webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

all: rename NetworkLock functions/types to TailnetLock

Browse Source 
To avoid breaking downstream code, add deprecated aliases for all the
old names.

Updates tailscale/corp#37904

Change-Id: I86d0b0d7da371946440b181c665448f91c3ef8d2
Signed-off-by: Alex Chan <alexc@tailscale.com>
This commit is contained in:
Alex Chan
2026-06-08 13:14:28 +01:00
committed by Alex Chan
parent 254bb6a43c
commit 65a117184b
14 changed files with 312 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/tailscale/cli/jsonoutput/tailnet-lock-log.go
+4 -4
View File
@@ -16,7 +16,7 @@ import (
"tailscale.com/tka"
)
// PrintNetworkLockLogJSONV1 prints the stored TKA state as a JSON object to the CLI,
// PrintTailnetLockLogJSONV1 prints the stored TKA state as a JSON object to the CLI,
// in a stable "v1" format.
//
// This format includes:
@@ -24,7 +24,7 @@ import (
// - the AUM hash as a base32-encoded string
// - the raw AUM as base64-encoded bytes
// - the expanded AUM, which prints named fields for consumption by other tools
func PrintNetworkLockLogJSONV1(out io.Writer, updates []ipnstate.NetworkLockUpdate) error {
func PrintTailnetLockLogJSONV1(out io.Writer, updates []ipnstate.TailnetLockUpdate) error {
messages := make([]logMessageV1, len(updates))
for i, update := range updates {
@@ -57,9 +57,9 @@ func PrintNetworkLockLogJSONV1(out io.Writer, updates []ipnstate.NetworkLockUpda
return enc.Encode(result)
}
// toLogMessageV1 converts a [tka.AUM] and [ipnstate.NetworkLockUpdate] to the
// toLogMessageV1 converts a [tka.AUM] and [ipnstate.TailnetLockUpdate] to the
// JSON output returned by the CLI.
func toLogMessageV1(aum tka.AUM, update ipnstate.NetworkLockUpdate) logMessageV1 {
func toLogMessageV1(aum tka.AUM, update ipnstate.TailnetLockUpdate) logMessageV1 {
expandedAUM := expandedAUMV1{}
expandedAUM.MessageKind = aum.MessageKind.String()
if len(aum.PrevAUMHash) > 0 {
cmd/tailscale/cli/jsonoutput/tailnet-lock-status.go
+4 -4
View File
@@ -15,9 +15,9 @@ import (
"tailscale.com/tka"
)
// PrintNetworkLockStatusJSONV1 prints the current Tailnet Lock status
// PrintTailnetLockStatusJSONV1 prints the current Tailnet Lock status
// as a JSON object to the CLI, in a stable "v1" format.
func PrintNetworkLockStatusJSONV1(out io.Writer, status *ipnstate.NetworkLockStatus) error {
func PrintTailnetLockStatusJSONV1(out io.Writer, status *ipnstate.TailnetLockStatus) error {
responseEnvelope := ResponseEnvelope{
SchemaVersion: "1",
}
@@ -46,7 +46,7 @@ func PrintNetworkLockStatusJSONV1(out io.Writer, status *ipnstate.NetworkLockSta
return enc.Encode(result)
}
func toTailnetLockDisabledStatusV1(status *ipnstate.NetworkLockStatus) tailnetLockDisabledStatusV1 {
func toTailnetLockDisabledStatusV1(status *ipnstate.TailnetLockStatus) tailnetLockDisabledStatusV1 {
out := tailnetLockDisabledStatusV1{
tailnetLockStatusV1Base: tailnetLockStatusV1Base{
Enabled: status.Enabled,
@@ -61,7 +61,7 @@ func toTailnetLockDisabledStatusV1(status *ipnstate.NetworkLockStatus) tailnetLo
return out
}
func toTailnetLockEnabledStatusV1(status *ipnstate.NetworkLockStatus) tailnetLockEnabledStatusV1 {
func toTailnetLockEnabledStatusV1(status *ipnstate.TailnetLockStatus) tailnetLockEnabledStatusV1 {
out := tailnetLockEnabledStatusV1{
tailnetLockStatusV1Base: tailnetLockStatusV1Base{
Enabled: status.Enabled,
cmd/tailscale/cli/tailnet-lock.go
+24 -24
View File
@@ -109,7 +109,7 @@ tailnet lock. We recommend setting this flag.
