public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 04:34:07 +09:00
Code Issues Packages Projects Releases Wiki Activity

policy/v2, servertest: add bare IPv6 sshTests destination capture

Browse Source 
SaaS fails an accept to a bare IPv6 dst, checking the source at
::ffff:100.64.0.0, which no device holds; the IPv4 twin passes.
Headscale checks the source's own addresses and accepts.
This commit is contained in:
Kristoffer Dalby committed 2026-10-28 07:16:13 +00:00
1 parent 280112839e
commit 06260d6fad
3 files changed
+194 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

hscontrol/policy/v2/sshtester_compat_test.go
+3 -1
View File
@@ -14,7 +14,9 @@ import (
// knownSSHTesterDivergences names the engine gap for each check where
// headscale and upstream disagree, keyed <test_id>/<check>.
var knownSSHTesterDivergences = map[string]string{}
var knownSSHTesterDivergences = map[string]string{
"sshtest-malformed-dst-bare-ipv6/verdict": "bare-IPv6 sshTests dst: upstream parse-accepts then engine-rejects; headscale accepts (IPv4 mirror passes both sides)",
}
func TestSSHTesterCompat(t *testing.T) {
t.Parallel()
hscontrol/policy/v2/testdata/sshtest_results/sshtest-malformed-dst-bare-ipv6.hujson
Vendored
+190
View File
@@ -0,0 +1,190 @@
// sshtest-malformed-dst-bare-ipv6
//
// sshTests dst with bare IPv6 literal
//
// Steps: 1
// Captured at: 2026-10-17T15:48:35Z
// tool version: tscap/e3511f1
// schema version: 1
{
"schema_version": 1,
"test_id": "sshtest-malformed-dst-bare-ipv6",
"description": "sshTests dst with bare IPv6 literal",
"category": "sshtest",
"captured_at": "2026-10-17T15:48:35.630660254Z",
"tool_version": "tscap/e3511f1",
"tailnet": "odin@example.com",
"error": true,
"input": {
"api_response_code": 400,
"api_response_body": {"message": "test(s) failed", "data": [{"user": "odin@example.com", "errors": [
"[ssh test error]: src \"odin@example.com\" at \"::ffff:100.64.0.0\", dst \"fd7a:115c:a1e0::10\" at \"fd7a:115c:a1e0::10\", ssh user \"root\": want: \"accept\" got: \"deny\""
]}]},
"tailnet": {
"dns": {"magic_dns": false, "nameservers": [], "search_paths": [], "split_dns": {}},
"settings": {}
},
"scenario_hujson": " \n \n \n \n{\n\t\"category\": \"sshtest\",\n\t\"description\": \"sshTests dst with bare IPv6 literal\",\n\t\"id\": \"sshtest-malformed-dst-bare-ipv6\",\n\t\"options\": {\"expect_api_error\": true},\n\t\"policy\": {\"grants\": [{\"dst\": [\"*\"], \"ip\": [\"*\"], \"src\": [\"*\"]}], \"ssh\": [{\n\t\t\"action\": \"accept\",\n\t\t\"dst\": [\"tag:server\"],\n\t\t\"src\": [\"autogroup:member\"],\n\t\t\"users\": [\"root\"]\n\t}], \"sshTests\": [{\n\t\t\"accept\": [\"root\"],\n\t\t\"dst\": [\"fd7a:115c:a1e0::10\"],\n\t\t\"src\": \"odin@example.com\"\n\t}], \"tagOwners\": {\n\t\t\"tag:prod\": [\"odin@example.com\"],\n\t\t\"tag:server\": [\"odin@example.com\"]\n\t}},\n\t\"tailnet\": {\n\t\t\"dns\": {\"magic_dns\": false, \"nameservers\": [], \"search_paths\": [], \"split_dns\": {}},\n\t\t\"settings\": {}\n\t},\n\t\"topology\": \"../_topologies/grant.hujson\"\n}\n",
"scenario_path": "scenarios/sshtest-edges-baremip/sshtest-malformed-dst-bare-ipv6.hujson",
"full_policy": {
"grants": [{"dst": ["*"], "ip": ["*"], "src": ["*"]}],
"ssh": [{
"action": "accept",
"dst": ["tag:server"],
"src": ["autogroup:member"],
"users": ["root"]
}],
"sshTests": [{
"accept": ["root"],
"dst": ["fd7a:115c:a1e0::10"],
"src": "odin@example.com"
}],
"tagOwners": {"tag:prod": ["odin@example.com"], "tag:server": ["odin@example.com"]}
}
},
"topology": {"users": [
{"id": 1, "name": "odin", "email": "odin@example.com"},
{"id": 2, "name": "thor", "email": "thor@example.org"},
{"id": 3, "name": "freya", "email": "freya@example.com"}
], "nodes": {"beedrill": {
"hostname": "beedrill",
"tags": ["tag:server"],
"ipv4": "100.64.0.16",
"ipv6": "fd7a:115c:a1e0::10",
"routable_ips": [],
