mirror of
https://github.com/juanfont/headscale.git
synced 2026-07-08 00:50:20 +09:00
testdata: add subnet-to-subnet route compatibility golden files
Add 6 golden files captured from Tailscale SaaS that cover subnet-to-subnet ACL scenarios where both source and destination are subnet CIDRs. These fill a complete gap in the existing 92 ROUTES golden files, none of which tested this pattern. Scenarios covered: f10: exact issue #3157 reproduction (disjoint subnets, host aliases) f11: bidirectional with overlapping big-router f12: host aliases where dst is a superset route f13: disjoint subnets, bidirectional f14: both src and dst overlap on one router f15: cross-router bidirectional All 6 pass TestRoutesCompat, confirming headscale matches Tailscale SaaS behavior for subnet-to-subnet filter rule distribution. Updates #3157
This commit is contained in:
Kristoffer Dalby
+274
@@ -0,0 +1,274 @@
|
||||
// ROUTES-f10_subnet_to_subnet_issue3157
|
||||
//
|
||||
// ACLs:
|
||||
// accept: src=['subnet_a'] dst=['subnet_b:*']
|
||||
// (hosts: subnet_a=192.168.1.0/24, subnet_b=172.16.0.0/24)
|
||||
//
|
||||
// Tests the EXACT scenario from issue #3157: two dedicated subnet routers,
|
||||
// each with one disjoint subnet, unidirectional ACL using host aliases.
|
||||
//
|
||||
// Expected: 1 rule on multi-router (routes 172.16.0.0/24 = dst subnet_b)
|
||||
{
|
||||
"test_id": "ROUTES-f10_subnet_to_subnet_issue3157",
|
||||
"input": {
|
||||
"full_policy": {
|
||||
"groups": {
|
||||
"group:admins": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:developers": [
|
||||
"kristoffer@dalby.cc",
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:monitors": [
|
||||
"monitorpasskeykradalby@passkey"
|
||||
],
|
||||
"group:empty": []
|
||||
},
|
||||
"tagOwners": {
|
||||
"tag:server": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:prod": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:client": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:router": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:exit": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:ha": [
|
||||
"kratail2tid@passkey"
|
||||
]
|
||||
},
|
||||
"hosts": {
|
||||
"webserver": "100.108.74.26",
|
||||
"prodbox": "100.103.8.15",
|
||||
"internal": "10.0.0.0/8",
|
||||
"subnet24": "192.168.1.0/24",
|
||||
"subnet_a": "192.168.1.0/24",
|
||||
"subnet_b": "172.16.0.0/24"
|
||||
},
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/8": [
|
||||
"tag:router"
|
||||
],
|
||||
"172.16.0.0/12": [
|
||||
"tag:router"
|
||||
],
|
||||
"192.168.0.0/16": [
|
||||
"tag:ha"
|
||||
],
|
||||
"0.0.0.0/0": [
|
||||
"tag:exit"
|
||||
],
|
||||
"::/0": [
|
||||
"tag:exit"
|
||||
]
|
||||
}
|
||||
},
|
||||
"acls": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"subnet_a"
|
||||
],
|
||||
"dst": [
|
||||
"subnet_b:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"topology": {
|
||||
"nodes": {
|
||||
"big-router": {
|
||||
"hostname": "big-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.97.174.21",
|
||||
"ipv6": "fd7a:115c:a1e0::5137:ae15",
|
||||
"routable_ips": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.0.0.0/8"
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"hostname": "exit-node",
|
||||
"tags": [
|
||||
"tag:exit"
|
||||
],
|
||||
"ipv4": "100.85.66.106",
|
||||
"ipv6": "fd7a:115c:a1e0::7c37:426a",
|
||||
"routable_ips": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
],
|
||||
"approved_routes": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
]
|
||||
},
|
||||
"ha-router1": {
|
||||
"hostname": "ha-router1",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.121.186.70",
|
||||
"ipv6": "fd7a:115c:a1e0::6737:ba46",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"hostname": "ha-router2",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.117.104.82",
|
||||
"ipv6": "fd7a:115c:a1e0::7437:6852",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"hostname": "multi-router",
|
||||
"tags": [
|
||||
"tag:exit",
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.119.241.111",
|
||||
"ipv6": "fd7a:115c:a1e0::3337:f16f",
|
||||
"routable_ips": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"172.16.0.0/24"
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"hostname": "subnet-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.92.142.61",
|
||||
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
|
||||
"routable_ips": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.33.0.0/16"
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"hostname": "tagged-client",
