pairling 0.2.7 → 0.2.9

package/payload/mac/connectd/cmd/pairling-connectd/peer_identity_test.go

@@ -34,7 +34,7 @@ func TestPeerNodeResolverUsesWhoIsRemoteAddr(t *testing.T) {
 		},
 	}
 
-	nodeID, ok := resolver.PeerNodeID(context.Background(), "100.64.0.50:12345")
+	nodeID, provenance, ok := resolver.PeerNodeID(context.Background(), "100.64.0.50:12345")
 	if !ok {
 		t.Fatal("resolver should accept tagged peer")
 	}
@@ -44,10 +44,13 @@ func TestPeerNodeResolverUsesWhoIsRemoteAddr(t *testing.T) {
 	if nodeID != "nPeerCNTRL" {
 		t.Fatalf("node ID = %q", nodeID)
 	}
+	if provenance != "tagged" {
+		t.Fatalf("provenance = %q, want tagged", provenance)
+	}
 }
 
 func TestWhoIsResolvesPeerStableID(t *testing.T) {
-	nodeID, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+	nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
 		Node: &tailcfg.Node{
 			StableID: tailcfg.StableNodeID("nPeerCNTRL"),
 			Tags:     []string{"tag:pairling-phone"},
@@ -60,6 +63,9 @@ func TestWhoIsResolvesPeerStableID(t *testing.T) {
 	if nodeID != "nPeerCNTRL" {
 		t.Fatalf("node ID = %q, want nPeerCNTRL", nodeID)
 	}
+	if provenance != "tagged" {
+		t.Fatalf("provenance = %q, want tagged", provenance)
+	}
 }
 
