You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Anton Tolchanov 01847e0123 ipn/ipnlocal: discard node keys that have been rotated out ... A non-signing node can be allowed to re-sign its new node keys following key renewal/rotation (e.g. via `tailscale up --force-reauth`). To be able to do this, node's TLK is written into WrappingPubkey field of the initial SigDirect signature, signed by a signing node. The intended use of this field implies that, for each WrappingPubkey, we typically expect to have at most one active node with a signature tracing back to that key. Multiple valid signatures referring to the same WrappingPubkey can occur if a client's state has been cloned, but it's something we explicitly discourage and don't support: https://tailscale.com/s/clone This change propagates rotation details (wrapping public key, a list of previous node keys that have been rotated out) to netmap processing, and adds tracking of obsolete node keys that, when found, will get filtered out. Updates tailscale/corp#19764 Signed-off-by: Anton Tolchanov <anton@tailscale.com>		6 months ago
..
conffile	cmd/tailscaled, ipn/conffile: support ec2 user-data config file	6 months ago
ipnauth	go.mod, all: move away from inet.af domain seized by Taliban	9 months ago
ipnlocal	ipn/ipnlocal: discard node keys that have been rotated out	6 months ago
ipnserver	ipn/ipnserver: close a small race in ipnserver, ~simplify code	6 months ago
ipnstate	cmd/tailscale/cli: print node signature in `tailscale lock status`	6 months ago
localapi	tsnet,wgengine/netstack: add ListenPacket and tests	6 months ago
policy	ipn,tailconfig: clean up unreleased and removed app connector service	1 year ago
store	ipn/store/kubestore, cmd/containerboot: allow overriding client api server URL via ENV (#12115)	6 months ago
backend.go	ipn: remove unused Options.LegacyMigrationPrefs	7 months ago
conf.go	cmd/k8s-operator,cmd/containerboot,ipn,k8s-operator: turn off stateful filter for egress proxies. (#12075)	6 months ago
doc.go	all: update copyright and license headers	2 years ago
ipn_clone.go	ipn,wgengine: remove vestigial Prefs.AllowSingleHosts	6 months ago
ipn_test.go	all: do not depend on the testing package	6 months ago
ipn_view.go	ipn,wgengine: remove vestigial Prefs.AllowSingleHosts	6 months ago
prefs.go	various: disable stateful filtering by default (#12197)	6 months ago
prefs_test.go	ipn,wgengine: remove vestigial Prefs.AllowSingleHosts	6 months ago
serve.go	serve.go, tsnet.go: Fix "in in" typo (#12279)	6 months ago
serve_test.go	{ipn/serve,cmd/tailscale/cli}: move some shared funcs to ipn	9 months ago
store.go	ipn: add comment about thread-safety to StateStore	9 months ago
store_test.go	ipn: avoid useless no-op WriteState calls	1 year ago