Add SSH ACL support

[evenh]

Based on the fork of @db48x from #661. Doesn’t support the ‘autogroup’ ACL functionality.

This ACL works for us (formatted slightly for readability)

{
  "acls":[{
      "action":"accept",
      "src":["group:employees"],
      "dst":["tag:proxy:*"]
    }
  ],
  "hosts":{},
  "groups":{
    "group:employees":[
      "john.doe",
      "jane.doe"
    ],
    "group:proxy":[
      "mycorp"
    ]
  },
  "tagOwners":{
    "tag:proxy":[
      "group:proxy"
    ]
  },
  "ssh":[
    {
      "action":"check",
      "src":["group:employees"],
      "dst":["tag:proxy"],
      "users":["some-allowlisted-user"],
      "checkPeriod":"8h"
    }
  ],
  "disableIPv4":false,
  "randomizeClientPort":false
}

• read the CONTRIBUTING guidelines
• raised a GitHub issue or discussed it on the projects chat beforehand
• added unit tests
• added integration tests
• updated documentation if needed
• updated CHANGELOG.md

[db48x]

It’s starting to look pretty good.

[db48x]

We should make similar constructor functions for the accept and reject actions as well.

[kradalby]

I think this looks like sensible work on this feature, I have not worked too much on the ACLs and our coverage of the feature and unit tests are good, but it suffers from the problem of testing "our interpretation" of how it should work.

My main concern with this is that if we get it wrong, and users start relying on that, we have a hard time fixing it. With things like SSH, the worst possible scenario is that someone lock themselves out from a machine.

As mentioned in Discord, integration tests would make a lot of sense for this feature, so we have the opportunity to actually verify that the client does what we expect and intend. I am not sure if Tailscale SSH will play nicely in Docker, but I think it is worth a shot.

I don't want to block this feature, the question is, how should we roll it out to minimise the impact if we get something wrong? (This hesitant approach comes from the Namespace/User/Tailnet issue we had earlier)

[iSchluff]

@kradalby maybe put it behind a feature toggle to let users know that the feature is experimental for now?

[kradalby]

Progress update: This is looking good, we are missing a few more test cases and @evenh and I have figured that we at least want:

• Given empty ACL file, no SSH should work
• Verify that given two namespaces, which only allow :22 access in its own namespace, cross namespace SSH should not work
• SSH ACL rules are configured, but no rules to allow :22, should not allow SSH access.

I think that should be sufficient to call it beta and add more tests later as we find broken behaviour.

[kradalby]

I'm happy with this, letting @juanfont and then we can get it in.

[juanfont]

Excellent!

[dedene]

@juanfont should the ssh "check" feature in ACLs work? I never seems to be getting the Tailscale SSH requires an additional check (as shown on https://tailscale.com/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode) although the ssh ACL uses "check" instead of "accept" with a low checkPeriod.