TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-18 20:51:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/ipnlocal: restrict local lan access to linux machines.

Browse Source 
Signed-off-by: Maisem Ali <maisem@tailscale.com>
This commit is contained in:
Maisem Ali 2021-04-19 16:03:03 -07:00 committed by Maisem Ali
parent 8570f82c8b
commit 36fa29feec
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
ipn/ipnlocal/local.go
View File

@ -1861,16 +1861,19 @@ func (b *LocalBackend) routerConfig(cfg *wgcfg.Config, prefs *ipn.Prefs) *router
if !default6 { if !default6 {
rs.Routes = append(rs.Routes, ipv6Default) rs.Routes = append(rs.Routes, ipv6Default)
} }
ips, _, err := interfaceRoutes() if runtime.GOOS == "linux" {
if err != nil { // Only allow local lan access on linux machines for now.
b.logf("failed to discover interface ips: %v", err) ips, _, err := interfaceRoutes()
} if err != nil {
if prefs.ExitNodeAllowLANAccess { b.logf("failed to discover interface ips: %v", err)
rs.LocalRoutes = ips.Prefixes() }
} else { if prefs.ExitNodeAllowLANAccess {
// Explicitly add routes to the local network so that we do not rs.LocalRoutes = ips.Prefixes()
// leak any traffic. } else {
rs.Routes = append(rs.Routes, ips.Prefixes()...) // Explicitly add routes to the local network so that we do not
// leak any traffic.
rs.Routes = append(rs.Routes, ips.Prefixes()...)
}
} }
} }