"approved_routes": []
}, "blastoise": {
"hostname": "blastoise",
"tags": ["tag:exit", "tag:router"],
"ipv4": "100.64.0.9",
"ipv6": "fd7a:115c:a1e0::9",
"routable_ips": ["10.33.0.0/16", "0.0.0.0/0", "::/0"],
"approved_routes": []
}, "bulbasaur": {
"hostname": "bulbasaur",
"tags": [],
"ipv4": "100.64.0.19",
"ipv6": "fd7a:115c:a1e0::13",
"user": "odin",
"routable_ips": [],
"approved_routes": []
}, "charmander": {
"hostname": "charmander",
"tags": ["tag:exit"],
"ipv4": "100.64.0.4",
"ipv6": "fd7a:115c:a1e0::4",
"routable_ips": ["0.0.0.0/0", "::/0"],
"approved_routes": []
}, "fearow": {
"hostname": "fearow",
"tags": ["tag:fearow"],
"ipv4": "100.64.0.12",
"ipv6": "fd7a:115c:a1e0::c",
"routable_ips": ["10.55.0.0/16"],
"approved_routes": []
}, "ivysaur": {
"hostname": "ivysaur",
"tags": [],
"ipv4": "100.64.0.17",
"ipv6": "fd7a:115c:a1e0::11",
"user": "thor",
"routable_ips": [],
"approved_routes": []
}, "kakuna": {
"hostname": "kakuna",
"tags": ["tag:prod"],
"ipv4": "100.64.0.15",
"ipv6": "fd7a:115c:a1e0::f",
"routable_ips": [],
"approved_routes": []
}, "pidgeotto": {
"hostname": "pidgeotto",
"tags": ["tag:pidgeotto"],
"ipv4": "100.64.0.3",
"ipv6": "fd7a:115c:a1e0::3",
"routable_ips": ["0.0.0.0/0", "::/0"],
"approved_routes": []
}, "pidgey": {
"hostname": "pidgey",
"tags": ["tag:pidgey"],
"ipv4": "100.64.0.2",
"ipv6": "fd7a:115c:a1e0::2",
"routable_ips": ["0.0.0.0/0", "::/0"],
"approved_routes": []
}, "raticate": {
"hostname": "raticate",
"tags": ["tag:group-b"],
"ipv4": "100.64.0.6",
"ipv6": "fd7a:115c:a1e0::6",
"routable_ips": [],
"approved_routes": []
}, "rattata": {
"hostname": "rattata",
"tags": ["tag:group-a"],
"ipv4": "100.64.0.5",
"ipv6": "fd7a:115c:a1e0::5",
"routable_ips": [],
"approved_routes": []
}, "spearow": {
"hostname": "spearow",
"tags": ["tag:spearow"],
"ipv4": "100.64.0.11",
"ipv6": "fd7a:115c:a1e0::b",
"routable_ips": ["10.44.0.0/16"],
"approved_routes": []
}, "squirtle": {
"hostname": "squirtle",
"tags": ["tag:router"],
"ipv4": "100.64.0.13",
"ipv6": "fd7a:115c:a1e0::d",
"routable_ips": ["10.33.0.0/16"],
"approved_routes": []
}, "venusaur": {
"hostname": "venusaur",
"tags": [],
"ipv4": "100.64.0.18",
"ipv6": "fd7a:115c:a1e0::12",
"user": "freya",
"routable_ips": [],
"approved_routes": []
}, "weedle": {
"hostname": "weedle",
"tags": ["tag:client"],
"ipv4": "100.64.0.14",
"ipv6": "fd7a:115c:a1e0::e",
"routable_ips": [],
"approved_routes": []
}}},
"captures": {},
"steps": [{
"name": "validate",
"at": "2026-10-17T15:48:41.613248342Z",
"result": "observed",
"actions": [{
"kind": "api",
"principal": "admin",
"method": "POST",
"path": "/tailnet/-/acl/validate",
"header": {"Content-Type": "application/hujson"},
"body": {
"grants": [{"dst": ["*"], "ip": ["*"], "src": ["*"]}],
"ssh": [{
"action": "accept",
"dst": ["tag:server"],
"src": ["autogroup:member"],
"users": ["root"]
}],
"sshTests": [{
"accept": ["root"],
"dst": ["fd7a:115c:a1e0::10"],
"src": "odin@example.com"
}],
"tagOwners": {"tag:prod": ["odin@example.com"], "tag:server": ["odin@example.com"]}
},
"status": 200,
"response": {"data": [{"errors": [
"[ssh test error]: src \"odin@example.com\" at \"::ffff:100.64.0.0\", dst \"fd7a:115c:a1e0::10\" at \"fd7a:115c:a1e0::10\", ssh user \"root\": want: \"accept\" got: \"deny\""
], "user": "odin@example.com"}], "message": "test(s) failed"}
}]
}]
}
hscontrol/servertest/policy_test.go
+1
View File
@@ -316,6 +316,7 @@ var rejectedPolicySkipReasons = map[string]string{
"ssh-e1/refused": noTailnetDomains,
"ssh-e2/refused": noTailnetDomains,
"ssh-malformed-user-localpart-multi-glob/refused": noTailnetDomains,
"sshtest-malformed-dst-bare-ipv6/refused": "SSHTEST_BARE_IPV6_DST: headscale accepts a bare IPv6 sshTests destination",
}
const noTailnetDomains = "NO_TAILNET_DOMAINS: headscale does not check user:*@domain or localpart:*@domain against the tailnet's domains"