You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn
Will Norris 236531c5fc ipn/ipnserver: always allow Windows SYSTEM user to connect
When establishing connections to the ipnserver, we validate that the
local user is allowed to connect.  If Tailscale is currently being
managed by a different user (primarily for multi-user Windows installs),
we don't allow the connection.

With the new device web UI, the inbound connection is coming from
tailscaled itself, which is often running as "NT AUTHORITY\SYSTEM".
In this case, we still want to allow the connection, even though it
doesn't match the user running the Tailscale GUI. The SYSTEM user has
full access to everything on the system anyway, so this doesn't escalate
privileges.

Eventually, we want the device web UI to run outside of the tailscaled
process, at which point this exception would probably not be needed.

Updates tailscale/corp#16393

Signed-off-by: Will Norris <will@tailscale.com>
5 months ago
..
conffile ipn/{conffile,ipnlocal}: start booting tailscaled from a config file w/ auth key 8 months ago
ipnauth ipn/ipnserver: always allow Windows SYSTEM user to connect 5 months ago
ipnlocal ipn/ipnserver: always allow Windows SYSTEM user to connect 5 months ago
ipnserver ipn/ipnserver: always allow Windows SYSTEM user to connect 5 months ago
ipnstate ipn/ipnstate: add AllowedIPs to PeerStatus 6 months ago
localapi cmd/tailscale, ipn/ipnlocal: add 'debug dial-types' command 5 months ago
policy ipn,tailconfig: clean up unreleased and removed app connector service 7 months ago
store cmd/k8s-operator,ipn/store/kubestore: patch secrets instead of updating 9 months ago
backend.go taildrop: remove breaking abstraction layers for apple (#10728) 5 months ago
conf.go ipn,cmd/tailscale/cli: support hierarchical MaskedPrefs (#10507) 6 months ago
doc.go all: update copyright and license headers 1 year ago
fake_test.go all: update copyright and license headers 1 year ago
ipn_clone.go linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilter 6 months ago
ipn_test.go net/packet: split off checksum munging into different pkg 8 months ago
ipn_view.go linuxfw,wgengine/route,ipn: add c2n and nodeattrs to control linux netfilter 6 months ago
prefs.go ipn: apply ControlURL policy before login 5 months ago
prefs_test.go ipn: apply tailnet-wide default for auto-updates (#10508) 6 months ago
serve.go ipn/localapi: require local Windows admin to set serve path (#9969) 7 months ago
serve_test.go ipn/localapi: require local Windows admin to set serve path (#9969) 7 months ago
store.go taildrop: lazily perform full deletion scan after first taildrop use (#10137) 7 months ago
store_test.go ipn: avoid useless no-op WriteState calls 10 months ago