tailscale

main

clairew/auto-exit-node-v2

naman/tsidp-funnel

angott/dns-warnables

bradfitz/mu

andrew/workgraph

irbekrm/sessionrecorder

flakes

dependabot/github_actions/peter-evans/create-pull-request-6.1.0

agottardo-patch-1

tomhjp/ipv6-egress

angott/captive-portal-detection-warnable

bradfitz/resume

irbekrm/operator_linux_only

nickkhyl/posture-sn-override

dependabot/npm_and_yarn/client/web/ws-8.17.1

kradalby/chaos

angott/ignore-some-warnings-startup

kradalby/nl-panic-fix

tomhjp/service-condition-status-dev

dependabot/npm_and_yarn/cmd/tsconnect/braces-3.0.3

release-branch/1.68

raggi/derper-doc

irbekrm/fixsubnets

irbekrm/dnstest

irbekrm/fix

icio/tsweb-nested-stdhandler

irbekrm/accept_routes

percy/issue8593

percy/issue8593-prep

jonathan/sugg_exit_node_fix

irbekrm/proxycidrs

release-branch/1.66

icio/public-key-short

clairew/handle-auto-exit-node-value

noncombatant/fix-12186

knyar/install2

will/tsnet-udp

raggi/web-zst-precompress

raggi/gocross-empty-goos-goarch

andrew/dns-fallback

andrew/prom-omit-metrics

dependabot/github_actions/golangci/golangci-lint-action-6.0.1

jwhited/android-packet-vectors

knyar/renew

bradfitz/debug_tstest

clairew/revert-storing-last-suggested

andrew/debug-integration-tests

fran/appc-ensmallen-gh-preset

ox/11854-3-sftp

percy/cherry-pick-2648d475d751b47755958f47a366e300b6b6de0a

ox/corp-19592

ox/11954-3

ox/11854

kevin/Split_Remove_advertised_routes_from_pref

dsnet/logtail-buffer2

bradfitz/dataplane_logs_no_logs_no_support

nickkhyl/ipn-user-identity

irbekrm/extsvcnftableslb

andrew/dns-wrap-errors

release-branch/1.64

noncombatant/safeweb-cleanup

bradfitz/login_retry

patrickod/installer-yml-fixup

release-branch/1.64.0

fran/appc-store-routes-by-source

andrew/controlclient-use-last-addr

enable-exit-node-dst-logs

clairew/peer-node-capability-documentation

revert-11590-catzkorn/penguin

enable-exit-node-dst-logs-2

licenses/corp

dsnet/logpolicy-opts

licenses/android

jonathan/taildrop_path

licenses/cli

release-branch/1.62

clairew/log-dst-exit-node

fran/appc-domain-delte-prototype

irbekrm/maybe_fix_v6

oxtoacart/golden_memory

irbekrm/cherry_fix_panic

oxtoacart/no_indent_status

angott/corp-18441

soniaappasamy/serve-funnel-ui

brafitz/remote-config

andrew/control-key-store

maisem/proxy-1

release-branch/1.60

andrew/netstack-forwarder-debug

oxtoacart/immediately_access_shares

knyar/varz

knyar/install

irbekrm/splitkeys

oxtoacart/automount

angott/sleep-debug-apis

clairew/suggest-non-mullvad-exit-node

tom/tka4

clairew/add-latitude-longitude

irbekrm/operatorversion

oxtoacart/dsnet_codereview_fixes

clairew/client-suggest-node-poc

raggi/rand

flyingsquirrel_bak

will/containerboot-webui

irbekrm/clustermagicdns

noncombatant/add-hello-systemd

catzkorn/jira

release-branch/1.58

kradalby/view-only-type

clairew/add-disco-pong-padding

clairew/receive-icmp-errors

dgentry-b10911

irbekrm/proxyclass2

irbekrm/proxyclass

