mirror of https://github.com/tailscale/tailscale/
safesocket, ipn/ipnserver: look up peer creds on Darwin
And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>peske/elnotfound^2
Brad Fitzpatrick
4 years ago
parent
65815cc1ac
commit
d3efe8caf6
@ -1,49 +0,0 @@
|
|||||||
// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
|
|
||||||
// Use of this source code is governed by a BSD-style
|
|
||||||
// license that can be found in the LICENSE file.
|
|
||||||
|
|
||||||
// +build linux
|
|
||||||
|
|
||||||
package ipnserver
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net"
|
|
||||||
|
|
||||||
"golang.org/x/sys/unix"
|
|
||||||
"tailscale.com/types/logger"
|
|
||||||
)
|
|
||||||
|
|
||||||
func isReadonlyConn(c net.Conn, logf logger.Logf) (ro bool) {
|
|
||||||
ro = true // conservative default for naked returns below
|
|
||||||
uc, ok := c.(*net.UnixConn)
|
|
||||||
if !ok {
|
|
||||||
logf("unexpected connection type %T", c)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
raw, err := uc.SyscallConn()
|
|
||||||
if err != nil {
|
|
||||||
logf("SyscallConn: %v", err)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
var cred *unix.Ucred
|
|
||||||
cerr := raw.Control(func(fd uintptr) {
|
|
||||||
cred, err = unix.GetsockoptUcred(int(fd),
|
|
||||||
unix.SOL_SOCKET,
|
|
||||||
unix.SO_PEERCRED)
|
|
||||||
})
|
|
||||||
if cerr != nil {
|
|
||||||
logf("raw.Control: %v", err)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if err != nil {
|
|
||||||
logf("raw.Control: %v", err)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
if cred.Uid == 0 {
|
|
||||||
// root is not read-only.
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
logf("non-root connection from %v (read-only)", cred.Uid)
|
|
||||||
return true
|
|
||||||
}
|
|
||||||
@ -1,27 +0,0 @@
|
|||||||
// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
|
|
||||||
// Use of this source code is governed by a BSD-style
|
|
||||||
// license that can be found in the LICENSE file.
|
|
||||||
|
|
||||||
// +build !linux
|
|
||||||
|
|
||||||
package ipnserver
|
|
||||||
|
|
||||||
import (
|
|
||||||
"net"
|
|
||||||
|
|
||||||
"tailscale.com/types/logger"
|
|
||||||
)
|
|
||||||
|
|
||||||
func isReadonlyConn(c net.Conn, logf logger.Logf) bool {
|
|
||||||
// Windows doesn't need/use this mechanism, at least yet. It
|
|
||||||
// has a different last-user-wins auth model.
|
|
||||||
|
|
||||||
// And on Darwin, we're not using it yet, as the Darwin
|
|
||||||
// tailscaled port isn't yet done, and unix.Ucred and
|
|
||||||
// unix.GetsockoptUcred aren't in x/sys/unix.
|
|
||||||
|
|
||||||
// TODO(bradfitz): OpenBSD and FreeBSD should implement this too.
|
|
||||||
// But their x/sys/unix package is different than Linux, so
|
|
||||||
// I didn't include it for now.
|
|
||||||
return false
|
|
||||||
}
|
|
||||||
Loading…
Reference in New Issue