CodeCow/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2026-06-03 21:01:54 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
01d0bdd253
tailscale/net
History
Andrew Dunham 33714211c8 net/dns: use os.Root to prevent path traversal in darwin resolver 
The darwinConfigurator writes split DNS resolver files to
/etc/resolver/$SUFFIX using os.WriteFile with string concatenation.
A crafted MatchDomain value containing path traversal sequences
(e.g. "../evil") could write files outside the resolver directory.

Use os.OpenRoot to confine all file operations in SetDNS and
removeResolverFiles to the resolver directory. os.Root rejects any
path component that escapes the root, returning an error instead of
following the traversal.

Also parametrize the resolver directory path on the struct to enable
testing with t.TempDir(), and add tests.

As far as I can tell, this would require a malicious controlplane to
exploit, but still worth fixing.

Updates tailscale/corp#39751

Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2026-04-28 11:08:22 -04:00
..
ace all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
art all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
bakedroots all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
batching cmd/vet: add subtestnames analyzer; fix all existing violations 2026-04-05 15:52:51 -07:00
captivedetection all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
connectproxy all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
dns net/dns: use os.Root to prevent path traversal in darwin resolver 2026-04-28 11:08:22 -04:00
dnscache all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
dnsfallback all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
flowtrack all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
ipset all: use bart.Lite instead of bart.Table where appropriate 2026-03-24 14:45:23 +00:00
ktimeout all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
memnet all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
netaddr all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
netcheck cmd/vet: add subtestnames analyzer; fix all existing violations 2026-04-05 15:52:51 -07:00
neterror all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
netkernelconf all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
netknob all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
netmon ipn/ipnlocal,net/netmon: make frequent darkwake more efficient 2026-04-06 15:46:51 -07:00
netns netns: add Android callback to bind socket to network (#18915) 2026-03-11 12:28:28 -07:00
netstat all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
netutil all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
netx all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
packet net,tsnet: fix the capitalisation of "Wireshark" 2026-03-26 19:39:29 +00:00
ping all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
portmapper all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
porttrack net/porttrack: change magic listen address format for Go 1.26 2026-03-04 21:57:05 -08:00
proxymux all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
routetable netns,wgengine: add OpenBSD support to netns via an rtable 2026-02-25 12:44:32 -08:00
sockopts all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
socks5 all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
sockstats all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
speedtest cmd/vet: add subtestnames analyzer; fix all existing violations 2026-04-05 15:52:51 -07:00
stun cmd/vet: add subtestnames analyzer; fix all existing violations 2026-04-05 15:52:51 -07:00
stunserver all: use Go 1.26 things, run most gofix modernizers 2026-03-06 13:32:03 -08:00
tcpinfo all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
tlsdial tsd, all: add Sys.ExtraRootCAs, plumb through TLS dial paths 2026-04-07 18:10:54 -07:00
tsaddr all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00
tsdial net/tsdial, ipn/localapi, client/local: let clients dial non-Tailscale addresses directly 2026-04-27 09:33:27 -07:00
tshttpproxy cmd/vet: add subtestnames analyzer; fix all existing violations 2026-04-05 15:52:51 -07:00
tstun tailcfg,ipn/ipnlocal: regulate netmap caching via a node attribute (#19117) 2026-04-01 15:02:53 -07:00
udprelay cmd/vet: add subtestnames analyzer; fix all existing violations 2026-04-05 15:52:51 -07:00
wsconn all: remove AUTHORS file and references to it 2026-01-23 15:49:45 -08:00