webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

all: store NL keys per profile

Browse Source 
This moves the NetworkLock key from a dedicated StateKey to be part of the persist.Persist struct.
This struct is stored as part for ipn.Prefs and is also the place where we store the NodeKey.

It also moves the ChonkDir from "/tka" to "/tka-profile/<profile-id>". The rename was intentional
to be able to delete the "/tka" dir if it exists.

This means that we will have a unique key per profile, and a unique directory per profile.

Note: `tailscale logout` will delete the entire profile, including any keys. It currently does not
delete the ChonkDir.

Signed-off-by: Maisem Ali <maisem@tailscale.com>
This commit is contained in:
Maisem Ali
2022-11-14 17:29:49 +05:00
committed by Tom
parent 751f866f01
commit 235309adc4
13 changed files with 198 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
control/controlclient/direct.go
+7 -18
View File
@@ -70,7 +70,6 @@ type Direct struct {
linkMon *monitor.Mon // or nil
discoPubKey key.DiscoPublic
getMachinePrivKey func() (key.MachinePrivate, error)
getNLPrivateKey func() (key.NLPrivate, error) // or nil
debugFlags []string
keepSharerAndUserSplit bool
skipIPForwardingCheck bool
@@ -118,10 +117,6 @@ type Options struct {
Dialer *tsdial.Dialer // non-nil
C2NHandler http.Handler // or nil
// GetNLPrivateKey specifies an optional function to use
// Network Lock. If nil, it's not used.
GetNLPrivateKey func() (key.NLPrivate, error)
// Status is called when there's a change in status.
Status func(Status)
@@ -232,7 +227,6 @@ func NewDirect(opts Options) (*Direct, error) {
c := &Direct{
httpc: httpc,
getMachinePrivKey: opts.GetMachinePrivateKey,
getNLPrivateKey: opts.GetNLPrivateKey,
serverURL: opts.ServerURL,
timeNow: opts.TimeNow,
logf: opts.Logf,
@@ -494,6 +488,10 @@ func (c *Direct) doLogin(ctx context.Context, opt loginOpt) (mustRegen bool, new
if !persist.OldPrivateNodeKey.IsZero() {
oldNodeKey = persist.OldPrivateNodeKey.Public()
}
if persist.NetworkLockKey.IsZero() {
persist.NetworkLockKey = key.NewNLPrivate()
}
nlPub := persist.NetworkLockKey.Public()
if tryingNewKey.IsZero() {
if opt.Logout {
@@ -502,19 +500,10 @@ func (c *Direct) doLogin(ctx context.Context, opt loginOpt) (mustRegen bool, new
log.Fatalf("tryingNewKey is empty, give up")
}
var nlPub key.NLPublic
var nodeKeySignature tkatype.MarshaledSignature
if c.getNLPrivateKey != nil {
priv, err := c.getNLPrivateKey()
if err != nil {
return false, "", nil, fmt.Errorf("get nl key: %v", err)
}
nlPub = priv.Public()
if !oldNodeKey.IsZero() && opt.OldNodeKeySignature != nil {
if nodeKeySignature, err = resignNKS(priv, tryingNewKey.Public(), opt.OldNodeKeySignature); err != nil {
c.logf("Failed re-signing node-key signature: %v", err)
}
if !oldNodeKey.IsZero() && opt.OldNodeKeySignature != nil {
if nodeKeySignature, err = resignNKS(persist.NetworkLockKey, tryingNewKey.Public(), opt.OldNodeKeySignature); err != nil {
c.logf("Failed re-signing node-key signature: %v", err)
}
}