CPP_MODULE" version="4">
-  <component name="Go" enabled="true" />
   <component name="NewModuleRootManager">
     <content url="file://$MODULE_DIR$">
       <sourceFolder url="file://$MODULE_DIR$/tfclient/src" isTestSource="false" />

Cargo.toml

@@ -7,8 +7,7 @@ members = [
     "nebula-ffi",
     "nebula-config",
     "trifid-api",
-    "trifid-api-derive",
+    "trifid-api-derive"
-    "trifid_mobile_bridge"
 ]
 resolver = "2"
 

dnapi-rs/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dnapi-rs"
-version = "0.2.3"
+version = "0.2.2"
 edition = "2021"
 description = "A rust client for the Defined Networking API"
 license = "AGPL-3.0-or-later"

dnapi-rs/src/client_async.rs

@@ -13,7 +13,6 @@ use log::{debug, error};
 use reqwest::StatusCode;
 use serde::{Deserialize, Serialize};
 use std::error::Error;
-use reqwest::header::HeaderValue;
 use trifid_pki::cert::serialize_ed25519_public;
 use trifid_pki::ed25519_dalek::{Signature, Signer, SigningKey, Verifier};
 use url::Url;
@@ -90,15 +89,10 @@ impl Client {
             .send()
             .await?;
 
-        let empty_hval;
-        #[allow(clippy::unwrap_used)] {
-            empty_hval = HeaderValue::from_str("").unwrap();
-        };
-
         let req_id = resp
             .headers()
             .get("X-Request-ID")
-            .unwrap_or(&empty_hval)
+            .ok_or("Response missing X-Request-ID")?
             .to_str()?;
         debug!("enrollment request complete {{req_id: {}}}", req_id);
 

dnapi-rs/src/client_blocking.rs

@@ -13,7 +13,6 @@ use log::{debug, error, trace};
 use reqwest::StatusCode;
 use serde::{Deserialize, Serialize};
 use std::error::Error;
-use reqwest::header::HeaderValue;
 use trifid_pki::cert::serialize_ed25519_public;
 use trifid_pki::ed25519_dalek::{Signature, Signer, SigningKey, Verifier};
 use url::Url;
@@ -91,15 +90,10 @@ impl Client {
             .body(req_json)
             .send()?;
 
-        let empty_hval;
-        #[allow(clippy::unwrap_used)] {
-            empty_hval = HeaderValue::from_str("").unwrap();
-        };
-
         let req_id = resp
             .headers()
             .get("X-Request-ID")
-            .unwrap_or(&empty_hval)
+            .ok_or("Response missing X-Request-ID")?
             .to_str()?;
         debug!("enrollment request complete {{req_id: {}}}", req_id);
 

nebula-config/Cargo.toml

@@ -2,14 +2,9 @@
 name = "nebula-config"
 version = "0.1.0"
 edition = "2021"
-description = "A rust client for the Defined Networking API"
-license = "AGPL-3.0-or-later"
-documentation = "https://docs.rs/nebula-config"
-homepage = "https://git.e3t.cc/core/trifid"
-repository = "https://git.e3t.cc/core/trifid"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
 serde = { version = "1", features = ["derive"] }
-ipnet = { version = "2.9", features = ["serde"] }
+ipnet = { version = "2.9", features = ["serde"] }

nebula-ffi/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nebula-ffi"
-version = "1.8.1"
+version = "1.7.3"
 edition = "2021"
 description = "A Rust wrapper crate for communicating with Nebula via a CGO FFI."
 license = "GPL-3.0-or-later"
@@ -13,4 +13,4 @@ repository = "https://git.e3t.cc/~core/trifid"
 
