You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Anton Tolchanov 151b77f9d6 cmd/tl-longchain: tool to re-sign nodes with long rotation signatures ... In Tailnet Lock, there is an implicit limit on the number of rotation signatures that can be chained before the signature becomes too long. This program helps tailnet admins to identify nodes that have signatures with long chains and prints commands to re-sign those node keys with a fresh direct signature. It's a temporary mitigation measure, and we will remove this tool as we design and implement a long-term approach for rotation signatures. Example output: ``` 2024/08/20 18:25:03 Self: does not need re-signing 2024/08/20 18:25:03 Visible peers with valid signatures: 2024/08/20 18:25:03 Peer xxx2.yy.ts.net. (100.77.192.34) nodeid=nyDmhiZiGA11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx3.yy.ts.net. (100.84.248.22) nodeid=ndQ64mDnaB11KTM59, current signature kind=direct: does not need re-signing 2024/08/20 18:25:03 Peer xxx4.yy.ts.net. (100.85.253.53) nodeid=nmZfVygzkB21KTM59, current signature kind=rotation: chain length 4, printing command to re-sign tailscale lock sign nodekey:530bddbfbe69e91fe15758a1d6ead5337aa6307e55ac92dafad3794f8b3fc661 tlpub:4bf07597336703395f2149dce88e7c50dd8694ab5bbde3d7c2a1c7b3e231a3c2 ``` To support this, the NetworkLockStatus localapi response now includes information about signatures of all peers rather than just the invalid ones. This is not displayed by default in `tailscale lock status`, but will be surfaced in `tailscale lock status --json`. Updates #13185 Signed-off-by: Anton Tolchanov <anton@tailscale.com>		2 months ago
..
testdata	ipn/ipnlocal: fix the path for writing cert files (#7203)	2 years ago
autoupdate.go	clientupdate: return true for CanAutoUpdate for macsys (#12746)	4 months ago
autoupdate_disabled.go	ipn/ipnlocal: periodically run auto-updates when "offline" (#12118)	5 months ago
breaktcp_darwin.go	cmd/tailscale: add debug commands to break connections	1 year ago
breaktcp_linux.go	cmd/tailscale: add debug commands to break connections	1 year ago
c2n.go	posture: add network hardware addresses to posture identity	4 months ago
c2n_pprof.go	ipn/ipnlocal: add c2n /debug/pprof/allocs endpoint	7 months ago
c2n_test.go	util/cmpx: delete now that we're using Go 1.22	9 months ago
cert.go	cmd/tailscale: add --min-validity flag to the cert command (#12822)	3 months ago
cert_js.go	ipn/ipnlocal: add c2n method to check on TLS cert fetch status	11 months ago
cert_test.go	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}	1 year ago
dnsconfig_test.go	util/cmpx: delete now that we're using Go 1.22	9 months ago
drive.go	ipn/ipnlocal: reuse transport across Taildrive remotes	6 months ago
expiry.go	ssh/tailssh: use control server time instead of local time	11 months ago
expiry_test.go	types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeView	1 year ago
local.go	ipnlocal: support setting authkey at login using syspolicy (#13061)	2 months ago
local_test.go	ipn/ipnlocal: check for offline auto exit node in SetControlClientStatus (#12772)	3 months ago
loglines_test.go	ipn/ipnlocal, all: plumb health trackers in tests	6 months ago
network-lock.go	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	2 months ago
network-lock_test.go	ipn/ipnlocal: allow multiple signature chains from the same SigCredential	4 months ago
peerapi.go	proxymap, various: distinguish between different protocols	4 months ago
peerapi_h2c.go	all: update copyright and license headers	2 years ago
peerapi_macios_ext.go	net/netmon, add: add netmon.State type alias of interfaces.State	6 months ago
peerapi_test.go	ipn/ipnlocal, all: plumb health trackers in tests	6 months ago
profiles.go	health,ipn/ipnlocal: hide update warning when auto-updates are enabled (#12631)	4 months ago
profiles_notwindows.go	ipn/ipnlocal: fix profile duplication	1 year ago
profiles_test.go	various: disable stateful filtering by default (#12197)	5 months ago
profiles_windows.go	ipn/ipnlocal: set default NoStatefulFiltering in ipn.NewPrefs (#12031)	6 months ago
serve.go	cmd/tsidp: add funnel support (#12591)	3 months ago
serve_test.go	ipn/ipnlocal: fix data race in tests	4 months ago
ssh.go	ipnlocal: log failure to get ssh host keys	9 months ago
ssh_stub.go	ipnlocal: log failure to get ssh host keys	9 months ago
ssh_test.go	ipn/ipnlocal: plumb health.Tracker into profileManager constructor	6 months ago
state_test.go	control/controlclient: delete unused Client.Login Oauth2Token field	5 months ago
taildrop.go	ipn/localapi: add support for multipart POST to file-put	7 months ago
web_client.go	all: remove LenIter, use Go 1.22 range-over-int instead	8 months ago
web_client_stub.go	ipn/ipnlocal: add mutex to webClient struct	11 months ago