webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

all: rename NetworkLock functions/types to TailnetLock

Browse Source 
To avoid breaking downstream code, add deprecated aliases for all the
old names.

Updates tailscale/corp#37904

Change-Id: I86d0b0d7da371946440b181c665448f91c3ef8d2
Signed-off-by: Alex Chan <alexc@tailscale.com>
This commit is contained in:
Alex Chan
2026-06-08 13:14:28 +01:00
committed by Alex Chan
parent 254bb6a43c
commit 65a117184b
14 changed files with 312 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipn/ipnlocal/tailnet-lock.go
+122 -37
View File
@@ -49,13 +49,18 @@ var (
errTailnetLockNotActive = errors.New("tailnet-lock is not active")
)
// IsNetworkLockNotActive reports whether the given error indicates that
// IsTailnetLockNotActive reports whether the given error indicates that
// tailnet-lock is not active. Stop-gap for feature/tailnetlock to check this
// until all of this is code is moved to the feature.
func IsNetworkLockNotActive(err error) bool {
func IsTailnetLockNotActive(err error) bool {
return errors.Is(err, errTailnetLockNotActive)
}
// Deprecated: use [IsTailnetLockNotActive] instead.
func IsNetworkLockNotActive(err error) bool {
return IsTailnetLockNotActive(err)
}
type tkaState struct {
profile ipn.ProfileID
authority *tka.Authority
@@ -519,9 +524,9 @@ func (b *LocalBackend) tkaBootstrapFromGenesisLocked(g tkatype.MarshaledAUM, per
return nil
}
// NetworkLockStatus returns a structure describing the state of the
// TailnetLockStatus returns a structure describing the state of the
// tailnet key authority, if any.
func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
func (b *LocalBackend) TailnetLockStatus() *ipnstate.TailnetLockStatus {
b.mu.Lock()
defer b.mu.Unlock()
@@ -536,13 +541,13 @@ func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
}
if nlPriv.IsZero() {
return &ipnstate.NetworkLockStatus{
return &ipnstate.TailnetLockStatus{
Enabled: false,
NodeKey: nodeKey,
}
}
if b.tka == nil {
return &ipnstate.NetworkLockStatus{
return &ipnstate.TailnetLockStatus{
Enabled: false,
NodeKey: nodeKey,
PublicKey: nlPriv.Public(),
@@ -590,7 +595,7 @@ func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
stateID1, _ := b.tka.authority.StateIDs()
return &ipnstate.NetworkLockStatus{
return &ipnstate.TailnetLockStatus{
Enabled: true,
Head: &head,
PublicKey: nlPriv.Public(),
@@ -604,6 +609,11 @@ func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
}
}
// Deprecated: use [LocalBackend.TailnetLockStatus] instead.
func (b *LocalBackend) NetworkLockStatus() *ipnstate.TailnetLockStatus {
return b.TailnetLockStatus()
}
func tkaStateFromPeer(p tailcfg.NodeView) ipnstate.TKAPeer {
fp := ipnstate.TKAPeer{
Name: p.Name(),
@@ -624,7 +634,7 @@ func tkaStateFromPeer(p tailcfg.NodeView) ipnstate.TKAPeer {
return fp
}
// NetworkLockInit enables tailnet-lock for the tailnet, with the tailnets'
// TailnetLockInit enables tailnet-lock for the tailnet, with the tailnets'
// key authority initialized to trust the provided keys.
//
// Initialization involves two RPCs with control, termed 'begin' and 'finish'.
@@ -633,7 +643,7 @@ func tkaStateFromPeer(p tailcfg.NodeView) ipnstate.TKAPeer {
// needing signatures is returned as a response.
