tailscale/ipn/ipnlocal
Mike Jensen 689c6c2e6d
ipn/ipnlocal: reject SrcCaps-based packet filter rules for unsigned peers (#20513)
This change ensures `packetFilterPermitsUnlockedNodes` also considers SrcCaps-based grants when checking for unsigned peer access.

Fixes tailscale/corp#45116

Change-Id: I0ac938367888f67ed6f355fc19959cc8c31722a2

Signed-off-by: Mike Jensen <mikej@tailscale.com>
2026-07-17 15:58:06 -06:00
..
ipnlocaltest ipn/ipnlocal, feature/acme: move most remaining cert code into feature/acme 2026-06-29 12:57:22 -07:00
netmapcache ipn/ipnlocal: update netmap cache after peer deltas are applied (#20111) 2026-06-12 09:41:00 -07:00
testdata ipn/ipnlocal: fix the path for writing cert files (#7203) 2023-02-07 14:34:04 -08:00
breaktcp_darwin.go all: apply go fix 2026-07-10 17:39:16 -07:00
breaktcp_linux.go all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
bus_test.go ipn/ipnlocal: add wireguard session state metrics + publish on IPN bus 2026-06-15 11:41:18 -07:00
bus.go ipn, ipn/ipnlocal: remove darwin & ios from goosGetsLegacyNetmapNotify 2026-07-15 14:47:16 -04:00
c2n_pprof.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
c2n_test.go ipn/ipnlocal, feature/acme: move most remaining cert code into feature/acme 2026-06-29 12:57:22 -07:00
c2n.go cmd/tailscale, ipn, feature/remoteconfig: add remote-config support 2026-07-07 12:10:34 -07:00
cert.go ipn/localapi,client/local: honour Retry-After on cert rate-limit (#20315) 2026-07-08 13:34:40 +01:00
diskcache_test.go ipn/ipnlocal/netmapcache: add UpdateSelfOnly method (#19818) 2026-05-20 16:29:04 -07:00
diskcache.go ipn/ipnlocal: remove logs for peer delta cache updates (#20145) 2026-06-15 10:00:03 -07:00
dnsconfig_test.go ipn/ipnlocal,net/dns/resolver: serve MagicDNS names from live indexes 2026-07-14 07:26:41 -07:00
drive_test.go ipn/ipnlocal, drive: stop using netmap.NetworkMap in Taildrive too 2026-06-23 10:41:50 -07:00
drive_tomove.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
drive.go ipn/ipnlocal, drive: stop using netmap.NetworkMap in Taildrive too 2026-06-23 10:41:50 -07:00
expiry_test.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
expiry.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
extension_host_test.go ipn/{ipnext,ipnlocal}: expose authReconfig in ipnext.Host as AuthReconfigAsync 2026-03-20 17:29:11 -04:00
extension_host.go ipn/ipnlocal: fix reporting of active ipnext extensions 2026-07-01 15:35:06 -07:00
fortest.go ipn/ipnlocal, feature/acme: move most remaining cert code into feature/acme 2026-06-29 12:57:22 -07:00
hwattest.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
local_test.go ipn/ipnlocal: reject SrcCaps-based packet filter rules for unsigned peers (#20513) 2026-07-17 15:58:06 -06:00
local.go ipn/ipnlocal: reject SrcCaps-based packet filter rules for unsigned peers (#20513) 2026-07-17 15:58:06 -06:00
loglines_test.go ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest 2026-06-27 16:11:42 -07:00
netstack.go types/ptr: deprecate ptr.To, use Go 1.26 new 2026-03-05 20:13:18 -08:00
node_backend_test.go ipn/ipnext, ipn/ipnlocal, feature/conn25: pass peer seq to AllowedIPs hook 2026-07-15 10:12:58 -04:00
node_backend.go ipn/ipnlocal: use the live peer map, not the netmap's stale Peers slice 2026-07-15 13:29:26 -04:00
peerapi_drive.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
peerapi_macios_ext.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
peerapi_test.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
peerapi.go ipn/ipnlocal, feature/conn25: add hook for accepting PeerAPI DNS 2026-06-29 16:33:33 -04:00
prefs_metrics.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
profiles_notwindows.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
profiles_test.go ipn/ipnlocal: sort profiles by date created when possible (#20223) 2026-06-30 09:01:32 -04:00
profiles_windows.go all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
profiles.go ipn/ipnlocal: sort profiles by date created when possible (#20223) 2026-06-30 09:01:32 -04:00
resolve_test.go net/tsdial, ipn/ipnlocal: stop using netmap.NetworkMap in Dialer 2026-06-24 13:14:45 -07:00
resolve.go ipn/ipnlocal,net/dns/resolver: serve MagicDNS names from live indexes 2026-07-14 07:26:41 -07:00
routecheck_disabled.go ipn/ipnlocal: use routecheck reports to make exit node suggestions 2026-07-02 20:26:27 -07:00
routecheck_enabled.go ipn/ipnlocal: use routecheck reports to make exit node suggestions 2026-07-02 20:26:27 -07:00
serve_disabled.go ipn/ipnlocal, feature/acme: move most remaining cert code into feature/acme 2026-06-29 12:57:22 -07:00
serve_metrics_test.go ipn/ipnlocal: add metrics for inbound and outbound bytes on Serve connections (#19991) 2026-06-12 05:49:00 -05:00
serve_test.go ipn/ipnlocal: update getServeHandler path handling on malformed url (#20431) 2026-07-13 15:15:44 -07:00
serve_unix_test.go ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve 2026-07-16 09:13:38 -06:00
serve.go ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve 2026-07-16 09:13:38 -06:00
state_test.go wgengine/wgcfg,wgengine,ipn/ipnlocal: remove Peers from wgcfg.Config 2026-07-14 19:57:59 -04:00
tailnet-lock_test.go ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest 2026-06-27 16:11:42 -07:00
tailnet-lock.go ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest 2026-06-27 16:11:42 -07:00
tailnetlock_disabled.go ipn/ipnlocal, types/netmap, tsnet: filter unsigned peers on delta path 2026-06-23 08:12:36 -07:00
watchdog_test.go ipn/ipnlocal: add back a watchdog after earlier removal from engine 2026-06-02 11:57:12 -07:00
watchdog.go wgengine: add Engine.ProbeLocks, drop PeerForIP lock-probe overload 2026-06-23 12:02:49 -07:00
web_client_stub.go ipn/ipnlocal: add webclient support for tvOS (#20256) 2026-06-26 08:58:23 -04:00
web_client.go ipn/ipnlocal: add webclient support for tvOS (#20256) 2026-06-26 08:58:23 -04:00