}
func runTailnetLockInit(ctx context.Context, args []string) error {
st, err := localClient.NetworkLockStatus(ctx)
st, err := localClient.TailnetLockStatus(ctx)
if err != nil {
return fixTailscaledConnectError(err)
}
@@ -183,9 +183,9 @@ func runTailnetLockInit(ctx context.Context, args []string) error {
fmt.Fprintln(&successMsg, "A disablement secret for Tailscale support has been generated and transmitted to Tailscale.")
}
// The state returned by NetworkLockInit likely doesn't contain the initialized state,
// The state returned by TailnetLockInit likely doesn't contain the initialized state,
// because that has to tick through from netmaps.
if _, err := localClient.NetworkLockInit(ctx, keys, disablementValues, supportDisablement); err != nil {
if _, err := localClient.TailnetLockInit(ctx, keys, disablementValues, supportDisablement); err != nil {
return err
}
@@ -215,14 +215,14 @@ func runTailnetLockStatus(ctx context.Context, args []string) error {
return fmt.Errorf("tailscale lock status: unexpected argument")
}
st, err := localClient.NetworkLockStatus(ctx)
st, err := localClient.TailnetLockStatus(ctx)
if err != nil {
return fixTailscaledConnectError(err)
}
if nlStatusArgs.json.IsSet {
if nlStatusArgs.json.Version == 1 {
return jsonoutput.PrintNetworkLockStatusJSONV1(os.Stdout, st)
return jsonoutput.PrintTailnetLockStatusJSONV1(os.Stdout, st)
} else {
return fmt.Errorf("unrecognised version: %d", nlStatusArgs.json.Version)
}
@@ -332,7 +332,7 @@ func runTailnetLockRemove(ctx context.Context, args []string) error {
if len(removeKeys) == 0 {
return fmt.Errorf("missing argument, expected one or more tailnet lock keys")
}
st, err := localClient.NetworkLockStatus(ctx)
st, err := localClient.TailnetLockStatus(ctx)
if err != nil {
return fixTailscaledConnectError(err)
}
@@ -359,7 +359,7 @@ func runTailnetLockRemove(ctx context.Context, args []string) error {
// Resign affected signatures for each of the keys we are removing.
for _, k := range removeKeys {
kID, _ := k.ID() // err already checked above
sigs, err := localClient.NetworkLockAffectedSigs(ctx, kID)
sigs, err := localClient.TailnetLockAffectedSigs(ctx, kID)
if err != nil {
return fmt.Errorf("affected sigs for key %X: %w", kID, err)
}
@@ -374,10 +374,10 @@ func runTailnetLockRemove(ctx context.Context, args []string) error {
return fmt.Errorf("failed decoding pubkey for signature: %w", err)
}
// Safety: NetworkLockAffectedSigs() verifies all signatures before
// Safety: TailnetLockAffectedSigs() verifies all signatures before
// successfully returning.
rotationKey, _ := sig.UnverifiedWrappingPublic()
if err := localClient.NetworkLockSign(ctx, nodeKey, []byte(rotationKey)); err != nil {
if err := localClient.TailnetLockSign(ctx, nodeKey, []byte(rotationKey)); err != nil {
return fmt.Errorf("failed to sign %v: %w", nodeKey, err)
}
}
@@ -396,7 +396,7 @@ of the Tailscale network. Proceed with caution.