|
||||
"tags": [
|
||||
"tag:client"
|
||||
],
|
||||
"ipv4": "100.83.200.69",
|
||||
"ipv6": "fd7a:115c:a1e0::c537:c845"
|
||||
},
|
||||
"tagged-prod": {
|
||||
"hostname": "tagged-prod",
|
||||
"tags": [
|
||||
"tag:prod"
|
||||
],
|
||||
"ipv4": "100.103.8.15",
|
||||
"ipv6": "fd7a:115c:a1e0::5b37:80f"
|
||||
},
|
||||
"tagged-server": {
|
||||
"hostname": "tagged-server",
|
||||
"tags": [
|
||||
"tag:server"
|
||||
],
|
||||
"ipv4": "100.108.74.26",
|
||||
"ipv6": "fd7a:115c:a1e0::b901:4a87"
|
||||
},
|
||||
"user-kris": {
|
||||
"hostname": "user-kris",
|
||||
"tags": [],
|
||||
"ipv4": "100.110.121.96",
|
||||
"ipv6": "fd7a:115c:a1e0::1737:7960"
|
||||
},
|
||||
"user-mon": {
|
||||
"hostname": "user-mon",
|
||||
"tags": [],
|
||||
"ipv4": "100.103.90.82",
|
||||
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
|
||||
},
|
||||
"user1": {
|
||||
"hostname": "user1",
|
||||
"tags": [],
|
||||
"ipv4": "100.90.199.68",
|
||||
"ipv6": "fd7a:115c:a1e0::2d01:c747"
|
||||
}
|
||||
}
|
||||
},
|
||||
"captures": {
|
||||
"big-router": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"exit-node": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router1": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router2": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"multi-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "172.16.0.0/24",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-client": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-prod": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-server": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-kris": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-mon": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user1": {
|
||||
"packet_filter_rules": null
|
||||
}
|
||||
}
|
||||
}
|
||||
Vendored
+326
@@ -0,0 +1,326 @@
|
||||
// ROUTES-f11_subnet_to_subnet_bidirectional
|
||||
//
|
||||
// ACLs:
|
||||
// accept: src=['192.168.1.0/24'] dst=['10.33.0.0/16:*']
|
||||
// accept: src=['10.33.0.0/16'] dst=['192.168.1.0/24:*']
|
||||
//
|
||||
// Bidirectional subnet-to-subnet with big-router overlapping on 10.0.0.0/8.
|
||||
// ha-router1 and ha-router2 both route 192.168.1.0/24.
|
||||
//
|
||||
// Expected: 4 nodes with rules (big-router, ha-router1, ha-router2, subnet-router)
|
||||
{
|
||||
"test_id": "ROUTES-f11_subnet_to_subnet_bidirectional",
|
||||
"input": {
|
||||
"full_policy": {
|
||||
"groups": {
|
||||
"group:admins": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:developers": [
|
||||
"kristoffer@dalby.cc",
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:monitors": [
|
||||
"monitorpasskeykradalby@passkey"
|
||||
],
|
||||
"group:empty": []
|
||||
},
|
||||
"tagOwners": {
|
||||
"tag:server": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:prod": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:client": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:router": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:exit": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:ha": [
|
||||
"kratail2tid@passkey"
|
||||
]
|
||||
},
|
||||
"hosts": {
|
||||
"webserver": "100.108.74.26",
|
||||
"prodbox": "100.103.8.15",
|
||||
"internal": "10.0.0.0/8",
|
||||
"subnet24": "192.168.1.0/24"
|
||||
},
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/8": [
|
||||
"tag:router"
|
||||
],
|
||||
"172.16.0.0/12": [
|
||||
"tag:router"
|
||||
],
|
||||
"192.168.0.0/16": [
|
||||
"tag:ha"
|
||||
],
|
||||
"0.0.0.0/0": [
|
||||
"tag:exit"
|
||||
],
|
||||
"::/0": [
|
||||
"tag:exit"
|
||||
]
|
||||
}
|
||||
},
|
||||
"acls": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"dst": [
|
||||
"10.33.0.0/16:*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"dst": [
|
||||
"192.168.1.0/24:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"topology": {
|
||||
"nodes": {
|
||||
"big-router": {
|
||||
"hostname": "big-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.97.174.21",
|
||||
"ipv6": "fd7a:115c:a1e0::5137:ae15",
|
||||
"routable_ips": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.0.0.0/8"
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"hostname": "exit-node",
|
||||
"tags": [
|
||||
"tag:exit"
|
||||
],
|
||||
"ipv4": "100.85.66.106",
|
||||
"ipv6": "fd7a:115c:a1e0::7c37:426a",
|
||||
"routable_ips": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
],
|
||||
"approved_routes": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
]
|
||||
},
|
||||
"ha-router1": {
|
||||