 func TestAssertsGrantedPhoneTagBeforePersist(t *testing.T) {
@@ -72,15 +78,149 @@ func TestAssertsGrantedPhoneTagBeforePersist(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			nodeID, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+			nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
 				Node: &tailcfg.Node{
 					StableID: tailcfg.StableNodeID("nPeerCNTRL"),
 					Tags:     tc.tags,
 				},
 			})
-			if ok || nodeID != "" {
-				t.Fatalf("wrongly accepted node ID %q with tags %#v", nodeID, tc.tags)
+			if ok || nodeID != "" || provenance != "" {
+				t.Fatalf("wrongly accepted node ID %q provenance %q with tags %#v", nodeID, provenance, tc.tags)
+			}
+		})
+	}
+}
+
+// TestPeerNodeIDProvenanceFromWhoIs covers the interactive-sign-in provenance
+// path: an untagged, user-owned iOS node whose WhoIs hostname starts with
+// pairling-ios- is admitted as "interactive", while a tagged phone is admitted
+// as "tagged". Non-Pairling untagged nodes and OS-mismatched nodes are rejected.
+func TestPeerNodeIDProvenanceFromWhoIs(t *testing.T) {
+	cases := []struct {
+		name           string
+		node           *tailcfg.Node
+		wantNodeID     string
+		wantProvenance string
+		wantOK         bool
+	}{
+		{
+			name: "tagged phone",
+			node: &tailcfg.Node{
+				StableID: tailcfg.StableNodeID("nPeerCNTRL"),
+				Tags:     []string{"tag:pairling-phone"},
+			},
+			wantNodeID:     "nPeerCNTRL",
+			wantProvenance: "tagged",
+			wantOK:         true,
+		},
+		{
+			name: "untagged interactive ios computed name",
+			node: &tailcfg.Node{
+				StableID:     tailcfg.StableNodeID("nInteractiveIOS"),
+				ComputedName: "pairling-ios-b702bb49",
+			},
+			wantNodeID:     "nInteractiveIOS",
+			wantProvenance: "interactive",
+			wantOK:         true,
+		},
+		{
+			name: "untagged non-pairling laptop",
+			node: &tailcfg.Node{
+				StableID:     tailcfg.StableNodeID("nLaptop"),
+				ComputedName: "my-laptop",
+			},
+			wantNodeID:     "",
+			wantProvenance: "",
+			wantOK:         false,
+		},
+		{
+			name: "untagged pairling-ios prefix but macOS hostinfo rejected",
+			node: &tailcfg.Node{
+				StableID:     tailcfg.StableNodeID("nFakeIOS"),
+				ComputedName: "pairling-ios-x",
+				Hostinfo:     (&tailcfg.Hostinfo{OS: "macOS"}).View(),
+			},
+			wantNodeID:     "",
+			wantProvenance: "",
+			wantOK:         false,
+		},
+		{
+			name: "empty stable id",
+			node: &tailcfg.Node{
+				StableID: tailcfg.StableNodeID(""),
+				Tags:     []string{"tag:pairling-phone"},
+			},
+			wantNodeID:     "",
+			wantProvenance: "",
+			wantOK:         false,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{Node: tc.node})
+			if ok != tc.wantOK {
+				t.Fatalf("ok = %t, want %t (nodeID=%q provenance=%q)", ok, tc.wantOK, nodeID, provenance)
+			}
+			if nodeID != tc.wantNodeID {
+				t.Fatalf("nodeID = %q, want %q", nodeID, tc.wantNodeID)
+			}
+			if provenance != tc.wantProvenance {
+				t.Fatalf("provenance = %q, want %q", provenance, tc.wantProvenance)
 			}
 		})
 	}
 }
+
+// TestPeerNodeIDInteractiveAcceptsIOSHostinfo confirms an untagged Pairling iOS
+// node with Hostinfo OS reported as "iOS" (case-insensitive) is still admitted
+// as interactive — the OS check only rejects a non-empty, non-iOS OS.
+func TestPeerNodeIDInteractiveAcceptsIOSHostinfo(t *testing.T) {
+	nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+		Node: &tailcfg.Node{
+			StableID:     tailcfg.StableNodeID("nIOS"),
+			ComputedName: "pairling-ios-abc123",
+			Hostinfo:     (&tailcfg.Hostinfo{OS: "iOS"}).View(),
+		},
+	})
+	if !ok {
+		t.Fatal("untagged pairling iOS node with iOS Hostinfo should be admitted")
+	}
+	if nodeID != "nIOS" {
+		t.Fatalf("nodeID = %q, want nIOS", nodeID)
+	}
+	if provenance != "interactive" {
+		t.Fatalf("provenance = %q, want interactive", provenance)
+	}
+}
+
+// TestPeerNodeIDInteractiveFallsBackToHostinfoHostname confirms that when
+// ComputedName is empty, the WhoIs hostname is derived from a valid Hostinfo's
+// Hostname() and the pairling-ios- prefix is still honored.
+func TestPeerNodeIDInteractiveFallsBackToHostinfoHostname(t *testing.T) {
+	nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+		Node: &tailcfg.Node{
+			StableID: tailcfg.StableNodeID("nIOSHost"),
+			Hostinfo: (&tailcfg.Hostinfo{Hostname: "pairling-ios-fallback", OS: "iOS"}).View(),
+		},
+	})
+	if !ok {
+		t.Fatal("untagged pairling iOS node identified via Hostinfo hostname should be admitted")
+	}
+	if nodeID != "nIOSHost" {
+		t.Fatalf("nodeID = %q, want nIOSHost", nodeID)
+	}
+	if provenance != "interactive" {
+		t.Fatalf("provenance = %q, want interactive", provenance)
+	}
+}
+
+// TestPeerNodeIDRejectsNilNode confirms a nil WhoIs or nil Node yields the
+// empty-rejection tuple.
+func TestPeerNodeIDRejectsNilNode(t *testing.T) {
+	for _, who := range []*apitype.WhoIsResponse{nil, {Node: nil}} {
+		nodeID, provenance, ok := peerNodeIDFromWhoIs(who)
+		if ok || nodeID != "" || provenance != "" {
+			t.Fatalf("nil node wrongly accepted: nodeID=%q provenance=%q ok=%t", nodeID, provenance, ok)
+		}
+	}
+}

package/payload/mac/connectd/internal/gateway/proxy.go

@@ -21,6 +21,18 @@ const pairDropSmallFileMaxBodyBytes int64 = 10 * 1024 * 1024
 const pairDropUploadChunkMaxBodyBytes int64 = 1024 * 1024
 const peerNodeHeader = "X-Pairling-Peer-Node"
 
