Mike Jensen 88aa2c6bb2 wgengine/netstack: block 4via6 forwards to host-scoped targets (#20866) (#20926) ...

The packet filter only sees a via address's outer ULA, so netstack unconditionally dialed whatever IPv4 was embedded in it.

This change refuses TCP, UDP, and ping relays to host-scoped destinations after UnmapVia.

Credit to the Anthropic infrastructure security team for finding and reporting.

Fixes https://github.com/tailscale/corp/issues/46646

Change-Id: I93d8e27a2eddbce7eb3f8c5fa4677f8de3a8ed9e

Change-Id: I8865c0e89474600b0b8254ebebd0523e29412e58

(cherry picked from commit 90ed0bcf4b)

Signed-off-by: Mike Jensen <mikej@tailscale.com>

2026-08-19 11:25:42 -06:00

..

gro

wgengine/netstack: accept IPv4 fragments before reassembly

2026-07-02 14:44:00 -07:00

link_endpoint.go

wgengine/netstack: deliver self-addressed packets via loopback

2026-02-27 14:30:41 -08:00

netstack_linux.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

netstack_tcpbuf_default.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

netstack_tcpbuf_ios.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

netstack_test.go

wgengine/netstack: block 4via6 forwards to host-scoped targets (#20866) (#20926)

2026-08-19 11:25:42 -06:00

netstack_userping_apple.go

wgengine/netstack, net/ping: stop using pro-bing and use our net/ping instead

2026-05-04 14:05:24 -07:00

netstack_userping_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

netstack_userping.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

netstack.go

wgengine/netstack: block 4via6 forwards to host-scoped targets (#20866) (#20926)

2026-08-19 11:25:42 -06:00