net/dns: use os.Root to prevent path traversal in darwin resolver

The darwinConfigurator writes split DNS resolver files to
/etc/resolver/$SUFFIX using os.WriteFile with string concatenation.
A crafted MatchDomain value containing path traversal sequences
(e.g. "../evil") could write files outside the resolver directory.

Use os.OpenRoot to confine all file operations in SetDNS and
removeResolverFiles to the resolver directory. os.Root rejects any
path component that escapes the root, returning an error instead of
following the traversal.

Also parametrize the resolver directory path on the struct to enable
testing with t.TempDir(), and add tests.

As far as I can tell, this would require a malicious controlplane to
exploit, but still worth fixing.

Updates tailscale/corp#39751

Signed-off-by: Andrew Dunham <andrew@tailscale.com>

net/dns/manager_darwin.go

@@ -5,7 +5,10 @@ package dns
 
 import (
 	"bytes"
+	"fmt"
+	"io/fs"
 	"os"
+	"strings"
 
 	"go4.org/mem"
 	"tailscale.com/control/controlknobs"
@@ -22,15 +25,22 @@ import (
 //
 // The health tracker, bus and the knobs may be nil and are ignored on this platform.
 func NewOSConfigurator(logf logger.Logf, _ *health.Tracker, _ *eventbus.Bus, _ policyclient.Client, _ *controlknobs.Knobs, ifName string) (OSConfigurator, error) {
-	return &darwinConfigurator{logf: logf, ifName: ifName}, nil
+	return &darwinConfigurator{
+		logf:           logf,
+		ifName:         ifName,
+		resolverDir:    "/etc/resolver",
+		resolvConfPath: "/etc/resolv.conf",
+	}, nil
 }
 
 // darwinConfigurator is the tailscaled-on-macOS DNS OS configurator that
 // maintains the Split DNS nameserver entries pointing MagicDNS DNS suffixes
 // to 100.100.100.100 using the macOS /etc/resolver/$SUFFIX files.
 type darwinConfigurator struct {
-	logf   logger.Logf
-	ifName string
+	logf           logger.Logf
+	ifName         string
+	resolverDir    string // default "/etc/resolver"
+	resolvConfPath string // default "/etc/resolv.conf"
 }
 
 func (c *darwinConfigurator) Close() error {
@@ -51,10 +61,16 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 		buf.WriteString("\n")
 	}
 
-	if err := os.MkdirAll("/etc/resolver", 0755); err != nil {
+	if err := os.MkdirAll(c.resolverDir, 0755); err != nil {
 		return err
 	}
 
+	root, err := os.OpenRoot(c.resolverDir)
+	if err != nil {
+		return err
+	}
+	defer root.Close()
+
 	var keep map[string]bool
 
 	// Add a dummy file to /etc/resolver with a "search ..." directive if we have
@@ -70,7 +86,7 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 			sbuf.WriteString(string(d.WithoutTrailingDot()))
 		}
 		sbuf.WriteString("\n")
-		if err := os.WriteFile("/etc/resolver/"+searchFile, sbuf.Bytes(), 0644); err != nil {
+		if err := root.WriteFile(searchFile, sbuf.Bytes(), 0644); err != nil {
 			return err
 		}
 	}
@@ -78,15 +94,34 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 	for _, d := range cfg.MatchDomains {
 		fileBase := string(d.WithoutTrailingDot())
 		mak.Set(&keep, fileBase, true)
-		fullPath := "/etc/resolver/" + fileBase
 
-		if err := os.WriteFile(fullPath, buf.Bytes(), 0644); err != nil {
+		if !isValidResolverFileName(fileBase) {
+			c.logf("[unexpected] invalid resolver domain %q with slashes or colons", fileBase)
+			return fmt.Errorf("invalid resolver domain %q: must not contain slashes or colons", fileBase)
+		}
+
+		if err := root.WriteFile(fileBase, buf.Bytes(), 0644); err != nil {
 			return err
 		}
 	}
 	return c.removeResolverFiles(func(domain string) bool { return !keep[domain] })
 }
 
+func isValidResolverFileName(name string) bool {
+	// Verify that the filename doesn't contain any characters that
+	// might cause issues when used as a filename; os.Root is a
+	// defense against path traversal, but prefer a nice error here
+	// if we can. These aren't valid for domain names anyway.
+	if strings.Contains(name, "/") || strings.Contains(name, "\\") {
+		return false
+	}
+
+	if strings.Contains(name, ":") {
+		return false
+	}
+	return true
+}
+
 // GetBaseConfig returns the current OS DNS configuration, extracting it from /etc/resolv.conf.
 // We should really be using the SystemConfiguration framework to get this information, as this
 // is not a stable public API, and is provided mostly as a compatibility effort with Unix
@@ -95,9 +130,9 @@ func (c *darwinConfigurator) SetDNS(cfg OSConfig) error {
 func (c *darwinConfigurator) GetBaseConfig() (OSConfig, error) {
 	cfg := OSConfig{}
 
-	resolvConf, err := resolvconffile.ParseFile("/etc/resolv.conf")
+	resolvConf, err := resolvconffile.ParseFile(c.resolvConfPath)
 	if err != nil {
-		c.logf("failed to parse /etc/resolv.conf: %v", err)
+		c.logf("failed to parse %s: %v", c.resolvConfPath, err)
 		return cfg, ErrGetBaseConfigNotSupported
 	}
 
@@ -113,7 +148,7 @@ func (c *darwinConfigurator) GetBaseConfig() (OSConfig, error) {
 
 	if len(cfg.Nameservers) == 0 {
 		// Log a warning in case we couldn't find any nameservers in /etc/resolv.conf.
-		c.logf("no nameservers found in /etc/resolv.conf, DNS resolution might fail")
+		c.logf("no nameservers found in %s, DNS resolution might fail", c.resolvConfPath)
 	}
 
 	return cfg, nil
@@ -124,13 +159,19 @@ const macResolverFileHeader = "# Added by tailscaled\n"
 // removeResolverFiles deletes all files in /etc/resolver for which the shouldDelete
 // func returns true.
 func (c *darwinConfigurator) removeResolverFiles(shouldDelete func(domain string) bool) error {
-	dents, err := os.ReadDir("/etc/resolver")
+	root, err := os.OpenRoot(c.resolverDir)
 	if os.IsNotExist(err) {
 		return nil
 	}
 	if err != nil {
 		return err
 	}
+	defer root.Close()
+
+	dents, err := fs.ReadDir(root.FS(), ".")
+	if err != nil {
+		return err
+	}
 	for _, de := range dents {
 		if !de.Type().IsRegular() {
 			continue
@@ -139,8 +180,7 @@ func (c *darwinConfigurator) removeResolverFiles(shouldDelete func(domain string
 		if !shouldDelete(name) {
 			continue
 		}
-		fullPath := "/etc/resolver/" + name
-		contents, err := os.ReadFile(fullPath)
+		contents, err := root.ReadFile(name)
 		if err != nil {
 			if os.IsNotExist(err) { // race?
 				continue
@@ -150,7 +190,7 @@ func (c *darwinConfigurator) removeResolverFiles(shouldDelete func(domain string
 		if !mem.HasPrefix(mem.B(contents), mem.S(macResolverFileHeader)) {
 			continue
 		}
-		if err := os.Remove(fullPath); err != nil {
+		if err := root.Remove(name); err != nil {
 			return err
 		}
 	}