+// peerProvenanceHeader tells pairlingd how connectd identified the peer node:
+// "tagged" (the old minted tag:pairling-phone path) or "interactive" (an
+// untagged, user-owned Pairling iOS node admitted via the D2 sign-in path).
+// connectd deletes any inbound copy before re-injecting the resolver's value, so
+// a client can never forge it.
+const peerProvenanceHeader = "X-Pairling-Peer-Provenance"
+
+const (
+	provenanceTagged      = "tagged"
+	provenanceInteractive = "interactive"
+)
+
 // funnelOriginHeader marks a request that arrived over the public Funnel
 // listener. connectd sets it only on the funnel handler and deletes any inbound
 // copy first; every other handler deletes it, so a client can never forge it.
@@ -50,7 +62,7 @@ type Logger interface {
 }
 
 type PeerNodeResolver interface {
-	PeerNodeID(ctx context.Context, remoteAddr string) (string, bool)
+	PeerNodeID(ctx context.Context, remoteAddr string) (nodeID string, provenance string, ok bool)
 }
 
 type Event struct {
@@ -222,14 +234,16 @@ func (h *Handler) rewrite(r *httputil.ProxyRequest) {
 	r.Out.Host = h.upstream.Host
 	r.Out.Header.Del("X-Forwarded-For")
 	r.Out.Header.Del(peerNodeHeader)
+	r.Out.Header.Del(peerProvenanceHeader)
 	r.Out.Header.Del(funnelOriginHeader)
 	if h.mode == ExposureModeFunnelBootstrap {
 		r.Out.Header.Set(funnelOriginHeader, "1")
 	}
 	if h.peerNodeResolver != nil {
-		if nodeID, ok := h.peerNodeResolver.PeerNodeID(in.Context(), in.RemoteAddr); ok {
+		if nodeID, provenance, ok := h.peerNodeResolver.PeerNodeID(in.Context(), in.RemoteAddr); ok {
 			if nodeID = strings.TrimSpace(nodeID); nodeID != "" {
 				r.Out.Header.Set(peerNodeHeader, nodeID)
+				r.Out.Header.Set(peerProvenanceHeader, provenance)
 			}
 		}
 	}

package/payload/mac/connectd/internal/gateway/proxy_test.go

@@ -21,9 +21,9 @@ type recordingLogger struct {
 	events []Event
 }
 
-type peerNodeResolverFunc func(context.Context, string) (string, bool)
+type peerNodeResolverFunc func(context.Context, string) (string, string, bool)
 
-func (f peerNodeResolverFunc) PeerNodeID(ctx context.Context, remoteAddr string) (string, bool) {
+func (f peerNodeResolverFunc) PeerNodeID(ctx context.Context, remoteAddr string) (string, string, bool) {
 	return f(ctx, remoteAddr)
 }
 
@@ -451,9 +451,11 @@ func TestPairlingConnectStripsForgedPeerNodeHeader(t *testing.T) {
 