// The Finish RPC submits signatures for all these nodes, at which point
// Control has everything it needs to atomically enable tailnet lock.
func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) error {
func (b *LocalBackend) TailnetLockInit(keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) error {
var ourNodeKey key.NodePublic
var nlPriv key.NLPrivate
@@ -698,15 +708,25 @@ func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byt
return err
}
// NetworkLockAllowed reports whether the node is allowed to use Tailnet Lock.
func (b *LocalBackend) NetworkLockAllowed() bool {
// Deprecated: use [LocalBackend.TailnetLockInit] instead.
func (b *LocalBackend) NetworkLockInit(keys []tka.Key, disablementValues [][]byte, supportDisablement []byte) error {
return b.TailnetLockInit(keys, disablementValues, supportDisablement)
}
// TailnetLockAllowed reports whether the node is allowed to use Tailnet Lock.
func (b *LocalBackend) TailnetLockAllowed() bool {
b.mu.Lock()
defer b.mu.Unlock()
return b.capTailnetLock
}
// Deprecated: use [LocalBackend.TailnetLockAllowed] instead.
func (b *LocalBackend) NetworkLockAllowed() bool {
return b.TailnetLockAllowed()
}
// Only use is in tests.
func (b *LocalBackend) NetworkLockVerifySignatureForTest(nks tkatype.MarshaledSignature, nodeKey key.NodePublic) error {
func (b *LocalBackend) TailnetLockVerifySignatureForTest(nks tkatype.MarshaledSignature, nodeKey key.NodePublic) error {
testenv.AssertInTest()
b.mu.Lock()
defer b.mu.Unlock()
@@ -716,8 +736,13 @@ func (b *LocalBackend) NetworkLockVerifySignatureForTest(nks tkatype.MarshaledSi
return b.tka.authority.NodeKeyAuthorized(nodeKey, nks)
}
// Deprecated: use [LocalBackend.TailnetLockVerifySignatureForTest] instead.
func (b *LocalBackend) NetworkLockVerifySignatureForTest(nks tkatype.MarshaledSignature, nodeKey key.NodePublic) error {
return b.TailnetLockVerifySignatureForTest(nks, nodeKey)
}
// Only use is in tests.
func (b *LocalBackend) NetworkLockKeyTrustedForTest(keyID tkatype.KeyID) bool {
func (b *LocalBackend) TailnetLockKeyTrustedForTest(keyID tkatype.KeyID) bool {
testenv.AssertInTest()
b.mu.Lock()
defer b.mu.Unlock()
@@ -727,9 +752,14 @@ func (b *LocalBackend) NetworkLockKeyTrustedForTest(keyID tkatype.KeyID) bool {
return b.tka.authority.KeyTrusted(keyID)
}
// NetworkLockForceLocalDisable shuts down TKA locally, and denylists the current
// Deprecated: use [LocalBackend.TailnetLockKeyTrustedForTest] instead.
func (b *LocalBackend) NetworkLockKeyTrustedForTest(keyID tkatype.KeyID) bool {
return b.TailnetLockKeyTrustedForTest(keyID)
}
// TailnetLockForceLocalDisable shuts down TKA locally, and denylists the current
// TKA from being initialized locally in future.
func (b *LocalBackend) NetworkLockForceLocalDisable() error {
func (b *LocalBackend) TailnetLockForceLocalDisable() error {
b.mu.Lock()
defer b.mu.Unlock()
if b.tka == nil {
@@ -753,9 +783,14 @@ func (b *LocalBackend) NetworkLockForceLocalDisable() error {
return nil
}
// NetworkLockSign signs the given node-key and submits it to the control plane.
// Deprecated: use [LocalBackend.TailnetLockForceLocalDisable] instead.
func (b *LocalBackend) NetworkLockForceLocalDisable() error {
return b.TailnetLockForceLocalDisable()
}
// TailnetLockSign signs the given node-key and submits it to the control plane.
