tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	e24de8a617	ssh/tailssh: add password-forcing workaround for buggy SSH clients If the username includes a suffix of +password, then we accept password auth and just let them in like it were no auth. This exists purely for SSH clients that get confused by seeing success to their initial auth type "none". Co-authored-by: Maisem Ali <maisem@tailscale.com> Change-Id: I616d4c64d042449fb164f615012f3bae246e91ec Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Emmanuel T Odeke	680f8d9793	all: fix more resource leaks found by staticmajor Updates #5706 Signed-off-by: Emmanuel T Odeke <emmanuel@orijtech.com>	2 years ago
Maisem Ali	f172fc42f7	ssh/tailssh: close sshContext on context cancellation This was preventing tailscaled from shutting down properly if there were active sessions in certain states (e.g. waiting in check mode). Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	4de1601ef4	ssh/tailssh: add support for sending multiple banners Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	ecf6cdd830	ssh/tailssh: add TestSSHAuthFlow Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	f16b77de5d	ssh/tailssh: do the full auth flow during ssh auth Fixes #5091 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	b84ec521bf	ssh/tailssh: do not send EOT on session disconnection This was assumed to be the fix for mosh not working, however turns out all we really needed was the duplicate fd also introduced in the same commit (`af412e8874`). Fixes #5103 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	b1bd96f114	go.mod, ssh/tailssh: fix ImplictAuthMethod typo Fixes #5745 Change-Id: Ie8bc88bd465a9cb35b0ae7782d61ce96480473ee Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Josh Soref	d4811f11a0	all: fix spelling mistakes Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>	2 years ago
Eng Zer Jun	f0347e841f	refactor: move from io/ioutil to io and os packages The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Reference: https://golang.org/doc/go1.16#ioutil Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2 years ago
Brad Fitzpatrick	74674b110d	envknob: support changing envknobs post-init Updates #5114 Change-Id: Ia423fc7486e1b3f3180a26308278be0086fae49b Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	4950fe60bd	syncs, all: move to using Go's new atomic types instead of ours Fixes #5185 Change-Id: I850dd532559af78c3895e2924f8237ccc328449d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	8725b14056	all: migrate more code code to net/netip directly Instead of going through the tailscale.com/net/netaddr transitional wrappers. Updates #5162 Change-Id: I3dafd1c2effa1a6caa9b7151ecf6edd1a3fda3dd Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	02a765743e	ssh/tailssh: fix deadlock in expandDelegateURL Also rename it to expandDelegateURLLocked, previously it was trying to acquire the mutex while holding the mutex. Fixes #5235 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	a12aad6b47	all: convert more code to use net/netip directly perl -i -npe 's,netaddr.IPPrefixFrom,netip.PrefixFrom,' $(git grep -l -F netaddr.) perl -i -npe 's,netaddr.IPPortFrom,netip.AddrPortFrom,' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPrefix,netip.Prefix,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPPort,netip.AddrPort,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IP\b,netip.Addr,g' $(git grep -l -F netaddr. ) perl -i -npe 's,netaddr.IPv6Raw\b,netip.AddrFrom16,g' $(git grep -l -F netaddr. ) goimports -w . Then delete some stuff from the net/netaddr shim package which is no longer neeed. Updates #5162 Change-Id: Ia7a86893fe21c7e3ee1ec823e8aba288d4566cd8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	6a396731eb	all: use various net/netip parse funcs directly Mechanical change with perl+goimports. Changed {Must,}Parse{IP,IPPrefix,IPPort} to their netip variants, then goimports -d . Finally, removed the net/netaddr wrappers, to prevent future use. Updates #5162 Change-Id: I59c0e38b5fbca5a935d701645789cddf3d7863ad Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Brad Fitzpatrick	7eaf5e509f	net/netaddr: start migrating to net/netip via new netaddr adapter package Updates #5162 Change-Id: Id7bdec303b25471f69d542f8ce43805328d56c12 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	3e06b9ea7a	ssh/tailssh: add "ssh" to conn logs Fixes #5089 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	480fd6c797	ssh/tailssh: handle not-authenticated-yet connections in matchRule Also make more fields in conn.info thread safe, there was previously a data race here. Fixes #5110 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	af412e8874	ssh/tailssh: better handling of signals and exits We were not handling errors occurred while copying data between the subprocess and the connection. This makes it so that we pass the appropriate signals when to the process and the connection. This also fixes mosh. Updates #4919 Co-authored-by: James Tucker <raggi@tailscale.com> Co-authored-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Brad Fitzpatrick	3b1f99ded1	ssh/tailssh: fix Tailscale SSH to Linux Arch machines See https://github.com/tailscale/tailscale/issues/4924#issuecomment-1168201823 Arch uses a different login binary that makes the -h flag set the PAM service to "remote". So if they don't have that configured, don't pass -h. Thanks to @eddiezane for debugging! Updates #4924 Change-Id: I8d33e0afb2dfb99517bcea2f9d5d0c6247519b3c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	2 years ago
