You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Will Norris 236531c5fc ipn/ipnserver: always allow Windows SYSTEM user to connect ... When establishing connections to the ipnserver, we validate that the local user is allowed to connect. If Tailscale is currently being managed by a different user (primarily for multi-user Windows installs), we don't allow the connection. With the new device web UI, the inbound connection is coming from tailscaled itself, which is often running as "NT AUTHORITY\SYSTEM". In this case, we still want to allow the connection, even though it doesn't match the user running the Tailscale GUI. The SYSTEM user has full access to everything on the system anyway, so this doesn't escalate privileges. Eventually, we want the device web UI to run outside of the tailscaled process, at which point this exception would probably not be needed. Updates tailscale/corp#16393 Signed-off-by: Will Norris <will@tailscale.com>		2 years ago
..
testdata	ipn/ipnlocal: fix the path for writing cert files (#7203)	3 years ago
breaktcp_darwin.go	cmd/tailscale: add debug commands to break connections	2 years ago
breaktcp_linux.go	cmd/tailscale: add debug commands to break connections	2 years ago
c2n.go	ipn: apply tailnet-wide default for auto-updates (#10508)	2 years ago
c2n_pprof.go	tailcfg: move LogHeapPprof from Debug to c2n [capver 69]	2 years ago
c2n_test.go	ipn/ipnlocal: add c2n method to check on TLS cert fetch status	2 years ago
cert.go	all: fix nilness issues	2 years ago
cert_js.go	ipn/ipnlocal: add c2n method to check on TLS cert fetch status	2 years ago
cert_test.go	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}	2 years ago
dnsconfig_test.go	types/netmap: remove NetworkMap.{Addresses,MachineStatus}	2 years ago
expiry.go	ssh/tailssh: use control server time instead of local time	2 years ago
expiry_test.go	types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeView	2 years ago
local.go	ipn/ipnserver: always allow Windows SYSTEM user to connect	2 years ago
local_test.go	appc,ipn: prevent undesirable route advertisements	2 years ago
loglines_test.go	tsd: add package with System type to unify subsystem init, discovery	3 years ago
network-lock.go	ipn/ipnlocal,cmd/tailscale: persist tailnet name in user profile	2 years ago
network-lock_test.go	ipn/ipnlocal,cmd/tailscale: persist tailnet name in user profile	2 years ago
peerapi.go	all: cleanup unused code, part 2 (#10670)	2 years ago
peerapi_h2c.go	all: update copyright and license headers	3 years ago
peerapi_macios_ext.go	all: update copyright and license headers	3 years ago
peerapi_test.go	all: cleanup unused code, part 2 (#10670)	2 years ago
profiles.go	util/cmpx: remove code that's in the stdlib now	2 years ago
profiles_notwindows.go	ipn/ipnlocal: fix profile duplication	2 years ago
profiles_test.go	ipn/ipnlocal,cmd/tailscale: persist tailnet name in user profile	2 years ago
profiles_windows.go	ipn/ipnlocal: better enforce system policies	2 years ago
serve.go	ipn/ipnlocal: log and don't return full file serve error (#10174)	2 years ago
serve_test.go	ipn/ipnlocal: close connections for removed proxy transports (#9884)	2 years ago
ssh.go	all: cleanup unused code, part 2 (#10670)	2 years ago
ssh_stub.go	all: update copyright and license headers	3 years ago
ssh_test.go	ipn/ipnlocal: drop not required StateKey parameter	3 years ago
state_test.go	ipn/ipnlocal,cmd/tailscale: persist tailnet name in user profile	2 years ago
web_client.go	{client/web},{ipn/ipnlocal}: replace localapi debug-web-client endpoint	2 years ago
web_client_stub.go	ipn/ipnlocal: add mutex to webClient struct	2 years ago