mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-12 17:59:06 +02:00
mlsmaycon
1b6a9d86a0
The bootstrap check refused pinning onto a cluster another account runs, but nothing held that decision afterwards: a proxy registration consulted the proxies table alone, so the same host could be claimed by another account a moment later, or a week later, and the pin it stranded was immutable. Validating only at bootstrap meant the check was true when it ran and not after. Make the claim symmetric. IsClusterAddressAvailable now treats a gateway pin as what it is — a claim on the host, served by whichever proxy declares that address — and refuses a proxy from a different account, since an account-scoped proxy never receives another account's mappings and so cannot serve the pin it would displace. Both claims are checked in one place so a caller cannot consult one and forget the other. An account claiming the address its own gateway is pinned to is the documented order, not a conflict: pin first, deploy the proxy after. Shared (NetBird-operated) proxies register without an account and are unaffected; an account-scoped proxy reaching for a shared cluster address that accounts are pinned to was already refused by the proxy-row conflict and now stays refused even if those rows are momentarily gone. Whichever of the two lands first now wins and the second is refused, which is what the bootstrap check could not do on its own. A genuinely concurrent pair can still pass both checks — closing that needs an invariant spanning the proxies and settings tables, not a wider read.