 [build-dependencies]
 bindgen = "0.69"
-cc = "1"
+cc = "1"

nebula-ffi/go.mod

@@ -1,11 +1,6 @@
-module git.e3t.cc/core/trifid/nebula-ffi
+module main
 
-go 1.21
+go 1.20
-
-require (
-	github.com/sirupsen/logrus v1.9.3
-	github.com/slackhq/nebula v1.8.1
-)
 
 require (
 	dario.cat/mergo v1.0.0 // indirect
@@ -18,23 +13,26 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/gopacket v1.1.19 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/miekg/dns v1.1.56 // indirect
+	github.com/miekg/dns v1.1.55 // indirect
 	github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f // indirect
-	github.com/prometheus/client_golang v1.17.0 // indirect
+	github.com/prometheus/client_golang v1.16.0 // indirect
-	github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
+	github.com/prometheus/client_model v0.4.0 // indirect
-	github.com/prometheus/common v0.44.0 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.11.1 // indirect
+	github.com/prometheus/procfs v0.10.1 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/slackhq/nebula v1.7.2 // indirect
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 // indirect
-	github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54 // indirect
+	github.com/vishvananda/netlink v1.1.0 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
+	golang.org/x/crypto v0.11.0 // indirect
-	golang.org/x/mod v0.12.0 // indirect
+	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/net v0.13.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/sys v0.10.0 // indirect
-	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/term v0.10.0 // indirect
-	golang.org/x/tools v0.13.0 // indirect
+	golang.org/x/tools v0.8.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect

nebula-ffi/go.sum

@@ -20,7 +20,6 @@ github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432 h1:M5QgkYacWj0Xs8MhpIK/5uwU02icXpEoSo9sM2aRCps=
 github.com/cyberdelia/go-metrics-graphite v0.0.0-20161219230853-39f87cc3b432/go.mod h1:xwIwAxMvYnVrGJPe2FKx5prTrnAjGOD8zvDOnxnrrkM=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/flynn/noise v1.0.0 h1:DlTHqmzmvcEiKj+4RYo/imoswx/4r6iBlCMfVtrMXpQ=
 github.com/flynn/noise v1.0.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
@@ -30,6 +29,7 @@ github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vb
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -52,15 +52,16 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
@@ -70,20 +71,20 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxv
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/miekg/dns v1.1.56 h1:5imZaSeoRNvpM9SzWNhEcP9QliKiz20/dA2QabIGVnE=
+github.com/miekg/dns v1.1.54 h1:5jon9mWcb0sFJGpnI99tOMhCPyJ+RPVz5b63MQG0VWI=
-github.com/miekg/dns v1.1.56/go.mod h1:cRm6Oo2C8TY9ZS/TqsSrseAcncm74lfK5G+ikN2SWWY=
+github.com/miekg/dns v1.1.54/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
+github.com/miekg/dns v1.1.55 h1:GoQ4hpsj0nFLYe+bWiCToyrBEJXkQfOOIvFGFy0lEgo=
+github.com/miekg/dns v1.1.55/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f h1:8dM0ilqKL0Uzl42GABzzC4Oqlc3kGRILz0vgoff7nwg=
@@ -91,41 +92,46 @@ github.com/nbrownus/go-metrics-prometheus v0.0.0-20210712211119-974a6260965f/go.
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q=
+github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
-github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY=
+github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
+github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
+github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 h1:v7DLqVdK4VrYkVD5diGdl4sxJurKJEMnODWRJlxV9oM=
+github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
-github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
+github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY=
+github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
-github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY=
+github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.11.1 h1:xRC8Iq1yyca5ypa9n1EZnWZkt7dwcoRPQwX/5gwaUuI=
+github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
-github.com/prometheus/procfs v0.11.1/go.mod h1:eesXgaPo1q7lBpVMoMy0ZOFTth9hBn4W/y0/p/ScXhY=
+github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
+github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
+github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
+github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/slackhq/nebula v1.8.1 h1:ZksG1misr1ongDnP8FUUIaalkCJyXD4jL93DCWyM4zE=
+github.com/slackhq/nebula v1.7.2 h1:Rko1Mlksz/nC0c919xjGpB8uOSrTJ5e6KPgZx+lVfYw=
-github.com/slackhq/nebula v1.8.1/go.mod h1:KFJPfI2wzLBlnCmB5R5hzeDc9ltlzPROqPvpnC9KYCU=
+github.com/slackhq/nebula v1.7.2/go.mod h1:cnaoahkUipDs1vrNoIszyp0QPRIQN9Pm68ppQEW1Fhg=
+github.com/slackhq/nebula v1.7.3-0.20230802182832-83b6dc7b16e5 h1:NWU3xgmHAWA10Io2a20RFOVC0raucO+ZBohow3Am3H0=
+github.com/slackhq/nebula v1.7.3-0.20230802182832-83b6dc7b16e5/go.mod h1:gpXidU9u3Nf0nfkwmM4nnjxhEiV/Z+8MEumGo4wVuyI=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -134,11 +140,9 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
-github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54 h1:8mhqcHPqTMhSPoslhGYihEgSfc77+7La1P6kiB6+9So=
+github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
-github.com/vishvananda/netlink v1.1.1-0.20211118161826-650dca95af54/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
-github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -148,14 +152,16 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
+golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
+golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -166,8 +172,10 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.13.0 h1:Nvo8UFsZ8X3BhAC9699Z1j7XQ3rsZnUUm7jfBEk1ueY=
+golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -175,39 +183,41 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
+golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
+golang.org/x/tools v0.8.0 h1:vSDcovVPld282ceKgDimkRSC8kpaH1dgyc9UMzlt84Y=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -227,12 +237,13 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -242,5 +253,4 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

