Fix protocol input validation

protocol/tailscale/dns_transport.go

@@ -186,16 +186,22 @@ func (t *DNSTransport) createResolver(directDialer func() N.Dialer, resolver *dn
 		myDialer = dialer.NewResolveDialer(t.ctx, myDialer, false, "", t.endpoint.queryOptions, 0)
 	}
 	if isHTTPScheme {
+		if serverURL.Hostname() == "" {
+			return nil, E.New("missing host in resolver address: ", resolver.Addr)
+		}
 		serverAddr := M.ParseSocksaddrHostPortStr(serverURL.Hostname(), serverURL.Port())
 		switch serverURL.Scheme {
 		case "https":
 			if serverAddr.Port == 0 {
 				serverAddr.Port = 443
 			}
-			tlsConfig := common.Must1(tls.NewClient(t.ctx, t.logger, serverAddr.AddrString(), option.OutboundTLSOptions{
+			tlsConfig, err := tls.NewClient(t.ctx, t.logger, serverAddr.AddrString(), option.OutboundTLSOptions{
 				Enabled: true,
 				ALPN:    []string{http2.NextProtoTLS, "http/1.1"},
-			}))
+			})
+			if err != nil {
+				return nil, E.Cause(err, "create TLS config for resolver ", resolver.Addr)
+			}
 			return transport.NewHTTPSRaw(t.TransportAdapter, t.logger, myDialer, serverURL, http.Header{}, serverAddr, tlsConfig), nil
 		case "http":
 			if serverAddr.Port == 0 {

protocol/tailscale/taildrop.go

@@ -361,7 +361,7 @@ func validateTaildropFileName(name string) error {
 
 var (
 	taildropExtensionSuffix = regexp.MustCompile(`(\.[a-zA-Z0-9]{0,3}[a-zA-Z][a-zA-Z0-9]{0,3})*$`)
-	taildropNumberSuffix    = regexp.MustCompile(` \([0-9]+\)`)
+	taildropNumberSuffix    = regexp.MustCompile(` \([0-9]+\)$`)
 )
 
 func nextFileName(name string) string {

protocol/tailscale/taildrop_send.go

@@ -55,7 +55,7 @@ func (t *Endpoint) SendTaildropFile(ctx context.Context, peerStableID string, fi
 	if !peer.Valid() {
 		return E.New("taildrop: peer not found: ", peerStableID)
 	}
-	if peer.Hostinfo().OS() == "tvOS" {
+	if !peer.Hostinfo().Valid() || peer.Hostinfo().OS() == "tvOS" {
 		return E.New("taildrop: peer cannot receive files")
 	}
 	if self.User() != peer.User() && !nodeBackend.PeerHasCap(peer, tailcfg.PeerCapabilityFileSharingTarget) {
@@ -187,7 +187,7 @@ func (t *Endpoint) taildropTargets() (canShareFiles bool, targets map[string]boo
 	}
 	targets = make(map[string]bool)
 	for _, peer := range nodeBackend.Peers() {
-		if !peer.Valid() || peer.Hostinfo().OS() == "tvOS" {
+		if !peer.Valid() || !peer.Hostinfo().Valid() || peer.Hostinfo().OS() == "tvOS" {
 			continue
 		}
 		if self.User() != peer.User() && !nodeBackend.PeerHasCap(peer, tailcfg.PeerCapabilityFileSharingTarget) {

protocol/tailscale/tailssh/server.go

@@ -334,6 +334,9 @@ func (s *Server) authenticate(ctx gliderssh.Context, conn gossh.ConnMetadata) (*
 func (s *Server) evaluatePolicy(policy *tailcfg.SSHPolicy, sshUser string, node tailcfg.NodeView, userProfile tailcfg.UserProfile, srcIP netip.Addr) (*sshConnInfo, error) {
 	now := time.Now()
 	for _, rule := range policy.Rules {
+		if rule == nil {
+			continue
+		}
 		if rule.RuleExpires != nil && now.After(*rule.RuleExpires) {
 			continue
 		}