From f398712c006a8afeb165942baae9e7c526de7a9e Mon Sep 17 00:00:00 2001 From: Maisem Ali Date: Fri, 20 Oct 2023 15:37:25 -0700 Subject: [PATCH] ipn/ipnlocal: prevent changing serve config if conf.Locked This adds a check to prevent changes to ServeConfig if tailscaled is run with a Locked config. Missed in 1fc3573446a9bb2411bb6b68864368fd1e465b7e. Updates #1412 Signed-off-by: Maisem Ali --- ipn/ipnlocal/local.go | 14 ++++++++++---- ipn/ipnlocal/serve.go | 3 +++ 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go index c01eff80e..c4ed545a7 100644 --- a/ipn/ipnlocal/local.go +++ b/ipn/ipnlocal/local.go @@ -2760,11 +2760,17 @@ func (b *LocalBackend) CheckPrefs(p *ipn.Prefs) error { return b.checkPrefsLocked(p) } +// isConfigLocked_Locked reports whether the parsed config file is locked. +// b.mu must be held. +func (b *LocalBackend) isConfigLocked_Locked() bool { + // TODO(bradfitz,maisem): make this more fine-grained, permit changing + // some things if they're not explicitly set in the config. But for now + // (2023-10-16), just blanket disable everything. + return b.conf != nil && !b.conf.Parsed.Locked.EqualBool(false) +} + func (b *LocalBackend) checkPrefsLocked(p *ipn.Prefs) error { - if b.conf != nil && !b.conf.Parsed.Locked.EqualBool(false) { - // TODO(bradfitz,maisem): make this more fine-grained, permit changing - // some things if they're not explicitly set in the config. But for now - // (2023-10-16), just blanket disable everything. + if b.isConfigLocked_Locked() { return errors.New("can't reconfigure tailscaled when using a config file; config file is locked") } var errs []error diff --git a/ipn/ipnlocal/serve.go b/ipn/ipnlocal/serve.go index 9b218a71f..60dbaeff4 100644 --- a/ipn/ipnlocal/serve.go +++ b/ipn/ipnlocal/serve.go @@ -245,6 +245,9 @@ func (b *LocalBackend) setServeConfigLocked(config *ipn.ServeConfig, etag string if config.IsFunnelOn() && prefs.ShieldsUp() { return errors.New("Unable to turn on Funnel while shields-up is enabled") } + if b.isConfigLocked_Locked() { + return errors.New("can't reconfigure tailscaled when using a config file; config file is locked") + } nm := b.netMap if nm == nil {