mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-16 16:04:30 -04:00
Brad Fitzpatrick
5c939a8560
Two fixes for DNS names from a malicious control server, from Ben Carman's security review: dnsname.ToFQDN now rejects names containing whitespace or control characters. ToFQDN previously checked label lengths only, so a search domain like "evil.com\nnameserver 6.6.6.6" passed validation and was written verbatim into /etc/resolv.conf by the direct DNS manager, where the injected line became a real nameserver. The same shape existed on Windows, where a CRLF in an ExtraRecords name injected lines into the hosts file. This is deliberately not RFC 1123 hostname validation (see the existing comment about issue 2024): labels may still contain any byte that isn't whitespace or a control character. dnsConfigForNetmap now drops search domains and split-DNS route suffixes that ToFQDN rejects. It previously logged the error but appended the zero FQDN anyway, and FQDN.WithoutTrailingDot panics on the empty FQDN when OS DNS config is written, so one over-long domain from control crashed tailscaled on every netmap until control sent a valid one. Thanks to Ben Carman for the report! Updates tailscale/corp#48187 Reported-by: Ben Carman Change-Id: I8de40cafacfb66e2b863f097794c42f3ca5c2da9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>