9 Commits (adda2d2a51de70545958b8a0a005be95855ffd5b)

Author	SHA1	Message	Date
Adrian Dewhurst	adda2d2a51	control/controlclient: select newer certificate ... If multiple certificates match when selecting a certificate, use the one issued the most recently (as determined by the NotBefore timestamp). This also adds some tests for the function that performs that comparison. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Adrian Dewhurst	4da559d7cc	control/controlclient: update machine certificate signature version ... This iterates on the original signature format. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	3 years ago
Dave Anderson	980acc38ba	types/key: add a special key with custom serialization for control private keys (#2792) ... * Revert "Revert "types/key: add MachinePrivate and MachinePublic."" This reverts commit 61c3b98a24. Signed-off-by: David Anderson <danderson@tailscale.com> * types/key: add ControlPrivate, with custom serialization. ControlPrivate is just a MachinePrivate that serializes differently in JSON, to be compatible with how the Tailscale control plane historically serialized its private key. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
David Anderson	61c3b98a24	Revert "types/key: add MachinePrivate and MachinePublic." ... Broke the tailscale control plane due to surprise different serialization. This reverts commit 4fdb88efe1.	3 years ago
David Anderson	4fdb88efe1	types/key: add MachinePrivate and MachinePublic. ... Plumb throughout the codebase as a replacement for the mixed use of tailcfg.MachineKey and wgkey.Private/Public. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Josh Bleecher Snyder	a5da4ed981	all: gofmt with Go 1.17 ... This adds "//go:build" lines and tidies up existing "// +build" lines. Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>	3 years ago
Adrian Dewhurst	6d6cf88d82	control/controlclient: use our fork of certstore ... The cyolosecurity fork of certstore did not update its module name and thus can only be used with a replace directive. This interferes with installing using `go install` so I created a tailscale fork with an updated module name. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Adrian Dewhurst	3f456ba2e7	control/controlclient: return correct certificate ... When searching for the matching client identity, the returned certificate chain was accidentally set to that of the last identity returned by the certificate store instead of the one corresponding to the selected identity. Also, add some extra error checking for invalid certificate chains, just in case. Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago
Adrian Dewhurst	04dd6d1dae	control/controlclient: sign RegisterRequest (#1549) ... control/controlclient: sign RegisterRequest Some customers wish to verify eligibility for devices to join their tailnets using machine identity certificates. TLS client certs could potentially fulfill this role but the initial customer for this feature has technical requirements that prevent their use. Instead, the certificate is loaded from the Windows local machine certificate store and uses its RSA public key to sign the RegisterRequest message. There is room to improve the flexibility of this feature in future and it is currently only tested on Windows (although Darwin theoretically works too), but this offers a reasonable starting place for now. Updates tailscale/coral#6 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	4 years ago