From 7e9f3216498f38901fe2a677208dfcd4ecc736b8 Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@tailscale.com>
Date: Fri, 23 Aug 2024 12:50:05 +0200
Subject: [PATCH] fix route table migration wiping routes 0.22 -> 0.23

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
---
 .github/workflows/test.yml                    |   2 +-
 hscontrol/db/db.go                            |  22 ++-
 hscontrol/db/db_test.go                       | 168 ++++++++++++++++++
 hscontrol/db/node.go                          |   7 +-
 hscontrol/db/node_test.go                     |  14 +-
 ...3-to-0-23-0-routes-are-dropped-2063.sqlite | Bin 0 -> 98304 bytes
 ...0-23-0-routes-fail-foreign-key-2076.sqlite | Bin 0 -> 57344 bytes
 hscontrol/util/test.go                        |   6 +-
 integration/route_test.go                     |   4 +-
 9 files changed, 204 insertions(+), 19 deletions(-)
 create mode 100644 hscontrol/db/db_test.go
 create mode 100644 hscontrol/db/testdata/0-22-3-to-0-23-0-routes-are-dropped-2063.sqlite
 create mode 100644 hscontrol/db/testdata/0-22-3-to-0-23-0-routes-fail-foreign-key-2076.sqlite

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b03fc434f8..f4659332e3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -34,4 +34,4 @@ jobs:
 
       - name: Run tests
         if: steps.changed-files.outputs.files == 'true'
-        run: nix develop --check
+        run: nix develop --command -- gotestsum
diff --git a/hscontrol/db/db.go b/hscontrol/db/db.go
index 331dba5425..3aaa7eebe8 100644
--- a/hscontrol/db/db.go
+++ b/hscontrol/db/db.go
@@ -51,8 +51,8 @@ func NewHeadscaleDatabase(
 		dbConn,
 		gormigrate.DefaultOptions,
 		[]*gormigrate.Migration{
-			// New migrations should be added as transactions at the end of this list.
-			// The initial commit here is quite messy, completely out of order and
+			// New migrations must be added as transactions at the end of this list.
+			// The initial migration here is quite messy, completely out of order and
 			// has no versioning and is the tech debt of not having versioned migrations
 			// prior to this point. This first migration is all DB changes to bring a DB
 			// up to 0.23.0.
@@ -123,9 +123,21 @@ func NewHeadscaleDatabase(
 						}
 					}
 
-					err = tx.AutoMigrate(&types.Route{})
-					if err != nil {
-						return err
+					// Only run automigrate Route table if it does not exist. It has only been
+					// changed ones, when machines where renamed to nodes, which is covered
+					// further up. This whole initial integration is a mess and if AutoMigrate
+					// is ran on a 0.22 to 0.23 update, it will wipe all the routes.
+					if tx.Migrator().HasTable(&types.Route{}) && tx.Migrator().HasTable(&types.Node{}) {
+						err := tx.Exec("delete from routes where node_id not in (select id from nodes)").Error
+						if err != nil {
+							return err
+						}
+					}
+					if !tx.Migrator().HasTable(&types.Route{}) {
+						err = tx.AutoMigrate(&types.Route{})
+						if err != nil {
+							return err
+						}
 					}
 
 					err = tx.AutoMigrate(&types.Node{})
diff --git a/hscontrol/db/db_test.go b/hscontrol/db/db_test.go
new file mode 100644
index 0000000000..b32d93cec9
--- /dev/null
+++ b/hscontrol/db/db_test.go
@@ -0,0 +1,168 @@
+package db
+
+import (
+	"fmt"
+	"io"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/juanfont/headscale/hscontrol/types"
+	"github.com/stretchr/testify/assert"
+	"gorm.io/gorm"
+)
+
+func TestMigrations(t *testing.T) {
+	ipp := func(p string) types.IPPrefix {
+		return types.IPPrefix(netip.MustParsePrefix(p))
+	}
+	r := func(id uint64, p string, a, e, i bool) types.Route {
+		return types.Route{
+			NodeID:     id,
+			Prefix:     ipp(p),
+			Advertised: a,
+			Enabled:    e,
+			IsPrimary:  i,
+		}
+	}
+	tests := []struct {
+		dbPath   string
+		wantFunc func(*testing.T, *HSDatabase)
+		wantErr  string
+	}{
+		{
+			dbPath: "testdata/0-22-3-to-0-23-0-routes-are-dropped-2063.sqlite",
+			wantFunc: func(t *testing.T, h *HSDatabase) {
+				routes, err := Read(h.DB, func(rx *gorm.DB) (types.Routes, error) {
+					return GetRoutes(rx)
+				})
+				assert.NoError(t, err)
+
+				assert.Len(t, routes, 10)
+				want := types.Routes{
+					r(1, "0.0.0.0/0", true, true, false),
+					r(1, "::/0", true, true, false),
+					r(1, "10.9.110.0/24", true, true, true),
+					r(26, "172.100.100.0/24", true, true, true),
+					r(26, "172.100.100.0/24", true, false, false),
+					r(31, "0.0.0.0/0", true, true, false),
+					r(31, "0.0.0.0/0", true, false, false),
+					r(31, "::/0", true, true, false),
+					r(31, "::/0", true, false, false),
+					r(32, "192.168.0.24/32", true, true, true),
+				}
+				if diff := cmp.Diff(want, routes, cmpopts.IgnoreFields(types.Route{}, "Model", "Node"), cmp.Comparer(func(x, y types.IPPrefix) bool {
+					return x == y
+				})); diff != "" {
+					t.Errorf("TestMigrations() mismatch (-want +got):\n%s", diff)
+				}
+			},
+		},
+		{
+			dbPath: "testdata/0-22-3-to-0-23-0-routes-fail-foreign-key-2076.sqlite",
+			wantFunc: func(t *testing.T, h *HSDatabase) {
+				routes, err := Read(h.DB, func(rx *gorm.DB) (types.Routes, error) {
+					return GetRoutes(rx)
+				})
+				assert.NoError(t, err)
+
+				assert.Len(t, routes, 4)
+				want := types.Routes{
+					// These routes exists, but have no nodes associated with them
+					// when the migration starts.
+					// r(1, "0.0.0.0/0", true, true, false),
+					// r(1, "::/0", true, true, false),
+					// r(3, "0.0.0.0/0", true, true, false),
+					// r(3, "::/0", true, true, false),
+					// r(5, "0.0.0.0/0", true, true, false),
+					// r(5, "::/0", true, true, false),
+					// r(6, "0.0.0.0/0", true, true, false),
+					// r(6, "::/0", true, true, false),
+					// r(6, "10.0.0.0/8", true, false, false),
+					// r(7, "0.0.0.0/0", true, true, false),
+					// r(7, "::/0", true, true, false),
+					// r(7, "10.0.0.0/8", true, false, false),
+					// r(9, "0.0.0.0/0", true, true, false),
+					// r(9, "::/0", true, true, false),
+					// r(9, "10.0.0.0/8", true, true, false),
+					// r(11, "0.0.0.0/0", true, true, false),
+					// r(11, "::/0", true, true, false),
+					// r(11, "10.0.0.0/8", true, true, true),
+					// r(12, "0.0.0.0/0", true, true, false),
+					// r(12, "::/0", true, true, false),
+					// r(12, "10.0.0.0/8", true, false, false),
+					//
+					// These nodes exists, so routes should be kept.
+					r(13, "10.0.0.0/8", true, false, false),
+					r(13, "0.0.0.0/0", true, true, false),
+					r(13, "::/0", true, true, false),
+					r(13, "10.18.80.2/32", true, true, true),
+				}
+				if diff := cmp.Diff(want, routes, cmpopts.IgnoreFields(types.Route{}, "Model", "Node"), cmp.Comparer(func(x, y types.IPPrefix) bool {
+					return x == y
+				})); diff != "" {
+					t.Errorf("TestMigrations() mismatch (-want +got):\n%s", diff)
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.dbPath, func(t *testing.T) {
+			dbPath, err := testCopyOfDatabase(tt.dbPath)
+			if err != nil {
+				t.Fatalf("copying db for test: %s", err)
+			}
+
+			hsdb, err := NewHeadscaleDatabase(types.DatabaseConfig{
+				Type: "sqlite3",
+				Sqlite: types.SqliteConfig{
+					Path: dbPath,
+				},
+			}, "")
+			if err != nil && tt.wantErr != err.Error() {
+				t.Errorf("TestMigrations() unexpected error = %v, wantErr %v", err, tt.wantErr)
+			}
+
+			if tt.wantFunc != nil {
+				tt.wantFunc(t, hsdb)
+			}
+		})
+	}
+}
+
+func testCopyOfDatabase(src string) (string, error) {
+	sourceFileStat, err := os.Stat(src)
+	if err != nil {
+		return "", err
+	}
+
+	if !sourceFileStat.Mode().IsRegular() {
+		return "", fmt.Errorf("%s is not a regular file", src)
+	}
+
+	source, err := os.Open(src)
+	if err != nil {
+		return "", err
+	}
+	defer source.Close()
+
+	tmpDir, err := os.MkdirTemp("", "hsdb-test-*")
+	if err != nil {
+		return "", err
+	}
+
+	fn := filepath.Base(src)
+	dst := filepath.Join(tmpDir, fn)
+
+	destination, err := os.Create(dst)
+	if err != nil {
+		return "", err
+	}
+	defer destination.Close()
+	_, err = io.Copy(destination, source)
+	return dst, err
+}
diff --git a/hscontrol/db/node.go b/hscontrol/db/node.go
index a2515ebfc9..a9e78a4539 100644
--- a/hscontrol/db/node.go
+++ b/hscontrol/db/node.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/netip"
 	"sort"
+	"sync"
 	"time"
 
