From 5642d976b248559b80e4bce70f75b5153f98977c Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sat, 31 Oct 2026 14:04:36 +0000 Subject: [PATCH] policy, state: correct MatchersForNode's doc It filters routes. Peers come from BuildPeerMap. Updates #3626 --- hscontrol/policy/pm.go | 2 +- hscontrol/policy/v2/policy.go | 5 ++--- hscontrol/state/state.go | 2 +- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/hscontrol/policy/pm.go b/hscontrol/policy/pm.go index c71dc88df..10992342d 100644 --- a/hscontrol/policy/pm.go +++ b/hscontrol/policy/pm.go @@ -16,7 +16,7 @@ type PolicyManager interface { Filter() ([]tailcfg.FilterRule, []matcher.Match) // FilterForNode returns filter rules for a specific node, handling autogroup:self FilterForNode(node types.NodeView) ([]tailcfg.FilterRule, error) - // MatchersForNode returns matchers for peer relationship determination (unreduced) + // MatchersForNode returns the unreduced matchers that filter the routes a node sees MatchersForNode(node types.NodeView) ([]matcher.Match, error) // BuildPeerMap constructs peer relationship maps for the given nodes BuildPeerMap(nodes views.Slice[types.NodeView]) map[types.NodeID][]types.NodeID diff --git a/hscontrol/policy/v2/policy.go b/hscontrol/policy/v2/policy.go index ae776e767..6a87abc94 100644 --- a/hscontrol/policy/v2/policy.go +++ b/hscontrol/policy/v2/policy.go @@ -1052,7 +1052,7 @@ func (pm *PolicyManager) FilterForNode(node types.NodeView) ([]tailcfg.FilterRul return pm.filterForNodeLocked(node), nil } -// MatchersForNode returns the matchers for peer relationship determination for a specific node. +// MatchersForNode returns the matchers that filter the routes a node sees. // These are UNREDUCED matchers - they include all rules where the node could be either source or destination. // This is different from [PolicyManager.FilterForNode] which returns REDUCED rules for packet filtering. // @@ -1060,8 +1060,7 @@ func (pm *PolicyManager) FilterForNode(node types.NodeView) ([]tailcfg.FilterRul // For autogroup:self: returns node-specific matchers from unreduced compiled rules. // // Per-node results are cached and invalidated on policy/node updates -// so [PolicyManager.BuildPeerMap]'s O(N²) slow path avoids recomputing -// matchers for every pair. +// so building a node's map does not recompile them. func (pm *PolicyManager) MatchersForNode(node types.NodeView) ([]matcher.Match, error) { if pm == nil { return nil, nil diff --git a/hscontrol/state/state.go b/hscontrol/state/state.go index 5c386d097..138b9eee8 100644 --- a/hscontrol/state/state.go +++ b/hscontrol/state/state.go @@ -1683,7 +1683,7 @@ func (s *State) FilterForNode(node types.NodeView) ([]tailcfg.FilterRule, error) return s.polMan.FilterForNode(node) } -// MatchersForNode returns matchers for peer relationship determination (unreduced). +// MatchersForNode returns the unreduced matchers that filter the routes a node sees. func (s *State) MatchersForNode(node types.NodeView) ([]matcher.Match, error) { return s.polMan.MatchersForNode(node) }