mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-28 22:19:12 -04:00
James Tucker
d75f04c927
Re-evaluate authenticated connections on policy updates and at session and forwarding gates. Close connections whose grants are revoked or narrowed, including forwarding permissions, user identity, duration, AcceptEnv, and effective recording requirements. Recheck rule-derived AcceptEnv and recording configuration for delegated connections too. Compare recorder lists with duplicate counts preserved so duplicate entries cannot hide a change of recording destination. Treat recording-failure changes in either direction as material, including fail-open to fail-closed transitions. An inconclusive user lookup retains the previous identity but does not skip other policy checks, including for `"*": "="` mappings. An absent account or a changed username, UID, or primary GID revokes the connection. Preserve explicit getent failures when the os/user fallback cannot find the account, instead of treating every lookup failure as account deletion. Numeric UID mappings use LookupId in the fallback, not Lookup by name. Known limitation: NSS can report a directory-only account as not found (getent exit status 2) during an sssd/LDAP outage. If the fallback also reports the account missing, this is indistinguishable from deletion and still revokes the connection. This availability tradeoff remains accepted for now; explicit command failures, timeouts, and malformed output do not by themselves establish that an account was deleted. Reject forwarding requests using the latched Allow bit before doing a policy recheck. Forwarding gates still re-evaluate policy, but use the latched account identity rather than spawning getent for every forwarded connection (including each SSH -D request). Account identity is rechecked at authentication completion, policy updates, rule expiry, and session gates. Re-arm rule-expiry timers under the policy recheck lock and prevent re-arming after teardown. Add connection-level login grace, extending it during delegation and stopping it only on SSH authentication success, not on unsigned key queries or partial authentication. Close the raw transport and cancel delegated authentication on teardown. Add regression tests for these transitions, wait for the auth-completion recheck before test policy flips, and release stalled recorder handlers even on test failure. Updates tailscale/corp#50380 Signed-off-by: James Tucker <james@tailscale.com>