 	"github.com/juanfont/headscale/hscontrol/types"
@@ -12,7 +13,6 @@ import (
 	"github.com/patrickmn/go-cache"
 	"github.com/puzpuzpuz/xsync/v3"
 	"github.com/rs/zerolog/log"
-	"github.com/sasha-s/go-deadlock"
 	"gorm.io/gorm"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
@@ -724,7 +724,7 @@ func ExpireExpiredNodes(tx *gorm.DB,
 // It is used to delete ephemeral nodes that have disconnected and should be
 // cleaned up.
 type EphemeralGarbageCollector struct {
-	mu deadlock.Mutex
+	mu sync.Mutex
 
 	deleteFunc  func(types.NodeID)
 	toBeDeleted map[types.NodeID]*time.Timer
@@ -752,10 +752,9 @@ func (e *EphemeralGarbageCollector) Close() {
 // Schedule schedules a node for deletion after the expiry duration.
 func (e *EphemeralGarbageCollector) Schedule(nodeID types.NodeID, expiry time.Duration) {
 	e.mu.Lock()
-	defer e.mu.Unlock()
-
 	timer := time.NewTimer(expiry)
 	e.toBeDeleted[nodeID] = timer
+	e.mu.Unlock()
 
 	go func() {
 		select {
diff --git a/hscontrol/db/node_test.go b/hscontrol/db/node_test.go
index ad94f064b1..c83da12062 100644
--- a/hscontrol/db/node_test.go
+++ b/hscontrol/db/node_test.go
@@ -609,12 +609,14 @@ func TestEphemeralGarbageCollectorOrder(t *testing.T) {
 	})
 	go e.Start()
 
-	e.Schedule(1, 1*time.Second)
-	e.Schedule(2, 2*time.Second)
-	e.Schedule(3, 3*time.Second)
-	e.Schedule(4, 4*time.Second)
-	e.Cancel(2)
-	e.Cancel(4)
+	go e.Schedule(1, 1*time.Second)
+	go e.Schedule(2, 2*time.Second)
+	go e.Schedule(3, 3*time.Second)
+	go e.Schedule(4, 4*time.Second)
+
+	time.Sleep(time.Second)
+	go e.Cancel(2)
+	go e.Cancel(4)
 
 	time.Sleep(6 * time.Second)
 