tfclient-go/cmd/tfclient-go/main.go

@@ -1,5 +0,0 @@
-package main
-
-func main() {
-
-}

tfclient-go/config.go

@@ -1,24 +0,0 @@
-package tfclient
-
-import (
-	"crypto/ed25519"
-	"runtime"
-)
-
-type TfConfig struct {
-	HostKey struct {
-		HostID      string              `yaml:"host_id"`
-		PrivateKey  ed25519.PrivateKey  `yaml:"private_key"`
-		Counter     uint                `yaml:"counter"`
-		TrustedKeys []ed25519.PublicKey `yaml:"trusted_keys"`
-	}
-}
-
-func ConfigPath() string {
-	switch runtime.GOOS {
-	case "windows":
-		return "C:\\ProgramData\\tfclient"
-	default:
-		return "/etc/tfclient"
-	}
-}

tfclient-go/go.mod

@@ -1,10 +0,0 @@
-module git.e3t.cc/core/trifid/tfclient-go
-
-go 1.20
-
-require (
-	github.com/sirupsen/logrus v1.9.3
-	github.com/slackhq/nebula v1.8.2
-)
-
-require gopkg.in/yaml.v3 v3.0.1 // indirect

tfclient-go/go.sum

@@ -1,12 +0,0 @@
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/slackhq/nebula v1.8.2/go.mod h1:SVVwnlGdmLg387U0XQMOSHRrD3VlJeXqd2/x/w/vxPs=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

tfclient-go/socket.go

@@ -1,12 +0,0 @@
-package tfclient
-
-import "runtime"
-
-func SocketPath(Name string) string {
-	switch runtime.GOOS {
-	case "windows":
-		return "C:\\ProgramData\\tfclient\\" + Name + ".sock"
-	default:
-		return "/tmp/tfclient-" + Name + ".sock"
-	}
-}

tfclient/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tfclient"
-version = "0.4.0"
+version = "0.3.0"
 edition = "2021"
 description = "An open-source reimplementation of a Defined Networking-compatible client"
 license = "GPL-3.0-or-later"
@@ -30,7 +30,7 @@ ipnet = "2.7"
 base64-serde = "0.7"
 dnapi-rs = { version = "0.2", path = "../dnapi-rs" }
 serde_yaml = "0.9"
-nebula-ffi = { version = "1.8.1", path = "../nebula-ffi", optional = true }
+nebula-ffi = { version = "1.7.2", path = "../nebula-ffi", optional = true }
 
 
 [package.metadata.deb]
@@ -42,4 +42,4 @@ systemd-units = { enable = false, unit-name = "tfclient@" }
 
