5688c201e9
Add validation for SSH source/destination combinations that enforces Tailscale's security model: - Tags/autogroup:tagged cannot SSH to user-owned devices - autogroup:self destination requires source to contain only users/groups - Username destinations require source to be that same single user only - Wildcard (*) is no longer supported as SSH destination; use autogroup:member or autogroup:tagged instead The validateSSHSrcDstCombination() function is called during policy validation to reject invalid configurations at load time. Fixes #3009 Fixes #3010 |
||
|---|---|---|
| .. | ||
| filter.go | ||
| filter_test.go | ||
| policy.go | ||
| policy_test.go | ||
| types.go | ||
| types_test.go | ||
| utils.go | ||
| utils_test.go | ||