You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Anton Tolchanov 151b77f9d6 cmd/tl-longchain: tool to re-sign nodes with long rotation signatures ... In Tailnet Lock, there is an implicit limit on the number of rotation signatures that can be chained before the signature becomes too long. This program helps tailnet admins to identify nodes that have signatures with long chains and prints commands to re-sign those node keys with a fresh direct signature. It's a temporary mitigation measure, and we will remove this tool as we design and implement a long-term approach for rotation signatures. Example output: ``` 2024/08/20 18:25:03 Self: does not need re-signing 2024/08/20 18:25:03 Visible peers with valid signatures: 2024/08/20 18:25:03 Peer xxx2.yy.ts.net. (100.77.192.34) nodeid=nyDmhiZiGA11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx3.yy.ts.net. (100.84.248.22) nodeid=ndQ64mDnaB11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx4.yy.ts.net. (100.85.253.53) nodeid=nmZfVygzkB21KTM59, current signature kind=rotation: chain length 4, printing command to re-sign tailscale lock sign nodekey:530bddbfbe69e91fe15758a1d6ead5337aa6307e55ac92dafad3794f8b3fc661 tlpub:4bf07597336703395f2149dce88e7c50dd8694ab5bbde3d7c2a1c7b3e231a3c2 ``` To support this, the NetworkLockStatus localapi response now includes information about signatures of all peers rather than just the invalid ones. This is not displayed by default in `tailscale lock status`, but will be surfaced in `tailscale lock status --json`. Updates #13185 Signed-off-by: Anton Tolchanov <anton@tailscale.com>		2 months ago
..
conffile	cmd/tailscaled, ipn/conffile: support ec2 user-data config file	5 months ago
ipnauth	go.mod, all: move away from inet.af domain seized by Taliban	8 months ago
ipnlocal	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	2 months ago
ipnserver	all: add test for package comments, fix, add comments as needed	4 months ago
ipnstate	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	2 months ago
localapi	ipn/localapi: only flush relevant data in multiFilePostResponseWriter.Flush()	2 months ago
policy	ipn,tailconfig: clean up unreleased and removed app connector service	12 months ago
store	all: add test for package comments, fix, add comments as needed	4 months ago
backend.go	health: begin work to use structured health warnings instead of strings, pipe changes into ipn.Notify (#12406)	4 months ago
conf.go	ipn,wgengine/magicsock: allow setting static node endpoints via tailscaled configfile (#12882)	3 months ago
doc.go	all: update copyright and license headers	2 years ago
ipn_clone.go	cmd/cloner, cmd/viewer, util/codegen: add support for generic types and interfaces	3 months ago
ipn_test.go	all: do not depend on the testing package	5 months ago
ipn_view.go	ipn,wgengine: remove vestigial Prefs.AllowSingleHosts	5 months ago
prefs.go	ipn: allow FQDN in exit node selection	3 months ago
prefs_test.go	ipn: allow FQDN in exit node selection	3 months ago
serve.go	cmd/serve: don't convert localhost to 127.0.0.1	4 months ago
serve_test.go	cmd/serve: don't convert localhost to 127.0.0.1	4 months ago
store.go	ipn: add comment about thread-safety to StateStore	8 months ago
store_test.go	ipn: avoid useless no-op WriteState calls	1 year ago