mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-15 01:53:08 -04:00
6a635c4e55
The conn25 extension's ExtraWireGuardAllowedIPs hook (Transit IPs) was only appended to wgcfg.Config.Peers in authReconfig. Now that outbound peer selection comes from the route manager's outbound table via the engine's PeerByIPPacketFunc (which, when installed, replaces wireguard-go's AllowedIPs trie lookup entirely) and lazily created peers get their allowed IPs from the route manager via the engine's peer config func, those extras never reached either path: outbound packets to Transit IPs matched no peer, and lazily created peers didn't accept inbound Transit IP sources. Teach the route manager a per-peer set of extra allowed IPs, staged by Mutation.SetExtraAllowedIPs. They appear in the outbound table and in PeerAllowedIPs (so both outbound routing and per-peer allowed source prefixes see them) but are excluded from the OS route set, preserving the hook's contract that the extras reach WireGuard but not the OS routing table. authReconfig now feeds the hook's results into the route manager and incrementally syncs any changed peers to the WireGuard device; the append to cfg.Peers remains only so Reconfig's full per-peer device sync doesn't strip the extras from active peers, and goes away with Config.Peers. Updates #12542 Change-Id: I06c8fa30929fbf8fe171a2d34c47c6fcc3abfa16 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>