starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] Taildrop between un-tagged and tagged nodes works #964

New Issue
Closed
opened 2025-12-29 02:26:47 +01:00 by adam · 1 comment
adam commented 2025-12-29 02:26:47 +01:00
Owner
Copy Link

Originally created by @lukaslindnermusic on GitHub (Mar 4, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

I just tried to send a file from my vps (that has the tag tag:server) to my macbook (that has no tags assigned). And it worked. Without any intervention, it straightup placed the file in my Downloads folder.
The server-tagged devices are not allowed to talk to my personal devices, but fine, Taildrop ignores ACLs. But as it mentions in the docs, that you cannot use Taildrop to send files to and from nodes you have tagged., I think that this is a bug.

Can anyone reproduce this?

Expected Behavior

According to https://tailscale.com/kb/1106/taildrop, Taildrop permits you to share files between devices that you are logged in to, even if ACLs are used to restrict access to the devices. You cannot use Taildrop to send files to and from nodes you have tagged..

Therefore, it should not be possible to send files from tagged nodes to un-tagged nodes and vice versa.

(It also would be amazing if there could be a flag in the config to disable Taildrop completely, as this is also possible to disable in the Tailscale Admin Console. I will create a separate feature request for that.)

Steps To Reproduce

  1. Access a node that has a tag assigned.
  2. Prepare the tailnet ip of a target device without tags.
  3. Use sudo tailscale file cp <yourfile.png> <target-ip>:
  4. If the target is linux, use sudo tailscale file get to see, if it arrives. on macOS it should already land in the Downloads folder right away.

Environment

- OS: Ubuntu 24.04
- Headscale version: v0.25.1
- Tailscale version: 1.80.2 / 1.80.1

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

No response

Originally created by @lukaslindnermusic on GitHub (Mar 4, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior I just tried to send a file from my vps (that has the tag `tag:server`) to my macbook (that has no tags assigned). And it worked. Without any intervention, it straightup placed the file in my Downloads folder. The server-tagged devices are not allowed to talk to my personal devices, but fine, Taildrop ignores ACLs. But as it mentions in the docs, that you `cannot use Taildrop to send files to and from nodes you have tagged.`, I think that this is a bug. Can anyone reproduce this? ### Expected Behavior According to https://tailscale.com/kb/1106/taildrop, `Taildrop permits you to share files between devices that you are logged in to, even if ACLs are used to restrict access to the devices. You cannot use Taildrop to send files to and from nodes you have tagged.`. Therefore, it should not be possible to send files from tagged nodes to un-tagged nodes and vice versa. (It also would be amazing if there could be a flag in the config to disable Taildrop completely, as this is also possible to disable in the Tailscale Admin Console. I will create a separate feature request for that.) ### Steps To Reproduce 1. Access a node that has a tag assigned. 2. Prepare the tailnet ip of a target device without tags. 3. Use `sudo tailscale file cp <yourfile.png> <target-ip>:` 4. If the target is linux, use `sudo tailscale file get` to see, if it arrives. on macOS it should already land in the Downloads folder right away. ### Environment ```markdown - OS: Ubuntu 24.04 - Headscale version: v0.25.1 - Tailscale version: 1.80.2 / 1.80.1 ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [ ] Headscale runs in a container ### Anything else? _No response_
adam added the bugtailscale-feature-gapno-stale-bottags labels 2025-12-29 02:26:47 +01:00
adam closed this issue 2025-12-29 02:26:47 +01:00
adam commented 2025-12-29 02:26:48 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Mar 16, 2025):

You are right, this does not conform with upstream, I've attached this to our tags tracking bug, the plan is to go over the whole tag system as it is broken in several ways.

@kradalby commented on GitHub (Mar 16, 2025): You are right, this does not conform with upstream, I've attached this to our tags tracking bug, the plan is to go over the whole tag system as it is broken in several ways.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug no-stale-bot tags tailscale-feature-gap
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#964
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?