starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2642] [MERGED] Fix /machine/map endpoint vulnerability #2777

New Issue
Closed
opened 2025-12-29 04:18:56 +01:00 by adam · 0 comments
adam commented 2025-12-29 04:18:56 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2642
Author: @Thifhi
Created: 6/5/2025
Status: ✅ Merged
Merged: 6/6/2025
Merged by: @kradalby

Base: main ← Head: improve-map-auth

📝 Commits (6)

  • ae30020 Improve map auth logic
  • 7610e8c Bugfix
  • fe97600 Add comment, improve error message
  • e03ec31 noise: make func, get by node
  • 84337b5 noise: add comment to remind future use of getAndVal
  • 339a9cf changelog: add entry

📊 Changes

2 files changed (+35 additions, -8 deletions)

View changed files

📝 CHANGELOG.md (+8 -0)
📝 hscontrol/noise.go (+27 -8)

📄 Description

Current Behavior

POST /machine/map requests are processed by extracting the Node from the public NodeKey provided in the request, without any additional verification. This allows an attacker who possesses the public key of any Node in the network to:

  1. Establish a Noise connection using a new machine key,
  2. Submit a MapRequest containing a NodeKey that does not belong to them, and
  3. Receive a stream of MapResponses.

As a result, the attacker can learn sensitive details about the entire Tailnet.

Problem

The current approach implicitly trusts the NodeKey in the request, even though the client has not proven ownership of its corresponding private key.

Proposed Change

Instead, we should retrieve the Node based on the machine key used in the Noise connection, as the client must possess the corresponding private key to establish the session. This provides proper authentication and matches the behavior of Tailscale servers. This is what Tailscale control plane returns in this case:
image

  • have read the CONTRIBUTING.md file
  • raised a GitHub issue or discussed it on the projects chat beforehand
  • added unit tests
  • added integration tests
  • updated documentation if needed
  • updated CHANGELOG.md

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2642 **Author:** [@Thifhi](https://github.com/Thifhi) **Created:** 6/5/2025 **Status:** ✅ Merged **Merged:** 6/6/2025 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `improve-map-auth` --- ### 📝 Commits (6) - [`ae30020`](https://github.com/juanfont/headscale/commit/ae30020b22ff280340a8c9e4c265de35ceaf8722) Improve map auth logic - [`7610e8c`](https://github.com/juanfont/headscale/commit/7610e8c39854c291e08732579a01e684e52fa7b8) Bugfix - [`fe97600`](https://github.com/juanfont/headscale/commit/fe97600c886437731e64ec21cb724086be6cb5dd) Add comment, improve error message - [`e03ec31`](https://github.com/juanfont/headscale/commit/e03ec310ed4408a6e85bf89b6568fb7537427438) noise: make func, get by node - [`84337b5`](https://github.com/juanfont/headscale/commit/84337b5ced04fd5de18d9e67e7d5658be124499d) noise: add comment to remind future use of getAndVal - [`339a9cf`](https://github.com/juanfont/headscale/commit/339a9cfcdcb4d4a23becb803ced8dc754ffc5a12) changelog: add entry ### 📊 Changes **2 files changed** (+35 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+8 -0) 📝 `hscontrol/noise.go` (+27 -8) </details> ### 📄 Description ### Current Behavior `POST /machine/map` requests are processed by extracting the Node from the public `NodeKey` provided in the request, without any additional verification. This allows an attacker who possesses the public key of any Node in the network to: 1. Establish a Noise connection using a new machine key, 2. Submit a `MapRequest` containing a `NodeKey` that does not belong to them, and 3. Receive a stream of `MapResponse`s. As a result, the attacker can learn sensitive details about the entire Tailnet. ### Problem The current approach implicitly trusts the `NodeKey` in the request, even though the client has not proven ownership of its corresponding private key. ### Proposed Change Instead, we should retrieve the Node based on the machine key used in the Noise connection, as the client must possess the corresponding private key to establish the session. This provides proper authentication and matches the behavior of Tailscale servers. This is what Tailscale control plane returns in this case: ![image](https://github.com/user-attachments/assets/179c34b3-06dd-491c-8957-d88afe223d27) <!-- Please tick if the following things apply. You… --> - [x] have read the [CONTRIBUTING.md](./CONTRIBUTING.md) file - [ ] raised a GitHub issue or discussed it on the projects chat beforehand - [ ] added unit tests - [ ] added integration tests - [ ] updated documentation if needed - [ ] updated CHANGELOG.md <!-- If applicable, please reference the issue using `Fixes #XXX` and add tests to cover your new code. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 04:18:56 +01:00
adam closed this issue 2025-12-29 04:18:56 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2777
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?