diff --git a/hscontrol/db/testdata/0-22-3-to-0-23-0-routes-are-dropped-2063.sqlite b/hscontrol/db/testdata/0-22-3-to-0-23-0-routes-are-dropped-2063.sqlite
new file mode 100644
index 0000000000000000000000000000000000000000..10e1aaec5ed56ab30e47570788d37fa634fa0d82
GIT binary patch
literal 98304
zcmeHwTZ~*sdR`An@g{O+wTi-(y}N48I*|!Yx9WcBU@c1&SE3`5Go0nxlAw@v&Z#r(
z)o^;YyN63=p#T&O8<uvRY#y8de#|<7fh>@hJS2b<14;ap3xXsMMu0pxKpencAU5EQ
z0p}rKom*e#BFeg~MAdMn*<JmgI(5FP`m6rG{>%E>EB&!==Y!!bH*WLR=UNL3t)FkV
zTd&?pTdmd?@b_2ocNl-4$KMhB)jtdMn|=Qeb#!n4+Ueu3wN4*<x3%=;rT@10&rbjF
z(SLpN_fGz;lV3h@_t=k*|EuHQJNE9ef3a^J@r#H+L?9v%5r_zUKm@Q1{f9H>&Mmxs
zW$cno@3#Bb-}HA!*RPNLt?k)QkDb4I;rXv$Xn+0r7hbv0zA^jdjrPyp=w~<D{jIUz
z@WYiG+e4rC@7!pQ{he|9+U1LD*DkEwxameWZ?u!mL9%iq9eOwR*>yL*(a!L0+`r{l
zZumRf{h=H82U|sHf9cp6{-uR`OZ~0P-|1&}t~a+WZ%}`Hv}#;=r}o9mFJAbiHd?gn
zf*b8CmnV(C@w0V9&n2ghosnl2?mg1nYG>q!qwAU9^kqAX&r8*frtUCLSKgv1Mg5cO
zZ=8GdU$*!IJ<h4-ah_c~dglC>7FtECM&H`R&g8n=84rrj6EtWI#OLps)5p$y=}QZ5
zpP%W``uo{lT&|0kKbroldUex{#@9#Qmz`P`u3o)(>G`X#w*TgZSIc{!J9lsS#IZA4
zFWgIurlW_$quvZ7^14emuaDivXwSlvvqN)Fn!QHor23h$i~E!VcV&-8{@n4SXC8li
z!52+@^Y#e8CuVPtl5jJ$x~k>IZMV7O%Ma)BV|d0V7w(;C#@TSNGxpO1tt>dcd!+56
zEQeZIJU7<vee3A4GfzIbaQ~}COG}#a_1J8CtIOv{z}^#dXFE*R`Dr^f$fqXrEtlTx
zZ~5yp;Fj~YM#g2g{czkLdGL;{om+m`Pr(GX0xy~_>5r~&5Bs;=5Rlend-ToezuS7`
z%>7G`6cgZAZWRw+HDXl%e{}ZY>*8I*qi%fBjknz}z3GNOtHimL8(V|ShcQ_{L)IUq
zgXx0)_H~zKLq8gMjD)}e!TJWH@s_()je?aM8~xjU>v~zz)XvYXEC;>;#Fi(lbm%ww
zqcKWv`SHyGU@2>ae3GIg!lbB+n%Odg_+GQ`Mp?L%rf6lpvw6Mj*Ild_4>@7Z;Tf*?
zxAH-KKfjf2gA<LL27KT#vqz^c{hQX8&piF~!u^ZWT;b^Hqs7wqcI(Ko;@jt@zb$yi
z46hhHGTZOdJffJcGmuSschCOV8HE8l8HzXj_Dzq$>o%LR_KO$3_WZS1zTVE=<_HTL
zx^*(3=fB(=wz;)%U$(h<_}H1}uyRcn$uO)&+YWs@zkD6p%~bXzE*MMk?4#w`HSFH<
z!m%@F&MdtBl>+c$nJZon%>Z0o`{6T{$t0?`6?=>s42{pfbar~xJa_2mnXjIiE}33O
ziwC$)i~kOvUi_!6Ba3UT#kHj$EWNz=#~*Nu6)%qnL<AxN5rK$6L?9v%5r_yx1R??v
zfzJv8uPz*It*^J9W`yw$p&drrRQ8zYan>bVp;QX>3?V&29)JY8!twPWsRl_H5dQoJ
zf$_B?Mbpj|_obx6Oq-G(r9El7)Ci&(<$S7X2b0V+O}ut^s&2wNRJ5t-2|Tv!YGH_y
zicHsiFv(2a{Ix^Vbx%X8yM|h=I5qo1x{G9{Zgz6%Kevu7{cvIFcbEQn>4!_d|3UDL
z*G2>)0uh0TKtv!S5D|z7L<AxN5rK$6L?9yYAt3Pi!{-)e#CLx9bBCWkF;j%w91pkJ
zMJtZ%Dq@FPCqa5-=|`=l|F`sim;MxQ;!i{%A`lUX2t))T0uh0TKtv!S5D|z7L<AxN
zpKb(>9BwTf2``7k%b~-ETPIHAi5@$7x3%=om%h35#NzKRzPb2?)BpDL;Pg+O`n^-b
zQ%^nm?;rj4qhC4sA3+j-A_5VCh(JUjA`lUX2t))T0)Ke~)*n03dVJyd@e}LoE=do=
zCRcP|6w6qf*d7%<VY-$|&AC;wvB|ATg4u3G!nszIh>~Reb9+?EI#jkn&P-3Tt|7)~
z$taz!v?PI<az&zyQB1Is<mwVCJyEx`Y$)px8|<2;>2cfThBK*+oEZ3`p(TlGNGNEe
zu~kDC_iSjWlm?4rA-Y--!-Sf$NNy@+HHp;PQf{iJUprkk^!QqUv}`CX9-j21?n%^X
zjb&QQw6mmu5p+cnte}moFkd@WJ^M_Rp_zCv-ean(x!_z{GYuy#&_R6_1u;~z`mR?W
zor4p`(uGYkqdmfVM0Y`J2&H;bXG6jo5^9NnF?rQRCwJFLI-G`PQr#m0cG8?kq3vWW
zq0W*-*CfO;CA8F47o9+z%>X@88;zHh2K#l1v80UFgjQEfli;Qm3AL6ATQzk3_}-Pm
zNFFUUJ<7UV8fgU~(-z&Kr655|D-umLXRI1bSC7?|uA$#2EiEkX!@#Goyf>P0QIC|S
zrR9Aq5~Y}?)u3NHTGe?ajHRZ|U^0)<iLNzW;IEXf+ECXR2v|+Pl`@p7dU8HeH*=3F
zsqJxC;WI+0ot~UUFO`*6B-C&%1+RPQNLlIef{o0y6Fh?TnCwy_G2a=T1GIdUnuNnX
zU)7EY>xZXX8h8_28FYuT&`S*LNq56sR@U(8$FE3qL&B{UR#%+n;-R|I=PHJWO7VEM
zO^Q*?H6CAc@FzRrO$`Yq27XC7G%qgfT~+CGU_jSpT3JP94O96DxEn}p=$^W&N5H|4
zF8x8^<4?c?;18GnV(G_Af3oxk#lQb@;_)W{>~nwriF<!zZLKAwdiUMGe)!4Oz0={}
z*{7cl-><Dd_v`eYhtG#hl05g+X)PShg~>E0miWvHlPaf7o=D1+e<z)-;+=Q0qTrp&
zQ|0fx^S$+{kHwwVzxTbL+f}yy-1j%$zP`Tppm(Q<Pl&e}Noh)QM_gu8$up%>mlz^A
zRfgD15iK;n_R4tW2vr!A38UzmEQJS)GcHq-N)YB!Tb<<EST1uyv=h!G31v=ZB+FBa
z^(*HxO)@Sr@3hIBlQw6GOnL4Z1BX{aN=~qdk**S5(&bmL{K6|=?>vvGz%?5VzPUN>
zxbj1~+27jP+??)BIGJD#!gW-DZ?j!vrx+7FxT1hWGh(Hv_$oo2!9$18cHxfGjEV0o
zUtGQX4a9>&WUA%fGVOBJrJXTlcpOYU+SxF|<!SC!w!E_Zwc!A9u(q;S1{)V&1iABo
zi6_i?;wVXl7Bbf^wRmW)9WxxmBE{<Jv{a!Vtl%=S!Yk`_<_$xYFSzv0sTxz4C7kCr
zrOM^j;i6n;+%s?&?Op0ro@FM@O-i`82~k>QoGB@@+@~p^MvYh2(XwwN3en)(qvGS#
z;}Kxam;#riTnK!-irc#lk1KAC`uO~E70w0)GhKtPE)Ve7qsxQ!o$c+xaJ<|b4|n{^
z@=Jr~5kn_{aVt}y%9jR{8*U76C)*XB@hD44>J?`q0J-jmxBCcVvfO+9JIkxX!FYfQ
zwml-PZ1;<16*u4lYw24nyC^!@)~K^R9Nf8!s#Xh9`qmq0p&wsF6r1JVca|@??d|^7
z#y8xs??*4(eG$G@7gy^hzwG+M)&ABN2$p+g9GB%^91P#Y=ZmYiRa16l{be^QOUh@h
zh_1cZR8?Pg{?h7g(Oh_Kbqf?#&8wHD-k+a(k4S2MIP}?z7p|g|s+HyN?iGY#+Dh++
zhoGHMC;ALPU>>Y2V{NQTw6Kie3T!9J63Vdb8;TNE(=fw0Hz?tC2`<8-j}p;b6{cjk
zN>(LITV`yyO4U~}iKQ>xUDqXwTWJD~Y3eanvOr_&63lUn1~#qH0=om;o7K;N##v=?
zZ&p78!J=)1MoE1YRtd$!lVeq?p3}k&jBu1po}s#TO~Rzb<QFT;6AEguzg$^v9+F{4
z#ZgK9j7(w6YCusxB2}8waGPCESU(`)*l1Y#)>|vf*Fr$K5SFLu^QPo#hygY%2i{w+
zFDtC3q>Htxi!D7EFu?$xDZ>teqKuNR?V<tUuO}vjSc*{r=J2jU$PiP7nsu4LFDjT&
zhC<VYZ{k#$#V3W$2<n6cQqjIqGTqwyj!P`aU9PcDBSOqC*!4nO@nwr`dbx7{>Y+o;
z@_FV=wY>iF=<T~$KCwkpd7`Y&gl3*oor@%}%@nJsOuWubVt67+8di;rWfqH!${i;j
zTsGBMqhyj|b(5YDVV$$yXQ(HGzh&ZC#xtMTgd42HkX01+>=^hNgeONGql8(DW@1aj
zu>a&XCpiNX$85<`lY8rO?D7+h+ZvK`kABuJ$A-~RlBF`RFw!hw>}q?Rkzr@V$Q}z8
zq^#g{*;Uw_VAnOXBd@$78xo2Jg;tf|y^jSeY|w0HoG3h@$)xFQWLV^}Hm6E@jHS61
z#?nMN41R62U>=JIRwBnO&nX21!J~8F;Vh8=z=mys!!n*=bAVknB)>2^ixtLgWy1mD
znT3xNhEF*PUi5*vUqU#wO|bQmyEWR`+Gwv|>bztP`5FkOSDAnxiYCj*@Rr(Z842?y