}
}
return localClient.NetworkLockModify(ctx, nil, removeKeys)
return localClient.TailnetLockModify(ctx, nil, removeKeys)
}
// parseTLArgs parses a slice of strings into slices of tka.Key & disablement
@@ -455,7 +455,7 @@ func runTailnetLockAdd(ctx context.Context, addArgs []string) error {
return fmt.Errorf("missing argument, expected one or more tailnet lock keys")
}
st, err := localClient.NetworkLockStatus(ctx)
st, err := localClient.TailnetLockStatus(ctx)
if err != nil {
return fixTailscaledConnectError(err)
}
@@ -463,7 +463,7 @@ func runTailnetLockAdd(ctx context.Context, addArgs []string) error {
return errors.New("tailnet lock is not enabled")
}
if err := localClient.NetworkLockModify(ctx, addKeys, nil); err != nil {
if err := localClient.TailnetLockModify(ctx, addKeys, nil); err != nil {
return err
}
return nil
@@ -519,7 +519,7 @@ func runTailnetLockSign(ctx context.Context, args []string) error {
}
}
err := localClient.NetworkLockSign(ctx, nodeKey, []byte(rotationKey.Verifier()))
err := localClient.TailnetLockSign(ctx, nodeKey, []byte(rotationKey.Verifier()))
// Provide a better help message for when someone clicks through the signing flow
// on the wrong device.
if err != nil && strings.Contains(err.Error(), tsconst.TailnetLockNotTrustedMsg) {
@@ -557,7 +557,7 @@ func runTailnetLockDisable(ctx context.Context, args []string) error {
if len(secrets) != 1 {
return errors.New("usage: tailscale lock disable <disablement-secret>")
}
return localClient.NetworkLockDisable(ctx, secrets[0])
return localClient.TailnetLockDisable(ctx, secrets[0])
}
var tlLocalDisableCmd = &ffcli.Command{
@@ -579,7 +579,7 @@ that are locked out.
}
func runTailnetLockLocalDisable(ctx context.Context, args []string) error {
return localClient.NetworkLockForceLocalDisable(ctx)
return localClient.TailnetLockForceLocalDisable(ctx)
}
var tlDisablementKDFCmd = &ffcli.Command{
@@ -621,7 +621,7 @@ var tlLogCmd = &ffcli.Command{
})(),
}
func nlDescribeUpdate(update ipnstate.NetworkLockUpdate, color bool) (string, error) {
func nlDescribeUpdate(update ipnstate.TailnetLockUpdate, color bool) (string, error) {
terminalYellow := ""
terminalClear := ""
if color {
@@ -694,7 +694,7 @@ func nlDescribeUpdate(update ipnstate.NetworkLockUpdate, color bool) (string, er
}
func runTailnetLockLog(ctx context.Context, args []string) error {
st, err := localClient.NetworkLockStatus(ctx)
st, err := localClient.TailnetLockStatus(ctx)
if err != nil {
return fixTailscaledConnectError(err)
}
@@ -702,7 +702,7 @@ func runTailnetLockLog(ctx context.Context, args []string) error {
return errors.New("Tailnet Lock is not enabled")
}
updates, err := localClient.NetworkLockLog(ctx, nlLogArgs.limit)
updates, err := localClient.TailnetLockLog(ctx, nlLogArgs.limit)
if err != nil {
return fixTailscaledConnectError(err)
}
@@ -715,7 +715,7 @@ func runTailnetLockLog(ctx context.Context, args []string) error {
func printTailnetLockLog(updates []ipnstate.NetworkLockUpdate, out io.Writer, jsonSchema jsonoutput.SchemaVersion, useColor bool) error {
if jsonSchema.IsSet {
if jsonSchema.Version == 1 {
return jsonoutput.PrintNetworkLockLogJSONV1(out, updates)
return jsonoutput.PrintTailnetLockLogJSONV1(out, updates)
} else {
