TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2024-11-25 19:15:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/ipnlocal,cmd/tailscale: minor improvements to lock modify command

Browse Source 
* Do not print the status at the end of a successful operation
 * Ensure the key of the current node is actually trusted to make these changes

Signed-off-by: Tom DNetto <tom@tailscale.com>
This commit is contained in:
Tom DNetto 2022-12-04 22:55:57 -08:00 committed by Tom
parent 98f21354c6
commit 55e0512a05
4 changed files with 19 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
client/tailscale/localclient.go
View File

@ -805,7 +805,7 @@ type initRequest struct {
} }
// NetworkLockModify adds and/or removes key(s) to the tailnet key authority. // NetworkLockModify adds and/or removes key(s) to the tailnet key authority.
func (lc *LocalClient) NetworkLockModify(ctx context.Context, addKeys, removeKeys []tka.Key) (*ipnstate.NetworkLockStatus, error) { func (lc *LocalClient) NetworkLockModify(ctx context.Context, addKeys, removeKeys []tka.Key) error {
var b bytes.Buffer var b bytes.Buffer
type modifyRequest struct { type modifyRequest struct {
AddKeys []tka.Key AddKeys []tka.Key
@ -813,14 +813,13 @@ type modifyRequest struct {
} }
if err := json.NewEncoder(&b).Encode(modifyRequest{AddKeys: addKeys, RemoveKeys: removeKeys}); err != nil { if err := json.NewEncoder(&b).Encode(modifyRequest{AddKeys: addKeys, RemoveKeys: removeKeys}); err != nil {
return nil, err return err
} }
body, err := lc.send(ctx, "POST", "/localapi/v0/tka/modify", 200, &b) if _, err := lc.send(ctx, "POST", "/localapi/v0/tka/modify", 204, &b); err != nil {
if err != nil { return fmt.Errorf("error: %w", err)
return nil, fmt.Errorf("error: %w", err)
} }
return decodeJSON[*ipnstate.NetworkLockStatus](body) return nil
} }
// NetworkLockSign signs the specified node-key and transmits that signature to the control plane. // NetworkLockSign signs the specified node-key and transmits that signature to the control plane.

5
cmd/tailscale/cli/network-lock.go
View File

@ -310,12 +310,9 @@ func runNetworkLockModify(ctx context.Context, addArgs, removeArgs []string) err
return err return err
} }
status, err := localClient.NetworkLockModify(ctx, addKeys, removeKeys) if err := localClient.NetworkLockModify(ctx, addKeys, removeKeys); err != nil {
if err != nil {
return err return err
} }
fmt.Printf("Status: %+v\n\n", status)
return nil return nil
} }

3
ipn/ipnlocal/network-lock.go
View File

@ -654,6 +654,9 @@ func (b *LocalBackend) NetworkLockModify(addKeys, removeKeys []tka.Key) (err err
if b.tka == nil { if b.tka == nil {
return errNetworkLockNotActive return errNetworkLockNotActive
} }
if !b.tka.authority.KeyTrusted(nlPriv.KeyID()) {
return errors.New("this node does not have a trusted tailnet lock key")
}
updater := b.tka.authority.NewUpdater(nlPriv) updater := b.tka.authority.NewUpdater(nlPriv)

9
ipn/localapi/localapi.go
View File

@ -1254,14 +1254,7 @@ type modifyRequest struct {
http.Error(w, "network-lock modify failed: "+err.Error(), http.StatusInternalServerError) http.Error(w, "network-lock modify failed: "+err.Error(), http.StatusInternalServerError)
return return
} }
w.WriteHeader(204)
j, err := json.MarshalIndent(h.b.NetworkLockStatus(), "", "\t")
if err != nil {
http.Error(w, "JSON encoding error", 500)
return
}
w.Header().Set("Content-Type", "application/json")
w.Write(j)
} }
func (h *Handler) serveTKADisable(w http.ResponseWriter, r *http.Request) { func (h *Handler) serveTKADisable(w http.ResponseWriter, r *http.Request) {