TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-12-01 09:32:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

tailcfg, ssh/tailssh: optionally support SSH public keys in wire policy

Browse Source 
And clean up logging.

Updates #3802

Change-Id: I756dc2d579a16757537142283d791f1d0319f4f0
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick
2022-04-01 12:57:12 -07:00
committed by Brad Fitzpatrick
parent df9ce972c7
commit da14e024a8
5 changed files with 246 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tailcfg/tailcfg.go
View File

@@ -1593,16 +1593,22 @@ type SSHRule struct {
}
// SSHPrincipal is either a particular node or a user on any node.
// Any matching field causes a match.
type SSHPrincipal struct {
// Matching any one of the following four field causes a match.
// It must also match Certs, if non-empty.
Node StableNodeID `json:"node,omitempty"`
NodeIP string `json:"nodeIP,omitempty"`
UserLogin string `json:"userLogin,omitempty"` // email-ish: foo@example.com, bar@github
// Any, if true, matches any user.
Any bool `json:"any,omitempty"`
Any bool `json:"any,omitempty"` // if true, match any connection
// TODO(bradfitz): add StableUserID, once that exists
// PubKeys, if non-empty, means that this SSHPrincipal only
// matches if one of these public keys is presented by the user.
//
// As a special case, if len(PubKeys) == 1 and PubKeys[0] starts
// with "https://", then it's fetched (like https://github.com/username.keys).
PubKeys []string `json:"pubKeys,omitempty"`
}
// SSHAction is how to handle an incoming connection.