irbekrm/byocerts

knyar/worklifeposture

dsnet/httpio

will/webclient-mobile

will/webclient-csrf

irbekrm/static_crd

irbekrm/manifests_crd

maisem/exp-k8s

release-branch/1.44

irbekrm/containerbootdeclarativeconf

kube_exp

irbekrm/conf

raggi/stun-subprocess

andrew/nixos-vm-tests

irbekrm/set_args

andrew/peer-ipv6-addrs

irbekrm/external_services

irbekrm/os

irbekrm/pull_in_certs

dependabot/github_actions/github/codeql-action-3

dependabot/github_actions/actions/upload-artifact-4

irbekrm/kube_build_tags

release-branch/1.56

jwhited/derp-cmm-timestamp

naman/web-client-update-fixes

dependabot/github_actions/actions/setup-go-5

soniaappasamy/use-swr

marwan/displayname

release-branch/1.54

danderson/debug-garden

jwhited/unsafe-exp

clairew/test-wrapper-file

bradfitz/compontent_logs

kradalby-keys-db-interface

kradalby/keys-db-interface

andrew/upnp-unfork

bm/tsoidc

irbekrm/le

knyar/restartmap

kristoffer/editable-tailnet-displayname

raggi/document-deprecated-approach

dsnet/statestore

awly/version-override

bradfitz/silentdisco_knob

richard/15372

raggi/icmplistener

awly/linux-sudoers-local-admin-poc

release-branch/1.52

soniaappasamy/web-auth-restructure

bradfitz/ipx_set_contains

knyar/derpmesh

irbekrm/chartandcli

richard/15037-2

bradfitz/linuxfw_nil_table

richard/15037

bradfitz/tbug

bradfitz/derp_mesh

valscale/meshFix

will/sonia/web-tailscaled

tyler/serve-status

maisem/ni

maisem/hi

rhea/apple-test

dgentry-nix-flake

dgentry-coverage

c761d10

bradfitz/gocross_wantver

awly/ipnlocal-watchnotifications-clientversion

bradfitz/integration_more_tun

bradfitz/recursive_controlknob

dgentry-authkey

dependabot/npm_and_yarn/cmd/tsconnect/postcss-8.4.31

bm/4via6

bradfitz/sessionactivetimeout

release-branch/1.50

rhea/taildrop-resume

andrew/peercap-ipv6-aaaa

irbekrm/k8sipnftheuristics

irbekrm/kubeipnft

irbekrm/k8sipnft

dgentry-istoreos

knyar/posturemac

dependabot/github_actions/tibdex/github-app-token-2.1.0

irbekrm/egress

raggi/restore-extra-records-dns

aaron/win_process_mitigations

danderson/lru-rollback

clairew/mdm-interface

angott/userdefaults-reader

andrew/bump-esbuild

andrew/netns-more-logging

release-branch/1.48

irbekrm/k8s-autopilot

dsnet/viewer-jsonv2

marwan/altmem_stash

irbekrm/k8s-nftables

marwan/postmem

maisem/fix-deadlock

bradfitz/matrix

irbekrm/egress-dns

bradfitz/wait_unpause

bradfitz/calc_state

irbekrm/svc_conditions

soniaappasamy/fix-test-flake

marwan/servedev

soniaappasamy/fix-web-client-lock

raggi/netfilter-runtime

raggi/netfilter-add-modes

marwan/scmem

bradfitz/ignore_ula

clairew/tstime-net

clairew/tstime-wgengine

bradfitz/tkasig_type

shayne/k8s-serve

bradfitz/gui_netmap

macsys-update

catzkorn/netcheckuout

andrew/doctor-conntrack

tsweb/client-ui

valscale/ptb

raggi/gotoolchain

irbekrm/improve_logout

maisem/doc

rhea/egress

noncombatant/large-int-string

release-branch/1.46

andrew/captive-portal-package

s/pmtud

