mirror of
https://github.com/slackhq/nebula.git
synced 2024-11-10 17:24:37 +08:00
e0185c4b01
* Support NIST curve P256 This change adds support for NIST curve P256. When you use `nebula-cert ca` or `nebula-cert keygen`, you can specify `-curve P256` to enable it. The curve to use is based on the curve defined in your CA certificate. Internally, we use ECDSA P256 to sign certificates, and ECDH P256 to do Noise handshakes. P256 is not supported natively in Noise Protocol, so we define `DHP256` in the `noiseutil` package to implement support for it. You cannot have a mixed network of Curve25519 and P256 certificates, since the Noise protocol will only attempt to parse using the Curve defined in the host's certificate. * verify the curves match in VerifyPrivateKey This would have failed anyways once we tried to actually use the bytes in the private key, but its better to detect the issue up front with a better error message. * add cert.Curve argument to Sign method * fix mismerge * use crypto/ecdh This is the preferred method for doing ECDH functions now, and also has a boringcrypto specific codepath. * remove other ecdh uses of crypto/elliptic use crypto/ecdh instead
194 lines
5.3 KiB
Makefile
194 lines
5.3 KiB
Makefile
GOMINVERSION = 1.20
|
|
NEBULA_CMD_PATH = "./cmd/nebula"
|
|
GO111MODULE = on
|
|
export GO111MODULE
|
|
CGO_ENABLED = 0
|
|
export CGO_ENABLED
|
|
|
|
# Set up OS specific bits
|
|
ifeq ($(OS),Windows_NT)
|
|
#TODO: we should be able to ditch awk as well
|
|
GOVERSION := $(shell go version | awk "{print substr($$3, 3)}")
|
|
GOISMIN := $(shell IF "$(GOVERSION)" GEQ "$(GOMINVERSION)" ECHO 1)
|
|
NEBULA_CMD_SUFFIX = .exe
|
|
NULL_FILE = nul
|
|
else
|
|
GOVERSION := $(shell go version | awk '{print substr($$3, 3)}')
|
|
GOISMIN := $(shell expr "$(GOVERSION)" ">=" "$(GOMINVERSION)")
|
|
NEBULA_CMD_SUFFIX =
|
|
NULL_FILE = /dev/null
|
|
endif
|
|
|
|
# Only defined the build number if we haven't already
|
|
ifndef BUILD_NUMBER
|
|
ifeq ($(shell git describe --exact-match 2>$(NULL_FILE)),)
|
|
BUILD_NUMBER = $(shell git describe --abbrev=0 --match "v*" | cut -dv -f2)-$(shell git branch --show-current)-$(shell git describe --long --dirty | cut -d- -f2-)
|
|
else
|
|
BUILD_NUMBER = $(shell git describe --exact-match --dirty | cut -dv -f2)
|
|
endif
|
|
endif
|
|
|
|
LDFLAGS = -X main.Build=$(BUILD_NUMBER)
|
|
|
|
ALL_LINUX = linux-amd64 \
|
|
linux-386 \
|
|
linux-ppc64le \
|
|
linux-arm-5 \
|
|
linux-arm-6 \
|
|
linux-arm-7 \
|
|
linux-arm64 \
|
|
linux-mips \
|
|
linux-mipsle \
|
|
linux-mips64 \
|
|
linux-mips64le \
|
|
linux-mips-softfloat \
|
|
linux-riscv64
|
|
|
|
ALL = $(ALL_LINUX) \
|
|
darwin-amd64 \
|
|
darwin-arm64 \
|
|
freebsd-amd64 \
|
|
windows-amd64 \
|
|
windows-arm64
|
|
|
|
e2e:
|
|
$(TEST_ENV) go test -tags=e2e_testing -count=1 $(TEST_FLAGS) ./e2e
|
|
|
|
e2ev: TEST_FLAGS = -v
|
|
e2ev: e2e
|
|
|
|
e2evv: TEST_ENV += TEST_LOGS=1
|
|
e2evv: e2ev
|
|
|
|
e2evvv: TEST_ENV += TEST_LOGS=2
|
|
e2evvv: e2ev
|
|
|
|
e2evvvv: TEST_ENV += TEST_LOGS=3
|
|
e2evvvv: e2ev
|
|
|
|
e2e-bench: TEST_FLAGS = -bench=. -benchmem -run=^$
|
|
e2e-bench: e2e
|
|
|
|
all: $(ALL:%=build/%/nebula) $(ALL:%=build/%/nebula-cert)
|
|
|
|
release: $(ALL:%=build/nebula-%.tar.gz)
|
|
|
|
release-linux: $(ALL_LINUX:%=build/nebula-%.tar.gz)
|
|
|
|
release-freebsd: build/nebula-freebsd-amd64.tar.gz
|
|
|
|
release-boringcrypto: build/nebula-linux-$(shell go env GOARCH)-boringcrypto.tar.gz
|
|
|
|
BUILD_ARGS = -trimpath
|
|
|
|
bin-windows: build/windows-amd64/nebula.exe build/windows-amd64/nebula-cert.exe
|
|
mv $? .
|
|
|
|
bin-windows-arm64: build/windows-arm64/nebula.exe build/windows-arm64/nebula-cert.exe
|
|
mv $? .
|
|
|
|
bin-darwin: build/darwin-amd64/nebula build/darwin-amd64/nebula-cert
|
|
mv $? .