zEF+1?QX8&l=GgwTuHe9!cGwJbgX3%XQxGep5TS<G8TLNCJh7ygD%DGP3bCx0^;oWL
z4}6Ed(Nh>-ffUl8;iv$+10s5oF#UiP%#lJ=?FG<#+;P!!DYv~;$fSpHDp98R8&&0V
za}d&c;0bUfHbKrP2g&r_s2N8XYS{PKN)UPH#6mL(&z@Z<_qg9(x_1qeFvs2`BVJN$
z{jev2kFsIfVJnz$A-zc*MTa}=eVCUJ7!qtX6s4GGd7cudA$I$mVA>I%a)HUhmB+T(
zl2qq-mso>+2~V(FwAvGsN||GBVwM?fj4-QmCBevZ?HP7WG}ZVdxuc1t7MmbzGV2p3
zu(daw7#@}`!mv3KIUI}`#g?|2gmk#w@9^|aXE>U?J2XEZc^hH{gHWTpnuf;lT3l&x
zEJ%Ww1QHGzQo~RBea}bLWu37V5}E)Eq|Sz7%rObM7{h38E_%$fgr?s5O!zd2tsGp?
zOJ*~fQWOD50~V>Uq09nWmg>X@UZr@FWMP^Vb1`g{?-U;<GcgE*_{E~AH=n_G=dpEl
zh}ww7sM?ski0FgEu<;tY(RR{zTc9e-CbbkRR9Sc)^Z7Dd({Vwv6XF&IazA==JlLL8
zIWzOGhI+BZx!Ydtw?(^P2<;czSN-ia?S{rr@qtOlp?sPd6dxxI`d~XsX#`gv>W;F)
z@>8>=tam(w8c8%!*jv?G94x&o>}u=-?rCc7df)~|?%ux$>|thhCD1X<Z&WCBF3mn=
zo)-pQ2i=jPZ0Rprk36~bhpk7x459vH8!vz5EMA}-Y_(2>K>m+Eg_qBL5idCFU;Me&
z$y3K$OTV@FCre*D{ohaDIrYucUtIjnQ~wTy@h2h>5r_yx1R??vfrvmvAR-VEcqkFL
zaq46U+qUq`i4!Lv`oq+~bf^ku6EJZQ(C|Rj2YrK_9HLH>;7C!y3W9{=EK(gW;h?e9
zqe3$)p5^S-<0o5dxWiK?P8=`q&=_XmM3v$&9qIw-?;ABvVeU|xZgAS;ysIpS>KDgG
zCCO9a;0FJmCD$G;8~+5XH1@1opy@bfny84T>JI0*xce;0Q@!4^<h2uJwNLF=EyeM!
z!O_uPO|Gh)C7CqY9V_eZG<BCo6ELd~(8U2V0bSd4s5~_JK$4#d3cW&S4ZSsa76)uc
z>s!=aI(I!RBBTPS)6H*4f;mE0Kxt-iLRod`u3KO#ys>@~{kqm#*cW_`lSy4$=<L}&
zGZY2%sQ9(7hl(*^p4e}|%v?5GaXDZ#)Y^hsQ`rg>HLo86Dr>D1RjoK+S2)`br{bLV
zI7Dbf>ti@0ofwJ~V<nip!0ZMxI+UK!Itf*4!NN#+<8T4>iKoliGgYa8=?x5oG=+8*
zrVZ0jmj*&brIK`Uj10XVj*v={=CC95<f{v1_0`mws=jJ7&efTLnsJ}%Lz{)d0RbjK
zNzzQ6;QxPe=|9!}|NnF8e=PlI>3=W%{?dO%Vf={*L<AxN5rK$6L?9v%5r_yx1R??v
zfrvmv;FE|z@asPnULFlEC&SCJ@NzV~oCq(+!^^Dyf9rFt*3$p^BtA}TQ$!#l5D|z7
zL<AxN5rK$6L?9v%5r_yx1R?@|83Yy=4xe4hlIyoi_ih^E{{{I!{zL>K0uh0TKtv!S
z5D|z7L<AxN5rK$6L?9yY@FEcG|BLhgKYe(gF+N#DAR-VEhzLXkA_5VCh(JUjA`lUX
z2t))vdkCC9eD;KUKEFN8eqsEr=TD#dLF>@TA0Jx0bn?faJuKoAM+71Q5rK$6L?9v%
z5r_zUHW0Y~%;7Ul7OQ89ELLmJJ@(iqApXBb{;%9+3`wH|k}x19f5;&ta)T@%)M|^o
zR2lMsIOGN~6j=w53_v1n5mG21!+}S-iYANH80mek->gy>6(2VGxBb@jErhF|qya#1
zGt*(n0EH-j2vw%K3Mr%nvfWIF600eYeGZ|-kmv?c@9Ly?`zPgi>-D)9<@@DK*{cl<
znFvf33$4{!`0dZexcrnq<^Ar$)U>J+Ydl=jiXJqrrqXN7jcH^VLWDjh5kzyJiG|dp
zh*d}t_mR{w`u5GwwrggwN%Vg(jF~W(_1q1!yKIG_h;Uei0VJmve+lycpB+B+gOh*O
z`a2)-_(KB7Ds|u!Pk`x$yB+!QOi{=-`0lsvIdEc!WN?BpDv;m<Io-hPkev;w^g>=a
z$2dW1J><!x-looL>kyw*B1Io_d4lAaNaTssgK3f@0TPnSIfNFKxG1qU&5_;6SnyAz
z57EpdiXt@-5;^4p*)Ne)4#|;lS1PnlkQ52&+mQW>Ae#`)k!QqF?o5WHfs!RwTCcz>
zK>#M5&>Y#CJo3`n1c_S2BohluHg|mZo8!76yeda#n~=BxnIwswq+Kn8S(Xu4c~97o
zY*ZsSs-Q?|R(IWlX7AGo_ShL?{Xm*07P9wYaWTkEX!l69mn-KSMV=buH&h4@id-qg
zBr@kTO`MU)goEcrP9TIP&82Z3DWM1wP6@{|gb9@jiAfGhz9P{QJOZ-TU?vcOv}YS0
z*;o20t~($X%TBVhHQoWud?pqkM?%h&UCCJTLFzWc7jwB-rjo0K9s$KAm)=AM7$k7H
zW7PF3%hImweW3t(^FVbwBzu}q=f{vr3B}0ZhZGw>tVZ-#%KVrZ(HQ5a{=u%&@1MK(
zRYW2U>4BJ*DF&{{Q-G^e<V;0c9}GE@ctcfYG)Xb7O%jqEQb%ma)Ru<CL&$EJ<VZwh
zOl~-*NRyK$sYe<hogl%G7Q|DVdGB-N+48wY;!A?GRmddfq~la(OeZ`y$e)uSb&*DH
zMvS~1DK9a#a)~^19$73s*hP-Kim69-6r0n;*_7o-f>b2Doa{KLx;ePz-DrdqI&Nz`
z^I>l2hYbgEkRsSE5;9XEkrikv?@+@#i{#0`)`VG!Nn7P_+JDP2pSThcaWV9*Bgo9@
z9kPHS$C@XJAP&7Xmv=~O4C6!^B$`AFSR{eTvB$||rZXhH#D`olZz<BSS$v!3Na#co
z<VohpMHCpfMveOpeQcV#oOW)y!KgEIA2FAW)kg#(0uh0Tz<vnaUpX-)r&L)uAA1bJ
z#(&c3|2{PF-yS5V%&f+`!w}oN*kvO8Insa<?3HJO!Z##E!bR)|vEotso*U6dOu_X!
zXc#1d%B!%ERmc@kE#~D`x48qtuosQMzM9pIxKEExb=SgAKem89)x#xLs)M@gu-h5m
zeAC~3{f$FFt4ImYNRh`KX%T3bSV%tD9!?_GPm_=y57`9JuSoLx;9b@vrWZl>AO!sd
zd0?Uyn!ZKT3aydSu@q0Bv-z$4re7@ogdl*8^yyQ-4f+4i7Z$Ia{PRypt70=E0uh0T
zKtv!S5D|z7L<AxNA36f}yI-hf%C9_KSO7e9G9^7wsGQLOOdk^RF7mZ;E`^u~l#NCn
z3INyufJEXj4yOdwQRDs^`C11+k?l;jX^=)kLNsFx*U+<11j?yfgrmx`6_(>RjX?R2
zKlD)$EBufVxZhc<r`6eqbXu{4R5km~Dv2SFQ)z;uta3cpN4%x&O_)`(3+o;n>XF(;
z-~nb8j#Hrt!o{>lInK#&8mExdaj#p1Syi+GQwsXKl7s~R|07F3s`LN-=tCY4vAT#r
zL?9v%5r_yx1R??vfrvmvAR-VEhzLXkK5hg;>c1m%`TtJ-qt@Z$e{|&d9~B+|A9su5
z{UQPpfrvmvAR-VEhzNX?2;8SXRi90TBj1P7jF=v1_T88fpPD^<s?J-f=5T!E2c7yd
z_$k6!?ExKBaimK-1jgm?;}Sh8yVMd66XDu*e7{y$IDb!WK^9+aUHx#!#r>5p)+1r&
zlydFivHzFv<CHQuqQWwtgf8MZm?w(P`w#~b*%J)zs$CccC_)+6)e+)*xG7^4;Orlx
zfWeX+K?b@4&be9{R$X6@g85b$w4%JjefHCJcVXf_l=lCW9MoSE2Y|&IttMmx)m;sL
zMP;qn&$V2DL}+Oh;T59qb+X*_8IG0FZK`WEQI^nIr;RDAk+KyMZXu#_Er$cZKlyNH
zZLIAhK%mb5xAe`Apz>H{L?9v%5r_yx1R??vfrvmvAR-VEhzLXkK641%dwk(|>+HQF
z2>CS$zyCAL{R|~P^Xg5xk)QX;knZgGasS!B{i3{l-e0yC)5}+0cx@;9+G;ob#;bg=
z_S&Ua$m+Fk^`A}pSD*?)6b9M}u^<rtuh6h+M&P=G$aIYd07%3PiA01CM0KkuV*bC+
z+(3*E91(~JL<AxN5rK$6L?9v%5r_yx1R?^T2?XZy|KXVro%)T#r+#Dc;%DOV<3oNN
z2poT>4tHN<dI)J9{vo~p64E;ORAi~mGMy#~V%}Ruh(LUH#8H>RlN5ObM5axeQsq>x
zDN78JJ|HEIL>2-hxIqk3m8baQ2vo0_77o$fy&%-^)Mp8iCb5hm<UPlS96?c2nhRx8
z?;LE-6cZ|ETIa|Z!BXZ`c&k!nC~_HSZyE9!D2v$cjv^0^%aJre3Iu((juD^8M2MtG
zutVukBrN>x7xaVDZU~ceP&yq65@9$ch|v08=5)J)+rN*z4#?7A06Sv-D*%#9f%yN3
z?C*rnJwft{+|vYEg(y!FMEiG4rpTOOtg`?L>4o@v2e*G_xIOL+xBH#j2E+#>bI5$s
zcUz#Tk~w@F!!h0?A`lUX2t))T0ug~vJ_7g2murjv;Gpp^y6T974E`HWouys&{?c@j
zkPPXw8uy4<k`N3IBnTyE451GgpRuv`M{q`@Y2aO=nUE3{H0Q`5nX>mUTcH`8c`ARQ
z`}C=)E_*1QH1t7THu2H;+-!#g?<(6xx(sae<=%jXJ_8A-8a^800h2ToeMS*eQ}mea
zLDmSKRZ3G^2@?CXLUClqs}BFc2!j3pp;N!vTD*dn_!AL`2t))T0uh0TKtv!S5D|z7
