mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-25 09:01:29 +02:00
bfc96ec9b5
The dial-time guard reported every non-public address as ErrPrivateHost, which the credential check reads as "this upstream cannot be reached from here, so save it unchecked". checkPublicHost has already cleared the target by the time anything is dialled, so an address refused at the socket is never the operator's upstream — it is a rebinding attempt, or an HTTP proxy the management server egresses through. A deployment behind such a proxy would install this feature and have it silently do nothing on every provider. It now reports an ordinary failure, which classifies as unreachable and blocks. Only the resolve-stage check still means "cannot be checked", and that one knows it is looking at the operator's own host. This is also why the three fixtures below passed locally and failed in CI: a sandbox that egresses through a loopback proxy skipped the check entirely, while CI reached the real api.openai.com and had the dummy key refused. They want a provider row rather than a working vendor, so they move to a private address and no longer depend on where a hostname resolves or whether the runner has egress.