mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-14 06:48:32 -04:00
Brad Fitzpatrick
5186c3f41c
isAddressValid rejected all non-masquerade destination addresses whenever any masquerade address was set for the peer. With a v6-only masquerade pair, the peer's client still dials the v4 (native, not masqueraded) peerapi URL, so every fresh peerapi connection got a 403. The bug was masked by HTTP keep-alive: peerNode is snapshotted per connection, so connections established before the masquerade was configured kept validating against the old node view. It surfaced when a newer tailscale/go toolchain started closing idle netstack connections, forcing fresh peerapi connections and failing the TestNATPing v6=true NAT subtests with 403s. A masquerade address for one family says nothing about the other family, so require a masquerade address match only for the address family it applies to, and fall through to the self-addresses check for the other family. Fixes #21194 Change-Id: Idd2ed82b81e805b47b6aa6af4b5938984c6fa208 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>