You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Nick Khyl 961ee321e8 ipn/{ipnauth,ipnlocal,ipnserver,localapi}: start baby step toward moving access checks from the localapi.Handler to the LocalBackend ... Currently, we use PermitRead/PermitWrite/PermitCert permission flags to determine which operations are allowed for a LocalAPI client. These checks are performed when localapi.Handler handles a request. Additionally, certain operations (e.g., changing the serve config) requires the connected user to be a local admin. This approach is inherently racey and is subject to TOCTOU issues. We consider it to be more critical on Windows environments, which are inherently multi-user, and therefore we prevent more than one OS user from connecting and utilizing the LocalBackend at the same time. However, the same type of issues is also applicable to other platforms when switching between profiles that have different OperatorUser values in ipn.Prefs. We'd like to allow more than one Windows user to connect, but limit what they can see and do based on their access rights on the device (e.g., an local admin or not) and to the currently active LoginProfile (e.g., owner/operator or not), while preventing TOCTOU issues on Windows and other platforms. Therefore, we'd like to pass an actor from the LocalAPI to the LocalBackend to represent the user performing the operation. The LocalBackend, or the profileManager down the line, will then check the actor's access rights to perform a given operation on the device and against the current (and/or the target) profile. This PR does not change the current permission model in any way, but it introduces the concept of an actor and includes some preparatory work to pass it around. Temporarily, the ipnauth.Actor interface has methods like IsLocalSystem and IsLocalAdmin, which are only relevant to the current permission model. It also lacks methods that will actually be used in the new model. We'll be adding these gradually in the next PRs and removing the deprecated methods and the Permit* flags at the end of the transition. Updates tailscale/corp#18342 Signed-off-by: Nick Khyl <nickk@tailscale.com>		3 months ago
..
deploy	cmd/k8s-operator: support default proxy class in k8s-operator (#12711)	3 months ago
generate	all: add test for package comments, fix, add comments as needed	4 months ago
connector.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463)	5 months ago
connector_test.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463)	5 months ago
depaware.txt	ipn/{ipnauth,ipnlocal,ipnserver,localapi}: start baby step toward moving access checks from the localapi.Handler to the LocalBackend	3 months ago
dnsrecords.go	cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057)	3 months ago
dnsrecords_test.go	cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057)	3 months ago
ingress.go	cmd/k8s-operator: support default proxy class in k8s-operator (#12711)	3 months ago
ingress_test.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463)	5 months ago
nameserver.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463)	5 months ago
nameserver_test.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463)	5 months ago
operator.go	cmd/k8s-operator: support default proxy class in k8s-operator (#12711)	3 months ago
operator_test.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: publish proxy status condition for annotated services (#12463)	5 months ago
proxy.go	cmd/k8s-operator,k8s-operator/sessionrecording: support recording kubectl exec sessions over WebSockets (#12947)	3 months ago
proxy_test.go	cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' sessions via Kubernetes operator's API server proxy (#12274)	5 months ago
proxyclass.go	cmd/k8s-operator: add a metric to track the amount of ProxyClass resources (#12833)	4 months ago
proxyclass_test.go	cmd/k8s-operator: add a metric to track the amount of ProxyClass resources (#12833)	4 months ago
sts.go	cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577)	5 months ago
sts_test.go	cmd/k8s-operator,k8s-operator,go.{mod,sum}: make individual proxy images/image pull policies configurable (#11928)	6 months ago
svc.go	all: fix new lint warnings from bumping staticcheck	3 months ago
testutils_test.go	cmd/containerboot,cmd/k8s-operator: enable IPv6 for fqdn egress proxies (#12577)	5 months ago