tailscale

Commit Graph

Author	SHA1	Message	Date
Tom DNetto	e8a11f6181	tka: make rotation signatures use nested keyID Duplicating this at each layer doesnt make any sense, and is another invariant where things could go wrong. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	e3beb4429f	tka: Checkpoint every 50 updates Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	be95aebabd	tka: implement credential signatures (key material delegation) This will be needed to support preauth-keys with network lock in the future, so getting the core mechanics out of the way now. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	79905a1162	tka: make storage a parameter rather than an Authority struct member Updates #5435 Based on the discussion in #5435, we can better support transactional data models by making the underlying storage layer a parameter (which can be specialized for the request) rather than a long-lived member of Authority. Now that Authority is just an instantaneous snapshot of state, we can do things like provide idempotent methods and make it cloneable, too. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	f580f4484f	tka: move disablement logic out-of-band from AUMs It doesn't make a ton of sense for disablement to be communicated as an AUM, because any failure in the AUM or chain mechanism will mean disablement wont function. Instead, tracking of the disablement secrets remains inside the state machine, but actual disablement and communication of the disablement secret is done by the caller. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	472529af38	tka: optimize common case of processing updates built from head Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	a78f8fa701	tka: support rotating node-keys in node-key signatures Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	06eac9bbff	tka: Use strict decoding settings, implement Unserialize() Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	f50043f6cb	tka,types/key: remove dependency for tailcfg & types/ packages on tka Following the pattern elsewhere, we create a new tka-specific types package for the types that need to couple between the serialized structure types, and tka. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	8cfd775885	tka,types/key: implement direct node-key signatures Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	023d4e2216	tka,types/key: implement NLPrivate glue for tailnet key authority keys Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	44a9b0170b	tka: support processing non-primary forks, scenario-driven tests Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	165c8f898e	tka: implement Authority API surface After this, there should be one final PR to implement the Sync algorithm! Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	4f1374ec9e	tka: implement consensus & state computation internals Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	1cfd96cdc2	tka: implement AUM and Key types This is the first in a series of PRs implementing the internals for the Tailnet Key Authority. This PR implements the AUM and Key types, which are used by pretty much everything else. Future PRs: - The State type & related machinery - The Tailchonk (storage) type & implementation - The Authority type and sync implementation Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago

15 Commits (5e9e57ecf531f26692413ecddebfa6172550dd44)