Brad Fitzpatrick
8ec07b5f7f
We never implemented the peercred package on OpenBSD (and I just tried again and failed), but we've always documented that the creds pointer can be nil for operating systems where we can't map the unix socket back to its UID. On those platforms, we set the default unix socket permissions such that only the admin can open it anyway and we don't have a read-only vs read-write distinction. OpenBSD was always in that camp, where any access to Tailscale's unix socket meant full access. But during some refactoring, we broke OpenBSD in that we started assuming during one logging path (during login) that Creds was non-nil when looking up an ipnauth.Actor's username, which wasn't relevant (it was called from a function "maybeUsernameOf" anyway, which threw away errors). Verified on an OpenBSD VM. We don't have any OpenBSD integration tests yet. Fixes #17209 Updates #17221 Change-Id: I473c5903dfaa645694bcc75e7f5d484f3dd6044d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
37 lines
1.0 KiB
Go
37 lines
1.0 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build !windows
|
|
|
|
package ipnauth
|
|
|
|
import (
|
|
"net"
|
|
|
|
"github.com/tailscale/peercred"
|
|
"tailscale.com/types/logger"
|
|
)
|
|
|
|
// GetConnIdentity extracts the identity information from the connection
|
|
// based on the user who owns the other end of the connection.
|
|
// and couldn't. The returned connIdentity has NotWindows set to true.
|
|
func GetConnIdentity(_ logger.Logf, c net.Conn) (ci *ConnIdentity, err error) {
|
|
ci = &ConnIdentity{conn: c, notWindows: true}
|
|
_, ci.isUnixSock = c.(*net.UnixConn)
|
|
if ci.creds, err = peercred.Get(c); ci.creds != nil {
|
|
ci.pid, _ = ci.creds.PID()
|
|
} else if err == peercred.ErrNotImplemented {
|
|
// peercred.Get is not implemented on this OS (such as OpenBSD)
|
|
// Just leave creds as nil, as documented.
|
|
} else if err != nil {
|
|
return nil, err
|
|
}
|
|
return ci, nil
|
|
}
|
|
|
|
// WindowsToken is unsupported when GOOS != windows and always returns
|
|
// ErrNotImplemented.
|
|
func (ci *ConnIdentity) WindowsToken() (WindowsToken, error) {
|
|
return nil, ErrNotImplemented
|
|
}
|