ipn: use Router.Self to break ProxyTo loops

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: ignoramous

intra/backend/ipn_proxies.go

@@ -357,6 +357,8 @@ type Router interface {
 	Reaches(hostportOrIPPortCsv string) (y bool)
 	// Contains returns true if this router can route ipprefix.
 	Contains(ipprefix string) (y bool)
+	// Self returns true if the given ip is one of this router's own exit IPs.
+	Self(ip string) (y bool)
 }
 
 type Client interface {

intra/dialers/ips.go

@@ -83,6 +83,7 @@ func NewProtected(hostOrIP string, ipps []string) (*ipmap.IPSet, bool) {
 // For returns addresses for hostOrIP from cache, resolving them if missing.
 // Underlying cache relies on Disconfirm() to remove unreachable IP addrs;
 // if not called, these entries may go stale. Use Resolve() to bypass cache.
+// Use CachedAddrs() to only ever return from cache.
 // hostOrIP may be host:port, or ip:port, or host, or ip.
 func For(hostOrIP string) []netip.Addr {
 	ipset := ipm.Get(hostOrIP)

intra/ipn/auto.go

@@ -463,6 +463,30 @@ func (h *auto) Reaches(hostportOrIPPortCsv string) bool {
 	return Reaches(h, hostportOrIPPortCsv)
 }
 
+// Self implements x.Router.
+func (h *auto) Self(ip string) bool {
+	if len(ip) <= 0 {
+		return false
+	}
+	if settings.AutoAlwaysRemote() {
+		if win, _ := h.pxr.mainRpnProxyOf(RpnWin); win != nil {
+			if iscircular(win, ip) {
+				return true
+			}
+		}
+		if exit64, _ := h.pxr.ProxyFor(Rpn64); exit64 != nil {
+			if iscircular(exit64, ip) {
+				return true
+			}
+		}
+		return false
+	}
+	if exit, _ := h.pxr.ProxyFor(Exit); exit != nil {
+		return iscircular(exit, ip)
+	}
+	return false
+}
+
 // Hop implements Proxy.
 func (h *auto) Hop(via *core.WeakRef[Proxy], dryrun bool) error {
 	var winerr error

intra/ipn/base.go

@@ -36,7 +36,6 @@ type base struct {
 	via      atomic.Pointer[core.WeakRef[Proxy]] // via dialer
 	px       ProxyProvider
 	status   atomic.Int32
-	lastaddr atomic.Pointer[string]
 	done     context.CancelFunc
 }
 

intra/ipn/exit.go

@@ -41,7 +41,6 @@ type exit struct {
 	dhdl     uint64
 	outbound *protect.RDial // outbound dialer
 	status   atomic.Int32
-	lastaddr atomic.Pointer[string]
 	done     context.CancelFunc
 }
 

intra/ipn/exit64.go

@@ -43,7 +43,6 @@ type exit64 struct {
 	hdl      uint64
 	dhdl     uint64
 	status   atomic.Int32
-	lastaddr atomic.Pointer[string]
 	done     context.CancelFunc
 }
 

intra/ipn/http1.go

@@ -37,7 +37,6 @@ type http1 struct {
 	opts     *settings.ProxyOptions
 	lastdial atomic.Int64
 	status   atomic.Int32
-	lastaddr atomic.Pointer[string]
 }
 
 func NewHTTPProxy(id string, ctx context.Context, c protect.Controller, px ProxyProvider, po *settings.ProxyOptions) (*http1, error) {
@@ -161,6 +160,21 @@ func (h *http1) Reaches(hostportOrIPPortCsv string) bool {
 	return Reaches(h, hostportOrIPPortCsv)
 }
 
+// Self implements x.Router.
+func (h *http1) Self(ip string) bool {
+	if len(ip) <= 0 {
+		return false
+	}
+	// Check cached IPs of the upstream proxy host
+	for _, a := range dialers.CachedAddrs(h.opts.Host) {
+		if a.String() == ip {
+			return true
+		}
+	}
+	// fallback to last known dialed address
+	return h.GW.Self(ip)
+}
+
 // Hop implements Proxy.
 func (h *http1) Hop(via *core.WeakRef[Proxy], dryrun bool) error {
 	if h.id == GlobalH1 {

intra/ipn/multihost/map.go

@@ -24,6 +24,7 @@ type MHMap struct {
 	uniq       map[*MH]struct{}
 	byIpp      map[netip.AddrPort]*MH // ip:port => MH
 	byHostport map[string]*MH         // host:port => MH
+	byAddr     map[netip.Addr]int     // addr => refcount; for O(1) HasAddr
 }
 
 func (m *MHMap) All() (all []*MH) {
@@ -57,6 +58,20 @@ func (m *MHMap) Endpoints() (all []string) {
 	return
 }
 