andrew/derp-bound-latency

andrew/health-state

bradfitz/gokrazy_dns

clairew/use-tstime-etc

bradfitz/negdep

raggi/stunc

raggi/gvisor-hostarch-deptest

crawshaw/art-table

irbekrm/fix_logout_loop

clairew/refactor-new-timer

clairew/test-wrapper-write-file

s/tsnetd

bradfitz/countrycode

crawshaw/stunchild

tom/disco

raggi/v6masq

dsnet/syncs-map-range-mutable

release-branch/1.42

raggi/heartbeat-timebomb

raggi/derp-probe-stun-loss

raggi/tsdebugger

tom/derp

andrew/ipn-debug-1.42.0

marwan/portlistrefactor

marwan/noconstructor

angott/allow-thunderbolt-bridge

marwan/polleropts

marwan/noconstructor2

andrew/slicesx-deduplicate

unraid-web

release-branch/1.40

kristoffer/enable-mips-pkgs

s/eq

raggi/atomiccloseonce

raggi/bump-goreleaserv2

marwan/tmp

catzkorn/addrsend

raggi/gofuzz

shayne/funnel_cmd

release-branch/1.38

dgentry/atomicfile

andrew/derp-region-location

tom/tka6

maisem/k8s-cache

azure

andrew/fastjson

crawshaw/lnclose

crawshaw/tsnet1

crawshaw/httpconnect

Xe/tsnet-funnel

dgentry/sniproxy-dns

andrew/util-dnsconfig

andrew/cloudenv-location

release-branch/1.36

aaron/migrate_windows

crawshaw/pidlisten

andrew/router-drop-ula

will/vizerr

danderson/mkversion

crawshaw/activesum

andrew/doctor-scutil

danderson/version-private3

bradfitz/sassy

bradfitz/win_unattended_warning

andrew/hostinfo-HavePortMap

skriptble/ssh-recording-persist

crawshaw/ondemanddomains

danderson/helm

andrew/peer-status-KeyExpiry

bradfitz/noise_debug_more

release-branch/1.34

cloner

danderson/backport

clairew/tsnet_get_own_ip

bradfitz/tidy

raggi/tsweb-compression

bradfitz/fix_ipn_cloner

danderson/bootstrap

will/enforce-hostname

mihaip/delete-all-profiles

release-branch/1.32

shayne/serve_empty_text_handler

bradfitz/hostinfo_ingress_bit

mihaip/logout-async-start

net-audit-log/1.32

bradfitz/set_prefs_locked

mihaip/fas

bradfitz/port_intercept

andrew/net-tsaddr-mapviaaddr

danderson/tsburrito

andrew/tstest-goroutine-ignore

andrew/monitor-link-change

danderson/k8s

andrew/debug-subnet-router

andrew/metrics-distribution

knyar/prober

crawshaw/accumulatorcfg

bradfitz/keyboard-interactive

bradfitz/tailpipe

raggi/accept-routes-filter

nyghtowl/tailnet-name2

buildjet

buildjet-vs-github

andrew/netns-macos-route

walterp-api

andrew/linux-router-v4-disabled

bradfitz/distro_ubuntu

tom/iptables

release-branch/1.30

tom/tka2

andrew/dnscache-debugging-1.22.2

andrew/controlclient-dial

raggi/experiment-queues

bradfitz/u32

ip6tables

catzkorn/derp-benchmark

jwhited/wireguard-go-vectorized-bind

catzkorn/otel-init

bradfitz/appendf

mihaip/js-cli

dsnet/tsweb-499s

bradfitz/deephash_early_exit

crawshaw/xdp

dsnet/logtail-zstd-single-segment

Xe/gitops-pusher-three-version-problem

Xe/gitops-pusher-acl-test-error-output

Xe/gitops-pusher-ffcli

bradfitz/ssh_auth_none_demo

release-branch/1.28

catzkorn/otel-derp

bradfitz/shared_split_dns

nyghtowl/fix-resolved

release-branch/1.26

