Jonas Schwartz f8018f177a policy/v2: skip via resolution when the policy has no via grants ...

ViaRoutesForPeer runs for every peer of every map response. Before it
looks at Via, it converts every ACL to grants and resolves each grant's
sources and destinations against the whole node set. Only via grants
can add to the result and ACLs never carry via, so without a via grant
all of that work was discarded. On large tailnets it dominated map
generation. Return early instead.

BenchmarkViaRoutesForPeer, mean per peer (Apple M3 Pro):

	policy     nodes  before    after
	global     1000   21.8us    9ns, 0 allocs
	self       1000   45.0us    9ns, 0 allocs
	via        1000   8.1us     unchanged
	via-mixed  1000   69.0us    unchanged

Fixes #3512

2026-10-08 12:43:45 +02:00

..

testdata

policy/v2: add via exit node captures with unrelated rules

2026-09-30 17:20:46 +02:00

canaccess_equiv_test.go

policy: precompute node routes in the peer-map build

2026-06-08 10:04:49 +02:00

compiled.go

policy/v2: send exit nodes every user's autogroup:self rules

2026-09-30 17:20:46 +02:00

filter_test.go

policy/v2: match the login user in SSHCheckParams

2026-10-08 10:29:23 +02:00

filter.go

policy/v2: send an empty SSH policy when no rule applies

2026-10-08 10:29:23 +02:00

issue_3212_test.go

policy,state: key the peer map by node ID

2026-09-10 13:06:13 +02:00

issue_3233_test.go

policy/v2: let autogroup:internet rules lift via exit steering

2026-09-30 17:20:46 +02:00

issue_3267_test.go

all: apply golangci-lint autofixes

2026-08-25 21:59:00 +02:00

main_test.go

all: fix test flakiness and improve test infrastructure

2026-03-14 02:52:28 -07:00

node_recompute_test.go

all: apply golangci-lint autofixes

2026-08-25 21:59:00 +02:00

nodeattrs_test.go

policy/v2: resolve unregistered users to an empty set

2026-10-07 11:10:51 +02:00

policy_concurrency_test.go

policy/v2: stop ViaRoutesForPeer appending into pm.pol.Grants

2026-10-07 11:10:38 +02:00

policy_test.go

policy/v2: skip via resolution when the policy has no via grants

2026-10-08 12:43:45 +02:00

policy.go

policy/v2: skip via resolution when the policy has no via grants

2026-10-08 12:43:45 +02:00

policytester_compat_test.go

all: apply golangci-lint autofixes

2026-08-25 21:59:00 +02:00

sshtest_test.go

policy/v2: test unregistered users at every policy site

2026-10-07 11:10:51 +02:00

sshtest.go

policy/v2: resolve unregistered users to an empty set

2026-10-07 11:10:51 +02:00

sshtester_compat_test.go

policy/v2: add sshtester compat runner

2026-05-13 21:10:13 +02:00

tailnet_state_caps.go

policy/v2: suggest approved exit nodes by default

2026-09-23 14:48:45 +02:00

tailscale_acl_data_compat_test.go

all: apply golangci-lint autofixes

2026-08-25 21:59:00 +02:00

tailscale_grants_compat_test.go

policy/v2: add via exit node captures with unrelated rules

2026-09-30 17:20:46 +02:00

tailscale_nodeattrs_compat_test.go

all: inline deprecated tailcfg capability aliases

2026-08-25 21:59:00 +02:00

tailscale_routes_data_compat_test.go

policy/v2: compare peer CapMap against SaaS route captures

2026-09-23 14:48:45 +02:00

tailscale_ssh_data_compat_test.go

policy/v2: match the login user in SSHCheckParams

2026-10-08 10:29:23 +02:00

test_test.go

policy/v2: test unregistered users at every policy site

2026-10-07 11:10:51 +02:00

test.go

policy/v2: resolve unregistered users to an empty set

2026-10-07 11:10:51 +02:00

types_test.go

policy/v2: resolve unregistered users to an empty set

2026-10-07 11:10:51 +02:00

types.go

policy/v2: resolve unregistered users to an empty set

2026-10-07 11:10:51 +02:00

utils_test.go

chore: fix function comment to match actual function name

2026-07-03 07:27:08 +02:00

utils.go

all: use strings.CutLast

2026-08-25 21:59:00 +02:00