mirror of
https://github.com/tailscale/tailscale.git
synced 2025-12-01 23:42:12 +01:00
c09c95ef67
Adds the ability to rotate discovery keys on running clients, needed for testing upcoming disco key distribution changes. Introduces key.DiscoKey, an atomic container for a disco private key, public key, and the public key's ShortString, replacing the prior separate atomic fields. magicsock.Conn has a new RotateDiscoKey method, and access to this is provided via localapi and a CLI debug command. Note that this implementation is primarily for testing as it stands, and regular use should likely introduce an additional mechanism that allows the old key to be used for some time, to provide a seamless key rotation rather than one that invalidates all sessions. Updates tailscale/corp#34037 Signed-off-by: James Tucker <james@tailscale.com>
59 lines
1.5 KiB
Go
59 lines
1.5 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package magicsock
|
|
|
|
import (
|
|
"sync/atomic"
|
|
|
|
"tailscale.com/types/key"
|
|
)
|
|
|
|
type discoKeyPair struct {
|
|
private key.DiscoPrivate
|
|
public key.DiscoPublic
|
|
short string // public.ShortString()
|
|
}
|
|
|
|
// discoAtomic is an atomic container for a disco private key, public key, and
|
|
// the public key's ShortString. The private and public keys are always kept
|
|
// synchronized.
|
|
//
|
|
// The zero value is not ready for use. Use [Set] to provide a usable value.
|
|
type discoAtomic struct {
|
|
pair atomic.Pointer[discoKeyPair]
|
|
}
|
|
|
|
// Pair returns the private and public keys together atomically.
|
|
// Code that needs both the private and public keys synchronized should
|
|
// use Pair instead of calling Private and Public separately.
|
|
func (dk *discoAtomic) Pair() (key.DiscoPrivate, key.DiscoPublic) {
|
|
p := dk.pair.Load()
|
|
return p.private, p.public
|
|
}
|
|
|
|
// Private returns the private key.
|
|
func (dk *discoAtomic) Private() key.DiscoPrivate {
|
|
return dk.pair.Load().private
|
|
}
|
|
|
|
// Public returns the public key.
|
|
func (dk *discoAtomic) Public() key.DiscoPublic {
|
|
return dk.pair.Load().public
|
|
}
|
|
|
|
// Short returns the short string of the public key (see [DiscoPublic.ShortString]).
|
|
func (dk *discoAtomic) Short() string {
|
|
return dk.pair.Load().short
|
|
}
|
|
|
|
// Set updates the private key (and the cached public key and short string).
|
|
func (dk *discoAtomic) Set(private key.DiscoPrivate) {
|
|
public := private.Public()
|
|
dk.pair.Store(&discoKeyPair{
|
|
private: private,
|
|
public: public,
|
|
short: public.ShortString(),
|
|
})
|
|
}
|