Mike Jensen 8dde70b8ca net/dns/{resolver,ipnlocal}: restrict reverse MagicDNS answers by source ...

A LAN-adjacent attacker can reach quad-100 on an IP-forwarding host and sweep the CGNAT range for reverse dns records to enumerate the responding node's peer set.

Restrict reverse (PTR) answers for Tailscale addresses (CGNAT plus ULA) to queries from loopback or the local peer node address only, refusing all other sources with REFUSED. Forward lookups, statics outside the Tailscale ranges, and exit-node/app-connector peer DNS are unchanged.

Fixes tailscale/corp#48229

Reported-by: @keeleysam
Change-Id: I2cf49c6cb2faa15fdde6a837b158b50cf449b26e
Signed-off-by: Mike Jensen <mikej@tailscale.com>

2026-09-22 12:30:31 -06:00

..

auditlog

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

conffile

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

desktop

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

ipnauth

ipnauth: set isUnixSock in the ts_omit_unixsocketidentity GetConnIdentity

2026-07-31 17:30:11 -07:00

ipnext

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

ipnlocal

net/dns/{resolver,ipnlocal}: restrict reverse MagicDNS answers by source

2026-09-22 12:30:31 -06:00

ipnserver

envknob: add SetenvForTest helper for safe environment variable handling

2026-08-19 12:22:26 +01:00

ipnstate

tailcfg: add Node.StableTailnetID and bump capver (#21314)

2026-09-16 14:28:46 -04:00

lapitest

ipn/ipnlocal: consolidate test-only LocalBackend methods behind ForTest

2026-06-27 16:11:42 -07:00

localapi

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

policy

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

backend_test.go

ipn, ipn/ipnlocal: remove Notify.NetMap, size initial status to subscription

2026-09-14 09:37:30 -07:00

backend.go

ipn, ipn/ipnlocal: remove Notify.NetMap, size initial status to subscription

2026-09-14 09:37:30 -07:00

conf_test.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

conf.go

ipn/conf: support RemoteConfig in the config file

2026-07-14 10:29:19 +02:00

doc.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_clone.go

tailcfg,tailcfg/{nodecap,selfcap}: split capability constants to their own packages (#20639)

2026-08-07 16:30:35 -07:00

ipn_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

ipn_view.go

wgengine/router/osrouter: add native FreeBSD routing, no-snat support

2026-08-31 20:31:01 -07:00

prefs_test.go

cmd/tailscale, ipn, feature/remoteconfig: add remote-config support

2026-07-07 12:10:34 -07:00

prefs.go

wgengine/router/osrouter: add native FreeBSD routing, no-snat support

2026-08-31 20:31:01 -07:00

serve_expand_test.go

ipn/ipnlocal,cmd/tailscale/cli: support unix socket targets for TCP serve

2026-07-16 09:13:38 -06:00

serve_test.go

cmd/tailscale: allow IPv6 localhost serve targets

2026-08-31 14:25:58 -07:00

serve.go

cmd/tailscale: allow IPv6 localhost serve targets

2026-08-31 14:25:58 -07:00

store_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

store.go

ipn/store: make WriteState(id, nil) delete key instead of adding nil entry (#19920)

2026-05-29 11:22:14 -07:00