You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Nick Khyl 551d6ae0f3 ipn, ipn/ipnauth: implement API surface for LocalBackend access checking ... We have a lot of access checks spread around the ipnserver, ipnlocal, localapi, and ipnauth packages, with a significant number of platform-specific checks that are used exclusively on either Windows or Unix-like platforms. Additionally, with the exception of a few Windows-specific checks, most of these checks are per-device rather than per-profile, which is not always correct even on single-user/single-session environments, but even more problematic on multi-user/multi-session environments such as Windows. We initially attempted to map all possible operations onto the permitRead/permitWrite access flags. However, these flags are not utilized on Windows and prove insufficient on Unix machines. Specifically, on Windows, the first user to connect is granted full access, while subsequent logged-in users have no access to the LocalAPI at all. This restriction applies regardless of the environment, local user roles (e.g., whether a Windows user is a local admin), or whether they are the active user on a shared Windows client device. Conversely, on Unix, we introduced the permitCert flag to enable granting non-root web servers (such as www-data, caddy, nginx, etc.) access to certificates. We also added additional access check to distinguish local admins (root on Unix-like platforms, elevated admins on Windows) from users with permitWrite access, and used it as a fix for the serve path LPE. A more fine-grained access control system could better suit our current and future needs, especially in improving the UX across various scenarios on corporate and personal Windows devices. This adds an API surface in ipnauth that will be used in LocalBackend to check access to individual Tailscale profiles as well as any device-wide information and operations. Updates tailscale/corp#18342 Signed-off-by: Nick Khyl <nickk@tailscale.com>		4 weeks ago
..
addlicense	all: update tools that manage copyright headers	1 year ago
build-webclient	client/web: precompress assets	5 months ago
cloner	all: use Go 1.22 range-over-int	1 month ago
connector-gen	cmd/connector-gen: add helper tool for wide app connector configurations	5 months ago
containerboot	cmd/{containerboot,k8s-operator/deploy/manifests}: optionally allow proxying cluster traffic to a cluster target via ingress proxy (#11036)	3 months ago
derper	hostinfo: use Distro field for distinguishing Windows Server builds	4 weeks ago
derpprobe	cmd/{derper,derpprobe}: add --version flag	2 months ago
dist	cmd/dist: update logs for synology builds	3 months ago
get-authkey	util/cmpx: delete now that we're using Go 1.22	3 months ago
gitops-pusher	cmd/gitops-pusher: only use OAuth creds if non-empty string	3 months ago
hello	cmd/hello: link to the Hello KB article (#11022)	3 months ago
k8s-operator	cmd/k8s-operator: correctly determine cluster domain (#11512)	4 weeks ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	1 year ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	10 months ago
mkversion	version/mkversion: open-source version generation logic	1 year ago
nardump	all: update copyright and license headers	1 year ago
netlogfmt	all: use Go 1.22 range-over-int	1 month ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	1 year ago
pgproxy	various: add golangci-lint, fix issues (#7905)	1 year ago
printdep	cmd/printdep: print correct toolchain URL	1 year ago
proxy-to-grafana	all: use Go 1.22 range-over-int	1 month ago
sniproxy	all: use Go 1.22 range-over-int	1 month ago
speedtest	all: update copyright and license headers	1 year ago
ssh-auth-none-demo	all: replace deprecated ioutil references	9 months ago
stunc	all: update copyright and license headers	1 year ago
stund	build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 (#11410)	1 month ago
sync-containers	all: adjust some build tags for plan9	9 months ago
tailscale	hostinfo: use Distro field for distinguishing Windows Server builds	4 weeks ago
tailscaled	ipn, ipn/ipnauth: implement API surface for LocalBackend access checking	4 weeks ago
testcontrol	all: use Go 1.22 range-over-int	1 month ago
testwrapper	cmd/testwrapper: apply results of all unit tests to coverage for all packages	3 months ago
tsconnect	ipn/ipnlocal: make StartLoginInteractive take (yet unused) context	1 month ago
tsidp	cmd/tsidp: add start of OIDC Tailscale IdP	6 months ago
tsshd	all: update copyright and license headers	1 year ago
viewer	all: use Go 1.22 range-over-int	1 month ago