You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina e89382897a cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342) ... * ipn/ipnlocal: don't fail profile unmarshal due to attestation keys (#18335) Soft-fail on initial unmarshal and try again, ignoring the AttestationKey. This helps in cases where something about the attestation key storage (usually a TPM) is messed up. The old key will be lost, but at least the node can start again. Updates #18302 Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> (cherry picked from commit 2e77b75e96) * cmd/tailscaled: disable state encryption / attestation by default (#18336) TPM-based features have been incredibly painful due to the heterogeneous devices in the wild, and many situations in which the TPM "changes" (is reset or replaced). All of this leads to a lot of customer issues. We hoped to iron out all the kinks and get all users to benefit from state encryption and hardware attestation without manually opting in, but the long tail of kinks is just too long. This change disables TPM-based features on Windows and Linux by default. Node state should get auto-decrypted on update, and old attestation keys will be removed. There's also tailscaled-on-macOS, but it won't have a TPM or Keychain bindings anyway. Updates #18302 Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> (cherry picked from commit 68617bb82e) * cmd/tailscaled,ipn/{ipnlocal,store/kubestore}: don't create attestation keys for stores that are not bound to a node (#18322) Ensure that hardware attestation keys are not added to tailscaled state stores that are Kubernetes Secrets or AWS SSM as those Tailscale devices should be able to be recreated on different nodes, for example, when moving Pods between nodes. Updates tailscale/tailscale#18302 Signed-off-by: Irbe Krumina <irbekrm@gmail.com> (cherry picked from commit 8ea90ba80d) --------- Signed-off-by: Andrew Lytvynov <awly@tailscale.com> Signed-off-by: Irbe Krumina <irbekrm@gmail.com> Co-authored-by: Andrew Lytvynov <awly@tailscale.com>		1 week ago
..
auditlog	syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging	2 months ago
conffile	cmd/tailscale/cli,ipn/conffile: add declarative config mode for Services (#17435)	3 months ago
desktop	go.mod: bump golang.org/x/crypto (#17907)	2 months ago
ipnauth	all: use buildfeature constants in a few more places	3 months ago
ipnext	ipn/ipnlocal: remove all the weird locking (LockedOnEntry, UnlockEarly, etc)	2 months ago
ipnlocal	cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342)	1 week ago
ipnserver	feature/featuretags, all: add build features, use existing ones in more places	3 months ago
ipnstate	cmd/tailscale, ipn/ipnstate, wgengine/magicsock: update ping output for peer relay (#16515)	6 months ago
lapitest	various: allow tailscaled shutdown via LocalAPI	4 months ago
localapi	cmd/tailscaled,ipn: show a health warning when state store fails to open (#17883)	2 months ago
policy	ipn,tailconfig: clean up unreleased and removed app connector service	2 years ago
store	cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342)	1 week ago
backend.go	types/netmap: remove PrivateKey from NetworkMap	2 months ago
backend_test.go	ipn: fix the string representation of an empty ipn.Notify	4 months ago
conf.go	ipn: ensure that conffile is source of truth for advertised services. (#15361)	10 months ago
doc.go	ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate	12 months ago
ipn_clone.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	2 months ago
ipn_test.go	all: do not depend on the testing package	2 years ago
ipn_view.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	2 months ago
prefs.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	2 months ago
prefs_test.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	2 months ago
serve.go	ipn/serve: validate service paths in HasPathHandler	2 months ago
serve_test.go	ipn/serve: validate service paths in HasPathHandler	2 months ago
store.go	cmd/tailscaled,ipn: show a health warning when state store fails to open (#17883)	2 months ago
store_test.go	ipn/store: automatically migrate between plaintext and encrypted state (#16318)	7 months ago