return fmt.Errorf("unrecognised version: %d", jsonSchema.Version)
}
@@ -772,11 +772,11 @@ func wrapAuthKey(ctx context.Context, keyStr string, status *ipnstate.Status) er
Meta: m,
}
wrapped, err := localClient.NetworkLockWrapPreauthKey(ctx, keyStr, priv)
wrapped, err := localClient.TailnetLockWrapPreauthKey(ctx, keyStr, priv)
if err != nil {
return fmt.Errorf("wrapping failed: %w", err)
}
if err := localClient.NetworkLockModify(ctx, []tka.Key{k}, nil); err != nil {
if err := localClient.TailnetLockModify(ctx, []tka.Key{k}, nil); err != nil {
return fmt.Errorf("add key failed: %w", err)
}
@@ -852,7 +852,7 @@ func runTailnetLockRevokeKeys(ctx context.Context, args []string) error {
}
}
aumBytes, err := localClient.NetworkLockGenRecoveryAUM(ctx, keyIDs, forkFrom)
aumBytes, err := localClient.TailnetLockGenRecoveryAUM(ctx, keyIDs, forkFrom)
if err != nil {
return fmt.Errorf("generation of recovery AUM failed: %w", err)
}
@@ -874,7 +874,7 @@ func runTailnetLockRevokeKeys(ctx context.Context, args []string) error {
}
if tlRevokeKeysArgs.cosign {
aumBytes, err := localClient.NetworkLockCosignRecoveryAUM(ctx, recoveryAUM)
aumBytes, err := localClient.TailnetLockCosignRecoveryAUM(ctx, recoveryAUM)
if err != nil {
return fmt.Errorf("co-signing recovery AUM failed: %w", err)
}
@@ -890,7 +890,7 @@ Alternatively if you are done with co-signing, complete recovery by running the
}
if tlRevokeKeysArgs.finish {
if err := localClient.NetworkLockSubmitRecoveryAUM(ctx, recoveryAUM); err != nil {
if err := localClient.TailnetLockSubmitRecoveryAUM(ctx, recoveryAUM); err != nil {
return fmt.Errorf("submitting recovery AUM failed: %w", err)
}
fmt.Println("Recovery completed.")
cmd/tailscale/cli/tailnet-lock_test.go
+7 -7
View File
@@ -63,7 +63,7 @@ func TestTailnetLockLogOutput(t *testing.T) {
Votes: &votes,
}
updates := []ipnstate.NetworkLockUpdate{
updates := []ipnstate.TailnetLockUpdate{
{
Hash: aum3.Hash(),
Change: aum3.MessageKind.String(),
@@ -226,12 +226,12 @@ func TestTailnetLockStatusOutput(t *testing.T) {
t.Run("json-1", func(t *testing.T) {
for _, tt := range []struct {
Name string
Status ipnstate.NetworkLockStatus
Status ipnstate.TailnetLockStatus
Want string
}{
{
Name: "tailnet-lock-disabled",
Status: ipnstate.NetworkLockStatus{Enabled: false},
Status: ipnstate.TailnetLockStatus{Enabled: false},
Want: `{
"SchemaVersion": "1",
"Enabled": false
@@ -240,7 +240,7 @@ func TestTailnetLockStatusOutput(t *testing.T) {
},
{
Name: "tailnet-lock-disabled-with-keys",
Status: ipnstate.NetworkLockStatus{
Status: ipnstate.TailnetLockStatus{
Enabled: false,
NodeKey: &nodeKey1,
PublicKey: trustedNlPub,
@@ -255,7 +255,7 @@ func TestTailnetLockStatusOutput(t *testing.T) {
},
{
Name: "tailnet-lock-enabled",
Status: ipnstate.NetworkLockStatus{
Status: ipnstate.TailnetLockStatus{
Enabled: true,
Head: &head,
PublicKey: nlPub,
@@ -355,9 +355,9 @@ func TestTailnetLockStatusOutput(t *testing.T) {
t.Parallel()
var outBuf bytes.Buffer
err := jsonoutput.PrintNetworkLockStatusJSONV1(&outBuf, &tt.Status)
err := jsonoutput.PrintTailnetLockStatusJSONV1(&outBuf, &tt.Status)
if err != nil {
t.Fatalf("PrintNetworkLockStatusJSONV1: %v", err)
t.Fatalf("PrintTailnetLockStatusJSONV1: %v", err)
}
if diff := cmp.Diff(outBuf.String(), tt.Want); diff != "" {