zL<D{^2;8S<Yl*UU`(Jy=(*Dr{gUL@s%EwA!4p|aKkoO4dapZF6$jKKnf=|onB?;1s
zo8Y#OlN+HVdC#MzGD`y_O5S0tO(0In!t38!!~`K~K2_svBcupwfU*(yyX~nyYcgx%
z-0z{utV!uXYJiXFEO4sBkXD1yUij5roZVT4<l%FnH73C#$`eUrq^YzFLH=J@Tx%_^
zJ#zmiGtED_cU}BnbBEY#pRGe|(j$loL%WO^YLR4gepHb*1EWE3ACPci1g&#h>>pm_
zAw9$P!%=^*wcJ~#tgD)%?el}oUv{@V%9Fw1&2JBex59UR^yYZ5z1+*)=E#T7xBIET
z1lmmyUUj4G#1Dse+pGPyXcxup7ur|-?KbTST>kQ4G~OyJ4Ymg;x#ZHD{jG2p=Z5J`
z6{ubsJdd}bXn3nC_(s#njR880btUMo4tB;a+4L7zN6Wp}m!UlDQf0bG!7HBSZ266q
z<#j&{?F(OjXL)rv7!OeEw)aD~-4AzK9Sq0IJ)|u$>aCSs6rF5q)Y%>m?%Zui>07Av
zvL9dE%2CyK(ERP~{?^7f+_3LQFWdz@<BO{eIxoBaaJ9d+1&Za~*3RbU%JMG`hHv8I
z#nsztxi=o}0K+TmFT2rnK}B=zMbuQ1)K{Iqw0c`K)n8lPn%ryk($xF&Q}2hck{Aws
z_Tq)BC>7{4ym`fq{Z@K6JOb^6DoGcqTMVpBBwq<dXdQ~E;2Opz6h)*aLyBb~q3A8j
zTJL=6%THE}=Iq(C)nUgwYxgZY#d2XXt6-Fp3oWcMiaXfLcm&e2Nt&qCd5K)jB=dqg
zBS@YhYclbv$~a;Ig+l@*at&pE%5s>mWQhnS9p0okK_E`#$n%tGN`0F1oWsr~6)rI;
zj8<~Ekf}s^Z-qf<p)}(u139Cp)aAy(R)?}oc<(gRDXeI;bjUrE20I=!MZ?qtwXun{
zjM&acom+#U=W6n9?_&<EWTGc^7l$0shO0Wq)U-YuVTr(*K%xmkNeNqLv)MNk)jZ#k
zqDwF$UvTN0ek*%ruyOH43~Pz)6yvF}nK0HTEKiw9Gvq!_2~1~lk`e2Lp`4_ESTX8F
zCN+o0oyjPr&Y{LD>!>FmdY_E4;^So6QQWh0{@T^67cPJO`$yY#pMPc6LTc?ZVj)%Z
za=ExjtS)qq;8h^OHWa)H-wW6wz2{-pd@t)yfrZp3cl#4t77>UDL<HU+0{2&zYYo7|
z8e7x69|b^>o=;*O<6VWonb-`9d83Mwg!ee_Vmkqa4%3xU#r}d+qX3W{%0dRfupu&C
z$*iPItBL=AX}2-g3Rqn?X*G-PJ%raU;O`9n7V-Bu{^CzWAR_STLEyWWzR<`NPd{Dh
zUcdkJJqztCI1l1BOE_F4B2PuabqZr4!ZK;8NxY#dGnzp1!KXAgDRnRsB7&z7>}k%D
zB$q@PlN-*d^)gLTPgANBtGyNk@+dqme6FnY5I4OgiC4Kv;AFt5%oymhG$oKK8J7rA
zl1uF@hkpiP_}~;ONi&~wo>(rl=Y}Zm^Bk?!iBl{{o`isXLN7tp&A~12Mx*{{?6$@;
zA7*r~h&jwdSYr+?mgs5?*-pcvZCY18MIu0A5a5<uQzcK`pY_g58Nn8=Gggj40+%}P
zY(Tuu0;~7CCCpqq2WOT<3W%68PjfF)##q8t;=H42!XZa%4lo6Qq;I7`oMo<*=1Fc{
z7F;U|33Ic*wR2}qzEoY>RlIZ44Mv?I)JT1NKjnu}szEMn-G+dA)42h@Ej=*sdEO_Z
zQ56NVvW9S4p9M|K$lnc5IIqu|Qc%tG4oLrUnkwk5aqWZYp(NqbeB^qlN^@7MlnO;u
zRraxJqUb@YD7g9vDS|4h(L2HR&nl)E%4(Gr<51j*LKVeo^%SfK5e2-sl-FfYvv4S)
zf*MOyWnuC%9Q_0}maNL4Dh3lEflSqx2JzlN2Zb_Smuc_;ZMa04sjK6}K-q*xqP8xQ
z2or9MwJXa_;}qgtlcK?_eg-I>7+S}02UgQTDFfFlM5{+x^AJpd3s@S;>W5&sR&(5C
zWw|Z_+XL%UK(2WN!5P)yfGf+B)=H%~{Ki(6>(+*(>4rjK_10S}%hyJjL)$KeTDF{c
zO+iq(`e9l8*6Yg#hMzFl4Gd1(UI@P)oUN#4T~4|<<)iauY__n{*m8xq>J{l5=ogM{
z;d^IX-^~G`&NJ2K^W7UyHtR{JQ>`c8d*=QXtS62NuQS9GPb7FcT;_Nl^pk{2D!~2V
zd8a%$y0XZ59bD^>$UVn;qmqoPOayN1C`(l;onsi2KrVr|Uq&+(Vu)*>Vhj;fWdst@
zTb+3<9Pr@tDO~uVZgd*He=LQ%(?|xlK<H9g0wU=Z`dnrhMv7qhz?p?~@Dqez8}xPr
zCe2n;le4MyM33C9(azRJd;L=9B|O2`s?VL#t<DBM=liWHOrU!V?nCHIzU^5|Ii5!{
zjQ(=rc^|8a4r8J-HcY~)k>$R#0UelyW2Db9K;|@;%;qdbpJ4y*VMok8=iadlD|(V<
z&OuL`5|YB@GA!7cBQnb*$9u_W#(c3-73+%I%7%mfF3n{alC$R&^QeJfit+F9?R%d{
zydOSKe<D2olXcjDnaU*iH@HQ8*Z}1}W{sNR(gM!07L#<E)xs2AK}ZZN84RsBs317Q
z$7YQOZeDXV67oEdz@$-9QYlWr2Pw)X>=$0RaAB3;+@Y*I_P|DpY7{j5SQ0Q$rULIp
zSy@?eT#XfJn)lM6QP;Q>?6{(W1FC>rJjYh61$SS*is{)^m_!OmE8wLN)cvo+*_if3
zD$*WMQoS&FAvk;6Q#b<YrIwjqCQ|wazG0f;iphakNMiE7t2ywB42-X*WuEtPY`}Xt
zXXzVL_i)7Zas}^!zyPp~RkGJZ%gQPzEFOtDSWjr!gy5VunD(<-2Y_Ad2zvrB!I~Wv
z=l`dkY~eTlL<AxN5rK$6L?9v%5r_zUY7scPQX3RK^+YAO|N7xyrV!jAAH%K%wks}S
z6!I}*?hwStA(DHD><XqYO63rwc`mXH@o+4G5fM`qJ4+}A2!iXtxCnuJ1VZFwGPf4C
zNeHjwpreF3qzJVmpae>(gkCq)q%!PEaiW#x3Di$ev``-c`?wss662r}(81z}5D4o~
zBS?h*f#wDweo*Wn!o$#sB61D4XkNyG5ML>R&E_C=n>S$%HyklCBcz*7$R!82+h8Wt
zh5iT;f6#(y)o(*Wpfl-O7#SH0X};bShrEU1w+;EA_$|Nq&b;bZLp=)JFZCHTwRqUh
z24sdg(cA%tG@&9h!dvJuh*!)*X93$K53P5S2URg_jGzgJuAOAL3wm#;egTFPE=7&+
zC7Q3ojLB^T3&5?x#$d3qS?Xn{?F#ph$fxA>220$m64ZY+TduV~XPZIv%XdE!gGlCy
z!2w2Yv{q0!VlWz#S%+Q_Fu`LfEXODYoJ9a5o<rYh@&ww(+@>l|pfN%esRtTFI-DQC
z1PLQVLM4hy#awdCYMg!GL4>TEopGAx80=oShiDYNrvYjszE4atYt8ArqI6oI$9xIK
zr+W(Y;7PLQC`4)xd7frYL!QT>N;pLb@;r>fx-c-Ts+f}S5&7VtdJT9~&*X)?4qYpl
zk%BmW&=q^NWO6|x;6pJAQ#V8(D+T<f#)bfD9^C^&O{WNg1^{RK4|M!br$;i_p#d|m
z*kR%Sf8=*sM}Ftgc;^49UGHPVBLbg61irg|w%((B<=nX<=FHl2fA8+Sez15*W#Sxm
z1F&PK*i{;rB#85fjV=+XOTqTN#(GW>1TyRjq{*<CfYCc5P#TzEAvj`|XzFYxv8O-)
zNJnvbno8_F@;p;8n!q7T2Jbjyy!6@$9MVXb+NT+o2xPfVbe?#|!a4-wd9(vZdp5_G
z1v_hQ!hxvP;Q%bnuy4ez;A)5CtYBGTxtClwdlbqB+i;>7jyhI$@^6dTPamI;;QZbf
z<`}{IWPZ2nIaJVaA;ABs6^O)%)2oywh(8Gd!Ls03ASv7!up@>g3XaDJY)8;1R$1d%
zsPP~ZdJa>Is~29m@cjCP&NdAi`o@MK;NtPyluaz}udH4!zG~ylj^bGDdN|LT+WyW$
zitnZj6>ep74mC3c@LIvH`*vu^OM}S`D-WCSG!JIC0Ot$!lR4A+N!Tsm5NIC{8c0DB
zo@N9T6SD=XWH@OJWzCU4!%-4M&T!Jz95Eqld64u1U47(FI3gmM;!vwT-bea*ILYW>
z8PM1$;0PC|Qy7*gt8Em*ffz(o9SjocQ-5456b`dt2+$mo!Hx<$L7ZaaWUIDYfLLqb
zr-PE(_9FPu;rL4i8-@BIAX<m#CAe#IP8O`PU`8Nuhl$;S#o4;Teh+2!Q(y-N^DS&^
zSC;E%WjG(k;hC8-Wk7o|9bt4jv1Nb&3dyrDc&MM0!Z=I;s44RXTnK&!ufB<S1K<%5
zwv>K<=Wvw4xB=D)@PmR=8IGz@O>wdo+@%OaZv?>Is}QN;cT?&~VP*GVWf%MAlC;_q
ze^4LhU;E}BlJC2Zz5Uld0qPTPR7N3rK*UKBjDQ4wSjhcOyb&3cDZ+^)&ond+;HAzb
zI!h6<I7B~AEc~)ybn#%4Z{Y(jai|ENLqwZHP%%4av<#zTxQR;+=(~jBuot|(IaGXL
z^-1BMlR^A}afqj#4F!FOq9NFF5Z30GmQSZ5<vm5<2U{UN`qkkR>s?v%JeUR`d7TKR
z3=@8dodX76T~-<&pbQ2Bq%<O^JTnP6H=8mmfHe?YB;hUpKG~U8FedF%7=0?p<k-Jh
zjMUdzBddddlb%In@lsZY@+l}PCVB^fp93%1g8+P!_F%|U%Ks(7`;z}><}(%@c%)X7
G_5TC3m>mEB

