reduce hashing on relevant groups calc

client/iface/iface_test.go

@@ -464,8 +464,6 @@ func Test_RemovePeer(t *testing.T) {
 }
 
 func Test_ConnectPeers(t *testing.T) {
-	t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
-
 	peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
 	peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
 	peer1Key, _ := wgtypes.GeneratePrivateKey()
@@ -507,8 +505,12 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP1 := "127.0.0.1"
-	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
+	localIP, err := getLocalIP()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer1wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -544,8 +546,7 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP2 := "127.0.0.1"
-	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
+	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer2wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -620,3 +621,28 @@ func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	}
 	return wgtypes.Peer{}, fmt.Errorf("peer not found")
 }
+
+func getLocalIP() (string, error) {
+	// Get all interfaces
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return "", err
+	}
+
+	for _, addr := range addrs {
+		ipNet, ok := addr.(*net.IPNet)
+		if !ok {
+			continue
+		}
+		if ipNet.IP.IsLoopback() {
+			continue
+		}
+
+		if ipNet.IP.To4() == nil {
+			continue
+		}
+		return ipNet.IP.String(), nil
+	}
+
+	return "", fmt.Errorf("no local IP found")
+}

management/server/types/account_components.go

@@ -321,10 +321,19 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 
 	relevantPeerIDs[peerID] = a.GetPeer(peerID).ToComponent()
 
+	addRelevantGroup := func(groupID string) *Group {
+		if g, ok := relevantGroupIDs[groupID]; ok {
+			return g
+		}
+		g := a.GetGroup(groupID)
+		relevantGroupIDs[groupID] = g
+		return g
+	}
+
 	peerGroupSet := make(map[string]struct{}, 8)
 	for groupID, group := range a.Groups {
 		if slices.Contains(group.Peers, peerID) {
-			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+			relevantGroupIDs[groupID] = group
 			peerGroupSet[groupID] = struct{}{}
 		}
 	}
@@ -355,15 +364,12 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			continue
 		}
 
-		for _, groupID := range r.PeerGroups {
-			relevantGroupIDs[groupID] = a.GetGroup(groupID)
-		}
 		for _, groupID := range r.Groups {
-			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+			addRelevantGroup(groupID)
 		}
 		if r.Enabled {
 			for _, groupID := range r.AccessControlGroups {
-				relevantGroupIDs[groupID] = a.GetGroup(groupID)
+				addRelevantGroup(groupID)
 				routeAccessControlGroups[groupID] = struct{}{}
 			}
 		}
@@ -389,7 +395,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			}
 		}
 		for _, groupID := range r.PeerGroups {
-			g := a.GetGroup(groupID)
+			g := addRelevantGroup(groupID)
 			if g == nil {
 				continue
 			}
@@ -424,10 +430,10 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					if _, needed := routeAccessControlGroups[destGroupID]; needed {
 						policyRelevant = true
 						for _, srcGroupID := range rule.Sources {
-							relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
+							addRelevantGroup(srcGroupID)
 						}
 						for _, dstGroupID := range rule.Destinations {
-							relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
+							addRelevantGroup(dstGroupID)
 						}
 						break
 					}
@@ -463,7 +469,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					}
 				}
 				for _, dstGroupID := range rule.Destinations {
-					relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
+					addRelevantGroup(dstGroupID)
 				}
 			}
 
@@ -475,7 +481,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					}
 				}
 				for _, srcGroupID := range rule.Sources {
-					relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
+					addRelevantGroup(srcGroupID)
 				}
 
 				if rule.Protocol == PolicyRuleProtocolNetbirdSSH {

proxy/internal/auth/tunnel_cache.go

@@ -3,30 +3,20 @@ package auth
 import (
 	"context"
 	"net/netip"
-	"os"
-	"strings"
 	"sync"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"golang.org/x/sync/singleflight"
 
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-// tunnelCacheTTL is the default cap on how long a positive ValidateTunnelPeer
-// result is reused before re-fetching from management. 5 minutes balances
-// freshness against management load on busy mesh networks. Override it with
-// envTunnelCacheTTL when an account needs authorization changes to take effect
-// sooner (at the cost of more ValidateTunnelPeer RPCs).
+// tunnelCacheTTL caps how long a positive ValidateTunnelPeer result is
+// reused before re-fetching from management. 5 minutes balances freshness
+// against management load on busy mesh networks.
 const tunnelCacheTTL = 300 * time.Second
 
