mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-12 17:59:06 +02:00
mlsmaycon
d911649158
Proxies store their cluster address as they declared it, while proxy_address is normalised lowercase before validation. The capability and ownership lookups match cluster_address exactly, so feeding them the normalised form asked about a spelling the store may never have seen: a private cluster declared with capitals came back unproven and was refused, and — worse — another account's cluster declared with capitals came back as "never declared" and let the pin through. Compare identity on the normalised form but keep the stored spellings, and read the capability under each of them, any-true, the same way it aggregates over a cluster's proxies. Ownership gets the same treatment at the source: hostnames are case-insensitive, so two spellings of one host are one cluster and must conflict rather than being claimable side by side, which also closes the same gap in the proxy-registration availability check that shares the query. The e2e's wait for a stopped cluster to leave the active list now allows for the active window rather than 90s: a proxy that dies without closing its stream is only dropped once its last heartbeat ages past proxyActiveThreshold, so the old budget could fail the test on the slow path alone.