You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Aaron Klotz 95671b71a6 ipn, safesocket: use Windows token in LocalAPI ... On Windows, the idiomatic way to check access on a named pipe is for the server to impersonate the client on its current OS thread, perform access checks using the client's access token, and then revert the OS thread's access token back to its true self. The access token is a better representation of the client's rights than just a username/userid check, as it represents the client's effective rights at connection time, which might differ from their normal rights. This patch updates safesocket to do the aforementioned impersonation, extract the token handle, and then revert the impersonation. We retain the token handle for the remaining duration of the connection (the token continues to be valid even after we have reverted back to self). Since the token is a property of the connection, I changed ipnauth to wrap the concrete net.Conn to include the token. I then plumbed that change through ipnlocal, ipnserver, and localapi as necessary. I also added a PermitLocalAdmin flag to the localapi Handler which I intend to use for controlling access to a few new localapi endpoints intended for configuring auto-update. Updates https://github.com/tailscale/tailscale/issues/755 Signed-off-by: Aaron Klotz <aaron@tailscale.com>		1 year ago
..
childproc	all: update copyright and license headers	2 years ago
debug.go	net/netmon: make ChangeFunc's signature take new ChangeDelta, not bool	1 year ago
depaware.txt	ipn, safesocket: use Windows token in LocalAPI	1 year ago
generate.go	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	2 years ago
install_darwin.go	all: update copyright and license headers	2 years ago
install_windows.go	all: update copyright and license headers	2 years ago
manifest_windows_386.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
manifest_windows_amd64.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
manifest_windows_arm64.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
proxy.go	all: update copyright and license headers	2 years ago
required_version.go	all: require Go 1.21	1 year ago
sigpipe.go	all: adjust some build tags for plan9	1 year ago
ssh.go	all: update copyright and license headers	2 years ago
taildrop.go	various: add detection and Taildrop for Unraid	2 years ago
tailscaled.defaults	cmd/tailscaled: rename relaynode reference in defaults file comment	5 years ago
tailscaled.go	cmd/tailscaled,*: add start of configuration file support	1 year ago
tailscaled.openrc	tstest/integration/vms: use an in-process logcatcher (#2360)	3 years ago
tailscaled.service	cmd/tailscaled: use explicit equal sign in --port=$PORT in tailscaled.service	2 years ago
tailscaled_bird.go	all: update copyright and license headers	2 years ago
tailscaled_notwindows.go	all: update copyright and license headers	2 years ago
tailscaled_test.go	util/linuxfw: remove yet-unused code to fix linux/arm64 crash	1 year ago
tailscaled_windows.go	util/syspolicy: add read boolean setting (#9592)	1 year ago
windows-manifest.xml	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	2 years ago
with_cli.go	all: update copyright and license headers	2 years ago