Tailscale security vulnerability

[Aubermean]

With the latest version of Tailscale, you might need to add --stateful-filtering=false - especially if you are using an exit node. See the release notes for v1.66.0

https://github.com/tailscale/tailscale/releases

I don't have an account to post to the forum.

[Admonstrator]

This must be done by GL.iNet, the update script does not modify the startup scripts.

[Aubermean]

GL.iNet does not (and likely will not) provide stable Tailscale support, it'll probably be a century before they update Tailscale, so I thought it would be smarter to report it here. It eluded me for ages today trying to figure out why suddenly everything was broken - hopefully might save someone some time. Thanks for the updater!

[Admonstrator]

I'll talk to them to adjust the tailscale integration script.

[Aubermean]

It's only relevant to the latest version, that flag isn't available in older versions. Tailscale did some server side mitigation too but it's unclear if that will have any effect on older versions, or with mixed client versions. I was also having issues after upgrading my macOS Tailscale version while the router version stayed the same. For now Tailscale are just suggesting everyone upgrade in general. The risk in particular is to Linux and site to site networking.

[Admonstrator]

Guess it's just Tunnelvision mitigation - which is a risk indeed; but not as bad as people think.

I will think about a way to add the parameter to the script somehow.

[Aubermean]

The parameter itself is basically disabling their clientside mitigation. Anyway whether or not it is ever actively exploited, the greater issue/frustration/risk is 24 hours of head scratching why suddenly your whole network isn't working properly :)

So I think even just a warning/explainer so people stumble via Google to a solution sooner rather than later, is all the help anyone will need! Upgrading might randomly break things and the solution (until now) was a little burried.

[Admonstrator]

So should it be enabled or disabled by default?

Sorry, don't use Tailscale - team Zerotier 😄

[Aubermean]

For things to work as they used to, site-to-site stuff, in combination with an exit node (they support Mullvad natively) or acting as a exit node... it needs to be set. Without it things won't work. A warning or pointer to this fact, for 1.66 and up, is enough. Failing that hopefully this issue indexed on google will provide a solution. :)

[Aubermean]

I already found myself googling back to this solution now, as my router rebooted overnight and lost the tailscale set --stateful-filtering=false flag!

To run this on startup, is it best to use /etc/rc.local?

[Admonstrator]

I would assume you need to modify /etc/init.d/tailscale and add procd_append_param command --stateful-filtering=false within the start_service() function. But this needs to be tested.

[Admonstrator]

A fix was integrated to modify the gl_tailscale script - so active exit nodes should work again.

[Admonstrator]

I got a confirmation that it works now.