2025-01-29 15:34:20 -06:00
|
|
|
// Copyright (c) Tailscale Inc & AUTHORS
|
|
|
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
|
|
|
|
|
|
package ipnauth
|
|
|
|
|
|
|
|
|
|
// ProfileAccess is a bitmask representing the requested, required, or granted
|
|
|
|
|
// access rights to an [ipn.LoginProfile].
|
2025-01-31 11:22:15 -06:00
|
|
|
//
|
|
|
|
|
// It is not to be written to disk or transmitted over the network in its integer form,
|
|
|
|
|
// but rather serialized to a string or other format if ever needed.
|
|
|
|
|
type ProfileAccess uint
|
ipn/ipn{auth,server,local}: initial support for the always-on mode
In this PR, we update LocalBackend to set WantRunning=true when applying policy settings
to the current profile's prefs, if the "always-on" mode is enabled.
We also implement a new (*LocalBackend).EditPrefsAs() method, which is like EditPrefs
but accepts an actor (e.g., a LocalAPI client's identity) that initiated the change.
If WantRunning is being set to false, the new EditPrefsAs method checks whether the actor
has ipnauth.Disconnect access to the profile and propagates an error if they do not.
Finally, we update (*ipnserver.actor).CheckProfileAccess to allow a disconnect
only if the "always-on" mode is not enabled by the AlwaysOn policy setting.
This is not a comprehensive solution to the "always-on" mode across platforms,
as instead of disconnecting a user could achieve the same effect by creating
a new empty profile, initiating a reauth, or by deleting the profile.
These are the things we should address in future PRs.
Updates #14823
Signed-off-by: Nick Khyl <nickk@tailscale.com>
2025-01-30 18:29:02 -06:00
|
|
|
|
|
|
|
|
// Define access rights that might be granted or denied on a per-profile basis.
|
|
|
|
|
const (
|
|
|
|
|
// Disconnect is required to disconnect (or switch from) a Tailscale profile.
|
|
|
|
|
Disconnect = ProfileAccess(1 << iota)
|
|
|
|
|
)
|