diff options
| author | Percy Wegmann <percy@tailscale.com> | 2024-02-11 15:01:59 -0600 |
|---|---|---|
| committer | Percy Wegmann <ox.to.a.cart@gmail.com> | 2024-02-12 14:08:00 -0600 |
| commit | c42a4e407a9fcaccdf29a275dcb9bbbd3040bb59 (patch) | |
| tree | 114aeabc799b04cd3258f23908fbaf3b2f9e159b /wgengine/netstack | |
| parent | d0ef3a25dfd36ce9634160cf500aa3f7620ac25d (diff) | |
| download | tailscale-c42a4e407a9fcaccdf29a275dcb9bbbd3040bb59.tar.xz tailscale-c42a4e407a9fcaccdf29a275dcb9bbbd3040bb59.zip | |
tailfs: listen for local clients only on 100.100.100.100
FileSystemForLocal was listening on the node's Tailscale address,
which potentially exposes the user's view of TailFS shares to other
Tailnet users. Remote nodes should connect to exported shares via
the peerapi.
This removes that code so that FileSystemForLocal is only avaialable
on 100.100.100.100:8080.
Updates tailscale/corp#16827
Signed-off-by: Percy Wegmann <percy@tailscale.com>
Diffstat (limited to 'wgengine/netstack')
| -rw-r--r-- | wgengine/netstack/netstack.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go index 2df8e2bb9..c58f11023 100644 --- a/wgengine/netstack/netstack.go +++ b/wgengine/netstack/netstack.go @@ -919,10 +919,10 @@ func (ns *Impl) acceptTCP(r *tcp.ForwarderRequest) { return gonet.NewTCPConn(&wq, ep) } - // Local DNS Service (DNS and WebDAV) + // Local Services (DNS and WebDAV) hittingServiceIP := dialIP == serviceIP || dialIP == serviceIPv6 hittingDNS := hittingServiceIP && reqDetails.LocalPort == 53 - hittingTailFS := hittingServiceIP && ns.tailFSForLocal != nil && reqDetails.LocalPort == 8080 + hittingTailFS := hittingServiceIP && ns.tailFSForLocal != nil && reqDetails.LocalPort == ipnlocal.TailFSLocalPort if hittingDNS || hittingTailFS { c := getConnOrReset() if c == nil { |