From 6a0fad1e1044f567cb4d00608d1b1f00cef954c1 Mon Sep 17 00:00:00 2001
From: Jordan Whited <jordan@tailscale.com>
Date: Wed, 9 Jul 2025 20:02:00 -0700
Subject: [PATCH] wgengine/magicsock: don't peer relay if NodeAttrOnlyTCP443 is
 set (#16517)

Updates tailscale/corp#30138

Signed-off-by: Jordan Whited <jordan@tailscale.com>
---
 wgengine/magicsock/magicsock.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index 8743fe9cc..18a6bbceb 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -2704,6 +2704,7 @@ func (c *Conn) onNodeViewsUpdate(update NodeViewsUpdate) {
 
 	relayClientEnabled := update.SelfNode.Valid() &&
 		!update.SelfNode.HasCap(tailcfg.NodeAttrDisableRelayClient) &&
+		!update.SelfNode.HasCap(tailcfg.NodeAttrOnlyTCP443) &&
 		envknob.UseWIPCode()
 
 	c.mu.Lock()