wgengine/filter: add filter benchmark

Baseline, on 2020 M1 Macbook Pro, on power:

    goos: darwin
    goarch: arm64
    pkg: tailscale.com/wgengine/filter
    BenchmarkFilterMatch/file1-8    34089133                32.79 ns/op
    BenchmarkFilterMatch/file1-8    35423917                32.59 ns/op
    BenchmarkFilterMatch/file1-8    35208598                32.80 ns/op
    BenchmarkFilterMatch/file1-8    35180470                33.39 ns/op
    BenchmarkFilterMatch/file1-8    36671608                32.82 ns/op
    BenchmarkFilterMatch/file1-8    35435991                33.13 ns/op
    BenchmarkFilterMatch/file1-8    34689181                33.29 ns/op
    BenchmarkFilterMatch/file1-8    34786053                32.94 ns/op
    BenchmarkFilterMatch/file1-8    35366235                32.56 ns/op
    BenchmarkFilterMatch/file1-8    35342799                32.47 ns/op

Updates #12486

Change-Id: I8f902bc064effb431e5b46751115942104ff6531
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

wgengine/filter/filter_test.go

@@ -5,8 +5,11 @@
 
 import (
 	"encoding/hex"
+	"encoding/json"
+	"flag"
 	"fmt"
 	"net/netip"
+	"os"
 	"slices"
 	"strconv"
 	"strings"
@@ -22,6 +25,7 @@
 	"tailscale.com/tstime/rate"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/logger"
+	"tailscale.com/util/must"
 )
 
 // testAllowedProto is an IP protocol number we treat as allowed for
@@ -819,6 +823,7 @@ func TestMatchesFromFilterRules(t *testing.T) {
 
 			compareIP := cmp.Comparer(func(a, b netip.Addr) bool { return a == b })
 			compareIPPrefix := cmp.Comparer(func(a, b netip.Prefix) bool { return a == b })
+
 			if diff := cmp.Diff(got, tt.want, compareIP, compareIPPrefix); diff != "" {
 				t.Errorf("wrong (-got+want)\n%s", diff)
 			}
@@ -954,3 +959,49 @@ func TestPeerCaps(t *testing.T) {
 		})
 	}
 }
+
+var (
+	filterMatchFile = flag.String("filter-match-file", "", "JSON file of []filter.Match to benchmark")
+)
+
+func BenchmarkFilterMatchFile(b *testing.B) {
+	if *filterMatchFile == "" {
+		b.Skip("no --filter-match-file specified; skipping")
+	}
+	benchmarkFile(b, *filterMatchFile)
+}
+
+func BenchmarkFilterMatch(b *testing.B) {
+	b.Run("file1", func(b *testing.B) {
+		benchmarkFile(b, "testdata/matches-1.json")
+	})
+}
+
+func benchmarkFile(b *testing.B, file string) {
+	var matches []Match
+	bts, err := os.ReadFile(file)
+	if err != nil {
+		b.Fatal(err)
+	}
+	if err := json.Unmarshal(bts, &matches); err != nil {
+		b.Fatal(err)
+	}
+
+	var localNets netipx.IPSetBuilder
+	localNets.AddPrefix(netip.MustParsePrefix("100.96.14.120/32"))
+	localNets.AddPrefix(netip.MustParsePrefix("fd7a:115c:a1e0:ab12:4843:cd96:6260:e78/32"))
+
+	var logIPs netipx.IPSetBuilder
+	logIPs.AddPrefix(tsaddr.CGNATRange())
+	logIPs.AddPrefix(tsaddr.TailscaleULARange())
+
+	f := New(matches, must.Get(localNets.IPSet()), must.Get(logIPs.IPSet()), nil, logger.Discard)
+	pkt := parsed(ipproto.TCP, "1.2.3.4", "5.6.7.8", 33123, 443)
+
+	for range b.N {
+		got := f.RunIn(&pkt, 0)
+		if got != Drop {
+			b.Fatalf("got %v; want Drop", got)
+		}
+	}
+}