TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-07-30 07:43:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

wgengine/filter: add single-item version of MatchesFromFilterRules

Browse Source 
In the other repo, we have a few cases where we call
MatchesFromFilterRules with a single tailcfg.FilterRule. Rather than
allocating a slice and then looping over the single-item slice, split
the internal logic out to a function that takes a single FilterRule so
we can use that.

Updates tailscale/corp#26353

Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
Change-Id: I95f2a7ee9de130712497259941264f06f3d00777
This commit is contained in:
Andrew Dunham 2025-02-11 16:34:20 -05:00
parent bc0cd512ee
commit bb8b22ff4f
1 changed files with 92 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
wgengine/filter/tailcfg.go
View File

@ -31,15 +31,30 @@ var defaultProtosView = views.SliceOf(defaultProtos)
func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
mm := make([]Match, 0, len(pf))
var erracc error
for _, r := range pf {
if len(r.SrcBits) > 0 {
return nil, fmt.Errorf("unexpected SrcBits; control plane should not send this to this client version")
m, err := MatchFromFilterRule(r)
if err != nil && erracc == nil {
erracc = err
}
mm = append(mm, m)
}
return mm, erracc
}
// MatchFromFilterRule converts a single tailcfg FilterRule into a Match.
//
// If an error is returned, the Match result is still valid, containing the
// portions of the rule that were successfully converted.
func MatchFromFilterRule(r tailcfg.FilterRule) (m Match, retErr error) {
if len(r.SrcBits) > 0 {
var zero Match
return zero, fmt.Errorf("unexpected SrcBits; control plane should not send this to this client version")
}
// Profiling determined that this function was spending a lot
// of time in runtime.growslice. As such, we attempt to
// pre-allocate some slices. Multipliers were chosen arbitrarily.
m := Match{
m = Match{
Srcs: make([]netip.Prefix, 0, len(r.SrcIPs)),
Dsts: make([]NetPortRange, 0, 2*len(r.DstPorts)),
Caps: make([]CapMatch, 0, 3*len(r.CapGrant)),
@ -59,8 +74,8 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
for _, s := range r.SrcIPs {
nets, cap, err := parseIPSet(s)
if err != nil && erracc == nil {
erracc = err
if err != nil && retErr == nil {
retErr = err
continue
}
m.Srcs = append(m.Srcs, nets...)
@ -72,15 +87,16 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
for _, d := range r.DstPorts {
if d.Bits != nil {
return nil, fmt.Errorf("unexpected DstBits; control plane should not send this to this client version")
var zero Match
return zero, fmt.Errorf("unexpected DstBits; control plane should not send this to this client version")
}
nets, cap, err := parseIPSet(d.IP)
if err != nil && erracc == nil {
erracc = err
if err != nil && retErr == nil {
retErr = err
continue
}
if cap != "" {
erracc = fmt.Errorf("unexpected capability %q in DstPorts", cap)
retErr = fmt.Errorf("unexpected capability %q in DstPorts", cap)
continue
}
for _, net := range nets {
@ -111,9 +127,7 @@ func MatchesFromFilterRules(pf []tailcfg.FilterRule) ([]Match, error) {
}
}
mm = append(mm, m)
}
return mm, erracc
return m, retErr
}
var (