mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-28 22:19:12 -04:00
Sam JeanandJames Tucker
3a38840ccc
The unix-socket reverse proxy checked its backend against the tailscaled socket only when the handler was built, but each backend connection re-resolved the path from scratch. A backend that was benign at config time could later be replaced with a symlink to the tailscaled socket by anyone able to write to its directory, and the next dial followed it. The proxy dials as root, so the same swap could redirect a serve or funnel backend at any root-only unix socket on the host. Move the check to the dial itself, in a dialServeUnixSocket method shared by the HTTP transport, the h2c transport and the TCP-forward handler, all of which previously dialed unix on their own. It refuses tailscaled's socket with ErrProxyToTailscaledSocket immediately before connecting. On Linux 5.6 and newer, the dial pins the resolved socket inode with openat2(2): an O_PATH descriptor opened with RESOLVE_NO_MAGICLINKS, and RESOLVE_BENEATH under the socket's parent directory where the path allows it, or by whole path otherwise. The pinned file is checked against the tailscaled socket, and the connection is made to the pinned file through /proc/self/fd, so replacing the path cannot retarget the connect. On kernels without openat2(2), and on other platforms, the path is dialed directly. The connected peer is re-checked after the dial on every platform. The peer address of a path-bound listener is the path the socket was bound to, not the path that was dialed, so a symlink swapped in before the dial is identified after the connect. This check is best-effort: connections that have no determinable peer name are allowed. Fixes tailscale/corp#50481 Change-Id: Iae5db207519db9c139a512c0427dce3dfa3ca672 Co-authored-by: James Tucker <james@tailscale.com> Signed-off-by: Sam Jean <samj@tailscale.com> Signed-off-by: James Tucker <james@tailscale.com>