mirrors/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-09-21 13:41:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

tka: block key addition when the max number of keys is reached

Browse Source 
Updates #16607

Signed-off-by: Anton Tolchanov <anton@tailscale.com>
This commit is contained in:
Anton Tolchanov 2025-08-14 14:02:19 +01:00 committed by Anton Tolchanov
parent 5402620db8
commit 819db6759c
2 changed files with 49 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tka/builder.go
View File

@ -67,6 +67,11 @@ func (b *UpdateBuilder) AddKey(key Key) error {
if _, err := b.state.GetKey(keyID); err == nil {
return fmt.Errorf("cannot add key %v: already exists", key)
}
if len(b.state.Keys) >= maxKeys {
return fmt.Errorf("cannot add key %v: maximum number of keys reached", key)
}
return b.mkUpdate(AUM{MessageKind: AUMAddKey, Key: &key})
}

44
tka/builder_test.go
View File

@ -58,6 +58,50 @@ func TestAuthorityBuilderAddKey(t *testing.T) {
t.Errorf("could not read new key: %v", err)
}
}
func TestAuthorityBuilderMaxKey(t *testing.T) {
pub, priv := testingKey25519(t, 1)
key := Key{Kind: Key25519, Public: pub, Votes: 2}
storage := &Mem{}
a, _, err := Create(storage, State{
Keys: []Key{key},
DisablementSecrets: [][]byte{DisablementKDF([]byte{1, 2, 3})},
}, signer25519(priv))
if err != nil {
t.Fatalf("Create() failed: %v", err)
}
for i := 0; i <= maxKeys; i++ {
pub2, _ := testingKey25519(t, int64(2+i))
key2 := Key{Kind: Key25519, Public: pub2, Votes: 1}
b := a.NewUpdater(signer25519(priv))
err := b.AddKey(key2)
if i < maxKeys-1 {
if err != nil {
t.Fatalf("AddKey(%v) failed: %v", key2, err)
}
} else {
// Too many keys.
if err == nil {
t.Fatalf("AddKey(%v) succeeded unexpectedly", key2)
}
continue
}
updates, err := b.Finalize(storage)
if err != nil {
t.Fatalf("Finalize() failed: %v", err)
}
if err := a.Inform(storage, updates); err != nil {
t.Fatalf("could not apply generated updates: %v", err)
}
if _, err := a.state.GetKey(key2.MustID()); err != nil {
t.Errorf("could not read new key: %v", err)
}
}
}
func TestAuthorityBuilderRemoveKey(t *testing.T) {
pub, priv := testingKey25519(t, 1)