You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/wgengine
Christine Dodrill b89c757817 wgengine/tsdns: explicitly reject .onion lookups
Tor has a location-hidden service feature that enables users to host services
from inside the Tor network. Each of these gets a unique DNS name that ends with
.onion. As it stands now, if a misbehaving application somehow manages to make
a .onion DNS request to our DNS server, we will forward that to the DNS server,
which could leak that to malicious third parties. See the recent bug Brave had
with this[1] for more context.

RFC 7686 suggests that name resolution APIs and libraries MUST respond with
NXDOMAIN unless they can actually handle Tor lookups. We can't handle .onion
lookups, so we reject them.

[1]: https://twitter.com/albinowax/status/1362737949872431108

Fixes tailscale/corp#1351

Signed-off-by: Christine Dodrill <xe@tailscale.com>
5 years ago
..
filter wgengine/filter: use IPSet for localNets instead of prefixes. 5 years ago
magicsock wgengine/magicsock: remove TODO about endpoints-over-DERP 5 years ago
monitor wgengine/monitor: make Darwin monitor shut down cleanly, add test 5 years ago
netstack wgengine/netstack: fix 32-bit build broken from prior commit 5 years ago
router wgengine/router: toggle killswitch when using default routes on windows. 5 years ago
tsdns wgengine/tsdns: explicitly reject .onion lookups 5 years ago
tstun wgengine/filter: use IPSet for localNets instead of prefixes. 5 years ago
wgcfg ipn/ipnlocal: only filter out default routes when computing the local wg config. 5 years ago
wglog wgengine/wglog: drop 1/s "interface is up" messages. 5 years ago
winnet wgengine/winnet: don't build on non-windows 5 years ago
ifstatus_noop.go wgengine: make NewUserspaceEngine wait for TUN interface to be up on Windows 5 years ago
ifstatus_windows.go wgengine: make NewUserspaceEngine wait for TUN interface to be up on Windows 5 years ago
pendopen.go ipn: split LocalBackend off into new ipn/ipnlocal package 5 years ago
userspace.go wgengine: fix bug from earlier commit 5 years ago
userspace_test.go cmd/tailscaled, wgengine: remove --fake, replace with netstack 5 years ago
watchdog.go wgengine{,/monitor}: move interface state fetching/comparing to monitor 5 years ago
watchdog_test.go cmd/tailscaled, wgengine: remove --fake, replace with netstack 5 years ago
wgengine.go wgengine{,/monitor}: move interface state fetching/comparing to monitor 5 years ago