TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-07-31 00:03:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

wgengine/filter: add single-item version of MatchesFromFilterRules

Browse Source 
In the other repo, we have a few cases where we call
MatchesFromFilterRules with a single tailcfg.FilterRule. Rather than
allocating a slice and then looping over the single-item slice, split
the internal logic out to a function that takes a single FilterRule so
we can use that.

Updates tailscale/corp#26353

Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Change-Id: I95f2a7ee9de130712497259941264f06f3d00777
This commit is contained in:
Andrew Dunham 2025-02-11 16:34:20 -05:00
parent bc0cd512ee
commit bb8b22ff4f
1 changed files with 92 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
wgengine/filter/tailcfg.go
View File

@ -31,15 +31,30 @@ var defaultProtosView = views.SliceOf(defaultProtos)
func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) { func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
mm := make([]Match, 0, len(pf)) mm := make([]Match, 0, len(pf))
var erracc error var erracc error
for _, r := range pf { for _, r := range pf {
if len(r.SrcBits) > 0 { m, err := MatchFromFilterRule(r)
return nil, fmt.Errorf("unexpected SrcBits; control plane should not send this to this client version") if err != nil && erracc == nil {
erracc = err
} }
mm = append(mm, m)
}
return mm, erracc
}
// MatchFromFilterRule converts a single tailcfg FilterRule into a Match.
//
// If an error is returned, the Match result is still valid, containing the
// portions of the rule that were successfully converted.
func MatchFromFilterRule(r tailcfg.FilterRule) (m Match, retErr error) {
if len(r.SrcBits) > 0 {
var zero Match
return zero, fmt.Errorf("unexpected SrcBits; control plane should not send this to this client version")
}
// Profiling determined that this function was spending a lot // Profiling determined that this function was spending a lot
// of time in runtime.growslice. As such, we attempt to // of time in runtime.growslice. As such, we attempt to
// pre-allocate some slices. Multipliers were chosen arbitrarily. // pre-allocate some slices. Multipliers were chosen arbitrarily.
m := Match{ m = Match{
Srcs: make([]netip.Prefix, 0, len(r.SrcIPs)), Srcs: make([]netip.Prefix, 0, len(r.SrcIPs)),
Dsts: make([]NetPortRange, 0, 2*len(r.DstPorts)), Dsts: make([]NetPortRange, 0, 2*len(r.DstPorts)),
Caps: make([]CapMatch, 0, 3*len(r.CapGrant)), Caps: make([]CapMatch, 0, 3*len(r.CapGrant)),
@ -59,8 +74,8 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
for _, s := range r.SrcIPs { for _, s := range r.SrcIPs {
nets, cap, err := parseIPSet(s) nets, cap, err := parseIPSet(s)
if err != nil && erracc == nil { if err != nil && retErr == nil {
erracc = err retErr = err
continue continue
} }
m.Srcs = append(m.Srcs, nets...) m.Srcs = append(m.Srcs, nets...)
@ -72,15 +87,16 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
for _, d := range r.DstPorts { for _, d := range r.DstPorts {
if d.Bits != nil { if d.Bits != nil {
return nil, fmt.Errorf("unexpected DstBits; control plane should not send this to this client version") var zero Match
return zero, fmt.Errorf("unexpected DstBits; control plane should not send this to this client version")
} }
nets, cap, err := parseIPSet(d.IP) nets, cap, err := parseIPSet(d.IP)
if err != nil && erracc == nil { if err != nil && retErr == nil {
erracc = err retErr = err
continue continue
} }
if cap != "" { if cap != "" {
erracc = fmt.Errorf("unexpected capability %q in DstPorts", cap) retErr = fmt.Errorf("unexpected capability %q in DstPorts", cap)
continue continue
} }
for _, net := range nets { for _, net := range nets {
@ -111,9 +127,7 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
} }
} }
mm = append(mm, m) return m, retErr
}
return mm, erracc
} }
var ( var (