Mike Jensen 94ea82ab55 ipn/localapi: restrict debug-log access to PermitWrite (#21447) ...

The debug-log endpoint was gated on PermitRead, which any local user connecting to the world-writable tailscaled socket passes. Although forged log entries are always possible, we should limit the ability for local users to influence that flow with respects to a given node.

This change requires PermitWrite for debug-log, matching the trust level of every other mutating debug endpoint. Also add a buildfeatures.HasDebug guard to debug-dial-types for parity with serveDebug.

Fixes tailscale/corp#48143

Change-Id: I0c0044b6b44fe7cbfb6734ac18bca3dc36eaffbf

Signed-off-by: Mike Jensen <mikej@tailscale.com>

2026-09-25 12:29:56 -06:00

..

auditlog

ipn/auditlog: store the audit log in the backend's state directory

2026-09-24 11:52:21 -07:00

conffile

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

desktop

ipn/desktop: skip the extension when sessions can't be enumerated

2026-09-24 11:51:51 -07:00

ipnauth

ipnauth: set isUnixSock in the ts_omit_unixsocketidentity GetConnIdentity

2026-07-31 17:30:11 -07:00

ipnext

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

ipnlocal

ipn/ipnlocal: add TS_SERVE_ALLOW_ALL_INTERFACES to opt serve out of the tun bind

2026-09-25 16:35:59 +01:00

ipnserver

envknob: add SetenvForTest helper for safe environment variable handling

2026-08-19 12:22:26 +01:00

ipnstate

tailcfg: add Node.StableTailnetID and bump capver (#21314)

2026-09-16 14:28:46 -04:00

lapitest

ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest

2026-06-27 16:11:42 -07:00

localapi

ipn/localapi: restrict debug-log access to PermitWrite (#21447)

2026-09-25 12:29:56 -06:00

policy

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

backend_test.go

ipn, ipn/ipnlocal: remove Notify.NetMap, size initial status to subscription

2026-09-14 09:37:30 -07:00

backend.go

ipn, ipn/ipnlocal: remove Notify.NetMap, size initial status to subscription

2026-09-14 09:37:30 -07:00

conf_test.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

conf.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

doc.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_clone.go

tailcfg,tailcfg/{nodecap,selfcap}: split capability constants to their own packages (#20639)

2026-08-07 16:30:35 -07:00

ipn_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_view.go

wgengine/router/osrouter: add native FreeBSD routing, no-snat support

2026-08-31 20:31:01 -07:00

prefs_test.go

cmd/tailscale, ipn, feature/remoteconfig: add remote-config support

2026-07-07 12:10:34 -07:00

prefs.go

wgengine/router/osrouter: add native FreeBSD routing, no-snat support

2026-08-31 20:31:01 -07:00

serve_expand_test.go

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

serve_test.go

cmd/tailscale: allow IPv6 localhost serve targets

2026-08-31 14:25:58 -07:00

serve.go

cmd/tailscale: allow IPv6 localhost serve targets

2026-08-31 14:25:58 -07:00

store_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store.go

ipn/store: make WriteState(id, nil) delete key instead of adding nil entry (#19920)

2026-05-29 11:22:14 -07:00