ipn,magicsock: deny peer capabilities to unsigned peers (#20561)

Unsigned peers aren't covered by tailnet lock, so they must never hold peer capabilities even if the packet filter grants them. This change extends the check for unsigned-peers to ensure full coverage in capabilities.

Fixes tailscale/corp#45116

Change-Id: I918af24f0b9855e55921cbdad109cc68e745e125

Signed-off-by: Mike Jensen <mikej@tailscale.com>

ipn/ipnlocal/node_backend.go

@@ -418,7 +418,24 @@ func (nb *nodeBackend) PeerCaps(src netip.Addr) tailcfg.PeerCapMap {
 	return nb.peerCapsLocked(src)
 }
 
+// srcIsUnsignedPeerLocked reports whether src is an address of a peer with
+// UnsignedPeerAPIOnly set. Such peers are not covered by tailnet lock and must
+// never be granted peer capabilities.
+//
+// nb.mu must be held before calling.
+func (nb *nodeBackend) srcIsUnsignedPeerLocked(src netip.Addr) bool {
+	id, ok := nb.nodeByAddr[src]
+	if !ok {
+		return false
+	}
+	n, ok := nb.nodeByIDLocked(id)
+	return ok && n.UnsignedPeerAPIOnly()
+}
+
 func (nb *nodeBackend) peerCapsLocked(src netip.Addr) tailcfg.PeerCapMap {
+	if nb.srcIsUnsignedPeerLocked(src) {
+		return nil
+	}
 	if nb.netMap == nil {
 		return nil
 	}
@@ -447,6 +464,9 @@ func (nb *nodeBackend) peerCapsLocked(src netip.Addr) tailcfg.PeerCapMap {
 func (nb *nodeBackend) PeerCapsForIP(src, dst netip.Addr) tailcfg.PeerCapMap {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
+	if nb.srcIsUnsignedPeerLocked(src) {
+		return nil
+	}
 	if nb.netMap == nil {
 		return nil
 	}
@@ -464,6 +484,9 @@ func (nb *nodeBackend) PeerCapsForIP(src, dst netip.Addr) tailcfg.PeerCapMap {
 func (nb *nodeBackend) PeerCapsForService(src netip.Addr, svcName tailcfg.ServiceName) tailcfg.PeerCapMap {
 	nb.mu.Lock()
 	defer nb.mu.Unlock()
+	if nb.srcIsUnsignedPeerLocked(src) {
+		return nil
+	}
 	if nb.netMap == nil {
 		return nil
 	}