 [features]
 default = ["linked-nebula"]
-linked-nebula = ["nebula-ffi"]
+linked-nebula = ["nebula-ffi"]

tfclient/src/nebulaworker.rs

@@ -28,7 +28,7 @@ fn insert_private_key(instance: &str) -> Result<(), Box<dyn Error>> {
 
     config.pki.key = Some(String::from_utf8(key)?);
 
-    debug!("inserted private key into config");
+    debug!("inserted private key into config: {:?}", config);
 
     let config_str = serde_yaml::to_string(&config)?;
     fs::write(nebula_yml(instance), config_str)?;

trifid-api/Cargo.toml

@@ -1,13 +1,13 @@
 [package]
 name = "trifid-api"
-version = "0.3.0-alpha3"
+version = "0.3.0-alpha2"
 authors = ["core <core@e3t.cc>"]
 edition = "2021"
 description = "An open-source reimplementation of the Defined Networking API server"
 documentation = "https://trifid.e3t.cc/docs/trifid-api/intro"
 homepage = "https://trifid.e3t.cc"
 repository = "https://git.e3t.cc/core/trifid"
-license = "GPL-3.0-or-later"
+license = "GPL-3"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -35,4 +35,4 @@ dnapi-rs = { version = "0.2", path = "../dnapi-rs" }
 nebula-config = { version = "0.1", path = "../nebula-config" }
 ipnet = "2.9"
 serde_yaml = "0.9"
-base64 = "0.21"
+base64 = "0.21"

trifid-api/src/auth.rs

@@ -1,8 +1,8 @@
-use crate::models::{AuthToken, SessionToken};
+use crate::models::SessionToken;
 
 pub struct AuthInfo {
     pub session_token: Option<SessionToken>,
-    pub auth_token: Option<AuthToken>,
+    pub auth_token: Option<()>,
 }
 
 #[macro_export]
@@ -52,24 +52,7 @@ macro_rules! auth {
                 auth_info.session_token = Some(real_token.clone());
             } else if token.starts_with("auth-") {
                 // parse auth token
-
+                todo!()
-                use $crate::schema::auth_tokens::dsl::*;
-
-                let tokens = $crate::handle_error!(
-                    auth_tokens
-                        .filter(id.eq(token))
-                        .select($crate::models::AuthToken::as_select())
-                        .load(&mut $c)
-                        .await
-                );
-                let real_token = match tokens.get(0) {
-                    Some(tok) => tok,
-                    None => $crate::err!(
-                        actix_web::http::StatusCode::UNAUTHORIZED,
-                        $crate::make_err!("ERR_UNAUTHORIZED", "unauthorized")
-                    ),
-                };
-                auth_info.auth_token = Some(real_token.clone());
             }
         }
         auth_info

trifid-api/src/config_generator.rs

@@ -65,7 +65,7 @@ pub async fn generate_config(
     let mut ca_string = String::new();
 
     for ca in cas {
-        if ca.expires_at > SystemTime::now() {
+        if ca.expires_at < SystemTime::now() {
             let ca_cert: NebulaCertificate =
                 serde_json::from_value(ca.cert.clone()).map_err(ConfigGenError::InvalidCACert)?;
             ca_string += &String::from_utf8_lossy(
@@ -112,10 +112,10 @@ pub async fn generate_config(
     let ca_cert: NebulaCertificate = serde_json::from_value(signing_ca.cert.clone()).unwrap();
 
     if cert.details.not_before < ca_cert.details.not_before {
-        cert.details.not_before = ca_cert.details.not_before;
+        cert.details.not_before = ca_cert.details.not_before; // prevent issuing invalid certs
     }
     if cert.details.not_after > ca_cert.details.not_after {
-        cert.details.not_after = ca_cert.details.not_after;
+        cert.details.not_after = ca_cert.details.not_after; // prevent issuing invalid certs
     }
 
     sign_cert_with_ca(signing_ca, &mut cert, &state.config).unwrap();

