Method RunIn

wgengine/filter/filter.go:443–472

RunIn determines whether this node is allowed to receive q from a Tailscale peer.

(q *packet.Parsed, rf RunFlags)

// RunIn determines whether this node is allowed to receive q from a
// Tailscale peer.
func (f *Filter) RunIn(q *packet.Parsed, rf RunFlags) Response {
	dir := in
	r, _ := f.pre(q, rf, dir)
	if r == Accept || r == Drop {
		// already logged
		return r
	}

	var why string
	switch q.IPVersion {
	case 4:
		r, why = f.runIn4(q)
	case 6:
		r, why = f.runIn6(q)
	default:
		r, why = Drop, "not-ip"
	}

	if r == noVerdict {
		for _, pm := range f.IngressAllowHooks {
			if match, why := pm(*q); match {
				f.logRateLimit(rf, q, dir, Accept, why)
				return Accept
			}
		}
		r = Drop
	}
	f.logRateLimit(rf, q, dir, r, why)
	return r
}

// RunOut determines whether this node is allowed to send q to a
// Tailscale peer.