From e811e968a4ba6b53e527abfcfbcc736bebb4da9f Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@tailscale.com>
Date: Wed, 16 Apr 2025 11:18:09 +0200
Subject: [PATCH] policy/v1: fix potential nil pointer in NodeCanApproveRoute

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
---
 hscontrol/policy/v1/policy.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hscontrol/policy/v1/policy.go b/hscontrol/policy/v1/policy.go
index 0ac49d04..06558927 100644
--- a/hscontrol/policy/v1/policy.go
+++ b/hscontrol/policy/v1/policy.go
@@ -174,7 +174,7 @@ func (pm *PolicyManager) NodeCanApproveRoute(node *types.Node, route netip.Prefi
 			}
 
 			// approvedIPs should contain all of node's IPs if it matches the rule, so check for first
-			if ips.Contains(*node.IPv4) {
+			if ips != nil && ips.Contains(*node.IPv4) {
 				return true
 			}
 		}