trifid-api/src/main.rs

@@ -2,7 +2,6 @@ use crate::config::Config;
 use crate::error::APIErrorResponse;
 use actix_web::middleware::Logger;
 use actix_web::web::{Data, JsonConfig};
-use actix_web::dev::Service;
 use actix_web::{App, Error, HttpResponse, HttpServer};
 use diesel::Connection;
 use diesel_async::async_connection_wrapper::AsyncConnectionWrapper;
@@ -13,8 +12,6 @@ use diesel_migrations::{embed_migrations, EmbeddedMigrations, MigrationHarness};
 use log::{error, info};
 use std::fs;
 use std::path::PathBuf;
-use actix_web::http::header::{HeaderName, HeaderValue};
-use std::str::FromStr;
 
 pub mod error;
 #[macro_use]
@@ -136,27 +133,15 @@ async fn main() {
                         HttpResponse::BadRequest().json(err2),
                     )
                 })
-            }).content_type_required(false))
+            }))
             .service(routes::v1::signup::signup_req)
             .service(routes::v1::auth::verify_magic_link::verify_link_req)
             .service(routes::v1::auth::magic_link::login_req)
             .service(routes::v1::totp_authenticators::create_totp_auth_req)
-            .service(routes::v1::verify_totp_authenticators::verify_totp_req)
+            .service(routes::v1::verify_totp_authenticator::verify_totp_req)
             .service(routes::v1::auth::totp::totp_req)
-            .service(routes::v1::dnclient::dnclient_req)
-            .service(routes::v1::networks::create_network_req)
-            .service(routes::v2::enroll::enroll_req)
             .wrap(Logger::default())
             .wrap(actix_cors::Cors::permissive())
-            .wrap_fn(|req, srv| {
-                let fut = srv.call(req);
-                async {
-                    let mut res = fut.await?;
-                    res.headers_mut()
-                        .insert(HeaderName::from_str("X-Request-ID").unwrap(), HeaderValue::from_str(&randid!(id "")).unwrap());
-                    Ok(res)
-                }
-            })
             .app_data(app_state.clone())
     })
     .bind((local_config.server.bind.ip, local_config.server.bind.port))

trifid-api/src/routes/v1/dnclient.rs

@@ -16,22 +16,18 @@ use dnapi_rs::message::{
 use log::warn;
 use serde::Serialize;
 use std::time::SystemTime;
-use actix_web::post;
 use trifid_pki::cert::{
     deserialize_ed25519_public, deserialize_x25519_public, serialize_ed25519_public,
 };
 use trifid_pki::ed25519_dalek::{Signature, Verifier, VerifyingKey};
 use trifid_pki::x25519_dalek::PublicKey;
-use crate::crypt::DnclientKeyLockbox;
 
 #[derive(Serialize, Debug)]
-#[serde(untagged)]
 pub enum DnclientResponse {
     CheckForUpdateResp(CheckForUpdateResponseWrapper),
     DoUpdateResp(SignedResponseWrapper),
 }
 
-#[post("/v1/dnclient")]
 pub async fn dnclient_req(
     req: Json<RequestV1>,
     state: Data<AppState>,
@@ -57,7 +53,7 @@ pub async fn dnclient_req(
         .await
         .optional());
 
-    let host_key = match maybe_key {
+    let key = match maybe_key {
         Some(k) => k,
         None => {
             err!(
@@ -71,9 +67,8 @@ pub async fn dnclient_req(
     };
 
     let signature = handle_error!(Signature::from_slice(&req.signature));
-    let ed_pub = deserialize_ed25519_public(&host_key.client_ed_pub).unwrap();
     let key = handle_error!(VerifyingKey::from_bytes(
-        &ed_pub.try_into().unwrap()
+        &key.client_ed_pub.try_into().unwrap()
     ));
 
     if key.verify(req.message.as_bytes(), &signature).is_err() {
@@ -144,7 +139,7 @@ pub async fn dnclient_req(
                 id: randid!(id "hostkey"),
                 host_id: host.id.clone(),
                 counter: new_counter,
-                client_ed_pub: do_update_req.ed_pubkey_pem,
+                client_ed_pub: new_ed_key,
                 client_dh_pub: new_dh_pub_bytes,
                 client_cert: new_config.pki.cert.as_bytes().to_vec(),
                 salt: key_lockbox.nonce.clone(),
@@ -181,16 +176,10 @@ pub async fn dnclient_req(
 
             let msg_bytes = handle_error!(serde_json::to_vec(&msg));
 
