You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Nick Khyl 2917ea8d0e ipn/ipnauth, safesocket: defer named pipe client's token retrieval until ipnserver needs it ... An error returned by net.Listener.Accept() causes the owning http.Server to shut down. With the deprecation of net.Error.Temporary(), there's no way for the http.Server to test whether the returned error is temporary / retryable or not (see golang/go#66252). Because of that, errors returned by (*safesocket.winIOPipeListener).Accept() cause the LocalAPI server (aka ipnserver.Server) to shut down, and tailscaled process to exit. While this might be acceptable in the case of non-recoverable errors, such as programmer errors, we shouldn't shut down the entire tailscaled process for client- or connection-specific errors, such as when we couldn't obtain the client's access token because the client attempts to connect at the Anonymous impersonation level. Instead, the LocalAPI server should gracefully handle these errors by denying access and returning a 401 Unauthorized to the client. In tailscale/tscert#15, we fixed a known bug where Caddy and other apps using tscert would attempt to connect at the Anonymous impersonation level and fail. However, we should also fix this on the tailscaled side to prevent a potential DoS, where a local app could deliberately open the Tailscale LocalAPI named pipe at the Anonymous impersonation level and cause tailscaled to exit. In this PR, we defer token retrieval until (*WindowsClientConn).Token() is called and propagate the returned token or error via ipnauth.GetConnIdentity() to ipnserver, which handles it the same way as other ipnauth-related errors. Fixes #18212 Fixes tailscale/tscert#13 Signed-off-by: Nick Khyl <nickk@tailscale.com>		16 hours ago
..
auditlog	syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging	1 month ago
conffile	cmd/tailscale/cli,ipn/conffile: add declarative config mode for Services (#17435)	2 months ago
desktop	go.mod: bump golang.org/x/crypto (#17907)	1 month ago
ipnauth	ipn/ipnauth, safesocket: defer named pipe client's token retrieval until ipnserver needs it	16 hours ago
ipnext	ipn/ipnlocal: remove all the weird locking (LockedOnEntry, UnlockEarly, etc)	1 month ago
ipnlocal	cmd/k8s-operator,ipn/ipnlocal: allow opting out of ACME order replace extension (#18252)	5 days ago
ipnserver	feature/featuretags, all: add build features, use existing ones in more places	3 months ago
ipnstate	cmd/tailscale/cli: stabilise the output of `tailscale lock status --json`	2 weeks ago
lapitest	various: allow tailscaled shutdown via LocalAPI	3 months ago
localapi	client/local: add method to set gauge metric to a value	1 week ago
policy	ipn,tailconfig: clean up unreleased and removed app connector service	2 years ago
store	ipn/store, feature/condregister: permit callers to empty import optonal ipn stores	3 months ago
backend.go	types/netmap: remove PrivateKey from NetworkMap	1 month ago
backend_test.go	ipn: fix the string representation of an empty ipn.Notify	3 months ago
conf.go	ipn: ensure that conffile is source of truth for advertised services. (#15361)	9 months ago
doc.go	ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate	11 months ago
ipn_clone.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	4 weeks ago
ipn_test.go	all: do not depend on the testing package	2 years ago
ipn_view.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	4 weeks ago
prefs.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	4 weeks ago
prefs_test.go	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	4 weeks ago
serve.go	cmd/tailscale,ipn: add Unix socket support for serve	3 weeks ago
serve_expand_test.go	cmd/tailscale,ipn: add Unix socket support for serve	3 weeks ago
serve_test.go	ipn/serve: validate service paths in HasPathHandler	4 weeks ago
store.go	cmd/tailscaled,ipn: show a health warning when state store fails to open (#17883)	1 month ago
store_test.go	ipn/store: automatically migrate between plaintext and encrypted state (#16318)	6 months ago