Andrew Dunham

> Psych.libyaml_version ``` $ irb Resolving dependencies... 3.0.4 :001 > require 'yaml' => true 3.0.4 :002 > Psych.libyaml_version => [0, 1, 7] 3.0.4 :003 > ```

@bradfitz you may recognize the shape of this as being inspired by [your change](https://go-review.googlesource.com/c/go/+/572119) in `database/sql`

Force-pushed over this to just implement the "check for `rp_filter`" functionality, and will defer using it to another PR.

@valpackett in order to get the "issuebot" test to pass, you will need to put the issue in the commit body; something like: ``` Motivated by fly.io currently requiring UDP...

This appears to be as a result of the "suggest exit node" functionality: ``` 2024-06-24 10:53:41 | magicsock.Conn.GetLastNetcheckReport: updateNetInfo: invalid concurrent call to GetReport -- | -- 2024-06-24 10:53:41 |...

It looks like that code calls `GetLastNetcheckReport`, which calls through to `updateNetInfo` if there's no report stored. That calls the `netcheck` `GetReport` function without doing any synchronization, which thus errors...

Looks like #7149 works correctly in this case: ``` tlsdial: error: server cert for "controlplane.tailscale.com" failed to verify and is not a Let's Encrypt cert tlsdial: error: server cert for...

And this is (unfortunately) expected even with #7214; the initial request to control to fetch the Noise key needs to go over verified TLS, even if using that key doesn't....

@kpiris Thanks for the report! I sent #12611 which should hopefully help here

> any progress ? since accept dns is a quite common feature #12611 should fix this, and will be part of the next Tailscale release.