// rotationPublic, if specified, must be an ed25519 public key.
func (b *LocalBackend) NetworkLockSign(nodeKey key.NodePublic, rotationPublic []byte) error {
func (b *LocalBackend) TailnetLockSign(nodeKey key.NodePublic, rotationPublic []byte) error {
ourNodeKey, sig, err := func(nodeKey key.NodePublic, rotationPublic []byte) (key.NodePublic, tka.NodeKeySignature, error) {
b.mu.Lock()
defer b.mu.Unlock()
@@ -803,8 +838,13 @@ func (b *LocalBackend) NetworkLockSign(nodeKey key.NodePublic, rotationPublic []
return nil
}
// NetworkLockModify adds and/or removes keys in the tailnet's key authority.
func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err error) {
// Deprecated: use [LocalBackend.TailnetLockSign] instead.
func (b *LocalBackend) NetworkLockSign(nodeKey key.NodePublic, rotationPublic []byte) error {
return b.TailnetLockSign(nodeKey, rotationPublic)
}
// TailnetLockModify adds and/or removes keys in the tailnet's key authority.
func (b *LocalBackend) TailnetLockModify(addKeys, removeKeys []tka.Key) (err error) {
defer func() {
if err != nil {
err = fmt.Errorf("modify tailnet-lock keys: %w", err)
@@ -883,8 +923,13 @@ func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err err
return nil
}
// NetworkLockDisable disables tailnet-lock using the provided disablement secret.
func (b *LocalBackend) NetworkLockDisable(secret []byte) error {
// Deprecated: use [LocalBackend.TailnetLockModify] instead.
func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err error) {
return b.TailnetLockModify(addKeys, removeKeys)
}
// TailnetLockDisable disables tailnet-lock using the provided disablement secret.
func (b *LocalBackend) TailnetLockDisable(secret []byte) error {
var (
ourNodeKey key.NodePublic
head tka.AUMHash
@@ -915,8 +960,13 @@ func (b *LocalBackend) NetworkLockDisable(secret []byte) error {
return err
}
// NetworkLockLog returns the changelog of TKA state up to maxEntries in size.
func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.NetworkLockUpdate, error) {
// Deprecated: use [LocalBackend.TailnetLockDisable] instead.
func (b *LocalBackend) NetworkLockDisable(secret []byte) error {
return b.TailnetLockDisable(secret)
}
// TailnetLockLog returns the changelog of TKA state up to maxEntries in size.
func (b *LocalBackend) TailnetLockLog(maxEntries int) ([]ipnstate.TailnetLockUpdate, error) {
b.mu.Lock()
defer b.mu.Unlock()
@@ -924,7 +974,7 @@ func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.NetworkLockUpd
return nil, errTailnetLockNotActive
}
var out []ipnstate.NetworkLockUpdate
var out []ipnstate.TailnetLockUpdate
cursor := b.tka.authority.Head()
for range maxEntries {
aum, err := b.tka.storage.AUM(cursor)
@@ -935,7 +985,7 @@ func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.NetworkLockUpd
return out, fmt.Errorf("reading AUM (%v): %w", cursor, err)
}
update := ipnstate.NetworkLockUpdate{
update := ipnstate.TailnetLockUpdate{
Hash: cursor,
Change: aum.MessageKind.String(),
Raw: aum.Serialize(),
@@ -952,9 +1002,14 @@ func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.NetworkLockUpd
return out, nil
}
// NetworkLockAffectedSigs returns the signatures which would be invalidated
// Deprecated: use [LocalBackend.TailnetLockLog] instead.
func (b *LocalBackend) NetworkLockLog(maxEntries int) ([]ipnstate.TailnetLockUpdate, error) {
return b.TailnetLockLog(maxEntries)
}
// TailnetLockAffectedSigs returns the signatures which would be invalidated
// by removing trust in the specified KeyID.
func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
func (b *LocalBackend) TailnetLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
var (
ourNodeKey key.NodePublic
err error
@@ -1010,12 +1065,17 @@ func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.M
return resp.Signatures, nil
}
// NetworkLockGenerateRecoveryAUM generates an AUM which retroactively removes trust in the
// Deprecated: use [LocalBackend.TailnetLockAffectedSigs] instead.
func (b *LocalBackend) NetworkLockAffectedSigs(keyID tkatype.KeyID) ([]tkatype.MarshaledSignature, error) {
return b.TailnetLockAffectedSigs(keyID)
}
// TailnetLockGenerateRecoveryAUM generates an AUM which retroactively removes trust in the
// specified keys. This AUM is signed by the current node and returned.
