You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Nick Khyl 80b2b45d60 ipn/ipnlocal: refactor and cleanup profileManager ... In preparation for multi-user and unattended mode improvements, we are refactoring and cleaning up `ipn/ipnlocal.profileManager`. The concept of the "current user", which is only relevant on Windows, is being deprecated and will soon be removed to allow more than one Windows user to connect and utilize `LocalBackend` according to that user's access rights to the device and specific Tailscale profiles. We plan to pass the user's identity down to the `profileManager`, where it can be used to determine the user's access rights to a given `LoginProfile`. While the new permission model in `ipnauth` requires more work and is currently blocked pending PR reviews, we are updating the `profileManager` to reduce its reliance on the concept of a single OS user being connected to the backend at the same time. We extract the switching to the default Tailscale profile, which may also trigger legacy profile migration, from `profileManager.SetCurrentUserID`. This introduces `profileManager.DefaultUserProfileID`, which returns the default profile ID for the current user, and `profileManager.SwitchToDefaultProfile`, which is essentially a shorthand for `pm.SwitchProfile(pm.DefaultUserProfileID())`. Both methods will eventually be updated to accept the user's identity and utilize that user's default profile. We make access checks more explicit by introducing the `profileManager.checkProfileAccess` method. The current implementation continues to use `profileManager.currentUserID` and `LoginProfile.LocalUserID` to determine whether access to a given profile should be granted. This will be updated to utilize the `ipnauth` package and the new permissions model once it's ready. We also expand access checks to be used more widely in the `profileManager`, not just when switching or listing profiles. This includes access checks in methods like `SetPrefs` and, most notably, `DeleteProfile` and `DeleteAllProfiles`, preventing unprivileged Windows users from deleting Tailscale profiles owned by other users on the same device, including profiles owned by local admins. We extract `profileManager.ProfilePrefs` and `profileManager.SetProfilePrefs` methods that can be used to get and set preferences of a given `LoginProfile` if `profileManager.checkProfileAccess` permits access to it. We also update `profileManager.setUnattendedModeAsConfigured` to always enable unattended mode on Windows if `Prefs.ForceDaemon` is true in the current `LoginProfile`, even if `profileManager.currentUserID` is `""`. This facilitates enabling unattended mode via `tailscale up --unattended` even if `tailscale-ipn.exe` is not running, such as when a Group Policy or MDM-deployed script runs at boot time, or when Tailscale is used on a Server Code or otherwise headless Windows environments. See #12239, #2137, #3186 and https://github.com/tailscale/tailscale/pull/6255#issuecomment-2016623838 for details. Fixes #12239 Updates tailscale/corp#18342 Updates #3186 Updates #2137 Signed-off-by: Nick Khyl <nickk@tailscale.com>		3 months ago
..
testdata	ipn/ipnlocal: fix the path for writing cert files (#7203)	2 years ago
autoupdate.go	clientupdate: return true for CanAutoUpdate for macsys (#12746)	5 months ago
autoupdate_disabled.go	ipn/ipnlocal: periodically run auto-updates when "offline" (#12118)	6 months ago
breaktcp_darwin.go	cmd/tailscale: add debug commands to break connections	1 year ago
breaktcp_linux.go	cmd/tailscale: add debug commands to break connections	1 year ago
c2n.go	posture: add network hardware addresses to posture identity	5 months ago
c2n_pprof.go	ipn/ipnlocal: add c2n /debug/pprof/allocs endpoint	8 months ago
c2n_test.go	util/cmpx: delete now that we're using Go 1.22	10 months ago
cert.go	cmd/tailscale: add --min-validity flag to the cert command (#12822)	4 months ago
cert_js.go	ipn/ipnlocal: add c2n method to check on TLS cert fetch status	1 year ago
cert_test.go	all: use Go 1.21 slices, maps instead of x/exp/{slices,maps}	1 year ago
dnsconfig_test.go	util/cmpx: delete now that we're using Go 1.22	10 months ago
drive.go	ipn/ipnlocal: refactor and cleanup profileManager	3 months ago
expiry.go	ssh/tailssh: use control server time instead of local time	1 year ago
expiry_test.go	types/netmap, all: make NetworkMap.SelfNode a tailcfg.NodeView	1 year ago
local.go	ipn/ipnlocal: refactor and cleanup profileManager	3 months ago
local_test.go	ipn/ipnlocal: refactor and cleanup profileManager	3 months ago
loglines_test.go	ipn/ipnlocal, all: plumb health trackers in tests	7 months ago
network-lock.go	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	3 months ago
network-lock_test.go	ipn/ipnlocal: allow multiple signature chains from the same SigCredential	5 months ago
peerapi.go	proxymap, various: distinguish between different protocols	5 months ago
peerapi_h2c.go	all: update copyright and license headers	2 years ago
peerapi_macios_ext.go	net/netmon, add: add netmon.State type alias of interfaces.State	7 months ago
peerapi_test.go	ipn/ipnlocal, all: plumb health trackers in tests	7 months ago
profiles.go	ipn/ipnlocal: refactor and cleanup profileManager	3 months ago
profiles_notwindows.go	ipn/ipnlocal: refactor and cleanup profileManager	3 months ago
profiles_test.go	ipn/ipnlocal: refactor and cleanup profileManager	3 months ago
profiles_windows.go	ipn/ipnlocal: refactor and cleanup profileManager	3 months ago
serve.go	cmd/tsidp: add funnel support (#12591)	4 months ago
serve_test.go	ipn/ipnlocal: fix data race in tests	5 months ago
ssh.go	ipnlocal: log failure to get ssh host keys	10 months ago
ssh_stub.go	ipnlocal: log failure to get ssh host keys	10 months ago
ssh_test.go	ipn/ipnlocal: plumb health.Tracker into profileManager constructor	7 months ago
state_test.go	control/controlclient: delete unused Client.Login Oauth2Token field	7 months ago
taildrop.go	ipn/localapi: add support for multipart POST to file-put	8 months ago
web_client.go	all: remove LenIter, use Go 1.22 range-over-int instead	9 months ago
web_client_stub.go	ipn/ipnlocal: add mutex to webClient struct	1 year ago