You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Nick Khyl 961ee321e8 ipn/{ipnauth,ipnlocal,ipnserver,localapi}: start baby step toward moving access checks from the localapi.Handler to the LocalBackend ... Currently, we use PermitRead/PermitWrite/PermitCert permission flags to determine which operations are allowed for a LocalAPI client. These checks are performed when localapi.Handler handles a request. Additionally, certain operations (e.g., changing the serve config) requires the connected user to be a local admin. This approach is inherently racey and is subject to TOCTOU issues. We consider it to be more critical on Windows environments, which are inherently multi-user, and therefore we prevent more than one OS user from connecting and utilizing the LocalBackend at the same time. However, the same type of issues is also applicable to other platforms when switching between profiles that have different OperatorUser values in ipn.Prefs. We'd like to allow more than one Windows user to connect, but limit what they can see and do based on their access rights on the device (e.g., an local admin or not) and to the currently active LoginProfile (e.g., owner/operator or not), while preventing TOCTOU issues on Windows and other platforms. Therefore, we'd like to pass an actor from the LocalAPI to the LocalBackend to represent the user performing the operation. The LocalBackend, or the profileManager down the line, will then check the actor's access rights to perform a given operation on the device and against the current (and/or the target) profile. This PR does not change the current permission model in any way, but it introduces the concept of an actor and includes some preparatory work to pass it around. Temporarily, the ipnauth.Actor interface has methods like IsLocalSystem and IsLocalAdmin, which are only relevant to the current permission model. It also lacks methods that will actually be used in the new model. We'll be adding these gradually in the next PRs and removing the deprecated methods and the Permit* flags at the end of the transition. Updates tailscale/corp#18342 Signed-off-by: Nick Khyl <nickk@tailscale.com>		2 months ago
..
testdata	ipn/ipnlocal: fix the path for writing cert files (#7203)	2 years ago
autoupdate.go	clientupdate: return true for CanAutoUpdate for macsys (#12746)	4 months ago
autoupdate_disabled.go	ipn/ipnlocal: periodically run auto-updates when "offline" (#12118)	5 months ago
breaktcp_darwin.go	cmd/tailscale: add debug commands to break connections	1 year ago
breaktcp_linux.go	cmd/tailscale: add debug commands to break connections	1 year ago
c2n.go	posture: add network hardware addresses to posture identity	4 months ago
c2n_pprof.go	ipn/ipnlocal: add c2n /debug/pprof/allocs endpoint	7 months ago
c2n_test.go	util/cmpx: delete now that we're using Go 1.22	9 months ago
cert.go	cmd/tailscale: add --min-validity flag to the cert command (#12822)	3 months ago
cert_js.go	ipn/ipnlocal: add c2n method to check on TLS cert fetch status	11 months ago
cert_test.go	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}	1 year ago
dnsconfig_test.go	util/cmpx: delete now that we're using Go 1.22	9 months ago
drive.go	ipn/ipnlocal: remember last notified taildrive shares and only notify if they've changed	2 months ago
expiry.go	ssh/tailssh: use control server time instead of local time	11 months ago
expiry_test.go	types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeView	1 year ago
local.go	ipn/{ipnauth,ipnlocal,ipnserver,localapi}: start baby step toward moving access checks from the localapi.Handler to the LocalBackend	2 months ago
local_test.go	ipn/ipnlocal: check for offline auto exit node in SetControlClientStatus (#12772)	3 months ago
loglines_test.go	ipn/ipnlocal, all: plumb health trackers in tests	6 months ago
network-lock.go	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	2 months ago
network-lock_test.go	ipn/ipnlocal: allow multiple signature chains from the same SigCredential	4 months ago
peerapi.go	proxymap, various: distinguish between different protocols	4 months ago
peerapi_h2c.go	all: update copyright and license headers	2 years ago
peerapi_macios_ext.go	net/netmon, add: add netmon.State type alias of interfaces.State	6 months ago
peerapi_test.go	ipn/ipnlocal, all: plumb health trackers in tests	6 months ago
profiles.go	health,ipn/ipnlocal: hide update warning when auto-updates are enabled (#12631)	4 months ago
profiles_notwindows.go	ipn/ipnlocal: fix profile duplication	1 year ago
profiles_test.go	various: disable stateful filtering by default (#12197)	5 months ago
profiles_windows.go	ipn/ipnlocal: set default NoStatefulFiltering in ipn.NewPrefs (#12031)	6 months ago
serve.go	cmd/tsidp: add funnel support (#12591)	3 months ago
serve_test.go	ipn/ipnlocal: fix data race in tests	4 months ago
ssh.go	ipnlocal: log failure to get ssh host keys	9 months ago
ssh_stub.go	ipnlocal: log failure to get ssh host keys	9 months ago
ssh_test.go	ipn/ipnlocal: plumb health.Tracker into profileManager constructor	6 months ago
state_test.go	control/controlclient: delete unused Client.Login Oauth2Token field	5 months ago
taildrop.go	ipn/localapi: add support for multipart POST to file-put	7 months ago
web_client.go	all: remove LenIter, use Go 1.22 range-over-int instead	8 months ago
web_client_stub.go	ipn/ipnlocal: add mutex to webClient struct	11 months ago