//
// If forkFrom is specified, it is used as the parent AUM to fork from. If the zero value,
// the parent AUM is determined automatically.
func (b *LocalBackend) NetworkLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) (*tka.AUM, error) {
func (b *LocalBackend) TailnetLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) (*tka.AUM, error) {
b.mu.Lock()
defer b.mu.Unlock()
if b.tka == nil {
@@ -1043,12 +1103,17 @@ func (b *LocalBackend) NetworkLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID
return aum, nil
}
// NetworkLockCosignRecoveryAUM co-signs the provided recovery AUM and returns
// Deprecated: use [LocalBackend.TailnetLockGenerateRecoveryAUM] instead.
func (b *LocalBackend) NetworkLockGenerateRecoveryAUM(removeKeys []tkatype.KeyID, forkFrom tka.AUMHash) (*tka.AUM, error) {
return b.TailnetLockGenerateRecoveryAUM(removeKeys, forkFrom)
}
// TailnetLockCosignRecoveryAUM co-signs the provided recovery AUM and returns
// the updated structure.
//
// The recovery AUM provided should be the output from a previous call to
// NetworkLockGenerateRecoveryAUM or NetworkLockCosignRecoveryAUM.
func (b *LocalBackend) NetworkLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, error) {
// [LocalBackend.TailnetLockGenerateRecoveryAUM] or [LocalBackend.TailnetLockCosignRecoveryAUM].
func (b *LocalBackend) TailnetLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, error) {
b.mu.Lock()
defer b.mu.Unlock()
if b.tka == nil {
@@ -1077,7 +1142,12 @@ func (b *LocalBackend) NetworkLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, err
return aum, nil
}
func (b *LocalBackend) NetworkLockSubmitRecoveryAUM(aum *tka.AUM) error {
// Deprecated: use [LocalBackend.TailnetLockCosignRecoveryAUM] instead.
func (b *LocalBackend) NetworkLockCosignRecoveryAUM(aum *tka.AUM) (*tka.AUM, error) {
return b.TailnetLockCosignRecoveryAUM(aum)
}
func (b *LocalBackend) TailnetLockSubmitRecoveryAUM(aum *tka.AUM) error {
b.mu.Lock()
defer b.mu.Unlock()
if b.tka == nil {
@@ -1097,15 +1167,20 @@ func (b *LocalBackend) NetworkLockSubmitRecoveryAUM(aum *tka.AUM) error {
return err
}
// Deprecated: use [LocalBackend.TailnetLockSubmitRecoveryAUM] instead.
func (b *LocalBackend) NetworkLockSubmitRecoveryAUM(aum *tka.AUM) error {
return b.TailnetLockSubmitRecoveryAUM(aum)
}
var tkaSuffixEncoder = base64.RawStdEncoding
// NetworkLockWrapPreauthKey wraps a pre-auth key with information to
// TailnetLockWrapPreauthKey wraps a pre-auth key with information to
// enable unattended bringup in the locked tailnet.