-            let old_key_lockbox = DnclientKeyLockbox {
-                nonce: host_key.salt.clone(),
-                info: host_key.info.clone(),
-                key: host_key.server_ed_priv.clone()
-            };
-
             let resp = SignedResponse {
                 version: 1,
                 message: msg_bytes.clone(),
-                signature: sign_dnclient_with_lockbox(&old_key_lockbox, &msg_bytes, &state.config)
+                signature: sign_dnclient_with_lockbox(&key_lockbox, &msg_bytes, &state.config)
                     .unwrap().to_vec(),
             };
 

trifid-api/src/routes/v1/mod.rs

@@ -3,4 +3,4 @@ pub mod dnclient;
 pub mod networks;
 pub mod signup;
 pub mod totp_authenticators;
-pub mod verify_totp_authenticators;
+pub mod verify_totp_authenticator;

trifid-api/src/routes/v1/networks.rs

@@ -7,7 +7,7 @@ use crate::schema::signing_cas::dsl::signing_cas;
 use crate::schema::users;
 use crate::{auth, enforce, randid, AppState};
 use actix_web::web::{Data, Json};
-use actix_web::{HttpRequest, post};
+use actix_web::HttpRequest;
 use chrono::{DateTime, SecondsFormat, Utc};
 use diesel::{ExpressionMethods, QueryDsl, SelectableHelper};
 use diesel_async::RunQueryDsl;
@@ -25,7 +25,6 @@ pub struct CreateNetworkResp {
     pub data: NetworkNormalized,
 }
 
-#[post("/v1/networks")]
 pub async fn create_network_req(
     req: Json<CreateNetworkReq>,
     state: Data<AppState>,

trifid-api/src/routes/v1/verify_totp_authenticator.rs

@@ -33,7 +33,7 @@ pub struct TotpAuthResp {
     pub metadata: TotpAuthRespMeta,
 }
 
-#[post("/v1/verify-totp-authenticators")]
+#[post("/v1/verify-totp-authenticator")]
 pub async fn verify_totp_req(
     req: Json<VerifyTotpAuthReq>,
     state: Data<AppState>,

trifid-api/src/routes/v2/enroll.rs

@@ -12,11 +12,9 @@ use diesel::{ExpressionMethods, OptionalExtension, QueryDsl};
 use diesel_async::RunQueryDsl;
 use dnapi_rs::message::{EnrollRequest, EnrollResponse, EnrollResponseData, EnrollResponseDataOrg};
 use std::time::SystemTime;
-use actix_web::post;
+use trifid_pki::cert::serialize_ed25519_public;
-use trifid_pki::cert::{deserialize_x25519_public, serialize_ed25519_public};
 use trifid_pki::x25519_dalek::PublicKey;
 
-#[post("/v2/enroll")]
 pub async fn enroll_req(
     req: Json<EnrollRequest>,
     state: Data<AppState>,
@@ -86,9 +84,7 @@ pub async fn enroll_req(
 
     let (key_lockbox, trusted_key) = handle_error!(create_dnclient_ed_key(&state.config));
 
