c3df84e354
MatchFromFilterRule only read DstPorts[].IP into the destination IPSet. Cap-grant-only filter rules (e.g. tailscale.com/cap/relay) carry their destinations in CapGrant[].Dsts, so the derived matchers had empty dest sets and BuildPeerMap / ReduceNodes never exposed the cap target to its source nodes. Without a companion IP-level grant the relay node stayed invisible, so clients never tried to use it and connections sat on DERP. Union CapGrant[].Dsts into the destination IPSet alongside DstPorts. Restores peer-visibility for any cap-grant-only relationship; the peer-relay flow is the most visible instance. Fixes #3256 |
||
|---|---|---|
| .. | ||
| matcher | ||
| policyutil | ||
| v2 | ||
| pm.go | ||
| policy.go | ||
| policy_autoapprove_test.go | ||
| policy_route_approval_test.go | ||
| policy_test.go | ||
| route_approval_test.go | ||