ipn/ipnlocal: lock down unsigned peers more
Apparently there's no tracking bug?
Updates tailscale/corp#7515 for ingress/funnel at least.
@@ -818,6 +818,10 @@ func (f *incomingFile) PartialFile() ipn.PartialFile {
// canPutFile reports whether h can put a file ("Taildrop") to this node.
func (h *peerAPIHandler) canPutFile() bool {
+ if h.peerNode.UnsignedPeerAPIOnly {
+ // Unsigned peers can't send files.
+ return false
+ }
return h.isSelf || h.peerHasCap(tailcfg.CapabilityFileSharingSend)
}
@@ -828,6 +832,10 @@ func (h *peerAPIHandler) canDebug() bool {
// This node does not expose debug info.
return false
}
+ if h.peerNode.UnsignedPeerAPIOnly {
+ // Unsigned peers can't debug.
+ return false
+ }
return h.isSelf || h.peerHasCap(tailcfg.CapabilityDebugPeer)
}
