TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-03-24 10:10:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/ipnserver: set PermitWrite on localapi handler

Browse Source 
The TODO was easy now with peerCreds and the isReadonlyConn func.

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick 2021-03-05 12:05:53 -08:00
parent 0d0fad43ed
commit 1ca3e739f7
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ipn/ipnserver/server.go
View File

@ -117,13 +117,14 @@ type server struct {
disconnectSub map[chan<- struct{}]struct{} // keys are subscribers of disconnects disconnectSub map[chan<- struct{}]struct{} // keys are subscribers of disconnects
} }
// connIdentity represents the owner of a localhost TCP connection. // connIdentity represents the owner of a localhost TCP or unix socket connection.
type connIdentity struct { type connIdentity struct {
Unknown bool Unknown bool
Pid int Pid int
UserID string UserID string
User *user.User User *user.User
IsUnixSock bool Conn net.Conn
IsUnixSock bool // Conn is a *net.UnixConn
} }
// getConnIdentity returns the localhost TCP connection's identity information // getConnIdentity returns the localhost TCP connection's identity information
@ -132,7 +133,7 @@ type connIdentity struct {
// to be able to map it and couldn't. // to be able to map it and couldn't.
func (s *server) getConnIdentity(c net.Conn) (ci connIdentity, err error) { func (s *server) getConnIdentity(c net.Conn) (ci connIdentity, err error) {
if runtime.GOOS != "windows" { // for now; TODO: expand to other OSes if runtime.GOOS != "windows" { // for now; TODO: expand to other OSes
ci = connIdentity{Unknown: true} ci = connIdentity{Unknown: true, Conn: c}
_, ci.IsUnixSock = c.(*net.UnixConn) _, ci.IsUnixSock = c.(*net.UnixConn)
return ci, nil return ci, nil
} }
@ -960,7 +961,7 @@ func (s *server) localhostHandler(ci connIdentity) http.Handler {
if ci.IsUnixSock && strings.HasPrefix(r.URL.Path, "/localapi/") { if ci.IsUnixSock && strings.HasPrefix(r.URL.Path, "/localapi/") {
h := localapi.NewHandler(s.b) h := localapi.NewHandler(s.b)
h.PermitRead = true h.PermitRead = true
h.PermitWrite = false // TODO: flesh out connIdentity on more platforms then set this h.PermitWrite = !isReadonlyConn(ci.Conn, logger.Discard)
h.ServeHTTP(w, r) h.ServeHTTP(w, r)
return return
} }