From 4dedb7081820a9535c4936040fe9f500d2b936ca Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 4 Apr 2026 13:20:45 +0000 Subject: [PATCH] policy: document CanAccessRoute and filterForNodeLocked design Add source comments explaining design decisions: CanAccessRoute (types/node.go): Explain why DestsIsTheInternet is intentionally absent. Exit routes are handled by RoutesForPeer via ExitRoutes(), not ACL-based filtering. autogroup:internet is skipped during filter compilation, so no matchers contain 'the internet'. Updates #3157 Updates #3169 --- hscontrol/types/node.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/hscontrol/types/node.go b/hscontrol/types/node.go index 755cf0e4..7010d3b0 100644 --- a/hscontrol/types/node.go +++ b/hscontrol/types/node.go @@ -363,6 +363,22 @@ func (node *Node) CanAccess(matchers []matcher.Match, node2 *Node) bool { return false } +// CanAccessRoute determines whether a specific route prefix should be +// visible to this node based on the given matchers. +// +// Unlike CanAccess, this function intentionally does NOT check +// DestsIsTheInternet(). Exit routes (0.0.0.0/0, ::/0) are handled by +// RoutesForPeer (state.go) which adds them unconditionally from +// ExitRoutes(), not through ACL-based route filtering. The +// DestsIsTheInternet check in CanAccess exists solely for peer +// visibility determination (should two nodes see each other), which +// is a separate concern from route prefix authorization. +// +// Additionally, autogroup:internet is explicitly skipped during filter +// rule compilation (filter.go), so no matchers ever contain "the +// internet" from internet-targeted ACLs. Wildcard "*" dests produce +// matchers where DestsOverlapsPrefixes(0.0.0.0/0) already returns +// true, so the check would be redundant for that case. func (node *Node) CanAccessRoute(matchers []matcher.Match, route netip.Prefix) bool { src := node.IPs() subnetRoutes := node.SubnetRoutes()