literal 0
HcmV?d00001

diff --git a/hscontrol/db/testdata/0-22-3-to-0-23-0-routes-fail-foreign-key-2076.sqlite b/hscontrol/db/testdata/0-22-3-to-0-23-0-routes-fail-foreign-key-2076.sqlite
new file mode 100644
index 0000000000000000000000000000000000000000..dbe969623060bbe12f2daa1cd00008788f80380f
GIT binary patch
literal 57344
zcmeHQ-)|hpeLqsNC{m)B)D0LnFv?tkI!eg%{GQn>($tn!TaYO!mX*|X4RUsORyvsC
zF~_4SH}M1W3kc!@Df$QWsc3*E{R3K{K+%T+?Q>t+hrXl_Eef;`eW+2i=x26sZufpr
zwq(2UkD(;$Zf19O=Cd>3-`|;=UwyGRbQ?u~aMunuc<WQGg@yCKv9Zx=wHEO20{(@c
zC44v?zTkgf|4u&(t<L_Rude-DYkB#*t+m$LU#ybz|8f56xffPmUjFXN#do?r)<*;)
z0uh0TKtv!S5E1xzB5>S3yR^Q(zVPi|8QOHu9UZ#CVfkzI(o2`0dHM3j%g;Rf;^mEY
zS=Qe8!fr3$-RSKP-EBA6+|35g4qd)uhr1g&J`H<!-RADmf&V;Rn!7zWTe@%Wy4{VT
zyFc8xb?wSmZ(ZKJ@zRy;XI^?`<Lc#Cs>fZtcyam6`j^)iTD|?;-9P-s9;C({do=8q
z-*?Kc?a=bS3&-DBT3UbNiG}Zcxg5`+e>8N5)$j8YBigMBci;aZ-L=`B-oD$JK<Z%N
zir)Qdq?@}ozvl+S-k}4S`$u=(pqFj#x_$o!nkBu%or6K|t{uElUp5DxZ@11Ytv~hD
z!gsz>jv0^g=-k<P-Mw)*@#Wkk0uyyJK;Z6CcgvTL;k4@)Kfp}!y{-GT>kjTXjKuDZ
z%Ql|7{F~3*dhz9r!tNdVdC?s2bmjc1<nABz26ou%?>8pc90-ovk1efhy>Oh(K(J%8
zy`7=GJpskIaOGr3#@Eb1(*$nvHRCxW(B^dV*H52WfBf+US9bCBdx!YDJo$K(_=nZd
z@7}X}N23LD@jKh6me!wqa^d@T%N9oS>@fU)da|uhJk$FyKg*}wvxDr89ehEFi<`Uq
z{oMIk6Q*h2JIwmcg5JT7&GUgfJap)&U$vXNclw9JdKGW(-tOIV`#V+1xOIMUbM7p<
z-8&q*!OmSbywk_buUdpcn1OuwcNU7me4a#m&mInU4xMXGj@_#8D9g~x;%INDqDGDB
zvs+Fo46>$JehfRk{h}Y9=l1ghkeA`O1M{cnLr}Uo^WoSml<)J~m&*5P4|?U24gW7r
zyw7$ho*}}RjbqXhi0JMedw6GeBi-w#CsFCSOKXJQB&2h?{`BIR^-E8lM3F;RcWC%@
z3f%MTGzVSv1#AB~T^zqh1R??vfrvmvAR-VEhzLXkA_5VCh(JUjBJeRnV8xFm>i-|3
zHyVc$5r_yx1R??vfrvmvAR-VEhzLXkA_5VCSp*(K(W$k6_7!K>{(bFVtB<qS#gd3X
zL?9v%5r_yx1R??vfrvmvAR-VEhzLXkKKuwQeHwi{vxZ-fl_CG3$NtOW;@hp|zrnBg
z6A}2NAn^NFSD$Ddulhfik=*#XUt8GT{>mRdetd3wyCnrRQYl6iWhSG!lv%1-k`t2>
zMlzBJV@0Axrd?(fr<rBB(ODv_)R|%h%L^@}=F(|Pm?&hz(Vo$Q2q|Skb)FEBkt|aw
zOGU=D%8epK7M5g^xFpROw}nlaPIJY1mL%NC!lfijGbK`?c$yQH=2|$J5|?vf{hdjk
zQYL7Y6}h%uN@doy)RAtNZc;)zN_0qvBAM|XGDEj)nVdEG&1ZNa_3YI)(!RQ7Zsy={
z>$cnX8HMfF78%B}Ma&kX8zkvc(iN;j3=>*^iI6S<G_&>SkR(Y}PY9t~<=>6+dfZY~
ze6xM!#<i~@>lHbM?QWZPl<Cl|VZxlvT&8(@v;C~iUPnUMi~ZYIp2H<5r}$e?g4be%
zG)yKkRm3Jbp)x6SQDhA7%Vg4|_?Njv>RhHW*UF|!qQ&bs(av6P|LA`CrGC8X&<@(&
zq7?rd*0FbgZy!VB9qaS-l)&Ye`ujtR{L(?YI~*Lj&GvK1p&Rsl$Mz0Tj!UYNx>b(0
zI?7kL!`FxXgLb#d$ZWqb%H6}wlWzmpZdYlnzTNS&pYK0|Zup|X-Lf;!_v@$J?$Zuq
z9pA^7kap|SL$BO8Y<FL66TE!<d77ZA+b#d2q0FERU(i8AI_zoA+OKW4Z@R&~9uoL)
z^EcZ!2K}KQ-hsnhIOzFt+~^O6?XFC;A#ZNZT;Y2#y21#q=3KFr?;ma*4Ep!q7+*@?
z#B;B?;T2>7w!7cN@DG6I?XTHE&mBJd29O(GxlsdWdxIOj{e4`~?(QG$?QOQd-XFY<
zuUBr|Q{&67-+aLyRwdQD8eMejIW#p<a^=$YjeBBz<E<O}^}}v#H$Go#d`9A*8w_0j
z+~t>0N(o*tKD~$~wx7M>2SK-dn}Av~#-ujFV;#zfGTbCwqAXlT6OyomaE3A#u9FGM
zSa}@}Wn54$weszWQ5jW4F_92|uL{>0%Cr#7piGA{rZs0qQIwf*uVhjstSn2$Wgtrm
z6mGLU?h2z^CCWd7g<;Tya;7EoWnmZ?E<q0&y2rx36hssY7Ncch6if(76W=+|jsO(F
z6Eup(7g1w)VkC;fMN|sG(G=Q}qx%?<27RFDY#1j+=Yg6`HrwN23Z|82if^{VD2bE;
zgHObpZ(?ch^^bDDx_<W%^YWI@#XkVGsb@tf@$1VIfN~kX`D$B=4)ZGrL__K>n&kDe
zN@R!9MxkaMsy#IxUH6)&FP^lLWP|7~lU-&y!V@>~Akr$e9@W3~#l_DCZibx%KGQn8
zy}kVhmmHW`o?Bz3DXh#>k`rdZm#CzM3zpK1rYe&<b&L}*o}6V2Z#)%@Q<5=_89@x?
z+}Z-9Rw}Ty)MAR|O1fOrOwmMgie^ok@&e4QNPu@{6-yb-w30eexkRlnI>GJ6riL1&
z49jxxDT5A>oEF^V1$V?2te_68D#zVPu0g<MW~Z4MtC<<|`wgh_*J8hyX8}b@HW=x0
z@F?BUjBClqD3&OX>P?p=9YMgV*;G9koal1e6}p1~VKJV-rv!M#*3b#&6rqG~-4>a%
zSPUhDnPOQy6^Uh50s;+|FLKAJDma!q1*7Lixr7?RQ@m73StfLmYE3ecVL{VEG0eu2
zWg&GO|NAdB*{7_dI)1v{0GqV8F<U)Hy?h@;sN|`h>v&?mjpXt@RD!QO+wZ>)s!r7=
z#eEGXRKkg(n)lo{YG=f00_(Y(Hwr+X(dIqh&I~W2gUqw<cgIYGrfMFmsF{gSGMUG2
z-d|=i;><sHZUTCG0yCkMC(0y5fq(}p3=#rP3vPn4K!s^yn9?A_C<|1WVAU!rjVJzr
z!V=6yNkPX^HYTwE8*fDT_5w4Z6y%dYmO@z|vi`Zu2;=)wQ&}OvOSmr!WR^k@Oq5DI
ztq-Ig{DDKrMsqbY0l!H!QJzbLVGsps@5@mZ?xhNhQYuW~3DyB#Qqub{GMa#jfinPs
z@xT-ag`omZ9rF$_E2RO<W;+bkGi#^-z9@_oqsOqo)f(&s+=XMsqbQ7%fb>(S2Z?7V
z?}CAN83g=8>5eoV#*+@^qAREpenEjZb|}PQEO0(5teJ(`ASh&A&LH%Gtjh<HF{AW|
zj5Srf)iZw${r`Mx<x`92&;LWSCVu{;A@BpSHY-H@@RbZggixs$2%JlJN^>g+w?^mC
zsI+rgo}@f2gwC8a0;>jsMJ7a=nndZu2(WfYxK0%c@&(VS&M41>$%M>E3O-0Po~K5F
z=WEacNz*JND&aigNnSwoGSIs5#X3&>f`l*vwVK<E;!0wQl-OKmAO_A!XwMeh92z)D
ziWIsrH7?5%NIz2=v8aUz;Taw;f1Rp@h-8bX4Z^yDdm%v*Na+)+t5Gjd4>G}2bM=+=
zj6(wHGScA?{S*2=2oVNiSZYKLfeiyqAxHu2v|tdJCCdt6RpgmdCU=zPDq}Pk5J*yG
zd6qijJR?0>h~ORB@#^9GBt&?=|ML(cV29vy^vzm`;NUKL&J`aOA)-=R->pUp_B|~`
z1Qtpl?1NisuR;cX34KqX5L|D}&me%BgbMj^{LFN?0$YNF3_*OFoym>}g=2Q+rE&_h
zRV9@}R;YC!NbS=Lj&WnE1%&{%?N1u1j^m98d>{z?&|a940j~atdqV>Fjb?^hlE7e{
zDJLu}2GH{HFV`-IRe-~^s%=38xD$-5&T5qu6e?{_s5QKx3}UxVb#7e-yS6mBE;y*Q
zhQ$O--wO`lWG;mb07hH}iv$r$Q6p5IK_#{(14GXeYlNfV_NlYRsFX_%@xf9U#|2br
zmD(InbLb}oe^@)5<1nbh3_m3U@LC2a*}wEMfNU5NKysuvBzVgW$QVR_SzEd*k`(GG
