Mike Jensen 88aa2c6bb2 wgengine/netstack: block 4via6 forwards to host-scoped targets (#20866) (#20926) ...

The packet filter only sees a via address's outer ULA, so netstack unconditionally dialed whatever IPv4 was embedded in it.

This change refuses TCP, UDP, and ping relays to host-scoped destinations after UnmapVia.

Credit to the Anthropic infrastructure security team for finding and reporting.

Fixes https://github.com/tailscale/corp/issues/46646

Change-Id: I93d8e27a2eddbce7eb3f8c5fa4677f8de3a8ed9e

Change-Id: I8865c0e89474600b0b8254ebebd0523e29412e58

(cherry picked from commit 90ed0bcf4b)

Signed-off-by: Mike Jensen <mikej@tailscale.com>

2026-08-19 11:25:42 -06:00

..

auditlog

all: use Go 1.26 things, run most gofix modernizers

2026-03-06 13:32:03 -08:00

conffile

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

desktop

all: don't repeat the the word "the" unnecessarily

2026-06-18 16:32:08 +01:00

ipnauth

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipnext

ipn/ipnext, ipn/ipnlocal, feature/conn25: pass peer seq to AllowedIPs hook

2026-07-15 10:12:58 -04:00

ipnlocal

wgengine/netstack: block 4via6 forwards to host-scoped targets (#20866) (#20926)

2026-08-19 11:25:42 -06:00

ipnserver

ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest

2026-06-27 16:11:42 -07:00

ipnstate

all: fix typos where we repeat repeat ourselves

2026-07-03 16:09:03 +01:00

lapitest

ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest

2026-06-27 16:11:42 -07:00

localapi

ipn/localapi,client/local: honour Retry-After on cert rate-limit (#20315)

2026-07-08 13:34:40 +01:00

policy

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store

all: fix typos where we repeat repeat ourselves

2026-07-03 16:09:03 +01:00

backend_test.go

ipn: add fmt.Stringer support to NotifyWatchOpt (#20072)

2026-06-18 10:27:16 -07:00

backend.go

client/local, ipn, tailcfg: document which LocalAPI client APIs are stable

2026-07-20 10:41:59 -07:00

conf_test.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

conf.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

doc.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_clone.go

cmd/tailscale, ipn, feature/remoteconfig: add remote-config support

2026-07-07 12:10:34 -07:00

ipn_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_view.go

client/local, ipn, tailcfg: document which LocalAPI client APIs are stable

2026-07-20 10:41:59 -07:00

prefs_test.go

cmd/tailscale, ipn, feature/remoteconfig: add remote-config support

2026-07-07 12:10:34 -07:00

prefs.go

client/local, ipn, tailcfg: document which LocalAPI client APIs are stable

2026-07-20 10:41:59 -07:00

serve_expand_test.go

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

serve_test.go

ipn,ipn/localapi: require local admin to serve Unix domain sockets

2026-06-03 09:45:02 -06:00

serve.go

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

store_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store.go

ipn/store: make WriteState(id, nil) delete key instead of adding nil entry (#19920)

2026-05-29 11:22:14 -07:00