perf(acl-filter): skip the lookups for a peering without ACLs

For a packet on a flow that no rule matches directly, the filter
builds the reply's summary from the reverse flow, looks that up too,
and only then falls back to the peering's default action. A peering
without an ACL takes that whole path for every packet of every flow:
it upgrades the `Weak` to the reverse flow (an atomic on a cold cache
line, then another to drop it) and reads that flow's key, to look up
rules that cannot exist.

Every peering with an ACL registers a default action for both
directions, and only such a peering has rules, so a pair without a
default action can match nothing either way. The filter now allows it
without looking anything up. The config-oracle fuzz test checks the
invariant this rests on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>

Author: daniel-noland

acl-filter/src/fuzz.rs

@@ -236,6 +236,19 @@ fn reference_lookup_matches_config_oracle() {
                     probe.src_vni, probe.dst_vni,
                 );
 
+                // The filter skips both lookups for a pair with no default action, which is only
+                // right if a rule in either direction implies a default action in both.
+                if got.is_some() {
+                    assert!(
+                        got_default.is_some()
+                            && tables
+                                .find_default_action(probe.dst_vni, probe.src_vni)
+                                .is_some(),
+                        "a rule matches {probe:?} but its peering has no default action both ways\n\
+                         spec: {overlay_spec:?}",
+                    );
+                }
+
                 assert_eq!(
                     resolved_action(got, got_default),
                     resolved_action(want, want_default),

acl-filter/src/lib.rs

@@ -122,6 +122,15 @@ impl AclFilter {
         let guard = self.tablesr.load();
         let tables = &guard.acls;
 
+        // Every peering with an ACL has a default action registered for both directions, and only
+        // such a peering has rules. Without one, nothing can match either way: allow the packet
+        // without the lookups, and without reaching the reverse flow (a cold cache line, and an
+        // atomic on it, for every packet of every flow).
+        let Some(default_action) = tables.find_default_action(summary.src_vni, summary.dst_vni)
+        else {
+            return (AclAction::Allow, false);
+        };
+
         // Look up for an ACL directly matching the packet
         let lookup_result = tables.lookup(summary);
         if let Some(result) = lookup_result {
@@ -155,15 +164,8 @@ impl AclFilter {
             }
         }
 
-        // Look for a fallback default action for the peering
-        let verdict = tables
-            .find_default_action(summary.src_vni, summary.dst_vni)
-            .unwrap_or(
-                // No default action was found for this peering, this means no ACL list was
-                // configured for the peering. Allow packet to go through.
-                AclAction::Allow,
-            );
-        (verdict, false)
+        // Fall back to the peering's default action
+        (default_action, false)
     }
 }