You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn
Nick Khyl d832467461 client/tailscale,ipn/ipn{local,server},util/syspolicy: implement the AlwaysOn.OverrideWithReason policy setting
In this PR, we update client/tailscale.LocalClient to allow sending requests with an optional X-Tailscale-Reason
header. We then update ipn/ipnserver.{actor,Server} to retrieve this reason, if specified, and use it to determine
whether ipnauth.Disconnect is allowed when the AlwaysOn.OverrideWithReason policy setting is enabled.
For now, we log the reason, along with the profile and OS username, to the backend log.

Finally, we update LocalBackend to remember when a disconnect was permitted and do not reconnect automatically
unless the policy changes.

Updates tailscale/corp#26146

Signed-off-by: Nick Khyl <nickk@tailscale.com>
11 months ago
..
conffile ipn/conffile: don't depend on hujson on iOS/Android 1 year ago
ipnauth ipn/ipnauth,util/syspolicy: improve comments 11 months ago
ipnlocal client/tailscale,ipn/ipn{local,server},util/syspolicy: implement the AlwaysOn.OverrideWithReason policy setting 11 months ago
ipnserver client/tailscale,ipn/ipn{local,server},util/syspolicy: implement the AlwaysOn.OverrideWithReason policy setting 11 months ago
ipnstate all: illumos/solaris userspace only support 12 months ago
localapi ipn/ipn{auth,server,local}: initial support for the always-on mode 11 months ago
policy ipn,tailconfig: clean up unreleased and removed app connector service 2 years ago
store kube/{kubeapi,kubeclient},ipn/store/kubestore,cmd/{containerboot,k8s-operator}: emit kube store Events (#14112) 1 year ago
backend.go ipn: declare NotifyWatchOpt consts without using iota 12 months ago
conf.go ipn/conf.go: add VIPServices to tailscaled configfile (#14345) 12 months ago
doc.go ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate 11 months ago
ipn_clone.go ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate 11 months ago
ipn_test.go all: do not depend on the testing package 2 years ago
ipn_view.go ipn: generate LoginProfileView and use it instead of *LoginProfile where appropriate 11 months ago
prefs.go cmd/tailscale,ipn,tailcfg: add `tailscale advertise` subcommand behind envknob (#13734) 1 year ago
prefs_test.go types/persist: remove Persist.LegacyFrontendPrivateMachineKey 11 months ago
serve.go tailcfg: add ServiceName 11 months ago
serve_test.go ipn: [serve] warn that foreground funnel won't work if shields are up (#14685) 11 months ago
store.go ipn: add comment about thread-safety to StateStore 2 years ago
store_test.go ipn: avoid useless no-op WriteState calls 2 years ago