ipn, safesocket: use Windows token in LocalAPI

On Windows, the idiomatic way to check access on a named pipe is for
the server to impersonate the client on its current OS thread, perform
access checks using the client's access token, and then revert the OS
thread's access token back to its true self.

The access token is a better representation of the client's rights than just
a username/userid check, as it represents the client's effective rights
at connection time, which might differ from their normal rights.

This patch updates safesocket to do the aforementioned impersonation,
extract the token handle, and then revert the impersonation. We retain
the token handle for the remaining duration of the connection (the token
continues to be valid even after we have reverted back to self).

Since the token is a property of the connection, I changed ipnauth to wrap
the concrete net.Conn to include the token. I then plumbed that change
through ipnlocal, ipnserver, and localapi as necessary.

I also added a PermitLocalAdmin flag to the localapi Handler which I intend
to use for controlling access to a few new localapi endpoints intended
for configuring auto-update.

Updates https://github.com/tailscale/tailscale/issues/755

Signed-off-by: Aaron Klotz <aaron@tailscale.com>

ipn/ipnserver/server.go

@@ -202,6 +202,7 @@ func (s *Server) serveHTTP(w http.ResponseWriter, r *http.Request) {
 		lah := localapi.NewHandler(lb, s.logf, s.netMon, s.backendLogID)
 		lah.PermitRead, lah.PermitWrite = s.localAPIPermissions(ci)
 		lah.PermitCert = s.connCanFetchCerts(ci)
+		lah.CallerIsLocalAdmin = s.connIsLocalAdmin(ci)
 		lah.ServeHTTP(w, r)
 		return
 	}
@@ -242,8 +243,30 @@ func (s *Server) checkConnIdentityLocked(ci *ipnauth.ConnIdentity) error {
 		for _, active = range s.activeReqs {
 			break
 		}
-		if active != nil && ci.WindowsUserID() != active.WindowsUserID() {
-			return inUseOtherUserError{fmt.Errorf("Tailscale already in use by %s, pid %d", active.User().Username, active.Pid())}
+		if active != nil {
+			chkTok, err := ci.WindowsToken()
+			if err == nil {
+				defer chkTok.Close()
+			} else if !errors.Is(err, ipnauth.ErrNotImplemented) {
+				return err
+			}
+
+			activeTok, err := active.WindowsToken()
+			if err == nil {
+				defer activeTok.Close()
+			} else if !errors.Is(err, ipnauth.ErrNotImplemented) {
+				return err
+			}
+
+			if chkTok != nil && !chkTok.EqualUIDs(activeTok) {
+				var b strings.Builder
+				b.WriteString("Tailscale already in use")
+				if username, err := activeTok.Username(); err == nil {
+					fmt.Fprintf(&b, " by %s", username)
+				}
+				fmt.Fprintf(&b, ", pid %d", active.Pid())
+				return inUseOtherUserError{errors.New(b.String())}
+			}
 		}
 	}
 	if err := s.mustBackend().CheckIPNConnectionAllowed(ci); err != nil {
@@ -341,6 +364,31 @@ func (s *Server) connCanFetchCerts(ci *ipnauth.ConnIdentity) bool {
 	return false
 }
 
+// connIsLocalAdmin reports whether ci has administrative access to the local
+// machine, for whatever that means with respect to the current OS.
+//
+// This returns true only on Windows machines when the client user is a
+// member of the built-in Administrators group (but not necessarily elevated).
+// This is useful because, on Windows, tailscaled itself always runs with
+// elevated rights: we want to avoid privilege escalation for certain mutative operations.
+func (s *Server) connIsLocalAdmin(ci *ipnauth.ConnIdentity) bool {
+	tok, err := ci.WindowsToken()
+	if err != nil {
+		if !errors.Is(err, ipnauth.ErrNotImplemented) {
+			s.logf("ipnauth.ConnIdentity.WindowsToken() error: %v", err)
+		}
+		return false
+	}
+	defer tok.Close()
+
+	isAdmin, err := tok.IsAdministrator()
+	if err != nil {
+		s.logf("ipnauth.WindowsToken.IsAdministrator() error: %v", err)
+		return false
+	}
+	return isAdmin
+}
+
 // addActiveHTTPRequest adds c to the server's list of active HTTP requests.
 //
 // If the returned error may be of type inUseOtherUserError.
@@ -372,14 +420,25 @@ func (s *Server) addActiveHTTPRequest(req *http.Request, ci *ipnauth.ConnIdentit
 
 	mak.Set(&s.activeReqs, req, ci)
 
-	if uid := ci.WindowsUserID(); uid != "" && len(s.activeReqs) == 1 {
-		// Tell the LocalBackend about the identity we're now running as.
-		lb.SetCurrentUserID(uid)
-		if s.lastUserID != uid {
-			if s.lastUserID != "" {
-				doReset = true
+	if len(s.activeReqs) == 1 {
+		token, err := ci.WindowsToken()
+		if err != nil {
+			if !errors.Is(err, ipnauth.ErrNotImplemented) {
+				s.logf("error obtaining access token: %v", err)
+			}
+		} else {
+			// Tell the LocalBackend about the identity we're now running as.
+			uid, err := lb.SetCurrentUser(token)
+			if err != nil {
+				token.Close()
+				return nil, err
+			}
+			if s.lastUserID != uid {
+				if s.lastUserID != "" {
+					doReset = true
+				}
+				s.lastUserID = uid
 			}
-			s.lastUserID = uid
 		}
 	}