tailfs: disable TailFSForLocal via policy

Adds support for node attribute tailfs:access. If this attribute is
not present, Tailscale will not accept connections to the local TailFS
server at 100.100.100.100:8080.

Updates tailscale/corp#16827

Signed-off-by: Percy Wegmann <percy@tailscale.com>
This commit is contained in:
Percy Wegmann
2024-02-09 16:23:42 -06:00
committed by Percy Wegmann
parent abab0d4197
commit ddcffaef7a
4 changed files with 31 additions and 3 deletions

View File

@@ -2211,8 +2211,11 @@ const (
// tail end of an active direct connection in magicsock.
NodeAttrProbeUDPLifetime NodeCapability = "probe-udp-lifetime"
// NodeAttrsTailFSSharingEnabled enables sharing via TailFS.
NodeAttrsTailFSSharingEnabled NodeCapability = "tailfs:share"
// NodeAttrsTailFSShare enables sharing via TailFS.
NodeAttrsTailFSShare NodeCapability = "tailfs:share"
// NodeAttrsTailFSAccess enables accessing shares via TailFS.
NodeAttrsTailFSAccess NodeCapability = "tailfs:access"
)
// SetDNSRequest is a request to add a DNS record.