F26-TS: Yes
Rationale
The regional DERP mesh provides a bounded transit-authorization boundary. handleFrameForwardPacket rejects callers without canMesh before receiving and forwarding the inner packet. canMesh is derived from isMeshPeer, which requires a supplied nonzero mesh key matching the server key. The DERP architecture documents meshed servers in managed regions. This protects the receiving relay-to-client onward link against unauthorized mesh ForwardPacket injection; local forwarding authority meets F26 without exposing the final application identity.
Assessment method
Broad primary-source and pinned-code review; no new runtime test
Source context
Round 597 primary-source review
Outstanding qualification
Source-level inference for the regional mesh role, not a production configuration audit. It does not establish ordinary leaf SendPacket admission, enforcement of tailnet grants by DERP, protection of already traversed ingress links, or containment of admitted malicious clients/mesh peers. No bandwidth benchmark was run.
Public sources
- https://github.com/tailscale/tailscale/blob/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/derp/derpserver/derpserver.go
- https://github.com/tailscale/tailscale/blob/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/derp/README.md
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round597.html
- round597-sources.json