tailscale

Commit Graph

Author	SHA1	Message	Date
Tom DNetto	be95aebabd	tka: implement credential signatures (key material delegation) This will be needed to support preauth-keys with network lock in the future, so getting the core mechanics out of the way now. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	7ca17b6bdb	tka: validate key after UpdateKey before applying state Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	79905a1162	tka: make storage a parameter rather than an Authority struct member Updates #5435 Based on the discussion in #5435, we can better support transactional data models by making the underlying storage layer a parameter (which can be specialized for the request) rather than a long-lived member of Authority. Now that Authority is just an instantaneous snapshot of state, we can do things like provide idempotent methods and make it cloneable, too. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	f580f4484f	tka: move disablement logic out-of-band from AUMs It doesn't make a ton of sense for disablement to be communicated as an AUM, because any failure in the AUM or chain mechanism will mean disablement wont function. Instead, tracking of the disablement secrets remains inside the state machine, but actual disablement and communication of the disablement secret is done by the caller. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	472529af38	tka: optimize common case of processing updates built from head Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	a78f8fa701	tka: support rotating node-keys in node-key signatures Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	facafd8819	client,cmd/tailscale,ipn,tka,types: implement tka initialization flow This PR implements the client-side of initializing network-lock with the Coordination server. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	06eac9bbff	tka: Use strict decoding settings, implement Unserialize() Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
David Crawshaw	15b8665787	tka: stable text representation of AUMHash This makes debugging easier, you can pass an AUMHash to a printf and get a string that is easy to debug. Also rearrange how directories/files work in the FS store: use the first two characters of the string representation as the prefix directory, and use the entire AUMHash string as the file name. This is again to aid debugging: you can `ls` a directory and line up what prints out easily with what you get from a printf in debug code. Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	2 years ago
Tom DNetto	f50043f6cb	tka,types/key: remove dependency for tailcfg & types/ packages on tka Following the pattern elsewhere, we create a new tka-specific types package for the types that need to couple between the serialized structure types, and tka. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	8cfd775885	tka,types/key: implement direct node-key signatures Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	c13fab2a67	tka: add attack-scenario unit tests, defensive checks, resolve TODOs Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	4001d0bf25	assorted: plumb tka initialization & network-lock key into tailscaled - A network-lock key is generated if it doesn't already exist, and stored in the StateStore. The public component is communicated to control during registration. - If TKA state exists on the filesystem, a tailnet key authority is initialized (but nothing is done with it for now). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	023d4e2216	tka,types/key: implement NLPrivate glue for tailnet key authority keys Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	44a9b0170b	tka: support processing non-primary forks, scenario-driven tests Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	5e61d52f91	tka: implement API surface for generating updates Based on the builder pattern. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	393a229de9	tka: implement synchronization mechanics This PR implements the synchronization mechanics for TKA: generating a SyncOffer, processing a SyncOffer to find an intersection, and computing the set of AUMs that should be transmitted to effect convergence. This is the final PR implementing core mechanics for TKA. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	165c8f898e	tka: implement Authority API surface After this, there should be one final PR to implement the Sync algorithm! Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	4f1374ec9e	tka: implement consensus & state computation internals Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	ec4f849079	tka: implement filesystem-based tailchonk implementation FS implements Chonk, and given the expected load characteristics (frequent use of AUM() + ChildAUMs(), and infrequent use of Heads() + CommitVerifiedAUMs()), the implementation avoids scanning the filesystem to service AUM() and ChildAUMs(). Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	cca25f6107	tka: implement Chonk type & an in-memory implementation Chonks are responsible for efficient storage of AUMs and other TKA state. For testing/prototyping I've implemented an in-memory version, but once we start to use this from tailscaled we'll need a file-based version. Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	3709074e55	tka: implement State and applying AUMs Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago
Tom DNetto	1cfd96cdc2	tka: implement AUM and Key types This is the first in a series of PRs implementing the internals for the Tailnet Key Authority. This PR implements the AUM and Key types, which are used by pretty much everything else. Future PRs: - The State type & related machinery - The Tailchonk (storage) type & implementation - The Authority type and sync implementation Signed-off-by: Tom DNetto <tom@tailscale.com>	2 years ago

23 Commits (9240f5c1e20bac3ecf945a58a447f53157f68e14)