Merge remote-tracking branch 'origin/main' into proto-ipv6-overlay

PeerCapability is reported in PeerSystemMeta.capabilities on login/sync.
Management uses it instead of version gating to determine client features.
disableIPv6 in Flags lets users opt out of IPv6 overlay.

client/internal/acl/manager.go

@@ -216,6 +216,7 @@ func (d *DefaultManager) protoRuleToFirewallRule(
 	r *mgmProto.FirewallRule,
 	ipsetName string,
 ) (id.RuleID, []firewall.Rule, error) {
+	//nolint:staticcheck // PeerIP used for backward compatibility with old management
 	ip := net.ParseIP(r.PeerIP)
 	if ip == nil {
 		return "", nil, fmt.Errorf("invalid IP address, skipping firewall rule")

client/internal/debug/debug.go

@@ -1270,8 +1270,9 @@ func anonymizeFirewallRule(rule *mgmProto.FirewallRule, anonymizer *anonymize.An
 		return
 	}
 
+	//nolint:staticcheck // PeerIP used for backward compatibility
 	if addr, err := netip.ParseAddr(rule.PeerIP); err == nil {
-		rule.PeerIP = anonymizer.AnonymizeIP(addr).String()
+		rule.PeerIP = anonymizer.AnonymizeIP(addr).String() //nolint:staticcheck
 	}
 }
 

management/internals/shared/grpc/conversion.go

@@ -284,7 +284,8 @@ func toProtocolFirewallRules(rules []*types.FirewallRule) []*proto.FirewallRule
 
 		fwRule := &proto.FirewallRule{
 			PolicyID:  []byte(rule.PolicyID),
-			PeerIP:    rule.PeerIP,
+			PeerIP:    rule.PeerIP, //nolint:staticcheck // populated for backward compatibility
+
 			Direction: getProtoDirection(rule.Direction),
 			Action:    getProtoAction(rule.Action),
 			Protocol:  getProtoProtocol(rule.Protocol),

management/server/peer_test.go

@@ -1253,6 +1253,7 @@ func TestToSyncResponse(t *testing.T) {
 	assert.Equal(t, int64(53), response.NetworkMap.DNSConfig.NameServerGroups[0].NameServers[0].GetPort())
 	// assert network map Firewall
 	assert.Equal(t, 1, len(response.NetworkMap.FirewallRules))
+	//nolint:staticcheck // testing backward-compatible field
 	assert.Equal(t, "192.168.1.2", response.NetworkMap.FirewallRules[0].PeerIP)
 	assert.Equal(t, proto.RuleDirection_IN, response.NetworkMap.FirewallRules[0].Direction)
 	assert.Equal(t, proto.RuleAction_ACCEPT, response.NetworkMap.FirewallRules[0].Action)

shared/management/proto/management.proto

@@ -200,6 +200,18 @@ message Flags {
   bool enableSSHLocalPortForwarding = 13;
   bool enableSSHRemotePortForwarding = 14;
   bool disableSSHAuth = 15;
+
+  bool disableIPv6 = 16;
+}
+
+// PeerCapability represents a feature the client binary supports.
+// Reported in PeerSystemMeta.capabilities on every login/sync.
+enum PeerCapability {
+  PeerCapabilityUnknown = 0;
+  // Client reads SourcePrefixes instead of the deprecated PeerIP string.
+  PeerCapabilitySourcePrefixes = 1;
+  // Client handles IPv6 overlay addresses and firewall rules.
+  PeerCapabilityIPv6Overlay = 2;
 }
 
