headscale/hscontrol/policy/policyutil/doc.go

// Package policyutil contains pure functions that transform compiled
// policy rules for a specific node. The headline function is
// [ReduceFilterRules], which filters global rules down to those relevant
// to one node.
//
// A node's [types.NodeView.SubnetRoutes] (approved, non-exit) participate
// in rule matching so subnet routers receive filter rules for
// destinations their subnets cover.
package policyutil
policyutil: fix reduceCapGrantRule and add route reduction reduceCapGrantRule was dropping rules whose CapGrant IPs overlap a subnet route; treat subnet routes as part of node identity so those rules survive reduction. ReduceFilterRules now also reduces route-reachable destinations. Updates #3157 2026-04-15 08:27:42 +00:00			`// Package policyutil contains pure functions that transform compiled`
			`// policy rules for a specific node. The headline function is`
all: apply godoc [Name] link conventions across comments Every Go-identifier reference in // and /* */ comments now uses godoc's [Name] linking syntax so pkg.go.dev and `go doc` render them as clickable cross-references. No behaviour change. Pattern applied across the tree: In-package [Foo], [Foo.Bar] Cross-package [pkg.Foo], [pkg.Foo.Bar] Stdlib [netip.Prefix], [errors.Is], [context.Context] Tailscale [tailcfg.MapResponse], [tailcfg.Node.CapMap], [tailcfg.NodeAttrSuggestExitNode] Skip rules: - File:line refs left as plain text - HuJSON wire keys inside backtick raw strings untouched - ACL/policy syntax tokens (tag:foo, autogroup:self, ...) not Go symbols, left as plain text - JSON/OIDC wire keys, gorm tags, RFC IPv6 placeholders, markdown link tags, decorative dividers — all left as-is 2026-05-18 18:35:53 +00:00			`// [ReduceFilterRules], which filters global rules down to those relevant`
policyutil: fix reduceCapGrantRule and add route reduction reduceCapGrantRule was dropping rules whose CapGrant IPs overlap a subnet route; treat subnet routes as part of node identity so those rules survive reduction. ReduceFilterRules now also reduces route-reachable destinations. Updates #3157 2026-04-15 08:27:42 +00:00			`// to one node.`
			`//`
all: apply godoc [Name] link conventions across comments Every Go-identifier reference in // and /* */ comments now uses godoc's [Name] linking syntax so pkg.go.dev and `go doc` render them as clickable cross-references. No behaviour change. Pattern applied across the tree: In-package [Foo], [Foo.Bar] Cross-package [pkg.Foo], [pkg.Foo.Bar] Stdlib [netip.Prefix], [errors.Is], [context.Context] Tailscale [tailcfg.MapResponse], [tailcfg.Node.CapMap], [tailcfg.NodeAttrSuggestExitNode] Skip rules: - File:line refs left as plain text - HuJSON wire keys inside backtick raw strings untouched - ACL/policy syntax tokens (tag:foo, autogroup:self, ...) not Go symbols, left as plain text - JSON/OIDC wire keys, gorm tags, RFC IPv6 placeholders, markdown link tags, decorative dividers — all left as-is 2026-05-18 18:35:53 +00:00			`// A node's [types.NodeView.SubnetRoutes] (approved, non-exit) participate`
			`// in rule matching so subnet routers receive filter rules for`
			`// destinations their subnets cover.`
policyutil: fix reduceCapGrantRule and add route reduction reduceCapGrantRule was dropping rules whose CapGrant IPs overlap a subnet route; treat subnet routes as part of node identity so those rules survive reduction. ReduceFilterRules now also reduces route-reachable destinations. Updates #3157 2026-04-15 08:27:42 +00:00			`package policyutil`