You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Aaron Klotz 95671b71a6 ipn, safesocket: use Windows token in LocalAPI ... On Windows, the idiomatic way to check access on a named pipe is for the server to impersonate the client on its current OS thread, perform access checks using the client's access token, and then revert the OS thread's access token back to its true self. The access token is a better representation of the client's rights than just a username/userid check, as it represents the client's effective rights at connection time, which might differ from their normal rights. This patch updates safesocket to do the aforementioned impersonation, extract the token handle, and then revert the impersonation. We retain the token handle for the remaining duration of the connection (the token continues to be valid even after we have reverted back to self). Since the token is a property of the connection, I changed ipnauth to wrap the concrete net.Conn to include the token. I then plumbed that change through ipnlocal, ipnserver, and localapi as necessary. I also added a PermitLocalAdmin flag to the localapi Handler which I intend to use for controlling access to a few new localapi endpoints intended for configuring auto-update. Updates https://github.com/tailscale/tailscale/issues/755 Signed-off-by: Aaron Klotz <aaron@tailscale.com>		8 months ago
..
addlicense	all: update tools that manage copyright headers	1 year ago
cloner	cmd/cloner: fix typo in test type's name	8 months ago
containerboot	cmd/containerboot: revert to using tailscale up	8 months ago
derper	ipn, safesocket: use Windows token in LocalAPI	8 months ago
derpprobe	prober: migrate to Prometheus metric library	1 year ago
dist	cmd/dist,release/dist: add distsign signing hooks (#9070)	10 months ago
get-authkey	all: use cmpx.Or where it made sense	1 year ago
gitops-pusher	.github,cmd/gitops-pusher: update to checkout@v4	9 months ago
hello	all: update copyright and license headers	1 year ago
k8s-operator	cmd/k8s-operator: allow cleanup of cluster resources for deleted devices (#9917)	8 months ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	1 year ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	10 months ago
mkversion	version/mkversion: open-source version generation logic	1 year ago
nardump	all: update copyright and license headers	1 year ago
netlogfmt	go.mod: update github.com/go-json-experiment/json (#9508)	9 months ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	1 year ago
pgproxy	various: add golangci-lint, fix issues (#7905)	1 year ago
printdep	cmd/printdep: print correct toolchain URL	1 year ago
proxy-to-grafana	tailcfg,all: add and use Node.IsTagged()	1 year ago
sniproxy	sniproxy allows configuration of hostname	8 months ago
speedtest	all: update copyright and license headers	1 year ago
ssh-auth-none-demo	all: replace deprecated ioutil references	10 months ago
stunc	all: update copyright and license headers	1 year ago
sync-containers	all: adjust some build tags for plan9	10 months ago
tailscale	ipn, safesocket: use Windows token in LocalAPI	8 months ago
tailscaled	ipn, safesocket: use Windows token in LocalAPI	8 months ago
testcontrol	all: update copyright and license headers	1 year ago
testwrapper	tstest, tstest/integration, github/workflows: shard integration tests	8 months ago
tsconnect	cmd/tsconnect/wasm: add missing tstun.Wrapper.Start call	8 months ago
tsshd	all: update copyright and license headers	1 year ago
viewer	cmd/cloner: add regression test for slice nil/empty semantics	8 months ago