You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Aaron Klotz 95671b71a6 ipn, safesocket: use Windows token in LocalAPI ... On Windows, the idiomatic way to check access on a named pipe is for the server to impersonate the client on its current OS thread, perform access checks using the client's access token, and then revert the OS thread's access token back to its true self. The access token is a better representation of the client's rights than just a username/userid check, as it represents the client's effective rights at connection time, which might differ from their normal rights. This patch updates safesocket to do the aforementioned impersonation, extract the token handle, and then revert the impersonation. We retain the token handle for the remaining duration of the connection (the token continues to be valid even after we have reverted back to self). Since the token is a property of the connection, I changed ipnauth to wrap the concrete net.Conn to include the token. I then plumbed that change through ipnlocal, ipnserver, and localapi as necessary. I also added a PermitLocalAdmin flag to the localapi Handler which I intend to use for controlling access to a few new localapi endpoints intended for configuring auto-update. Updates https://github.com/tailscale/tailscale/issues/755 Signed-off-by: Aaron Klotz <aaron@tailscale.com>		1 year ago
..
conffile	ipn/{conffile,ipnlocal}: start booting tailscaled from a config file w/ auth key	1 year ago
ipnauth	ipn, safesocket: use Windows token in LocalAPI	1 year ago
ipnlocal	ipn, safesocket: use Windows token in LocalAPI	1 year ago
ipnserver	ipn, safesocket: use Windows token in LocalAPI	1 year ago
ipnstate	client/web: restrict full management client behind browser sessions	1 year ago
localapi	ipn, safesocket: use Windows token in LocalAPI	1 year ago
policy	ipn: prefer allow/denylist terminology	2 years ago
store	cmd/k8s-operator,ipn/store/kubestore: patch secrets instead of updating	1 year ago
backend.go	cmd/tailscale,ipn/ipnlocal: print debug component names	1 year ago
conf.go	ipn/{conffile,ipnlocal}: start booting tailscaled from a config file w/ auth key	1 year ago
doc.go	all: update copyright and license headers	2 years ago
fake_test.go	all: update copyright and license headers	2 years ago
ipn_clone.go	ipn: add PostureChecks to Prefs	1 year ago
ipn_test.go	net/packet: split off checksum munging into different pkg	1 year ago
ipn_view.go	ipn: add PostureChecks to Prefs	1 year ago
prefs.go	ipn: add PostureChecks to Prefs	1 year ago
prefs_test.go	ipn: add PostureChecks to Prefs	1 year ago
serve.go	ipn: use NodeCapMap in CheckFunnel	1 year ago
serve_test.go	ipn: use NodeCapMap in CheckFunnel	1 year ago
store.go	ipn: avoid useless no-op WriteState calls	1 year ago
store_test.go	ipn: avoid useless no-op WriteState calls	1 year ago