TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-06-14 20:18:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/ipnlocal: fix deadlock when filtering DisplayMessage URLs

Browse Source 
Updates tailscale/corp#27759

Signed-off-by: James Sanderson <jsanderson@tailscale.com>
This commit is contained in:
James Sanderson 2025-06-02 15:52:16 +01:00 committed by James 'zofrex' Sanderson
parent 5f35143d83
commit 8a3afa5963
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
ipn/ipnlocal/local.go
View File

@ -3289,6 +3289,16 @@ func (b *LocalBackend) popBrowserAuthNow(url string, keyExpired bool, recipient
// //
// b.mu must *not* be held. // b.mu must *not* be held.
func (b *LocalBackend) validPopBrowserURL(urlStr string) bool { func (b *LocalBackend) validPopBrowserURL(urlStr string) bool {
b.mu.Lock()
defer b.mu.Unlock()
return b.validPopBrowserURLLocked(urlStr)
}
// validPopBrowserURLLocked reports whether urlStr is a valid value for a
// control server to send in a *URL field.
//
// b.mu must be held.
func (b *LocalBackend) validPopBrowserURLLocked(urlStr string) bool {
if urlStr == "" { if urlStr == "" {
return false return false
} }
@ -3296,7 +3306,7 @@ func (b *LocalBackend) validPopBrowserURL(urlStr string) bool {
if err != nil { if err != nil {
return false return false
} }
serverURL := b.Prefs().ControlURLOrDefault() serverURL := b.sanitizedPrefsLocked().ControlURLOrDefault()
if ipn.IsLoginServerSynonym(serverURL) { if ipn.IsLoginServerSynonym(serverURL) {
// When connected to the official Tailscale control plane, only allow // When connected to the official Tailscale control plane, only allow
// URLs from tailscale.com or its subdomains. // URLs from tailscale.com or its subdomains.
@ -5830,7 +5840,7 @@ func (b *LocalBackend) setNetMapLocked(nm *netmap.NetworkMap) {
if nm != nil { if nm != nil {
messages := make(map[tailcfg.DisplayMessageID]tailcfg.DisplayMessage) messages := make(map[tailcfg.DisplayMessageID]tailcfg.DisplayMessage)
for id, msg := range nm.DisplayMessages { for id, msg := range nm.DisplayMessages {
if msg.PrimaryAction != nil && !b.validPopBrowserURL(msg.PrimaryAction.URL) { if msg.PrimaryAction != nil && !b.validPopBrowserURLLocked(msg.PrimaryAction.URL) {
msg.PrimaryAction = nil msg.PrimaryAction = nil
} }
messages[id] = msg messages[id] = msg

1
ipn/ipnlocal/local_test.go
View File

@ -5374,6 +5374,7 @@ func TestDisplayMessagesURLFilter(t *testing.T) {
ht.SetIPNState("NeedsLogin", true) ht.SetIPNState("NeedsLogin", true)
ht.GotStreamedMapResponse() ht.GotStreamedMapResponse()
defer b.lockAndGetUnlock()()
b.setNetMapLocked(&netmap.NetworkMap{ b.setNetMapLocked(&netmap.NetworkMap{
DisplayMessages: map[tailcfg.DisplayMessageID]tailcfg.DisplayMessage{ DisplayMessages: map[tailcfg.DisplayMessageID]tailcfg.DisplayMessage{
"test-message": { "test-message": {