5688c201e9
Add validation for SSH source/destination combinations that enforces Tailscale's security model: - Tags/autogroup:tagged cannot SSH to user-owned devices - autogroup:self destination requires source to contain only users/groups - Username destinations require source to be that same single user only - Wildcard (*) is no longer supported as SSH destination; use autogroup:member or autogroup:tagged instead The validateSSHSrcDstCombination() function is called during policy validation to reject invalid configurations at load time. Fixes #3009 Fixes #3010 |
||
|---|---|---|
| .. | ||
| matcher | ||
| policyutil | ||
| v2 | ||
| pm.go | ||
| policy.go | ||
| policy_autoapprove_test.go | ||
| policy_route_approval_test.go | ||
| policy_test.go | ||
| route_approval_test.go | ||