z3_MVw=*ZGt86t2$^D+b#o}?wPm5eCXjJ;cw_HM~ck;vStt=pLZyqV24c<7WJ0d|;F
z!V{57E>aG0tbhQJS%6FdMap1gu~eAEzz9xrm+GW2%)+K4CBy*kTRd3=c%SVE-p>9$
zi2$W!@*p$9M}>Qjj0^9QeLu(q0IgO-Fb4CkO#oiWmR`kfm;e+ErI@@Z8#8`bQLw^@
zw>ys+KZ8BNFfw6J7D9X5C@u?XF~L<DjvRk$(2I%plqpX9BWeo(RyNFkC<=lERuHsq
z<@N4yN3hZ%T=*w63;;r-Bg`xI!2m!p>p3yr*xfV$Xc!ZPw<nBMdrEM#@&<)4F0_wF
z3e_|oD+oRcihIKV;HeBK5gr;w3d13Xc@7taaYFwG<Y>O3{|i7Nr8jejVG^w4L~!zu
z^3ucW|CJe2z=#ZEF-$9L!pu2My}WB62uwBWSUvkB^#3!h#WUwLKE|I<Bm!^!;-|*W
z@Ui>gt>?eT!S=P0g@7iVrKv5zUZKXrcMKv!c>zl{1<#_XfcKgyYYMPrr5${&Fj;$F
zEc{jqz5@wsKnfpD&ahtdTsr9dIqcjSr#68HLMb@J;rGt8QQ&|%voPa<fu~sbxH3r$
zb<(j^8j=^8&P0(xFc2>BCITT82mvLQh(d5ML1?`eev888;Q7;RU)F5D<oM;L#q{(X
z)n9Zeyta%(QkhZhE7O2LJ%{gW!hcX|DhzC&cO{%WFh%f@Sn!_szVLwoDFmD>^E@7q
z!G;3J6X^XJK~zEkq~LAWAe~miLkEWf+}#k2oMDB_9?16}UG)c?XnD$i;EVph_<rq+
zhH(~3>VtgIaH+|8wt){`cBpjrNA^X(VDCBaPKQT4IIS!9^h4PK<_Hr(a-bTbv=W}R
zjoCWN5&}KEDuPEH4oh67!DC_W9<y+Gu;HQdzG)PdSHXUum;_sYIE#Vi9fYsI1P*DK
z8iW?WH;0KdT@0bZ%ayN!htn>)+=bN--aea?u1ZAFg)h!_rO5LxJm%`PvF%~19XMo3
zGTXd>L(co!rmluBKzj?)RPorZQH4^#tAaIua{szY6ZhH!FM;*03lRez07>$$h2r$!
z>*o%+>cfO(1;og7x#%Ed0N#nY^eoUj_-ccoaO#&nk^C?YIwJ5u1b)!{^t74e>h=$_
z+mM$KrUJP|P%n)jh7aLUB*_xWV77qX1g2~YI5#8=^IRg#fkT?gb2uw3cR83i)lS1)
zVls}90HvH}aIQdJ0^64^F*;45%)##AwJQOhkFZ0p)%y={GME&xIq<=F`vD>mLChRF
zkiwQyfZieK12F}uLkS`fNWpWcDk)+K;k^M7*MuViV_IH9fItWyEJH0ye~FkdlTfw+
zc?a}`@DB7lsF9QOrCHAr-f&{I>A*&UAb{%j_arVMUeY?1B76`)q~4u`SHKl~Bwhn8
z7$Z6Na-xNlgokqDNRHTyghQrs2#*4-KiN#;#U;-q9^O-8=7~$5v0UpTw(;;<|K`!b
zK^a+BarRn@s>A(45XMRIfAk$~CAG|?U>2eel$l`EVjpF1$$Pf91Q7{V4$MtN?>0mv
zM7b$Mlli!bu{?z3;td#OG}$ef6yG6!%)jS%;r>T-+qD0mi4CH<RCNjMz~0BF_5XU=
zVO>F63hSy#*~<9;Gk@D!{uzG7pNK$2AR-VEhzNY-5cvN3;}atJXM70s_deZ&NKRl%
zL^LweWDpqxJGrIQ!BeSIg0KcoxPw2yyDhoPU^Ikt5n<4I1`!>yk;;5*l7(>*5^`1)
zju*JpqDh-0y97x%+`=7KSc~@Ie<TI2Ck#Q=FbrCeN#^~YIYfdCvA+-&94la*WH!?p
zAr2W&k;r2tmx(JZhZPf{(3)k$TDVhTb$|t6CVB}%WDv=XcUqQl(5w{6eI5k7kI2)}
zrS}ryOR~##2VPW`)N=PsJ(LX-`~&0r)dnJ%d^|exd|<~lBQxlXT<+r&w}$WpdrM3<
z$7hMrL)lP;NHVLDKb4T8AP|wVlp;LLS~zgwyUk(Z^l_7j@4^d#saU54vUlLZofgJx
zxf^LXdxx3DnQgdc$_nWv^hc4OtNfWq@io4CagV~IjOcPEU{gz2*S{VgdR2#edU>xZ
z^=6#L`||Gt5oH9H@#**3cwg|VX*%*&zqR@c6Dy-i4mjuI`rtEWun`Mb=1HPb;0`A{
zLS~_*S+0@arZsi2*V6(PdHC+&0fYJqry$mgg{sMNOAAD`o76dnCalXH)JPxxhg`SR
z2l7K#g%*ks+%!Q`Qltto+|XHbMV;Up)7)T*6fpW*q<LiMHdY$q+%g!m;Vn>3DXR!N
zDKS-`r6GzC=>iE!VI-STR&~8Hv|kz3uZg%m3aJ@Uvl7{79oX0qI6I}RR`mk*NAL5O
zWV)VvWfu#B^N!Ds2=z0o;$fWnh}z4MHJDh~R*_r?1ROE|(>zB&JYGtU_$%o52>vTX
zjzz?Bgjqu0M|cI^lPhKx$V76$qid^klLP$ven)NfJ>?9%qyGBA+v`VK<0BjFAHh0L
z=S1p-JghP(4~}wBh_O1#VQ7Je4Mk%wIo2hj_k5Uq?dtbo>@Z3BkbvM4hZzb+c0}W#
ztoEF9E?`Xd_XZC*$Tpl?Fe0HW_`s3W1-1pR7|O=Jev0HTbkScIyx^b|Fg3%#)zFOL
zO-EJ$_YV6o3ZD%`5y{eY_7fP!ph3$CXFmsfhK7qS*STXLQ~<y~b{qgeU|xd9&gX@N
z(IW1~XA~sR+sA|TDGM6Is{;U#n})W`L;wIr%Ftb06-EyuTA~ne)Cd58vjgc5J~AN;
zoxt~j1fN7bocrS;116I#==VOnSb>;zV3~l?YAz)kQ92}ejO=Pn(a!7t3u`}X;cxtj
z2t))T0uh0TKtv!S5D|z7L<AxN5rK$6MBpQgz=efVpI^(<oqN>|TeLZp(*M8qSFN>w
z#IN`h5r_yx1R??vfrvmvAR-VEhzLXkA_5VCh`@&vfzK|UZY}V|IXiZ*FPv^I^EnmG
zft33Hh5u@;-NUc=6A_3AL<AxN5rK$6L?9v%5r_yx1R??vfsYvi-&$O5-CbT=Tif2w
zkXn#qw@`)Cw2DGwe~rXq4-JJqJg}({lKZidInvO4P9SpV{81>wYJbmgTnoiE;n=(%
zTY1ol9r&tx(+%}Vniy@Y^R0#P(~-81-8UF^OT|WM5{I;4!)_!4@<K_5jH<j)$U5{p
znHJbO2*<PxhxOC3|35bW!~Xw%-wf=bI?e~<)nPKSQIEvBusdn<ReJsZiKU;k*8XVi
z`h~YI{P_Ia=YM?ezt8>Y`LC}0@5)cly}a~4OFvnDZ28ZYf9LE^SKnU!lM6RiudjS<
z<*~Cjo2|sp5rK$6L?9v%5r_zUPzYTA?UfdCwiiCLynMDPfk=NACq+KFKgDh$2e6Vr
z#`V&eki)<1&wzaSm8!vCKB+;T;HQ~XINhM+;n<VqaF`_d`tj2%t*hwgQ_IWCp`Voc
ztZ5t@ii7PK&R3n-fzaTr%~3T+GdOgKjh?zXaV+Jn<1bVl{(Pfle`FqZLBi%^30g+#
z_#7Fmtfx4j4~IGh1kTmRU*39k-0TU!;<UW6a8;kwH*OYtOb6j=xo-CQ@l*3(SlwM5
zc{8zhY=!T*9=Wk0z5HDH!j6A+{u>+LA&k_cgJuHs698dj1vSF<-1v=MJMN&_tFto;
z*`?J{gc`>KPMmL3bu`ptn+!1;$7<Ejt@-^7H{fV7oTxK9vqHT@hO!t<<<)UNudmL>
z6MN5Lj$`-G1iJ*x8GWe7p@v8quAaJ7_VfJwZiXAM)gF?2XS*5daUu~mB_B07?&hrv
zRjZ$0K07g;!d*}>(9x4yZPqW<)9Km@nw|5K{P|!0C|-Z|+vJ%k)k_-JW51En+Bj1V
ze)*)qhxU*+KDV2rdYmB|&^%KQ{@h7}4|ieT!Z}l^?qywnrXKwDvsJSbw9jl%Oi%2@
zpppNKJ>I8RezV^ABc&?LA1g<{G-ve98=x+c>ABRbHyj(@j~c8;f4n(=_+erT>}orY
zq|U4N#IOAGw7Gu##W~|IDIX4t!%h@Pna3epvvW#e&)2dZn;!DfaL!jt^x_-<CR)T+
z6m#Z&-6Hha&|>H)xpn-d`2dV>!<m8)>}aF@d;@^fbH)$-7lXq&)D%bOK?9!VeT{nT
z6|BNG-KWa&pPDoL#tk^i4EvHy0otrjG|uj=>Q9Y_e{HdBb$M!<V#5)xyEqRCyiHDS
zID$2bR>$?&Ga(!l=6iW_p=xh}LpQId{$zvMUe@j5@W9ba8h5fOpLqTM^o74{t^M)Z
zZ>^ofhxii_hzLXkA_5VCh(JUjA`lUX2t))T0ug}^9RgQRpYay)^<e7sC*q9{y75O^
zOsU2v)%&eN#nn@@jfL}wu{|yh>zLHDo97ib>wRPVD$dkv_N-F!g|~8baE<_W?woAw
zq<Y^N+g>Oe`&<~NznFG$@)408oV0{fAZHt!S3l?<4Y3D6^EIyE%jvbhYpwmu+CQ!R
zJwC*rh(JUjA`lUX2t))T0uh0TKtv!S5D|z7L<By}2rQpkUnmV3r^6?HDtuy#E2loU
IJV*ckKT)|oPyhe`