bradfitz/explicit_empty_test_3808

crawshaw/preservenetinfo

miriah-3808-reset-operator

dsnet/tsnet-logging

mihaip/wasm-taildrop

crawshaw/stunname

bradfitz/wasm_play

bradfitz/dot

bradfitz/tcp_flows

release-branch/1.24

raggi/netstack_fwd_close

bradfitz/netstack_fwd_close

merge-tag

cross-android

bradfitz/kmod

bradfitz/ssh_banner

bradfitz/ping

tom/integration

bradfitz/ssh_policy_earlier

bradfitz/derpy_cast

bradfitz/cli_admin

release-branch/1.22

aaron/go-ole-ref

bradfitz/key_rotation_prep

josh/tswebflags

release-branch/1.20

crawshaw/envtype

danderson/tsweb-server

bradfitz/autocert_force

bradfitz/use_netstack_upstream

Xe/winui-bugreport-without-tailscaled

bradfitz/hostinfo_basically_equal

release-branch/1.18

aaron/loglog

aaron/dnsapc

bradfitz/demo_client_hijack

bradfitz/windns

bradfitz/exit_node_forward_dns

bradfitz/1.18.1

Xe/tailtlsproxy

bradfitz/allsrc

josh/peermap

danderson/ebpf

bradfitz/1_16_stress_netmap

danderson/nodekey-move

danderson/nodekey-delete-old

danderson/nodekey-cleanup

danderson/magicsock-discokey

release-branch/1.16

danderson/magicsock-node-key

crawshaw/updatefallback

release-branch/1.14

bradfitz/1.14

bradfitz/updates

josh/immutable-views

bradfitz/portmap_gh_actions

danderson/kernel-tailscale

bradfitz/win_default_route

release-branch/1.12

jknodt/logging

simenghe/add-tsmpping-call

josh/opt-getstatus

Aadi/speedtest-tailscaled

dsnet/admin-cli

bradfitz/portmap_test

jknodt/portmap_test

upnpdebug

jknodt/upnp_reuse

crawshaw/peerdoh

josh/debug-flake

simenghe/pingresult-work

jknodt/derp_flow

tps/tailscaled

jknodt/vms_ref

jknodt/integ_test

josh/fast-time

josh/coarsetime

bradfitz/derp_flow

release-branch/1.10

josh/io_uring

josh/deflake-pipe-again

Xe/testcontrol-v6

jknodt/io-uring

simenghe/admin-ping-test

jknodt/periodic_probe

simenghe/isoping

Xe/private-logcatcher-in-process

simenghe/tcpnodeping

bradfitz/deephash_methods

crawshaw/deephash

josh/de-select-tstun-wrapper

Xe/debug-nixos-build

simenghe/isoping-experiment

crawshaw/dnswslhackery

jknodt/userderp

jknodt/bw_rep2

crawshaw/wslresolvconf

jknodt/upnp

crawshaw/magicdnsalways

simenghe/flakeresolve

rec_in_use_after_5_sec

bradfitz/acme

release-branch/1.8

simenghe/add-httphandlers-ping

simenghe/add-ping-route-testcontrol-mux

simeng-pingtest

Xe/test-install-script-libvirtd

apenwarr/check184

crawshaw/newbackendserver

adding-address-ips-totestcontrolnode

onebinary

Xe/synology-does-actually-work-with-subnet-routes-til

bradfitz/netstack_port_map

bradfitz/demo_pinger

apenwarr/fixes

apenwarr/relogin

josh/NewIPPort

josh/IPWithPort

bradfitz/integration_tests

josh/opt-dp-wip

bradfitz/ping_notes

bradfitz/dropped_by_filter_logspam

bradfitz/netstack_drop_silent

bradfitz/log_rate_test

bradfitz/issue_1840_rebased_tree

bradfitz/issue_1849_rebased_tree

crawshaw/syno

apenwarr/statefix

apenwarr/statetest

josh/wip/endpoint-serialize

apenwarr/ioslogin

