You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/types/key
Simon Law 3ee4c60ff0
cmd/derper: fix mesh auth for DERP servers (#16061)
To authenticate mesh keys, the DERP servers used a simple == comparison,
which is susceptible to a side channel timing attack.

By extracting the mesh key for a DERP server, an attacker could DoS it
by forcing disconnects using derp.Client.ClosePeer. They could also
enumerate the public Wireguard keys, IP addresses and ports for nodes
connected to that DERP server.

DERP servers configured without mesh keys deny all such requests.

This patch also extracts the mesh key logic into key.DERPMesh, to
prevent this from happening again.

Security bulletin: https://tailscale.com/security-bulletins#ts-2025-003

Fixes tailscale/corp#28720

Signed-off-by: Simon Law <sfllaw@tailscale.com>
7 months ago
..
chal.go all: implement AppendText alongside MarshalText (#9207) 2 years ago
control.go all: update copyright and license headers 3 years ago
control_test.go all: update copyright and license headers 3 years ago
derp.go cmd/derper: fix mesh auth for DERP servers (#16061) 7 months ago
derp_test.go cmd/derper: fix mesh auth for DERP servers (#16061) 7 months ago
disco.go wgengine/magicsock: implement probing of UDP path lifetime (#10844) 2 years ago
disco_test.go all: update copyright and license headers 3 years ago
doc.go all: add test for package comments, fix, add comments as needed 1 year ago
machine.go all: implement AppendText alongside MarshalText (#9207) 2 years ago
machine_test.go all: update copyright and license headers 3 years ago
nl.go types/key: use tlpub: in error message (#13707) 1 year ago
nl_test.go all: update copyright and license headers 3 years ago
node.go types/key: remove copy returning array by value 2 years ago
node_test.go all: use Go 1.22 range-over-int 2 years ago
util.go all: use new AppendEncode methods available in Go 1.22 (#11079) 2 years ago
util_test.go all: use Go 1.22 range-over-int 2 years ago