lzc256
/
tailscale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tka: add public API on NodeKeySignature key information 

This is needed in the coordination server.

Signed-off-by: Tom DNetto <tom@tailscale.com>
pull/7356/head
Tom DNetto 2023-02-23 10:31:13 -08:00 committed by Tom
parent 61a345c8e1
commit abc874b04e
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tka/sig.go
View File

@ -96,6 +96,18 @@ type NodeKeySignature struct {
WrappingPubkey []byte `cbor:"6,keyasint,omitempty"` WrappingPubkey []byte `cbor:"6,keyasint,omitempty"`
} }
// UnverifiedWrappingPublic returns the public key which must sign a
// signature which embeds this one, if any.
//
// See docs on NodeKeySignature.WrappingPubkey & SigRotation for documentation
// about wrapping public keys.
//
// SAFETY: The caller MUST verify the signature using
// Authority.NodeKeyAuthorized if treating this as authentic information.
func (s NodeKeySignature) UnverifiedWrappingPublic() (pub ed25519.PublicKey, ok bool) {
return s.wrappingPublic()
}
// wrappingPublic returns the public key which must sign a signature which // wrappingPublic returns the public key which must sign a signature which
// embeds this one, if any. // embeds this one, if any.
func (s NodeKeySignature) wrappingPublic() (pub ed25519.PublicKey, ok bool) { func (s NodeKeySignature) wrappingPublic() (pub ed25519.PublicKey, ok bool) {
@ -115,6 +127,15 @@ func (s NodeKeySignature) wrappingPublic() (pub ed25519.PublicKey, ok bool) {
} }
} }
// UnverifiedAuthorizingKeyID returns the KeyID of the key which authorizes
// this signature.
//
// SAFETY: The caller MUST verify the signature using
// Authority.NodeKeyAuthorized if treating this as authentic information.
func (s NodeKeySignature) UnverifiedAuthorizingKeyID() (tkatype.KeyID, error) {
return s.authorizingKeyID()
}
// authorizingKeyID returns the KeyID of the key trusted by network-lock which authorizes // authorizingKeyID returns the KeyID of the key trusted by network-lock which authorizes
// this signature. // this signature.
func (s NodeKeySignature) authorizingKeyID() (tkatype.KeyID, error) { func (s NodeKeySignature) authorizingKeyID() (tkatype.KeyID, error) {