cmd/tailscale, util/quarantine: set quarantine flags on files from Taildrop

This sets the "com.apple.quarantine" flag on macOS, and the
"Zone.Identifier" alternate data stream on Windows.

Change-Id: If14f805467b0e2963067937d7f34e08ba1d1fa85
Signed-off-by: Andrew Dunham <andrew@du.nham.ca>

util/quarantine/quarantine.go

@@ -0,0 +1,15 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package quarantine sets platform specific "quarantine" attributes on files
+// that are received from other hosts.
+package quarantine
+
+import "os"
+
+// SetOnFile sets the platform-specific quarantine attribute (if any) on the
+// provided file.
+func SetOnFile(f *os.File) error {
+	return setQuarantineAttr(f)
+}

util/quarantine/quarantine_darwin.go

@@ -0,0 +1,57 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package quarantine
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/sys/unix"
+)
+
+func setQuarantineAttr(f *os.File) error {
+	sc, err := f.SyscallConn()
+	if err != nil {
+		return err
+	}
+
+	now := time.Now()
+
+	// We uppercase the UUID to match what other applications on macOS do
+	id := strings.ToUpper(uuid.New().String())
+
+	// kLSQuarantineTypeOtherDownload; this matches what AirDrop sets when
+	// receiving a file.
+	quarantineType := "0001"
+
+	// This format is under-documented, but the following links contain a
+	// reasonably comprehensive overview:
+	//    https://eclecticlight.co/2020/10/29/quarantine-and-the-quarantine-flag/
+	//    https://nixhacker.com/security-protection-in-macos-1/
+	//    https://ilostmynotes.blogspot.com/2012/06/gatekeeper-xprotect-and-quarantine.html
+	attrData := fmt.Sprintf("%s;%x;%s;%s",
+		quarantineType, // quarantine value
+		now.Unix(),     // time in hex
+		"Tailscale",    // application
+		id,             // UUID
+	)
+
+	var innerErr error
+	err = sc.Control(func(fd uintptr) {
+		innerErr = unix.Fsetxattr(
+			int(fd),
+			"com.apple.quarantine", // attr
+			[]byte(attrData),
+			0,
+		)
+	})
+	if err != nil {
+		return err
+	}
+	return innerErr
+}

util/quarantine/quarantine_default.go

@@ -0,0 +1,15 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !darwin && !windows
+
+package quarantine
+
+import (
+	"os"
+)
+
+func setQuarantineAttr(f *os.File) error {
+	return nil
+}

util/quarantine/quarantine_windows.go

@@ -0,0 +1,30 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package quarantine
+
+import (
+	"os"
+	"strings"
+)
+
+func setQuarantineAttr(f *os.File) error {
+	// Documentation on this can be found here:
+	//    https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8
+	//
+	// Additional information can be found at:
+	//    https://www.digital-detective.net/forensic-analysis-of-zone-identifier-stream/
+	//    https://bugzilla.mozilla.org/show_bug.cgi?id=1433179
+	content := strings.Join([]string{
+		"[ZoneTransfer]",
+
+		// "URLZONE_INTERNET"
+		// https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537175(v=vs.85)
+		"ZoneId=3",
+
+		// TODO(andrew): should/could we add ReferrerUrl or HostUrl?
+	}, "\r\n")
+
+	return os.WriteFile(f.Name()+":Zone.Identifier", []byte(content), 0)
+}