-    let dh_pubkey = deserialize_x25519_public(&req.dh_pubkey).unwrap();
+    let fixed_dh_key: [u8; 32] = req.dh_pubkey.clone().try_into().unwrap();
-
-    let fixed_dh_key: [u8; 32] = dh_pubkey.clone().try_into().unwrap();
 
     let user_dh_key = PublicKey::from(fixed_dh_key);
 

trifid_mobile_bridge/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "trifid_mobile_bridge"
-version = "0.1.0"
-edition = "2021"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-env_logger = "0.11"
-dnapi-rs = { version = "0.2", path = "../dnapi-rs" }
-serde = { version = "1", features = ["derive"] }
-toml = "0.8"
-inquire = { version = "0.6", features = ["editor"] }
-spinners = "4"
-colored = "2"

trifid_mobile_bridge/src/main.rs

@@ -1,95 +0,0 @@
-use std::io::{Read, stdin, stdout, Write};
-use std::path::PathBuf;
-use std::thread::sleep;
-use std::time::Duration;
-use colored::Colorize;
-use inquire::{Confirm, Editor, Text};
-use spinners::{Spinner, Spinners};
-
-fn main() {
-    env_logger::init();
-
-    // usage: trifid_mobile_bridge path_to_config <enroll|update>
-    let mut args = std::env::args();
-
-    println!("-=- Trifid Mobile Bridge -=-");
-
-    /*
-
-    mobile_nebula config settings:
-    - Site Name
-    - Identity
-        - Certificate
-            - Certificate Contents (QR)
-        - CA (QR)
-    - Static Hosts
-    - Advanced
-        - Lighthouse interval
-        - Listen port
-        - MTU
-        - Cipher
-        - Log verbosity
-        - Unsafe routes
-
-     */
-
-    if args.len() != 3 {
-        eprintln!("usage: {} <path_to_config> <enroll|update|settings>", args.next().unwrap());
-        std::process::exit(1);
-    }
-
-    let config_path = args.nth(1).unwrap();
-    let cmd = args.next().unwrap();
-
-    if cmd == "enroll" {
-
-        if PathBuf::from(config_path).exists() {
-            if !Confirm::new("Configuration already exists. Continuing will remove old data. Continue?").prompt().unwrap() {
-                println!("Aborting");
-                std::process::exit(1);
-            }
-        }
-        let api_server = Text::new("What API server should be used to initialize this configuration?").prompt().unwrap();
-        let enroll_code = Text::new("What enrollment code should be used to initialize this configuration?").prompt().unwrap();
-
-        println!("{}", "-- Manual configuration required --".bold().bright_yellow());
-        print!("{} Open the {} app on your mobile device {}", "1.".bold().bright_yellow(), "Mobile Nebula".bright_cyan().bold(), "[enter to continue]".bright_cyan().bold());
-        wait_enter();
-        print!("{} Click the plus in the top left to create a new site {}", "2.".bold().bright_yellow(), "[enter to continue]".bright_cyan().bold());
-        wait_enter();
-        print!("{} Enter a name for the new site you are creating {}", "3.".bold().bright_yellow(), "[enter to continue]".bright_cyan().bold());
-        wait_enter();
-        print!("{} Tap the {} item to view the public key (at the top) {}", "4.".bold().bright_yellow(), "Certificate".bright_cyan().bold(), "[enter to continue]".bright_cyan().bold());
-        wait_enter();
-
-        let pubkey = Editor::new("Please enter your mobile device's public key:")
-            .with_formatter(&|submission| {
-                let char_count = submission.chars().count();
-                if char_count == 0 {
-                    std::process::exit(1);
-                } else if char_count <= 20 {
-                    submission.into()
-                } else {
-                    let mut substr: String = submission.chars().take(17).collect();
-                    substr.push_str("...");
-                    substr
-                }
-            })
-            .prompt().unwrap();
-
-        let mut sp = Spinner::new(Spinners::Dots, "Contacting API for enrollment".into());
-        sleep(Duration::from_secs(10));
-    } else if cmd == "update" {
-
-    } else if cmd == "settings" {
-
-    } else {
-        eprintln!("usage: {} <path_to_config> <enroll|update|settings>", args.next().unwrap());
-        std::process::exit(1);
-    }
-}
-
-fn wait_enter() {
-    stdout().flush().unwrap();
-    let _ = stdin().read(&mut [0u8]).unwrap();
-}