literal 0
HcmV?d00001

diff --git a/hscontrol/util/test.go b/hscontrol/util/test.go
index 0a23acb4e9..d93ae1f28c 100644
--- a/hscontrol/util/test.go
+++ b/hscontrol/util/test.go
@@ -4,7 +4,9 @@ import (
 	"net/netip"
 
 	"github.com/google/go-cmp/cmp"
+	"tailscale.com/types/ipproto"
 	"tailscale.com/types/key"
+	"tailscale.com/types/views"
 )
 
 var PrefixComparer = cmp.Comparer(func(x, y netip.Prefix) bool {
@@ -31,6 +33,8 @@ var DkeyComparer = cmp.Comparer(func(x, y key.DiscoPublic) bool {
 	return x.String() == y.String()
 })
 
+var ViewSliceIPProtoComparer = cmp.Comparer(func(a, b views.Slice[ipproto.Proto]) bool { return views.SliceEqual(a, b) })
+
 var Comparers []cmp.Option = []cmp.Option{
-	IPComparer, PrefixComparer, AddrPortComparer, MkeyComparer, NkeyComparer, DkeyComparer,
+	IPComparer, PrefixComparer, AddrPortComparer, MkeyComparer, NkeyComparer, DkeyComparer, ViewSliceIPProtoComparer,
 }
diff --git a/integration/route_test.go b/integration/route_test.go
index ed37164291..a92258aff6 100644
--- a/integration/route_test.go
+++ b/integration/route_test.go
@@ -1170,7 +1170,7 @@ func TestSubnetRouteACL(t *testing.T) {
 		},
 	}
 
-	if diff := cmp.Diff(wantClientFilter, clientNm.PacketFilter, util.PrefixComparer); diff != "" {
+	if diff := cmp.Diff(wantClientFilter, clientNm.PacketFilter, util.ViewSliceIPProtoComparer, util.PrefixComparer); diff != "" {
 		t.Errorf("Client (%s) filter, unexpected result (-want +got):\n%s", client.Hostname(), diff)
 	}
 
@@ -1220,7 +1220,7 @@ func TestSubnetRouteACL(t *testing.T) {
 		},
 	}
 
-	if diff := cmp.Diff(wantSubnetFilter, subnetNm.PacketFilter, util.PrefixComparer); diff != "" {
+	if diff := cmp.Diff(wantSubnetFilter, subnetNm.PacketFilter, util.ViewSliceIPProtoComparer, util.PrefixComparer); diff != "" {
 		t.Errorf("Subnet (%s) filter, unexpected result (-want +got):\n%s", subRouter1.Hostname(), diff)
 	}
 }