|
|
|
|
bin-freebsd: build/freebsd-amd64/nebula build/freebsd-amd64/nebula-cert
|
|
mv $? .
|
|
|
|
bin-boringcrypto: build/linux-$(shell go env GOARCH)-boringcrypto/nebula build/linux-$(shell go env GOARCH)-boringcrypto/nebula-cert
|
|
mv $? .
|
|
|
|
bin:
|
|
go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula${NEBULA_CMD_SUFFIX} ${NEBULA_CMD_PATH}
|
|
go build $(BUILD_ARGS) -ldflags "$(LDFLAGS)" -o ./nebula-cert${NEBULA_CMD_SUFFIX} ./cmd/nebula-cert
|
|
|
|
install:
|
|
go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ${NEBULA_CMD_PATH}
|
|
go install $(BUILD_ARGS) -ldflags "$(LDFLAGS)" ./cmd/nebula-cert
|
|
|
|
build/linux-arm-%: GOENV += GOARM=$(word 3, $(subst -, ,$*))
|
|
build/linux-mips-%: GOENV += GOMIPS=$(word 3, $(subst -, ,$*))
|
|
|
|
# Build an extra small binary for mips-softfloat
|
|
build/linux-mips-softfloat/%: LDFLAGS += -s -w
|
|
|
|
# boringcrypto
|
|
build/linux-amd64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1
|
|
build/linux-arm64-boringcrypto/%: GOENV += GOEXPERIMENT=boringcrypto CGO_ENABLED=1
|
|
|
|
build/%/nebula: .FORCE
|
|
GOOS=$(firstword $(subst -, , $*)) \
|
|
GOARCH=$(word 2, $(subst -, ,$*)) $(GOENV) \
|
|
go build $(BUILD_ARGS) -o $@ -ldflags "$(LDFLAGS)" ${NEBULA_CMD_PATH}
|
|
|
|
build/%/nebula-cert: .FORCE
|
|
GOOS=$(firstword $(subst -, , $*)) \
|
|
GOARCH=$(word 2, $(subst -, ,$*)) $(GOENV) \
|
|
go build $(BUILD_ARGS) -o $@ -ldflags "$(LDFLAGS)" ./cmd/nebula-cert
|
|
|
|
build/%/nebula.exe: build/%/nebula
|
|
mv $< $@
|
|
|
|
build/%/nebula-cert.exe: build/%/nebula-cert
|
|
mv $< $@
|
|
|
|
build/nebula-%.tar.gz: build/%/nebula build/%/nebula-cert
|
|
tar -zcv -C build/$* -f $@ nebula nebula-cert
|
|
|
|
build/nebula-%.zip: build/%/nebula.exe build/%/nebula-cert.exe
|
|
cd build/$* && zip ../nebula-$*.zip nebula.exe nebula-cert.exe
|
|
|
|
vet:
|
|
go vet -v ./...
|
|
|
|
test:
|
|
go test -v ./...
|
|
|
|
test-cov-html:
|
|
go test -coverprofile=coverage.out
|
|
go tool cover -html=coverage.out
|
|
|
|
bench:
|
|
go test -bench=.
|
|
|
|
bench-cpu:
|
|
go test -bench=. -benchtime=5s -cpuprofile=cpu.pprof
|
|
go tool pprof go-audit.test cpu.pprof
|
|
|
|
bench-cpu-long:
|
|
go test -bench=. -benchtime=60s -cpuprofile=cpu.pprof
|
|
go tool pprof go-audit.test cpu.pprof
|
|
|
|
proto: nebula.pb.go cert/cert.pb.go
|
|
|
|
nebula.pb.go: nebula.proto .FORCE
|
|
go build github.com/gogo/protobuf/protoc-gen-gogofaster
|
|
PATH="$(CURDIR):$(PATH)" protoc --gogofaster_out=paths=source_relative:. $<
|
|
rm protoc-gen-gogofaster
|
|
|
|
cert/cert.pb.go: cert/cert.proto .FORCE
|
|
$(MAKE) -C cert cert.pb.go
|
|
|
|
service:
|
|
@echo > $(NULL_FILE)
|
|
$(eval NEBULA_CMD_PATH := "./cmd/nebula-service")
|
|
ifeq ($(words $(MAKECMDGOALS)),1)
|
|
@$(MAKE) service ${.DEFAULT_GOAL} --no-print-directory
|
|
endif
|
|
|
|
bin-docker: bin build/linux-amd64/nebula build/linux-amd64/nebula-cert
|
|
|
|
smoke-docker: bin-docker
|
|
cd .github/workflows/smoke/ && ./build.sh
|
|
cd .github/workflows/smoke/ && ./smoke.sh
|
|
cd .github/workflows/smoke/ && NAME="smoke-p256" CURVE="P256" ./build.sh
|
|
cd .github/workflows/smoke/ && NAME="smoke-p256" ./smoke.sh
|
|
|
|
smoke-relay-docker: bin-docker
|
|
cd .github/workflows/smoke/ && ./build-relay.sh
|
|
cd .github/workflows/smoke/ && ./smoke-relay.sh
|
|
|
|
smoke-docker-race: BUILD_ARGS = -race
|
|
smoke-docker-race: smoke-docker
|
|
|
|
.FORCE:
|
|
.PHONY: e2e e2ev e2evv e2evvv e2evvvv test test-cov-html bench bench-cpu bench-cpu-long bin proto release service smoke-docker smoke-docker-race
|
|
.DEFAULT_GOAL := bin
|