//
// The provided trusted tailnet-lock key is used to sign
// a SigCredential structure, which is encoded along with the
// private key and appended to the pre-auth key.
func (b *LocalBackend) NetworkLockWrapPreauthKey(preauthKey string, tkaKey key.NLPrivate) (string, error) {
func (b *LocalBackend) TailnetLockWrapPreauthKey(preauthKey string, tkaKey key.NLPrivate) (string, error) {
b.mu.Lock()
defer b.mu.Unlock()
if b.tka == nil {
@@ -1131,9 +1206,14 @@ func (b *LocalBackend) NetworkLockWrapPreauthKey(preauthKey string, tkaKey key.N
return fmt.Sprintf("%s--TL%s-%s", preauthKey, tkaSuffixEncoder.EncodeToString(sig.Serialize()), tkaSuffixEncoder.EncodeToString(priv)), nil
}
// NetworkLockVerifySigningDeeplink asks the authority to verify the given deeplink
// Deprecated: use [LocalBackend.TailnetLockWrapPreauthKey] instead.
func (b *LocalBackend) NetworkLockWrapPreauthKey(preauthKey string, tkaKey key.NLPrivate) (string, error) {
return b.TailnetLockWrapPreauthKey(preauthKey, tkaKey)
}
// TailnetLockVerifySigningDeeplink asks the authority to verify the given deeplink
// URL. See the comment for ValidateDeeplink for details.
func (b *LocalBackend) NetworkLockVerifySigningDeeplink(url string) tka.DeeplinkValidationResult {
func (b *LocalBackend) TailnetLockVerifySigningDeeplink(url string) tka.DeeplinkValidationResult {
b.mu.Lock()
defer b.mu.Unlock()
if b.tka == nil {
@@ -1143,6 +1223,11 @@ func (b *LocalBackend) NetworkLockVerifySigningDeeplink(url string) tka.Deeplink
return b.tka.authority.ValidateDeeplink(url)
}
// Deprecated: use [LocalBackend.TailnetLockVerifySigningDeeplink] instead.
func (b *LocalBackend) NetworkLockVerifySigningDeeplink(url string) tka.DeeplinkValidationResult {
return b.TailnetLockVerifySigningDeeplink(url)
}
func signNodeKey(nodeInfo tailcfg.TKASignInfo, signer key.NLPrivate) (*tka.NodeKeySignature, error) {
p, err := nodeInfo.NodePublic.MarshalBinary()
if err != nil {
ipn/ipnlocal/tailnet-lock_test.go
+19 -19
View File
@@ -641,7 +641,7 @@ func TestTKAFilterNetmap(t *testing.T) {
return node, nodeSig
}
preauth, err := b.NetworkLockWrapPreauthKey("tskey-auth-k7UagY1CNTRL-ZZZZZ", nlPriv)
preauth, err := b.TailnetLockWrapPreauthKey("tskey-auth-k7UagY1CNTRL-ZZZZZ", nlPriv)
if err != nil {
t.Fatal(err)
}
@@ -791,11 +791,11 @@ func TestTKADisable(t *testing.T) {
b := newLocalBackendForTKA(t, temp, client, pm, authority, chonk)
// Test that we get an error for an incorrect disablement secret.
