Kristoffer Dalby 0b1727c337 policy: merge filter rules with identical SrcIPs and IPProto ...

Tailscale merges multiple ACL rules into fewer FilterRule entries
when they have identical SrcIPs and IPProto, combining their DstPorts
arrays. This change implements the same behavior in Headscale.

Add mergeFilterRules() which uses O(n) hash map lookup to merge rules
with identical keys. DstPorts are NOT deduplicated to match Tailscale
behavior.

Also fix DestsIsTheInternet() to handle merged filter rules where
TheInternet is combined with other destinations - now uses superset
check instead of equality check.

Updates #3036

2026-02-05 19:29:16 +01:00

..

matcher_test.go

Split code into modules

2023-05-26 12:24:50 +02:00

matcher.go

policy: merge filter rules with identical SrcIPs and IPProto

2026-02-05 19:29:16 +01:00