rosszurowski/cli-fix-typo

bradfitz/cli_pretty

bradfitz/win_delete_retry

bradfitz/sleep

naman/netstack-request-logging

naman/ephem-expand-range

bradfitz/macos_progress

bradfitz/ip_of

crawshaw/localapi404

crawshaw/movefiles

crawshaw/socket

crawshaw/cgi

naman/netstack-subnet-routing

josh/wip/create-endpoint-no-public-key

Xe/log-target-registry-key

release-branch/1.6

bradfitz/ipv6_link_local_strip

bradfitz/darwin_gw

Xe/disallow-local-ip-for-exit-node

release-branch/1.4

crawshaw/upjson

bradfitz/proposed_1.4.6

bradfitz/derp_steer

crawshaw/tailscalestatus

Xe/reset-logid-on-logout-login

naman/netstack-incoming

mkramlich/macos-brew2

naman/netstack-outgoing-udp-test

mkramlich/macos-brew

bradfitz/proposed-1.4.5

peske/ifacewatcher

Xe/hello-vr

crawshaw/filchsync

Xe/derphttp-panic-fix

peske/elnotfound

Xe/rel-144-fix-ipv6-broken-in-tests

bradfitz/darwin_creds

josh/longblock

josh/udp-alloc-less

josh/simplify-filch

josh/remove-ipcgetfilter

Xe/envvar-name-TS

Xe/TS-envvar-name

Xe/do-windows-logserver-better

Xe/log-target-flag

crawshaw/ipuint

bradfitz/hello

bradfitz/linux_v6_off

bradfitz/call_me_maybe_eps

bradfitz/api_docs

alexbrainman/use_wg_dns_code

naman/netstack-use-tailscale-ip

josh/debug-TestLikelyHomeRouterIPSyscallExec

noerror-not-notimp

bradfitz/umaskless_permissions

naman/netstack-bump-version

bradfitz/lite_endpoint_update

c22wen/api-docs

bradfitz/grafana_auth_proxy

crawshaw/dnsguid

nix-shell

release-branch/1.2

bradfitz/acl_tags_in_tailscale_status

bradfitz/expiry_spin

josh/no-goroutine-per-udp-read-2

crawshaw/tailcfg

bradfitz/wgengine_monitor_windows_take2

netstat-unsafe

bradfitz/ipn_empty

bradfitz/win_firewall_async

bradfitz/machine_key

apenwarr/faketun

crawshaw/cloner

crawshaw/jsonhandler

c22wen/route-addr

c22wen/magicsock.go

bradfitz/gvisor_netstack

crawshaw/loadtest

dshynkev/dns-autoset

crawshaw/e2etest

bradfitz/win_wpad_pac

release-branch/1.0

bradfitz/linux_default_route_interface

bradfitz/release-branch-1.0

crawshaw/restartlimit

clone

dshynkev/dns-name

dshynkev/dns-refactor

bradfitz/go_vet

crawshaw/tswebextra

crawshaw/pinger2

lzjluzijie/all_proxy

rate-limiting

lzjluzijie/227_http_proxy

crawshaw/rebind

crawshaw/hostinfo

crawshaw/derp-nokeepalives

crawshaw/derptimeout

crawshaw/derpdial2

crawshaw/derpdial

crawshaw/ipn

crawshaw/e2e_test

crawshaw/ipn2

crawshaw/magicsock

crawshaw/magicsock-infping

crawshaw/spray

crawshaw/br1

v1.68.1

v1.68.0

v1.66.4

v1.66.3

v1.66.2

v1.66.1

v1.66.0

v1.64.2

v1.64.1

v1.64.0

v1.62.1

v1.62.0

v1.60.1

v1.60.0

v1.58.2

v1.58.1

v1.58.0

v1.44.3

v1.56.1

v1.56.0

v1.54.1

v1.54.0

v1.52.1

v1.52.0

v1.50.1

v1.50.0

v1.48.2

v1.48.1

v1.48.0

v1.46.1

v1.46.0

v1.44.2

v1.44.0

v1.42.1

v1.42.0

v1.40.1

v1.40.0

v1.38.4

v1.38.3

v1.38.2

v1.38.1

v1.38.0

v1.36.2

v1.36.1

v1.36.0

v1.34.2

v1.34.1

v1.34.0

v1.32.3

v1.32.2

v1.32.1

v1.32.0

v1.30.2

v1.30.1

v1.30.0

