54db47badc
Compile grants with "via" field into FilterRules that are placed only on nodes matching the via tag and actually advertising the destination subnets. Key behavior: - Filter rules go exclusively to via-nodes with matching approved routes - Destination subnets not advertised by the via node are silently dropped - App-only via grants (no ip field) produce no packet filter rules - Via grants are skipped in the global compileFilterRules since they are node-specific Reduces grant compat test skips from 41 to 30 (11 newly passing). Updates #2180 |
||
|---|---|---|
| .. | ||
| matcher | ||
| policyutil | ||
| v2 | ||
| pm.go | ||
| policy.go | ||
| policy_autoapprove_test.go | ||
| policy_route_approval_test.go | ||
| policy_test.go | ||
| route_approval_test.go | ||