if err := b.NetworkLockDisable([]byte{1, 2, 3, 4}); err == nil || err.Error() != "incorrect disablement secret" {
t.Errorf("NetworkLockDisable(<bad secret>).err = %v, want 'incorrect disablement secret'", err)
if err := b.TailnetLockDisable([]byte{1, 2, 3, 4}); err == nil || err.Error() != "incorrect disablement secret" {
t.Errorf("TailnetLockDisable(<bad secret>).err = %v, want 'incorrect disablement secret'", err)
}
if err := b.NetworkLockDisable(disablementSecret); err != nil {
t.Errorf("NetworkLockDisable() failed: %v", err)
if err := b.TailnetLockDisable(disablementSecret); err != nil {
t.Errorf("TailnetLockDisable() failed: %v", err)
}
}
@@ -834,8 +834,8 @@ func TestTKASign(t *testing.T) {
b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
if err := b.NetworkLockSign(toSign.Public(), nil); err != nil {
t.Errorf("NetworkLockSign() failed: %v", err)
if err := b.TailnetLockSign(toSign.Public(), nil); err != nil {
t.Errorf("TailnetLockSign() failed: %v", err)
}
}
@@ -894,8 +894,8 @@ func TestTKAForceDisable(t *testing.T) {
b.pm = pm
b.mu.Unlock()
if err := b.NetworkLockForceLocalDisable(); err != nil {
t.Fatalf("NetworkLockForceLocalDisable() failed: %v", err)
if err := b.TailnetLockForceLocalDisable(); err != nil {
t.Fatalf("TailnetLockForceLocalDisable() failed: %v", err)
}
if b.tka != nil {
t.Fatal("tka was not shut down")
@@ -1000,14 +1000,14 @@ func TestTKAAffectedSigs(t *testing.T) {
defer ts.Close()
b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
sigs, err := b.NetworkLockAffectedSigs(nlPriv.KeyID())
sigs, err := b.TailnetLockAffectedSigs(nlPriv.KeyID())
switch {
case tc.wantErr == "" && err != nil:
t.Errorf("NetworkLockAffectedSigs() failed: %v", err)
t.Errorf("TailnetLockAffectedSigs() failed: %v", err)
case tc.wantErr != "" && err == nil:
t.Errorf("NetworkLockAffectedSigs().err = nil, want %q", tc.wantErr)
t.Errorf("TailnetLockAffectedSigs().err = nil, want %q", tc.wantErr)
case tc.wantErr != "" && err.Error() != tc.wantErr:
t.Errorf("NetworkLockAffectedSigs().err = %q, want %q", err.Error(), tc.wantErr)
t.Errorf("TailnetLockAffectedSigs().err = %q, want %q", err.Error(), tc.wantErr)
}
if tc.wantErr == "" {
@@ -1064,24 +1064,24 @@ func TestTKARecoverCompromisedKeyFlow(t *testing.T) {
defer ts.Close()
b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
aum, err := b.NetworkLockGenerateRecoveryAUM([]tkatype.KeyID{compromisedPriv.KeyID()}, tka.AUMHash{})
aum, err := b.TailnetLockGenerateRecoveryAUM([]tkatype.KeyID{compromisedPriv.KeyID()}, tka.AUMHash{})
if err != nil {
t.Fatalf("NetworkLockGenerateRecoveryAUM() failed: %v", err)
t.Fatalf("TailnetLockGenerateRecoveryAUM() failed: %v", err)
}
// Cosign using the cosigning key.
{
pm := setupProfileManager(t, nodePriv, cosignPriv)
b := newLocalBackendForTKA(t, varRoot, client, pm, authority, chonk)
if aum, err = b.NetworkLockCosignRecoveryAUM(aum); err != nil {
t.Fatalf("NetworkLockCosignRecoveryAUM() failed: %v", err)
if aum, err = b.TailnetLockCosignRecoveryAUM(aum); err != nil {
t.Fatalf("TailnetLockCosignRecoveryAUM() failed: %v", err)
}
}
// Finally, submit the recovery AUM. Validation is done
// in the fake control handler.
if err := b.NetworkLockSubmitRecoveryAUM(aum); err != nil {
t.Errorf("NetworkLockSubmitRecoveryAUM() failed: %v", err)
if err := b.TailnetLockSubmitRecoveryAUM(aum); err != nil {
t.Errorf("TailnetLockSubmitRecoveryAUM() failed: %v", err)
}
}
ipn/ipnlocal/tailnetlock_disabled.go
+7 -2
View File
@@ -26,6 +26,11 @@ func (b *LocalBackend) tkaSyncIfNeeded(nm *netmap.NetworkMap, prefs ipn.PrefsVie
func (b *LocalBackend) tkaFilterNetmapLocked(nm *netmap.NetworkMap) {}
func (b *LocalBackend) NetworkLockStatus() *ipnstate.NetworkLockStatus {
return &ipnstate.NetworkLockStatus{Enabled: false}
func (b *LocalBackend) TailnetLockStatus() *ipnstate.TailnetLockStatus {
return &ipnstate.TailnetLockStatus{Enabled: false}
}
// Deprecated: use [LocalBackend.TailnetLockStatus] instead.
