From 97b3972c11062f1a0102f84767cd118ebb0424b1 Mon Sep 17 00:00:00 2001 From: Wade Simmons Date: Mon, 10 Nov 2025 13:52:40 -0500 Subject: [PATCH] honor remote_allow_list in hole punch response (#1186) * honor remote_allow_ilst in hole punch response When we receive a "hole punch notification" from a Lighthouse, we send a hole punch packet to every remote of that host, even if we don't include those remotes in our "remote_allow_list". Change the logic here to check if the remote IP is in our allow list before sending the hole punch packet. * fix for netip * cleanup --- lighthouse.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/lighthouse.go b/lighthouse.go index 9f00c391..4a191e6e 100644 --- a/lighthouse.go +++ b/lighthouse.go @@ -1337,12 +1337,19 @@ func (lhh *LightHouseHandler) handleHostPunchNotification(n *NebulaMeta, fromVpn } } + remoteAllowList := lhh.lh.GetRemoteAllowList() for _, a := range n.Details.V4AddrPorts { - punch(protoV4AddrPortToNetAddrPort(a), detailsVpnAddr) + b := protoV4AddrPortToNetAddrPort(a) + if remoteAllowList.Allow(detailsVpnAddr, b.Addr()) { + punch(b, detailsVpnAddr) + } } for _, a := range n.Details.V6AddrPorts { - punch(protoV6AddrPortToNetAddrPort(a), detailsVpnAddr) + b := protoV6AddrPortToNetAddrPort(a) + if remoteAllowList.Allow(detailsVpnAddr, b.Addr()) { + punch(b, detailsVpnAddr) + } } // This sends a nebula test packet to the host trying to contact us. In the case