 // PeerSystemMeta is machine meta data like OS and version.
@@ -221,6 +233,8 @@ message PeerSystemMeta {
   Environment environment = 15;
   repeated File files = 16;
   Flags flags = 17;
+
+  repeated PeerCapability capabilities = 18;
 }
 
 message LoginResponse {
@@ -335,6 +349,9 @@ message PeerConfig {
 
   // Auto-update config
   AutoUpdateSettings autoUpdate = 8;
+
+  // IPv6 overlay address as compact bytes: 16 bytes IP + 1 byte prefix length.
+  bytes address_v6 = 9;
 }
 
 message AutoUpdateSettings {
@@ -567,7 +584,8 @@ enum RuleAction {
 
 // FirewallRule represents a firewall rule
 message FirewallRule {
-  string PeerIP = 1;
+  // Use sourcePrefixes instead.
+  string PeerIP = 1 [deprecated = true];
   RuleDirection Direction = 2;
   RuleAction Action = 3;
   RuleProtocol Protocol = 4;
@@ -576,6 +594,13 @@ message FirewallRule {
 
   // PolicyID is the ID of the policy that this rule belongs to
   bytes PolicyID = 7;
+
+  // CustomProtocol is a custom protocol ID when Protocol is CUSTOM.
+  uint32 customProtocol = 8;
+
+  // Compact source IP prefixes for this rule, supersedes PeerIP.
+  // Each entry is 5 bytes (v4) or 17 bytes (v6): [IP bytes][1 byte prefix_len].
+  repeated bytes sourcePrefixes = 9;
 }
 
 message NetworkAddress {

shared/netiputil/compact.go

@@ -0,0 +1,72 @@
+// Package netiputil provides compact binary encoding for IP prefixes used in
+// the management proto wire format.
+//
+// Format: [IP bytes][1 byte prefix_len]
+//   - IPv4: 5 bytes total (4 IP + 1 prefix_len, 0-32)
+//   - IPv6: 17 bytes total (16 IP + 1 prefix_len, 0-128)
+//
+// Address family is determined by length: 5 = v4, 17 = v6.
+package netiputil
+
+import (
+	"fmt"
+	"net/netip"
+)
+
+// EncodePrefix encodes a netip.Prefix into compact bytes.
+// The address is always unmapped before encoding.
+func EncodePrefix(p netip.Prefix) []byte {
+	addr := p.Addr().Unmap()
+	return append(addr.AsSlice(), byte(p.Bits()))
+}
+
+// DecodePrefix decodes compact bytes into a netip.Prefix.
+func DecodePrefix(b []byte) (netip.Prefix, error) {
+	switch len(b) {
+	case 5:
+		var ip4 [4]byte
+		copy(ip4[:], b)
+		bits := int(b[len(b)-1])
+		if bits > 32 {
+			return netip.Prefix{}, fmt.Errorf("invalid IPv4 prefix length %d (max 32)", bits)
+		}
+		return netip.PrefixFrom(netip.AddrFrom4(ip4), bits), nil
+	case 17:
+		var ip6 [16]byte
+		copy(ip6[:], b)
+		addr := netip.AddrFrom16(ip6).Unmap()
+		bits := int(b[len(b)-1])
+		if addr.Is4() {
+			if bits > 32 {
+				bits = 32
+			}
+		} else if bits > 128 {
+			return netip.Prefix{}, fmt.Errorf("invalid IPv6 prefix length %d (max 128)", bits)
+		}
+		return netip.PrefixFrom(addr, bits), nil
+	default:
+		return netip.Prefix{}, fmt.Errorf("invalid compact prefix length %d (expected 5 or 17)", len(b))
+	}
+}
+
+// EncodeAddr encodes a netip.Addr into compact prefix bytes with a host prefix
+// length (/32 for v4, /128 for v6). The address is always unmapped before encoding.
+func EncodeAddr(a netip.Addr) []byte {
+	a = a.Unmap()
+	bits := 128
+	if a.Is4() {
+		bits = 32
+	}
+	return EncodePrefix(netip.PrefixFrom(a, bits))
+}
+
+// DecodeAddr decodes compact prefix bytes and returns only the address,
+// discarding the prefix length. Useful when the prefix length is implied
+// (e.g. peer overlay IPs are always /32 or /128).
+func DecodeAddr(b []byte) (netip.Addr, error) {
+	p, err := DecodePrefix(b)
+	if err != nil {
+		return netip.Addr{}, err
+	}
+	return p.Addr(), nil
+}