func (b *LocalBackend) NetworkLockStatus() *ipnstate.TailnetLockStatus {
return b.TailnetLockStatus()
}
ipn/ipnstate/ipnstate.go
+10 -4
View File
@@ -107,10 +107,10 @@ type TKAPeer struct {
NodeKeySignature tka.NodeKeySignature
}
// NetworkLockStatus represents whether tailnet-lock is enabled,
// TailnetLockStatus represents whether tailnet-lock is enabled,
// along with details about the locally-known state of the tailnet
// key authority.
type NetworkLockStatus struct {
type TailnetLockStatus struct {
// Enabled is true if tailnet lock is enabled.
Enabled bool
@@ -151,8 +151,11 @@ type NetworkLockStatus struct {
StateID uint64
}
// NetworkLockUpdate describes a change to tailnet-lock state.
type NetworkLockUpdate struct {
// Deprecated: use [TailnetLockStatus] instead.
type NetworkLockStatus = TailnetLockStatus
// TailnetLockUpdate describes a change to tailnet-lock state.
type TailnetLockUpdate struct {
Hash [32]byte
Change string // values of tka.AUMKind.String()
@@ -161,6 +164,9 @@ type NetworkLockUpdate struct {
Raw []byte
}
// Deprecated: use [TailnetLockUpdate] instead.
type NetworkLockUpdate = TailnetLockUpdate
// TailnetStatus is information about a Tailscale network ("tailnet").
type TailnetStatus struct {
// Name is the name of the network that's currently in use.
ipn/localapi/localapi.go
+1 -1
View File
@@ -440,7 +440,7 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
h.logf.JSON(1, "UserBugReportOS", osdiag.SupportInfo(osdiag.LogSupportInfoReasonBugReport))
// Tailnet Lock details
st := h.b.NetworkLockStatus()
st := h.b.TailnetLockStatus()
if st.Enabled {
h.logf.JSON(1, "UserBugReportTailnetLockStatus", st)
if st.NodeKeySignature != nil {
ipn/localapi/tailnetlock.go
+15 -15
View File
@@ -43,7 +43,7 @@ func (h *Handler) serveTKAStatus(w http.ResponseWriter, r *http.Request) {
return
}
j, err := json.MarshalIndent(h.b.NetworkLockStatus(), "", "\t")
j, err := json.MarshalIndent(h.b.TailnetLockStatus(), "", "\t")
if err != nil {
http.Error(w, "JSON encoding error", http.StatusInternalServerError)
return
@@ -72,7 +72,7 @@ func (h *Handler) serveTKASign(w http.ResponseWriter, r *http.Request) {
return
}
if err := h.b.NetworkLockSign(req.NodeKey, req.RotationPublic); err != nil {
if err := h.b.TailnetLockSign(req.NodeKey, req.RotationPublic); err != nil {
http.Error(w, "signing failed: "+err.Error(), http.StatusInternalServerError)
return
}
@@ -101,17 +101,17 @@ func (h *Handler) serveTKAInit(w http.ResponseWriter, r *http.Request) {
return
}
if !h.b.NetworkLockAllowed() {
if !h.b.TailnetLockAllowed() {
http.Error(w, "Tailnet Lock is not supported on your pricing plan", http.StatusForbidden)
return
}
if err := h.b.NetworkLockInit(req.Keys, req.DisablementValues, req.SupportDisablement); err != nil {
if err := h.b.TailnetLockInit(req.Keys, req.DisablementValues, req.SupportDisablement); err != nil {
http.Error(w, "initialization failed: "+err.Error(), http.StatusInternalServerError)
return
}
j, err := json.MarshalIndent(h.b.NetworkLockStatus(), "", "\t")
j, err := json.MarshalIndent(h.b.TailnetLockStatus(), "", "\t")
if err != nil {
