mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-18 09:08:16 -04:00
loowr
d645114dd4
The ts_omit_unixsocketidentity variant of GetConnIdentity never
performs the *net.UnixConn type assertion, so ConnIdentity.isUnixSock
stays false. ipnserver's Permissions only grants local API access to
unix socket connections, so with this build tag every local API request
is denied read and write access ("status access denied") and the CLI
cannot talk to the daemon at all in --extra-small/--min builds.
Mirror the type assertion from the peercred variant so the omitted
identity build behaves as intended (everyone is an admin when unix
socket identities are compiled out).
Signed-off-by: loowr <loowr@proton.me>
28 lines
786 B
Go
28 lines
786 B
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build !windows && ts_omit_unixsocketidentity
|
|
|
|
package ipnauth
|
|
|
|
import (
|
|
"net"
|
|
|
|
"tailscale.com/types/logger"
|
|
)
|
|
|
|
// GetConnIdentity extracts the identity information from the connection
|
|
// based on the user who owns the other end of the connection.
|
|
// and couldn't. The returned connIdentity has NotWindows set to true.
|
|
func GetConnIdentity(_ logger.Logf, c net.Conn) (ci *ConnIdentity, err error) {
|
|
ci = &ConnIdentity{conn: c, notWindows: true}
|
|
_, ci.isUnixSock = c.(*net.UnixConn)
|
|
return ci, nil
|
|
}
|
|
|
|
// WindowsToken is unsupported when GOOS != windows and always returns
|
|
// ErrNotImplemented.
|
|
func (ci *ConnIdentity) WindowsToken() (WindowsToken, error) {
|
|
return nil, ErrNotImplemented
|
|
}
|