sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-19 23:11:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Fix lazy-conn exclusion for ingress forward peers

Browse Source 
peerRoutesAddr compared AllowedIPs (CIDR, e.g. a peer's overlay IP as /32)
against the unmasked TranslatedAddress string, so the match never fired and
forward-target peers were never excluded from lazy connections. Use prefix
containment so a routed address matches the peer's AllowedIP.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
riccardom
2026-07-06 11:03:17 +02:00
parent 460967d218
commit 22434897b6
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
client/internal/engine.go
View File

@@ -2580,7 +2580,11 @@ func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers
// peerRoutesAddr verifies if the peer is a router for a given address.
func peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
for _, allowedIP := range p.GetAllowedIps() {
if allowedIP == addr.String() {
prefix, err := netip.ParsePrefix(allowedIP)
if err != nil {
continue
}
if prefix.Contains(addr) {
return true
}
}