And open up socket permissions like Linux, now that we know who connections are from. This uses the new inet.af/peercred that supports Linux and Darwin at the moment. Fixes #1347 Fixes #1348 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>main
Brad Fitzpatrick
5 years ago
parent
65815cc1ac
commit
d3efe8caf6
@ -1,49 +0,0 @@ |
||||
// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// +build linux
|
||||
|
||||
package ipnserver |
||||
|
||||
import ( |
||||
"net" |
||||
|
||||
"golang.org/x/sys/unix" |
||||
"tailscale.com/types/logger" |
||||
) |
||||
|
||||
func isReadonlyConn(c net.Conn, logf logger.Logf) (ro bool) { |
||||
ro = true // conservative default for naked returns below
|
||||
uc, ok := c.(*net.UnixConn) |
||||
if !ok { |
||||
logf("unexpected connection type %T", c) |
||||
return |
||||
} |
||||
raw, err := uc.SyscallConn() |
||||
if err != nil { |
||||
logf("SyscallConn: %v", err) |
||||
return |
||||
} |
||||
|
||||
var cred *unix.Ucred |
||||
cerr := raw.Control(func(fd uintptr) { |
||||
cred, err = unix.GetsockoptUcred(int(fd), |
||||
unix.SOL_SOCKET, |
||||
unix.SO_PEERCRED) |
||||
}) |
||||
if cerr != nil { |
||||
logf("raw.Control: %v", err) |
||||
return |
||||
} |
||||
if err != nil { |
||||
logf("raw.Control: %v", err) |
||||
return |
||||
} |
||||
if cred.Uid == 0 { |
||||
// root is not read-only.
|
||||
return false |
||||
} |
||||
logf("non-root connection from %v (read-only)", cred.Uid) |
||||
return true |
||||
} |
||||
@ -1,27 +0,0 @@ |
||||
// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// +build !linux
|
||||
|
||||
package ipnserver |
||||
|
||||
import ( |
||||
"net" |
||||
|
||||
"tailscale.com/types/logger" |
||||
) |
||||
|
||||
func isReadonlyConn(c net.Conn, logf logger.Logf) bool { |
||||
// Windows doesn't need/use this mechanism, at least yet. It
|
||||
// has a different last-user-wins auth model.
|
||||
|
||||
// And on Darwin, we're not using it yet, as the Darwin
|
||||
// tailscaled port isn't yet done, and unix.Ucred and
|
||||
// unix.GetsockoptUcred aren't in x/sys/unix.
|
||||
|
||||
// TODO(bradfitz): OpenBSD and FreeBSD should implement this too.
|
||||
// But their x/sys/unix package is different than Linux, so
|
||||
// I didn't include it for now.
|
||||
return false |
||||
} |
||||
Loading…
Reference in new issue