From 1cfed59214b4e0c23eee6c5b4cb95f7995c30e86 Mon Sep 17 00:00:00 2001
From: JackDoan <me@jackdoan.com>
Date: Wed, 30 Sep 2026 14:46:44 -0500
Subject: [PATCH] checkpt

---
 firewall/ruleset.go | 18 ------------------
 firewall/table.go   | 14 +++++++++-----
 2 files changed, 9 insertions(+), 23 deletions(-)

diff --git a/firewall/ruleset.go b/firewall/ruleset.go
index a51e50eb..ce8d0845 100644
--- a/firewall/ruleset.go
+++ b/firewall/ruleset.go
@@ -44,24 +44,6 @@ func (s ruleSets) at(i int) ruleSet {
 	return s.bits[i*s.setLen : (i+1)*s.setLen]
 }
 
-// any reports whether pred holds for any id in s. It tries the ids in ascending order and stops at the first
-// one for which pred holds.
-//
-// any walks the set the same way all does, but without a range-over-func iterator, whose state machine costs
-// about a nanosecond per call.
-func (s ruleSet) any(pred func(id int) bool) bool {
-	for i, ids := range s {
-		for ids != 0 {
-			id := i*8 + bits.TrailingZeros8(ids)
-			ids &= ids - 1 // Clear the lowest set bit, which is id's.
-			if pred(id) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
 // all returns an iterator over the ids in s, in ascending order.
 func (s ruleSet) all() iter.Seq[int] {
 	return func(yield func(int) bool) {
diff --git a/firewall/table.go b/firewall/table.go
index c6a29a71..8751fd16 100644
--- a/firewall/table.go
+++ b/firewall/table.go
@@ -110,11 +110,15 @@ func (t *Table) Match(p *Packet, incoming bool, c *cert.CachedCertificate, caPoo
 		return false
 	}
 
-	// The index yields every rule whose proto and port clauses allow p. The packet is allowed when the
-	// remaining clauses of any of those rules allow it as well.
-	return proto.whichMatch(p, incoming).any(func(id int) bool {
-		return t.rules[id].match(p, c, caPool)
-	})
+	// The index yields every rule whose proto and port clauses allow p.
+	// The packet is allowed when the remaining clauses of any of those rules allow it as well.
+	for id := range proto.whichMatch(p, incoming).all() {
+		if t.rules[id].match(p, c, caPool) {
+			return true
+		}
+	}
+
+	return false
 }
 
 // match reports whether r allows p from the peer with certificate c. The port clause is not checked here; the