Perform CIDR validation in localapi instead of cmd/tailscale #18243
Description
What is the issue?
The control plane requires that CIDRs for subnet routes use the network address (no host bits set). This requirement is enforced by the logic in cmd, but not by the localapi.
If you send the localapi an invalid CIDR such as 192.168.1.1/24, it will happily accept it and send it on to the control plane, which then creates errors there.
The localapi should enforce these requirements so that the check is completed no matter how the updated route is sent.
Refs:
Check in cmd:
tailscale/cmd/tailscale/cli/set.go
Line 300 in e4847fa
Discord thread related to the resulting admin panel error:
https://discord.com/channels/1379528469859532931/1450887790425407578/1450887790425407578
Steps to reproduce
No response
Are there any recent changes that introduced the issue?
No response
OS
No response
OS version
No response
Tailscale version
No response
Other software
No response
Bug report
No response