tailscale

0 Fork 0

mirror of https://github.com/tailscale/tailscale.git synced 2026-10-09 11:52:00 -04:00

Files

T

Brad Fitzpatrick b3de3b2217 ipn/ipnlocal, net/netns: bind Linux peerapi listener to the tun device

Linux is a weak-host stack, so a LAN-adjacent machine can complete a
TCP handshake with a node's peerapi listener by sending a packet to
the node's Tailscale IP, with no credentials and no tailnet
membership.

macOS and iOS already bind the listener to the tunnel interface, and
Windows is protected by its strong host model, so Linux tun mode was
the only platform that leaked.

Bind the Linux listener to the tunnel interface as well, so the
kernel only answers connections that arrive from the tunnel or from
the local host. A natlab VM test verifies that a same-LAN machine can
no longer complete the handshake, while local and peer peerapi keep
working.

FreeBSD has the same weak-host exposure but no per-socket equivalent,
so handling it there with pf is a TODO (#21419).

Updates tailscale/corp#48248

Reported-By: Samuel Keeley (@keeleysam)
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I5f8501b0938c9f7aa39c4c12ebddd988c72e89bf

2026-09-22 14:10:30 -07:00

mksyscall.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

netns_android.go

netns: add Android callback to bind socket to network (#18915 )

2026-03-11 12:28:28 -07:00

netns_darwin_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

netns_darwin.go

all: don't repeat the the word "the" unnecessarily