tailscale/logtail: log-filtering

[as2643]

In order to provide more visibility into the operation of tailnets for a specific customer, redact public IP addresses such as employee homes from the log content before the upload.

Updates #15664

[DentonGentry]

For this to make it into 1.56 it would need to be finished tomorrow. However the consumer, who shall remain nameless because this is a public PR, wouldn't be likely to deploy it in December anyway. If it slips into 1.58 instead that would be fine.

[DentonGentry]

At this point I'd request this go in after release 1.56 branches, to be included in 1.58.

[creachadair]

A couple small notes in passing.

[creachadair]

We should bump these variables up to the package level so we don't re-compile the patterns each time it's called.

Suggested change

	func redactIPs(buf []byte) []byte {
	regexMatchesIPv6 := regexp.MustCompile(`([0-9a-fA-F]{1,4}):([0-9a-fA-F]{1,4}):([0-9a-fA-F:]{1,4})*`)
	regexMatchesIPv4 := regexp.MustCompile(`(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}`)
	var (
	regexMatchesIPv6 = regexp.MustCompile(`([0-9a-fA-F]{1,4}):([0-9a-fA-F]{1,4}):([0-9a-fA-F:]{1,4})*`)
	regexMatchesIPv4 = regexp.MustCompile(`(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}`)
	)
	func redactIPs(buf []byte) []byte {

[creachadair]

Although it's unexported, this function is doing enough interesting work that it probably deserves a doc comment. In particular it'd be good to say what the input is and to summarize how the function transforms it.

[creachadair]

I would guess we can save some allocation and copying if we use the byte forms:

regexMatchesIPv6.ReplaceAllFunc(buf, func(b []byte) []byte {
   // ...
   prefix := bytes.Split(b, []byte(":"))
   return bytes.Join(append(prefix[:2], []byte("x")), []byte(":"))
})

That way we don't need to convert to string and back, since we wanted the output as a byte slice anyway. But, YMMV.

[creachadair]

LGTM for the code, though before merging we should make sure the release branch Denton noted has been cut.