From 0480a925c17d3366560377043185c719854b1069 Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Sat, 19 Nov 2022 15:29:15 -0800
Subject: [PATCH] ipn/ipnlocal: send Content-Security-Policy, etc to peerapi
 browser requests

Updates tailscale/corp#7948

Change-Id: Ie70e0d042478338a37b7789ac63225193e47a524
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 ipn/ipnlocal/peerapi.go | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/ipn/ipnlocal/peerapi.go b/ipn/ipnlocal/peerapi.go
index c5cf2749f..aa4e4f32e 100644
--- a/ipn/ipnlocal/peerapi.go
+++ b/ipn/ipnlocal/peerapi.go
@@ -34,6 +34,7 @@ import (
 	"github.com/kortschak/wol"
 	"golang.org/x/exp/slices"
 	"golang.org/x/net/dns/dnsmessage"
+	"golang.org/x/net/http/httpguts"
 	"tailscale.com/client/tailscale/apitype"
 	"tailscale.com/envknob"
 	"tailscale.com/health"
@@ -575,12 +576,50 @@ func (h *peerAPIHandler) validatePeerAPIRequest(r *http.Request) error {
 	return h.validateHost(r)
 }
 
+// peerAPIRequestShouldGetSecurityHeaders reports whether the PeerAPI request r
+// should get security response headers. It aims to report true for any request
+// from a browser and false for requests from tailscaled (Go) clients.
+//
+// PeerAPI is primarily an RPC mechanism between Tailscale instances. Some of
+// the HTTP handlers are useful for debugging with curl or browsers, but in
+// general the client is always tailscaled itself. Because PeerAPI only uses
+// HTTP/1 without HTTP/2 and its HPACK helping with repetitive headers, we try
+// to minimize header bytes sent in the common case when the client isn't a
+// browser. Minimizing bytes is important in particular with the ExitDNS service
+// provided by exit nodes, processing DNS clients from queries. We don't want to
+// waste bytes with security headers to non-browser clients. But if there's any
+// hint that the request is from a browser, then we do.
+func peerAPIRequestShouldGetSecurityHeaders(r *http.Request) bool {
+	// Accept-Encoding is a forbidden header
+	// (https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name)
+	// that Chrome, Firefox, Safari, etc send, but Go does not. So if we see it,
+	// it's probably a browser and not a Tailscale PeerAPI (Go) client.
+	if httpguts.HeaderValuesContainsToken(r.Header["Accept-Encoding"], "deflate") {
+		return true
+	}
+	// Clients can mess with their User-Agent, but if they say Mozilla or have a bunch
+	// of components (spaces) they're likely a browser.
+	if ua := r.Header.Get("User-Agent"); strings.HasPrefix(ua, "Mozilla/") || strings.Count(ua, " ") > 2 {
+		return true
+	}
+	// Tailscale/PeerAPI/Go clients don't have an Accept-Language.
+	if r.Header.Get("Accept-Language") != "" {
+		return true
+	}
+	return false
+}
+
 func (h *peerAPIHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if err := h.validatePeerAPIRequest(r); err != nil {
 		h.logf("invalid request from %v: %v", h.remoteAddr, err)
 		http.Error(w, "invalid peerapi request", http.StatusForbidden)
 		return
 	}
+	if peerAPIRequestShouldGetSecurityHeaders(r) {
+		w.Header().Set("Content-Security-Policy", `default-src 'none'; frame-ancestors 'none'; script-src 'none'; script-src-elem 'none'; script-src-attr 'none'`)
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+	}
 	if strings.HasPrefix(r.URL.Path, "/v0/put/") {
 		h.handlePeerPut(w, r)
 		return