Maisem Ali	40503ef07a	ssh/tailssh: fix logging typo Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	c434e47f2d	ssh/tailssh: always use current time for policy evaluation Whenever the SSH policy changes we revaluate all open connections to make sure they still have access. This check was using the wrong timestamp and would match against expired policies, however this really isn't a problem today as we don't have policy that would be impacted by this check. Fixing it for future use. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	a7d2024e35	ssh/tailssh: allow multiple sessions on the same conn Fixes #4920 Fixes tailscale/corp#5633 Updates #4479 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Adam Eijdenberg	9294a14a37	ssh/tailssh: limit setgroups to 16 on macOS Fixes #4938 Signed-off-by: Adam Eijdenberg <adam@continusec.com>	2 years ago
Adam Eijdenberg	7f807fef6c	ssh/tailssh: fix /usr/bin/login args on macOS Fixes #4931 Signed-off-by: Adam Eijdenberg <adam@continusec.com>	2 years ago
Brad Fitzpatrick	e428bba7a3	ssh/tailssh: add metrics Updates #3802 Change-Id: Ic9a4b8c51cff6dfe148a1c78bc0e5074195b7f80 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	928530a112	ipn/ipnlocal: shutdown sshServer on tailscale down Also lazify SSHServer initialization to allow restarting the server on a subsequent `tailscale up` Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	575aacb1e2	ssh/tailssh: terminate sessions on stdout copy failures Currently, killing a SCP copy with a Ctrl+C leaves the session hanging even though the stdout copy goroutine fails with an io.EOF. Taking a step back, when we are unable to send any more data back to the client we should just terminate the session as the client will stop getting any response from the server anyways. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	7cd8c3e839	ssh/tailssh: terminate sessions when tailscaled shutsdown Ideally we would re-establish these sessions when tailscaled comes back up, however we do not do that yet so this is better than leaking the sessions. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	760740905e	ssh/tailssh: only use `login` with TTY sessions Otherwise, the shell exits immediately causing applications like mosh and VSCode to fail. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	5cd56fe8d5	ssh/tailssh: exec into `login` when launching a shell This has the added benefit of displaying the MOTD and reducing our dependency on the DBus interface. Fixes #4627 Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	a253057fc3	ssh/tailssh: refactor incubator flags Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	c1445155ef	ssh/tailssh: handle Control-C during hold-and-delegate prompt Fixes #4549 Change-Id: Iafc61af5e08cd03564d39cf667e940b2417714cc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	3012a2e1ca	ssh/tailssh,ipn/ipnlocal: terminate any active sessions on `up --ssh=false` Currently the ssh session isn't terminated cleanly, instead the packets are just are no longer routed to the in-proc SSH server. This makes it so that clients get a disconnection when the `RunSSH` pref changes to `false`. Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	910ae68e0b	util/mak: move tailssh's mapSet into a new package for reuse elsewhere Change-Id: Idfe95db82275fd2be6ca88f245830731a0d5aecf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
James Tucker	c2eff20008	ssh/tailssh: avoid user ssh configuration in tests Signed-off-by: James Tucker <james@tailscale.com>	3 years ago
David Anderson	a364bf2b62	ssh/tailssh: various typo fixes, clarifications. Signed-off-by: David Anderson <danderson@tailscale.com>	3 years ago
Brad Fitzpatrick	c994eba763	ssh/tailssh: simplify matchRule with Reject rules Updates #3802 Change-Id: I59fe111eef5ac8abbcbcec922e293712a65a4830 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	31094d557b	ssh/tailssh: chmod the auth socket to be only user accessible Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	337c77964b	ssh/tailssh: set groups and gid in the incubated process Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	8ac4d52b59	ssh/tailssh: filter accepted environment variables Noted by @danderson Updates #3802 Change-Id: Iac70717ed57f11726209ac1ea93ddc6696605f94 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Brad Fitzpatrick	89832c1a95	tailcfg: fix typo in SessionDuration field name Noted by @danderson. Updates #3802 Change-Id: Ide15f3f28e30f6abb5c94d7dcd218bd9482752a0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	695f8a1d7e	ssh/tailssh: add support for sftp Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	5b4154342e	ssh/tailssh: fix double SSH-2.0- prefix in greeting banner gliderlabs/ssh was already adding the "SSH-2.0-" prefix. Updates #3802 Change-Id: I19a1cd9308371a2898e7883cf26e94c9b54bab29 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	2b8b887d55	ssh/tailssh: send banner messages during auth, move more to conn (VSCode Live Share between Brad & Maisem!) Updates #3802 Change-Id: Id8edca4481b0811debfdf56d4ccb1a46f71dd6d3 Co-Authored-By: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	f74ee80abe	ssh/tailssh: support expansions in public key fetch URL too Updates #3802 Change-Id: I5aa98bdab14fd1c1c00ba63b93f8d7e670f72437 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	14d077fc3a	ssh/tailssh: terminate ssh auth early if no policy can match Also bump github.com/tailscale/golang-x-crypto/ssh Updates #3802 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brad Fitzpatrick	8b81254992	ipn/ipnlocal: reject tailscale up --ssh if disabled on tailnet Updates #3802 Change-Id: I3f1e839391fe9b28270f506f4bb8d8e3d36716f5 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	3 years ago
Maisem Ali	91a187bf87	ssh/tailssh: make checkStillValid also consider username changes Currently if the policy changes and the session is logged in with local user "u1" and the new policy says they can only login with "u2" now, the user doesn't get kicked out because they had requested `rando@<ssh-host>` and the defaulting had made that go to `u1`. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago

1 2

93 Commits (036f70b7b45ab78b07ff0c691d749c2c6045ac33)