http.Error(w, "JSON encoding error", http.StatusInternalServerError)
return
@@ -140,7 +140,7 @@ func (h *Handler) serveTKAModify(w http.ResponseWriter, r *http.Request) {
return
}
if err := h.b.NetworkLockModify(req.AddKeys, req.RemoveKeys); err != nil {
if err := h.b.TailnetLockModify(req.AddKeys, req.RemoveKeys); err != nil {
http.Error(w, "tailnet-lock modify failed: "+err.Error(), http.StatusInternalServerError)
return
}
@@ -172,7 +172,7 @@ func (h *Handler) serveTKAWrapPreauthKey(w http.ResponseWriter, r *http.Request)
return
}
wrappedKey, err := h.b.NetworkLockWrapPreauthKey(req.TSKey, priv)
wrappedKey, err := h.b.TailnetLockWrapPreauthKey(req.TSKey, priv)
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
@@ -200,7 +200,7 @@ func (h *Handler) serveTKAVerifySigningDeeplink(w http.ResponseWriter, r *http.R
return
}
res := h.b.NetworkLockVerifySigningDeeplink(req.URL)
res := h.b.TailnetLockVerifySigningDeeplink(req.URL)
j, err := json.MarshalIndent(res, "", "\t")
if err != nil {
http.Error(w, "JSON encoding error", http.StatusInternalServerError)
@@ -227,7 +227,7 @@ func (h *Handler) serveTKADisable(w http.ResponseWriter, r *http.Request) {
return
}
if err := h.b.NetworkLockDisable(secret); err != nil {
if err := h.b.TailnetLockDisable(secret); err != nil {
http.Error(w, "tailnet-lock disable failed: "+err.Error(), http.StatusBadRequest)
return
}
@@ -251,7 +251,7 @@ func (h *Handler) serveTKALocalDisable(w http.ResponseWriter, r *http.Request) {
return
}
if err := h.b.NetworkLockForceLocalDisable(); err != nil {
if err := h.b.TailnetLockForceLocalDisable(); err != nil {
http.Error(w, "tailnet-lock local disable failed: "+err.Error(), http.StatusBadRequest)
return
}
@@ -274,7 +274,7 @@ func (h *Handler) serveTKALog(w http.ResponseWriter, r *http.Request) {
limit = int(lm)
}
updates, err := h.b.NetworkLockLog(limit)
updates, err := h.b.TailnetLockLog(limit)
if err != nil {
http.Error(w, "reading log failed: "+err.Error(), http.StatusInternalServerError)
return
@@ -300,7 +300,7 @@ func (h *Handler) serveTKAAffectedSigs(w http.ResponseWriter, r *http.Request) {
return
}
sigs, err := h.b.NetworkLockAffectedSigs(keyID)
sigs, err := h.b.TailnetLockAffectedSigs(keyID)
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
@@ -343,7 +343,7 @@ func (h *Handler) serveTKAGenerateRecoveryAUM(w http.ResponseWriter, r *http.Req
}
}
res, err := h.b.NetworkLockGenerateRecoveryAUM(req.Keys, forkFrom)
res, err := h.b.TailnetLockGenerateRecoveryAUM(req.Keys, forkFrom)
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
@@ -374,7 +374,7 @@ func (h *Handler) serveTKACosignRecoveryAUM(w http.ResponseWriter, r *http.Reque
return
}
res, err := h.b.NetworkLockCosignRecoveryAUM(&aum)
res, err := h.b.TailnetLockCosignRecoveryAUM(&aum)
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
@@ -405,7 +405,7 @@ func (h *Handler) serveTKASubmitRecoveryAUM(w http.ResponseWriter, r *http.Reque
return
}
if err := h.b.NetworkLockSubmitRecoveryAUM(&aum); err != nil {
if err := h.b.TailnetLockSubmitRecoveryAUM(&aum); err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}