mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-09 11:52:00 -04:00
Basavaraj S mandMike Jensen
a40d145b21
* derp/derphttp: reject invalid DERP node hostname before proxy CONNECT When a DERP client reaches a node through an HTTP(S) proxy, dialNodeUsingProxy writes the CONNECT request by hand and puts net.JoinHostPort(n.HostName, port) into both the request line and the Host header. n.HostName comes from the control-supplied DERP map and net.JoinHostPort does no sanitizing, so a hostname carrying CR/LF was written verbatim into the plaintext request sent to the proxy. That let whoever populated the DERP map inject extra headers, or a second pipelined request, into the connection to the operator's proxy. Validate n.HostName with httpguts.ValidHostHeader at the top of dialNodeUsingProxy, before the proxy is dialed, and also reject the empty hostname, which ValidHostHeader accepts. DNS names and IP literals continue to work. Add a table-driven test that runs accepted and rejected hostnames against a fake proxy and checks the CONNECT target that goes out. Fixes tailscale/corp#48122 Signed-off-by: basavaraj-sm05 <basavaraj@digiscrypt.com> Co-authored-by: Mike Jensen <mikej@tailscale.com> Signed-off-by: Mike Jensen <mikej@tailscale.com>