11 Commits (6d0418432578071d7c1baa3b14db37c484f73f7d)

Author	SHA1	Message	Date
Tom DNetto	e9b98dd2e1	control/controlclient,ipn/ipnlocal: wire tka enable/disable ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	f580f4484f	tka: move disablement logic out-of-band from AUMs ... It doesn't make a ton of sense for disablement to be communicated as an AUM, because any failure in the AUM or chain mechanism will mean disablement wont function. Instead, tracking of the disablement secrets remains inside the state machine, but actual disablement and communication of the disablement secret is done by the caller. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	facafd8819	client,cmd/tailscale,ipn,tka,types: implement tka initialization flow ... This PR implements the client-side of initializing network-lock with the Coordination server. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	06eac9bbff	tka: Use strict decoding settings, implement Unserialize() ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
David Crawshaw	15b8665787	tka: stable text representation of AUMHash ... This makes debugging easier, you can pass an AUMHash to a printf and get a string that is easy to debug. Also rearrange how directories/files work in the FS store: use the first two characters of the string representation as the prefix directory, and use the entire AUMHash string as the file name. This is again to aid debugging: you can `ls` a directory and line up what prints out easily with what you get from a printf in debug code. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Tom DNetto	f50043f6cb	tka,types/key: remove dependency for tailcfg & types/ packages on tka ... Following the pattern elsewhere, we create a new tka-specific types package for the types that need to couple between the serialized structure types, and tka. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	c13fab2a67	tka: add attack-scenario unit tests, defensive checks, resolve TODOs ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	023d4e2216	tka,types/key: implement NLPrivate glue for tailnet key authority keys ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	165c8f898e	tka: implement Authority API surface ... After this, there should be one final PR to implement the Sync algorithm! Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	3709074e55	tka: implement State and applying AUMs ... Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	1cfd96cdc2	tka: implement AUM and Key types ... This is the first in a series of PRs implementing the internals for the Tailnet Key Authority. This PR implements the AUM and Key types, which are used by pretty much everything else. Future PRs: - The State type & related machinery - The Tailchonk (storage) type & implementation - The Authority type and sync implementation Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago