tailcat: reject null regions and nodes in a ConnBlob - #52
Merged
Conversation
CBOR nulls decode to nil pointers, so a blob whose region or node array contained a null panicked when ParseConnBlob dereferenced it. Blobs come from untrusted places — a pasted address, or a "tailcat=" TXT record looked up from a DNS name — so that took down the process. Reject them with an error instead. ParseConnBlobRaw keeps returning the nulls: "tailcat parse" is a diagnostic for inspecting a broken blob. Fixes tailscale#51 Signed-off-by: Ho Geun Choi <ohyes9711@gmail.com>
bradfitz
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reject ConnBlobs whose region or node arrays contain a CBOR null, instead of panicking on the nil pointer. Fixes #51.
Details
CBOR nulls decode to nil pointers.
ParseConnBlobdereferenced the elements of both arrays without checking, so a blob with a null in either one crashed the process atwire.go:94orwire.go:100.Blobs are attacker-influenced:
addrBlobArgtreats a non-tcargument as a DNS name and takes thetailcat=TXT value as the blob, so the owner of a DNS name could crash a client. Callers cannot defend against it — the two call sites incmd/tailcatprobe withParseConnBloband testerr == nil, which a panic bypasses.This is the same class as #26, which rejected malformed public keys for the same reason; that change validated the key lengths but left the array elements unchecked. The error wording follows it.
ParseConnBlobRawis deliberately left permissive:tailcat parseis a diagnostic for inspecting a broken blob, so it keeps showing the nulls.Testing
TestParseConnBlobNullInArraysis the regression test: it panics before the change and passes after it.TestParseConnBlobRawKeepsNullspasses both before and after. It locks in the permissive raw path, so moving the validation earlier would fail visibly rather than silently changing whattailcat parseprints.go test ./...,go vet ./...,gofmtclean.