only send relevant filterrules to nodes

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

hscontrol/mapper/mapper_test.go

@@ -403,8 +403,8 @@ func Test_fullMapResponse(t *testing.T) {
 				ACLs: []policy.ACL{
 					{
 						Action:       "accept",
-						Sources:      []string{"mini"},
-						Destinations: []string{"100.64.0.2:*"},
+						Sources:      []string{"100.64.0.2"},
+						Destinations: []string{"mini:*"},
 					},
 				},
 			},
@@ -430,8 +430,9 @@ func Test_fullMapResponse(t *testing.T) {
 				CollectServices: "false",
 				PacketFilter: []tailcfg.FilterRule{
 					{
-						SrcIPs: []string{"100.64.0.1/32", "100.64.0.2/32"},
+						SrcIPs: []string{"100.64.0.2/32"},
 						DstPorts: []tailcfg.NetPortRange{
+							{IP: "100.64.0.1/32", Ports: tailcfg.PortRangeAny},
 							{IP: "100.64.0.2/32", Ports: tailcfg.PortRangeAny},
 						},
 					},