no bart for cidr

firewall/table.go

@@ -46,7 +46,9 @@ type remoteRules struct {
 	Any    *localRules
 	Hosts  map[string]*localRules
 	Groups []*groupsRule
-	CIDR   *bart.Table[*localRules]
+	// CIDR is checked with Prefix.Contains, so 0.0.0.0/0 allows any IPv4 address and ::/0 any IPv6 address,
+	// neither allows the other family
+	CIDR []cidrRule
 }
 
 type groupsRule struct {
@@ -54,6 +56,12 @@ type groupsRule struct {
 	LocalCIDR *localRules
 }
 
+type cidrRule struct {
+	// Prefix is masked, so a cidr written two ways is one cidrRule
+	Prefix    netip.Prefix
+	LocalCIDR *localRules
+}
+
 type localRules struct {
 	Any bool
 	// LocalCIDR is always set when Any isn't. It's shared with other localRules, so it's never changed.
@@ -164,11 +172,9 @@ func (rr *remoteRules) match(p *Packet, c *cert.CachedCertificate) bool {
 		}
 	}
 
-	if rr.CIDR != nil {
-		for _, v := range rr.CIDR.Supernets(netip.PrefixFrom(p.RemoteAddr, p.RemoteAddr.BitLen())) {
-			if v.match(p, c) {
-				return true
-			}
+	for i := range rr.CIDR {
+		if rr.CIDR[i].Prefix.Contains(p.RemoteAddr) && rr.CIDR[i].LocalCIDR.match(p, c) {
+			return true
 		}
 	}