-// envTunnelCacheTTL overrides tunnelCacheTTL. The value is a Go duration string
-// (e.g. "30s", "2m"); an unset, unparseable, or non-positive value keeps the
-// default.
-const envTunnelCacheTTL = "NB_PROXY_TUNNEL_CACHE_TTL"
-
 // tunnelCachePerAccount caps the number of cached identities per account.
 // Bounded eviction avoids memory growth in pathological cases (huge peer
 // roster, brief request bursts) while staying generous for normal use.
@@ -70,35 +60,16 @@ type accountBucket struct {
 	order []tunnelCacheKey
 }
 
-// newTunnelValidationCache constructs a cache with the configured TTL
-// (envTunnelCacheTTL override or default) and default bounds.
+// newTunnelValidationCache constructs a cache with default TTL and bounds.
 func newTunnelValidationCache() *tunnelValidationCache {
 	return &tunnelValidationCache{
 		entries: make(map[types.AccountID]*accountBucket),
-		ttl:     tunnelCacheTTLFromEnv(),
+		ttl:     tunnelCacheTTL,
 		maxSize: tunnelCachePerAccount,
 		now:     time.Now,
 	}
 }
 
-// tunnelCacheTTLFromEnv returns the tunnel-cache TTL, honoring the
-// envTunnelCacheTTL override. The override must be a positive Go duration
-// string (e.g. "30s", "2m"); anything unset, unparseable, or non-positive
-// falls back to tunnelCacheTTL.
-func tunnelCacheTTLFromEnv() time.Duration {
-	raw := strings.TrimSpace(os.Getenv(envTunnelCacheTTL))
-	if raw == "" {
-		return tunnelCacheTTL
-	}
-	d, err := time.ParseDuration(raw)
-	if err != nil || d <= 0 {
-		log.Warnf("ignoring invalid %s=%q (want a positive Go duration like 30s or 2m); using default %s",
-			envTunnelCacheTTL, raw, tunnelCacheTTL)
-		return tunnelCacheTTL
-	}
-	return d
-}
-
 // get returns a cached response for the key, or nil when missing or
 // expired. Expired entries are evicted lazily on read.
 func (c *tunnelValidationCache) get(key tunnelCacheKey) *proto.ValidateTunnelPeerResponse {

proxy/internal/auth/tunnel_cache_test.go

@@ -169,32 +169,3 @@ func TestTunnelCache_BoundedSizeEvictsOldest(t *testing.T) {
 	assert.NotNil(t, cache.get(keys[1]), "second-newest must remain cached")
 	assert.NotNil(t, cache.get(keys[2]), "newest must remain cached")
 }
-
-func TestTunnelCacheTTLFromEnv(t *testing.T) {
-	t.Run("unset uses default", func(t *testing.T) {
-		t.Setenv(envTunnelCacheTTL, "")
-		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
-	})
-	t.Run("valid duration overrides", func(t *testing.T) {
-		t.Setenv(envTunnelCacheTTL, "45s")
-		assert.Equal(t, 45*time.Second, tunnelCacheTTLFromEnv())
-	})
-	t.Run("whitespace trimmed", func(t *testing.T) {
-		t.Setenv(envTunnelCacheTTL, "  2m ")
-		assert.Equal(t, 2*time.Minute, tunnelCacheTTLFromEnv())
-	})
-	t.Run("unparseable uses default", func(t *testing.T) {
-		t.Setenv(envTunnelCacheTTL, "nonsense")
-		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
-	})
-	t.Run("non-positive uses default", func(t *testing.T) {
-		t.Setenv(envTunnelCacheTTL, "0s")
-		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
-		t.Setenv(envTunnelCacheTTL, "-30s")
-		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
-	})
-	t.Run("constructor honors override", func(t *testing.T) {
-		t.Setenv(envTunnelCacheTTL, "90s")
-		assert.Equal(t, 90*time.Second, newTunnelValidationCache().ttl)
-	})
-}

sharedsock/sock_linux.go

@@ -24,7 +24,7 @@ import (
 )
 
 // ErrSharedSockStopped indicates that shared socket has been stopped
-var ErrSharedSockStopped = fmt.Errorf("shared socket stopped")
+var ErrSharedSockStopped = fmt.Errorf("shared socked stopped")
 
 // SharedSocket is a net.PacketConn that initiates two raw sockets (ipv4 and ipv6) and listens to UDP packets filtered
 // by BPF instructions (e.g., IncomingSTUNFilter that checks and sends only STUN packets to the listeners (ReadFrom)).