 func TestPairlingConnectSetsPeerNodeHeaderFromResolver(t *testing.T) {
 	var forwardedHeader string
+	var forwardedProvenance string
 	var resolvedRemote string
 	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		forwardedHeader = r.Header.Get("X-Pairling-Peer-Node")
+		forwardedProvenance = r.Header.Get("X-Pairling-Peer-Provenance")
 		w.WriteHeader(http.StatusOK)
 	}))
 	defer upstream.Close()
@@ -465,9 +467,9 @@ func TestPairlingConnectSetsPeerNodeHeaderFromResolver(t *testing.T) {
 		Upstream:     upstreamURL,
 		MaxBodyBytes: 1024,
 		Mode:         ExposureModePairlingConnect,
-		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, remoteAddr string) (string, bool) {
+		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, remoteAddr string) (string, string, bool) {
 			resolvedRemote = remoteAddr
-			return "nPeerCNTRL", true
+			return "nPeerCNTRL", "tagged", true
 		}),
 	})
 	if err != nil {
@@ -489,6 +491,103 @@ func TestPairlingConnectSetsPeerNodeHeaderFromResolver(t *testing.T) {
 	if forwardedHeader != "nPeerCNTRL" {
 		t.Fatalf("peer-node header = %q, want trusted resolver value", forwardedHeader)
 	}
+	if forwardedProvenance != "tagged" {
+		t.Fatalf("peer-provenance header = %q, want tagged", forwardedProvenance)
+	}
+}
+
+// TestRewriteStripsForgedProvenanceAndReinjectsFromResolver proves the rewrite
+// step deletes BOTH client-supplied X-Pairling-Peer-Node and
+// X-Pairling-Peer-Provenance headers, then re-injects them from the resolver's
+// trusted return values. A forged "tagged" provenance from the client must not
+// survive when the resolver reports "interactive".
+func TestRewriteStripsForgedProvenanceAndReinjectsFromResolver(t *testing.T) {
+	var forwardedHeader string
+	var forwardedProvenance string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		forwardedHeader = r.Header.Get("X-Pairling-Peer-Node")
+		forwardedProvenance = r.Header.Get("X-Pairling-Peer-Provenance")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+	upstreamURL, err := url.Parse(upstream.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler, err := NewHandler(Options{
+		Upstream:     upstreamURL,
+		MaxBodyBytes: 1024,
+		Mode:         ExposureModePairlingConnect,
+		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, _ string) (string, string, bool) {
+			return "nResolverIOS", "interactive", true
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/send-text", strings.NewReader(`{}`))
+	req.RemoteAddr = "100.64.0.50:12345"
+	req.Header.Set("Authorization", "Bearer device-token")
+	req.Header.Set("X-Pairling-Peer-Node", "forged-node")
+	req.Header.Set("X-Pairling-Peer-Provenance", "tagged")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if forwardedHeader != "nResolverIOS" {
+		t.Fatalf("peer-node header = %q, want resolver value nResolverIOS", forwardedHeader)
+	}
+	if forwardedProvenance != "interactive" {
+		t.Fatalf("peer-provenance header = %q, want resolver value interactive", forwardedProvenance)
+	}
+}
+
+// TestRewriteInjectsNoHeadersWhenResolverRejects proves that when the resolver
+// returns ok=false, NEITHER the peer-node NOR the peer-provenance header reaches
+// the upstream, and any client-supplied copies are stripped.
+func TestRewriteInjectsNoHeadersWhenResolverRejects(t *testing.T) {
+	var sawNode bool
+	var sawProvenance bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, sawNode = r.Header["X-Pairling-Peer-Node"]
+		_, sawProvenance = r.Header["X-Pairling-Peer-Provenance"]
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+	upstreamURL, err := url.Parse(upstream.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler, err := NewHandler(Options{
+		Upstream:     upstreamURL,
+		MaxBodyBytes: 1024,
+		Mode:         ExposureModePairlingConnect,
+		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, _ string) (string, string, bool) {
+			return "", "", false
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/send-text", strings.NewReader(`{}`))
+	req.RemoteAddr = "100.64.0.50:12345"
+	req.Header.Set("Authorization", "Bearer device-token")
+	req.Header.Set("X-Pairling-Peer-Node", "forged-node")
+	req.Header.Set("X-Pairling-Peer-Provenance", "interactive")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if sawNode {
+		t.Fatal("peer-node header reached upstream when resolver rejected")
+	}
+	if sawProvenance {
+		t.Fatal("peer-provenance header reached upstream when resolver rejected")
+	}
 }
 
 func TestPairlingConnectModeMatchesEndpointContract(t *testing.T) {