v1.28.0

v1.26.2

v1.26.1

v1.26.0

v1.24.2

v1.24.1

v1.24.0

v1.22.2

v1.22.1

v1.22.0

v1.20.4

v1.20.3

v1.20.2

v1.20.1

v1.20.0

v1.18.2

v1.18.1

v1.18.0

v1.16.2

v1.16.1

v1.16.0

v1.14.6

v1.14.5

v1.14.4

v1.14.3

v1.14.0

v1.12.4

v1.12.3

v1.12.2

v1.12.1

v1.12.0

v1.10.2

v1.10.1

v1.10.0

v1.8.8

v1.8.7

v1.8.6

v1.8.5

v1.8.4

v1.8.3

v1.8.2

v1.8.1

v1.8.0

v1.6.0

v1.4.6

v1.4.5

v1.4.4

v1.4.3

v1.4.2

v1.4.1

v1.4.0

v1.2.10

v1.2.9

v1.2.8

v1.2.7

v1.2.6

v1.2.5

v1.2.3

v1.2.2

v1.2.1

v1.2.0

v1.0.5

v1.0.4

v1.0.3

v1.0.2

v1.0.1

v1.1.0

v1.0.0

v0.100.0

v0.99.1

v0.99.0

v0.98.1

v0.98

v0.98.0

v0.97

v0.96.1

v0.96

coral-gitops

gitops-1.30.0

gitops-1.58.2

nginx-auth-0.1.2

v0.100.0-107

v0.100.0-153

v1.61.0-pre

v1.63.0-pre

v1.65.0-pre

v1.67.0-pre

v1.69.0-pre

Commit Graph

Author	SHA1	Message	Date
Aaron Klotz	7adf15f90e	cmd/tailscale/cli, util/winutil/authenticode: flesh out authenticode support Previously, tailscale upgrade was doing the bare minimum for checking authenticode signatures via `WinVerifyTrustEx`. This is fine, but we can do better: * WinVerifyTrustEx verifies that the binary's signature is valid, but it doesn't determine whose signature is valid; tailscale upgrade should also ensure that the binary is actually signed by us. * I added the ability to check the signatures of MSI files. * In future PRs I will be adding diagnostic logging that lists details about every module (ie, DLL) loaded into our process. As part of that metadata, I want to be able to extract information about who signed the binaries. This code is modelled on some C++ I wrote for Firefox back in the day. See https://searchfox.org/mozilla-central/rev/27e4816536c891d85d63695025f2549fd7976392/toolkit/xre/dllservices/mozglue/Authenticode.cpp for reference. Fixes #8284 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	11 months ago

Author

SHA1

Message

Date

Aaron Klotz

7adf15f90e

cmd/tailscale/cli, util/winutil/authenticode: flesh out authenticode support

Previously, tailscale upgrade was doing the bare minimum for checking
authenticode signatures via `WinVerifyTrustEx`. This is fine, but we can do
better:

* WinVerifyTrustEx verifies that the binary's signature is valid, but it doesn't
  determine *whose* signature is valid; tailscale upgrade should also ensure that
  the binary is actually signed *by us*.
* I added the ability to check the signatures of MSI files.
* In future PRs I will be adding diagnostic logging that lists details about
  every module (ie, DLL) loaded into our process. As part of that metadata, I
  want to be able to extract information about who signed the binaries.

This code is modelled on some C++ I wrote for Firefox back in the day. See
https://searchfox.org/mozilla-central/rev/27e4816536c891d85d63695025f2549fd7976392/toolkit/xre/dllservices/mozglue/Authenticode.cpp
for reference.

Fixes #8284

Signed-off-by: Aaron Klotz <aaron@tailscale.com>

1 Commits (main)