policy: add NodeNeedsPeerRecompute predicate

Reports whether a node's online/offline transition forces peers to recompute their netmap. True for subnet routers, relay targets (tailscale.com/cap/relay), and via targets; false otherwise.

The relay-target IP set and via-target tag set are precompiled from the grants in updateLocked, alongside the existing filter, so the per-node check is a cheap set lookup. Keyed on the node itself, so an ordinary node in a tailnet that uses relay or via for other nodes is still classified as not needing a recompute.

Updates #3293
This commit is contained in:
Kristoffer Dalby 2026-06-03 10:25:20 +00:00
parent 171fd7a3c5
commit bceac495f9
4 changed files with 253 additions and 0 deletions

View file

@ -36,6 +36,14 @@ type PolicyManager interface {
// NodeCanApproveRoute reports whether the given node can approve the given route.
NodeCanApproveRoute(node types.NodeView, route netip.Prefix) bool
// NodeNeedsPeerRecompute reports whether peers must recompute their
// netmap when the node's online state changes. True for subnet
// routers, relay targets (tailscale.com/cap/relay), and via targets;
// false for ordinary nodes, which only need a lightweight online or
// offline peer patch. [State.Connect] and [State.Disconnect] use it to
// avoid a tailnet-wide recompute on every ordinary reconnect.
NodeNeedsPeerRecompute(node types.NodeView) bool
// ViaRoutesForPeer computes via grant effects for a viewer-peer pair.
// It returns which routes should be included (peer is via-designated for viewer)
// and excluded (steered to a different peer). When no via grants apply,