shared/netiputil/compact_test.go

@@ -0,0 +1,143 @@
+package netiputil
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncodeDecodePrefix(t *testing.T) {
+	tests := []struct {
+		name   string
+		prefix string
+		size   int
+	}{
+		{
+			name:   "v4 host",
+			prefix: "100.64.0.1/32",
+			size:   5,
+		},
+		{
+			name:   "v4 network",
+			prefix: "10.0.0.0/8",
+			size:   5,
+		},
+		{
+			name:   "v4 default",
+			prefix: "0.0.0.0/0",
+			size:   5,
+		},
+		{
+			name:   "v6 host",
+			prefix: "fd00::1/128",
+			size:   17,
+		},
+		{
+			name:   "v6 network",
+			prefix: "fd00:1234:5678::/48",
+			size:   17,
+		},
+		{
+			name:   "v6 default",
+			prefix: "::/0",
+			size:   17,
+		},
+		{
+			name:   "v4 /16 overlay",
+			prefix: "100.64.0.1/16",
+			size:   5,
+		},
+		{
+			name:   "v6 /64 overlay",
+			prefix: "fd00::abcd:1/64",
+			size:   17,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := netip.MustParsePrefix(tt.prefix)
+			b := EncodePrefix(p)
+			assert.Equal(t, tt.size, len(b), "encoded size")
+
+			decoded, err := DecodePrefix(b)
+			require.NoError(t, err)
+			assert.Equal(t, p, decoded)
+		})
+	}
+}
+
+func TestEncodePrefixUnmaps(t *testing.T) {
+	// v4-mapped v6 address should encode as v4
+	mapped := netip.MustParsePrefix("::ffff:10.1.2.3/32")
+	b := EncodePrefix(mapped)
+	assert.Equal(t, 5, len(b), "v4-mapped should encode as 5 bytes")
+
+	decoded, err := DecodePrefix(b)
+	require.NoError(t, err)
+	assert.Equal(t, netip.MustParsePrefix("10.1.2.3/32"), decoded)
+}
+
+func TestDecodeAddr(t *testing.T) {
+	v4 := netip.MustParseAddr("100.64.0.5")
+	b := EncodeAddr(v4)
+	assert.Equal(t, 5, len(b))
+
+	got, err := DecodeAddr(b)
+	require.NoError(t, err)
+	assert.Equal(t, v4, got)
+
+	v6 := netip.MustParseAddr("fd00::1")
+	b = EncodeAddr(v6)
+	assert.Equal(t, 17, len(b))
+
+	got, err = DecodeAddr(b)
+	require.NoError(t, err)
+	assert.Equal(t, v6, got)
+}
+
+func TestDecodePrefixInvalidLength(t *testing.T) {
+	_, err := DecodePrefix([]byte{1, 2, 3})
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid compact prefix length 3")
+
+	_, err = DecodePrefix(nil)
+	assert.Error(t, err)
+
+	_, err = DecodePrefix([]byte{})
+	assert.Error(t, err)
+}
+
+func TestDecodePrefixInvalidBits(t *testing.T) {
+	// v4 with bits > 32
+	b := []byte{10, 0, 0, 1, 33}
+	_, err := DecodePrefix(b)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid IPv4 prefix length 33")
+
+	// v6 with bits > 128
+	b = make([]byte, 17)
+	b[0] = 0xfd
+	b[16] = 129
+	_, err = DecodePrefix(b)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid IPv6 prefix length 129")
+}
+
+func TestDecodePrefixUnmapsV6Input(t *testing.T) {
+	// If someone encodes a v4-mapped v6 as 17 bytes, decode should unmap it
+	// and clamp the prefix length to 32 for v4
+	addr := netip.MustParseAddr("::ffff:192.168.1.1")
+
+	raw := addr.As16()
+	b := make([]byte, 17)
+	copy(b, raw[:])
+	b[16] = 128
+
+	decoded, err := DecodePrefix(b)
+	require.NoError(t, err)
+	assert.True(t, decoded.Addr().Is4(), "should be unmapped to v4")
+	assert.Equal(t, netip.MustParsePrefix("192.168.1.1/32"), decoded)
+}