1 files changed, 24 insertions, 9 deletions
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index b0c596a29..8002cf627 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -241,13 +241,21 @@ func (ns *Impl) addSubnetAddress(ip netaddr.IP) {
 	ns.mu.Unlock()
 	// Only register address into netstack for first concurrent connection.
 	if needAdd {
-		var pn tcpip.NetworkProtocolNumber
+		pa := tcpip.ProtocolAddress{
+			AddressWithPrefix: tcpip.AddressWithPrefix{
+				Address:   tcpip.Address(ip.IPAddr().IP),
+				PrefixLen: int(ip.BitLen()),
+			},
+		}
 		if ip.Is4() {
-			pn = ipv4.ProtocolNumber
+			pa.Protocol = ipv4.ProtocolNumber
 		} else if ip.Is6() {
-			pn = ipv6.ProtocolNumber
+			pa.Protocol = ipv6.ProtocolNumber
 		}
-		ns.ipstack.AddAddress(nicID, pn, tcpip.Address(ip.IPAddr().IP))
+		ns.ipstack.AddProtocolAddress(nicID, pa, stack.AddressProperties{
+			PEB:        stack.CanBePrimaryEndpoint, // zero value default
+			ConfigType: stack.AddressConfigStatic,  // zero value default
+		})
 	}
 }
 
@@ -318,12 +326,19 @@ func (ns *Impl) updateIPs(nm *netmap.NetworkMap) {
 		}
 	}
 	for ipp := range ipsToBeAdded {
-		var err tcpip.Error
+		pa := tcpip.ProtocolAddress{
+			AddressWithPrefix: ipp,
+		}
 		if ipp.Address.To4() == "" {
-			err = ns.ipstack.AddAddressWithPrefix(nicID, ipv6.ProtocolNumber, ipp)
+			pa.Protocol = ipv6.ProtocolNumber
 		} else {
-			err = ns.ipstack.AddAddressWithPrefix(nicID, ipv4.ProtocolNumber, ipp)
+			pa.Protocol = ipv4.ProtocolNumber
 		}
+		var err tcpip.Error
+		err = ns.ipstack.AddProtocolAddress(nicID, pa, stack.AddressProperties{
+			PEB:        stack.CanBePrimaryEndpoint, // zero value default
+			ConfigType: stack.AddressConfigStatic,  // zero value default
+		})
 		if err != nil {
 			ns.logf("netstack: could not register IP %s: %v", ipp, err)
 		} else {
@@ -572,8 +587,8 @@ func (ns *Impl) forwardTCP(client *gonet.TCPConn, clientRemoteIP netaddr.IP, wq
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	waitEntry, notifyCh := waiter.NewChannelEntry(nil)
-	wq.EventRegister(&waitEntry, waiter.EventHUp)
+	waitEntry, notifyCh := waiter.NewChannelEntry(waiter.EventHUp) // TODO(bradfitz): right EventMask?
+	wq.EventRegister(&waitEntry)
 	defer wq.EventUnregister(&waitEntry)
 	done := make(chan bool)
 	// netstack doesn't close the notification channel automatically if there was no