mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-20 21:23:07 +08:00
a68be19739
A connection to a Tailscale Service IP on a port the service does not serve was forwarded to the underlying host. `acceptTCP` fell through to the isTailscaleIP case (a VIP is in the Tailscale IP range), which rewrote the dial target to 127.0.0.1:<port> and forwardTCP'd the connection onto whatever unrelated listener happened to be on the host's loopback at that port. This is reachable through the service IP by any peer which was granted access only to the service (dst: svc:foo), so it exposes host ports the peer has no ACL access to via the machine's regular IP. This happens when there tailscaled has a Tun interface and the forward bits are set. In this commit, we added a guard in acceptTCP, before the isTailscaleIP case that RSTs connections to a VIP service IP on a port with no serve handler. Served ports return earlier via TCPHandlerForDst, so only unserved ports reach the guard. Layer 3 services are unaffected: their traffic is released to the host in injectInbound and never reaches acceptTCP. Fixes #20362 Signed-off-by: kevinliang10 <kevinliang@tailscale.com> |
||
|---|---|---|
| .. | ||
| bench | ||
| filter | ||
| magicsock | ||
| netlog | ||
| netstack | ||
| router | ||
| wgcfg | ||
| wgint | ||
| wglog | ||
| winnet | ||
| mem_ios.go | ||
| netlog_hooks.go | ||
| pendopen_omit.go | ||
| pendopen.go | ||
| userspace_ext_test.go | ||
| userspace_test.go | ||
| userspace.go | ||
| wgengine.go | ||