3 files changed, 35 insertions, 1 deletions
diff --git a/wgengine/filter/match.go b/wgengine/filter/match.go
index 74807dda7..2115be452 100644
--- a/wgengine/filter/match.go
+++ b/wgengine/filter/match.go
@@ -14,6 +14,7 @@ import (
 )
 
 //go:generate go run tailscale.com/cmd/cloner --type=Match --output=match_clone.go
+//go:generate go run tailscale.com/cmd/viewer --type=Match --output=match_view.go
 
 // PortRange is a range of TCP and UDP ports.
 type PortRange struct {
diff --git a/wgengine/filter/match_view.go b/wgengine/filter/match_view.go
new file mode 100644
index 000000000..c3c267a6e
--- /dev/null
+++ b/wgengine/filter/match_view.go
@@ -0,0 +1,33 @@
+// Copyright (c) 2021 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Code generated by the following command; DO NOT EDIT.
+//   tailscale.com/cmd/viewer -type Match
+
+package filter
+
+import (
+	"inet.af/netaddr"
+	"tailscale.com/types/ipproto"
+)
+
+// View makes a readonly view of Match.
+func (src *Match) View() MatchView {
+	return MatchView{src}
+}
+
+// MatchView is a readonly view of Match.
+type MatchView struct{ ж *Match }
+
+func (v MatchView) Valid() bool              { return v.ж != nil }
+func (v MatchView) IPProto() []ipproto.Proto { return v.ж.IPProto }
+func (v MatchView) Dsts() []NetPortRange     { return v.ж.Dsts }
+func (v MatchView) Srcs() []netaddr.IPPrefix { return v.ж.Srcs }
+
+// A compilation failure here means this code must be regenerated, with the command at the top of this file.
+var _MatchViewNeedsRegeneration = Match(struct {
+	IPProto []ipproto.Proto
+	Dsts    []NetPortRange
+	Srcs    []netaddr.IPPrefix
+}{})
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index 791e030d0..f0bb7f6ff 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -176,7 +176,7 @@ type DNSMap map[string]netaddr.IP
 
 func DNSMapFromNetworkMap(nm *netmap.NetworkMap) DNSMap {
 	ret := make(DNSMap)
-	suffix := nm.MagicDNSSuffix()
+	suffix := nm.View().MagicDNSSuffix()
 	have4 := false
 	if nm.Name != "" && len(nm.Addresses) > 0 {
 		ip := nm.Addresses[0].IP()