+// HasAddr returns true if any endpoint in this map contains the given address.
+// It looks up byIpp directly for efficiency rather than iterating through all MHs.
+// HasAddr returns true if any endpoint in this map contains the given address.
+// Uses the byAddr index for O(1) lookup.
+func (m *MHMap) HasAddr(addr netip.Addr) bool {
+	if m == nil || !addr.IsValid() {
+		return false
+	}
+	m.RLock()
+	defer m.RUnlock()
+	_, ok := m.byAddr[addr]
+	return ok
+}
+
 func (m *MHMap) Get(hostOrIpport string) (h *MH, _ error) {
 	if m == nil {
 		return nil, errMhNotFound
@@ -116,6 +131,8 @@ func (m *MHMap) putLocked(h *MH) (ok bool) {
 		m.uniq[h] = struct{}{}
 		for _, ipp := range ipps {
 			m.byIpp[ipp] = h
+			// increment refcount for each unique addr (ignore port)
+			m.byAddr[ipp.Addr()]++
 		}
 		for _, name := range names {
 			m.byHostport[name] = h
@@ -149,6 +166,13 @@ func (m *MHMap) delLocked(h *MH) (ok bool) {
 		for _, ip := range ipps {
 			if x := m.byIpp[ip]; x == h {
 				delete(m.byIpp, ip)
+				// decrement refcount for each unique addr (ignore port)
+				a := ip.Addr()
+				if m.byAddr[a] <= 1 {
+					delete(m.byAddr, a)
+				} else {
+					m.byAddr[a]--
+				}
 			}
 		}
 		for _, name := range names {
@@ -263,5 +287,6 @@ func NewMap(id string) *MHMap {
 		uniq:       make(map[*MH]struct{}),
 		byIpp:      make(map[netip.AddrPort]*MH),
 		byHostport: make(map[string]*MH),
+		byAddr:     make(map[netip.Addr]int),
 	}
 }

intra/ipn/multihost/multihost.go

@@ -124,6 +124,38 @@ func (h *MH) Addrs() []netip.AddrPort {
 	return slices.Concat(h.addrs, h.preresolved)
 }
 
+// Has returns true if the given ip matches any address in this multihost.
+func (h *MH) Has(ip string) bool {
+	if h == nil {
+		return false
+	}
+	addr, err := netip.ParseAddr(ip)
+	if err != nil {
+		return false
+	}
+	return h.HasAddr(addr)
+}
+
+// HasAddr returns true if the given addr matches any address in this multihost.
+func (h *MH) HasAddr(addr netip.Addr) bool {
+	if h == nil || !addr.IsValid() {
+		return false
+	}
+	h.RLock()
+	defer h.RUnlock()
+	for _, a := range h.addrs {
+		if a.Addr() == addr {
+			return true
+		}
+	}
+	for _, a := range h.preresolved {
+		if a.Addr() == addr {
+			return true
+		}
+	}
+	return false
+}
+
 func (h *MH) splitFamily() (out4, out6, og []netip.AddrPort) {
 	out4 = make([]netip.AddrPort, 0)
 	out6 = make([]netip.AddrPort, 0)

intra/ipn/nop.go

@@ -8,6 +8,7 @@ package ipn
 
 import (
 	"errors"
+	"net"
 	"net/netip"
 	"slices"
 	"sync/atomic"
@@ -34,9 +35,10 @@ type GWNoVia struct {
 
 // GW is a no-op/stub gateway that is either dualstack or not and has dummy stats.
 type GW struct {
-	nov4, nov6 bool          // is dualstack
-	stats      x.RouterStats // zero stats
-	since      atomic.Int64  // uptime in unix millis
+	nov4, nov6 bool                   // is dualstack
+	stats      x.RouterStats          // zero stats
+	since      atomic.Int64           // uptime in unix millis
+	lastaddr   atomic.Pointer[string] // last dialed address (ip:port)
 }
 
 // setSince resets the since time for this proxy (useful in re-add/update scenarios).
@@ -64,6 +66,19 @@ func (w *GW) Stat() *x.RouterStats {
 	return &w.stats
 }
 
+// Self implements x.Router.
+func (w *GW) Self(ip string) bool {
+	if len(ip) <= 0 {
+		return false
+	}
+	if a := w.lastaddr.Load(); a != nil {
+		if host, _, err := net.SplitHostPort(*a); err == nil && host == ip {
+			return true
+		}
+	}
+	return false
+}
+
 // Contains implements x.Router.
 func (w *GW) Contains(ippOrCidr string) bool {
 	prefix, err := core.IP2Cidr2(ippOrCidr)
@@ -166,6 +181,7 @@ func (NoProxy) ID() string                                            { return "
 func (NoProxy) Type() string                                          { return "" }
 func (NoProxy) Router() x.Router                                      { return nil }
 func (NoProxy) Reaches(string) bool                                   { return false }
+func (NoProxy) Self(string) bool                                      { return false }
 func (NoProxy) Dial(string, string) (protect.Conn, error)             { return nil, errNop }
 func (NoProxy) DialBind(string, string, string) (protect.Conn, error) { return nil, errNop }
 func (NoProxy) Dialer() protect.RDialer                               { return nil }