You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Anton Tolchanov 151b77f9d6 cmd/tl-longchain: tool to re-sign nodes with long rotation signatures ... In Tailnet Lock, there is an implicit limit on the number of rotation signatures that can be chained before the signature becomes too long. This program helps tailnet admins to identify nodes that have signatures with long chains and prints commands to re-sign those node keys with a fresh direct signature. It's a temporary mitigation measure, and we will remove this tool as we design and implement a long-term approach for rotation signatures. Example output: ``` 2024/08/20 18:25:03 Self: does not need re-signing 2024/08/20 18:25:03 Visible peers with valid signatures: 2024/08/20 18:25:03 Peer xxx2.yy.ts.net. (100.77.192.34) nodeid=nyDmhiZiGA11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx3.yy.ts.net. (100.84.248.22) nodeid=ndQ64mDnaB11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx4.yy.ts.net. (100.85.253.53) nodeid=nmZfVygzkB21KTM59, current signature kind=rotation: chain length 4, printing command to re-sign tailscale lock sign nodekey:530bddbfbe69e91fe15758a1d6ead5337aa6307e55ac92dafad3794f8b3fc661 tlpub:4bf07597336703395f2149dce88e7c50dd8694ab5bbde3d7c2a1c7b3e231a3c2 ``` To support this, the NetworkLockStatus localapi response now includes information about signatures of all peers rather than just the invalid ones. This is not displayed by default in `tailscale lock status`, but will be surfaced in `tailscale lock status --json`. Updates #13185 Signed-off-by: Anton Tolchanov <anton@tailscale.com>		1 year ago
..
addlicense	all: update tools that manage copyright headers	3 years ago
build-webclient	client/web: precompress assets	2 years ago
cloner	cmd/cloner, cmd/viewer: add _test prefix for files generated with the test build tag	1 year ago
connector-gen	cmd/connector-gen: add helper tool for wide app connector configurations	2 years ago
containerboot	cmd/containerboot: optionally serve health check endpoint (#12899)	1 year ago
derper	go.{mod,sum}: migrate from nhooyr.io/websocket to github.com/coder/websocket	1 year ago
derpprobe	cmd/derpprobe: use a status page from the prober library	1 year ago
dist	release/dist/qnap: add qnap target builder	2 years ago
get-authkey	util/cmpx: delete now that we're using Go 1.22	2 years ago
gitops-pusher	cmd/gitops-pusher: ignore previous etag if local acls match control (#13068)	1 year ago
hello	cmd/hello: link to the Hello KB article (#11022)	2 years ago
k8s-nameserver	cmd/k8s-nameserver: fix AAAA record query response (#12412)	2 years ago
k8s-operator	net/tstun,wgengine{/netstack/gro}: refactor and re-enable gVisor GRO for Linux (#13172)	1 year ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	3 years ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	2 years ago
mkversion	version/mkversion: open-source version generation logic	3 years ago
nardump	all: update copyright and license headers	3 years ago
natc	go.mod: bump bart	1 year ago
netlogfmt	all: use Go 1.22 range-over-int	2 years ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	3 years ago
pgproxy	tsnet: split user facing and backend logging	2 years ago
printdep	cmd/printdep: print correct toolchain URL	3 years ago
proxy-to-grafana	cmd/proxy-to-grafana: add flag for alternative control server	1 year ago
sniproxy	all: use math/rand/v2 more	2 years ago
speedtest	all: update copyright and license headers	3 years ago
ssh-auth-none-demo	all: replace deprecated ioutil references	2 years ago
stunc	cmd/stunc: support user-specified port (#12469)	1 year ago
stund	types/opt: add generic Value[T any] for optional values of any types	1 year ago
stunstamp	cmd/stunstamp: refactor connection construction (#13110)	1 year ago
sync-containers	all: adjust some build tags for plan9	2 years ago
tailscale	go.{mod,sum}: migrate from nhooyr.io/websocket to github.com/coder/websocket	1 year ago
tailscaled	net/tstun,wgengine{/netstack/gro}: refactor and re-enable gVisor GRO for Linux (#13172)	1 year ago
testcontrol	all: use Go 1.22 range-over-int	2 years ago
testwrapper	cmd/testwrapper: apply results of all unit tests to coverage for all packages	2 years ago
tl-longchain	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	1 year ago
tsconnect	all: use math/rand/v2 more	2 years ago
tsidp	cmd/tsidp: add funnel support (#12591)	1 year ago
tsshd	all: update copyright and license headers	3 years ago
tta	cmd/tta, vnet: add host firewall, env var support, more tests	1 year ago
viewer	cmd/viewer: add support for map-like container types	1 year ago
vnet	gokrazy,tstest/integration/nat: add Gokrazy appliance just for natlab	1 year ago
xdpderper	all: add test for package comments, fix, add comments as needed	1 year ago