Problem
The kernel allowlists are exact-match hash maps — ALLOW: HashMap<u32> / ALLOW6: HashMap<u128> (crates/pasu-ebpf/src/main.rs). A subnet can only be allowed by enumerating every address, which doesn't scale to the way self-hosted / internal networks are actually specified (10.0.0.0/8, fd00::/8, ...).
Proposal
- Switch (or add)
LpmTrie maps (aya supports BPF_MAP_TYPE_LPM_TRIE) keyed by prefix for v4 and v6.
- Accept CIDR everywhere an address is accepted today:
--allow, policy YAML egress_allowlist.ips/ips6, the admin socket allow/deny.
- Exact IPs become /32 (v4) and /128 (v6) prefixes — no behavior change for existing configs.
Tests (per CONTRIBUTING)
- Kernel E2E TP/TN: allow
198.51.100.0/24 → an address inside passes, an adjacent one outside is dropped.
- Regression: exact-IP configs behave identically.
Problem
The kernel allowlists are exact-match hash maps —
ALLOW: HashMap<u32>/ALLOW6: HashMap<u128>(crates/pasu-ebpf/src/main.rs). A subnet can only be allowed by enumerating every address, which doesn't scale to the way self-hosted / internal networks are actually specified (10.0.0.0/8,fd00::/8, ...).Proposal
LpmTriemaps (aya supportsBPF_MAP_TYPE_LPM_TRIE) keyed by prefix for v4 and v6.--allow, policy YAMLegress_allowlist.ips/ips6, the admin socketallow/deny.Tests (per CONTRIBUTING)
198.51.100.0/24→ an address inside passes, an adjacent one outside is dropped.