"hostname": "ha-router1",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.121.186.70",
|
||||
"ipv6": "fd7a:115c:a1e0::6737:ba46",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"hostname": "ha-router2",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.117.104.82",
|
||||
"ipv6": "fd7a:115c:a1e0::7437:6852",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"hostname": "multi-router",
|
||||
"tags": [
|
||||
"tag:exit",
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.119.241.111",
|
||||
"ipv6": "fd7a:115c:a1e0::3337:f16f",
|
||||
"routable_ips": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"172.16.0.0/24"
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"hostname": "subnet-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.92.142.61",
|
||||
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
|
||||
"routable_ips": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.33.0.0/16"
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"hostname": "tagged-client",
|
||||
"tags": [
|
||||
"tag:client"
|
||||
],
|
||||
"ipv4": "100.83.200.69",
|
||||
"ipv6": "fd7a:115c:a1e0::c537:c845"
|
||||
},
|
||||
"tagged-prod": {
|
||||
"hostname": "tagged-prod",
|
||||
"tags": [
|
||||
"tag:prod"
|
||||
],
|
||||
"ipv4": "100.103.8.15",
|
||||
"ipv6": "fd7a:115c:a1e0::5b37:80f"
|
||||
},
|
||||
"tagged-server": {
|
||||
"hostname": "tagged-server",
|
||||
"tags": [
|
||||
"tag:server"
|
||||
],
|
||||
"ipv4": "100.108.74.26",
|
||||
"ipv6": "fd7a:115c:a1e0::b901:4a87"
|
||||
},
|
||||
"user-kris": {
|
||||
"hostname": "user-kris",
|
||||
"tags": [],
|
||||
"ipv4": "100.110.121.96",
|
||||
"ipv6": "fd7a:115c:a1e0::1737:7960"
|
||||
},
|
||||
"user-mon": {
|
||||
"hostname": "user-mon",
|
||||
"tags": [],
|
||||
"ipv4": "100.103.90.82",
|
||||
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
|
||||
},
|
||||
"user1": {
|
||||
"hostname": "user1",
|
||||
"tags": [],
|
||||
"ipv4": "100.90.199.68",
|
||||
"ipv6": "fd7a:115c:a1e0::2d01:c747"
|
||||
}
|
||||
}
|
||||
},
|
||||
"captures": {
|
||||
"big-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.33.0.0/16",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router1": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "192.168.1.0/24",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "192.168.1.0/24",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"subnet-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.33.0.0/16",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-prod": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-server": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-kris": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-mon": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user1": {
|
||||
"packet_filter_rules": null
|
||||
}
|
||||
}
|
||||
}
|
||||
Vendored
+288
@@ -0,0 +1,288 @@
|
||||
// ROUTES-f12_subnet_to_subnet_host_aliases
|
||||
//
|
||||
// ACLs:
|
||||
// accept: src=['subnet24'] dst=['internal:*']
|
||||
// (hosts: subnet24=192.168.1.0/24, internal=10.0.0.0/8)
|
||||
//
|
||||
// Host aliases where dst is a superset route. big-router routes 10.0.0.0/8
|
||||
// which exactly matches dst 'internal'. subnet-router routes 10.33.0.0/16
|
||||
// which is a subset of dst — Tailscale SaaS gives it the SAME rule.
|
||||
//
|
||||
// Expected: 2 nodes with rules (big-router, subnet-router)
|
||||
{
|
||||
"test_id": "ROUTES-f12_subnet_to_subnet_host_aliases",
|
||||
"input": {
|
||||
"full_policy": {
|
||||
"groups": {
|
||||
"group:admins": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:developers": [
|
||||
"kristoffer@dalby.cc",
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:monitors": [
|
||||
"monitorpasskeykradalby@passkey"
|
||||
],
|
||||
"group:empty": []
|
||||
},
|
||||
"tagOwners": {
|
||||
"tag:server": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:prod": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:client": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:router": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:exit": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:ha": [
|
||||
"kratail2tid@passkey"
|
||||
]
|
||||
},
|
||||
"hosts": {
|
||||
"webserver": "100.108.74.26",
|
||||
"prodbox": "100.103.8.15",
|
||||
"internal": "10.0.0.0/8",
|
||||
"subnet24": "192.168.1.0/24"
|
||||
},
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/8": [
|
||||
"tag:router"
|
||||
],
|
||||
"172.16.0.0/12": [
|
||||
"tag:router"
|
||||
],
|
||||
"192.168.0.0/16": [
|
||||
"tag:ha"
|
||||
],
|
||||
"0.0.0.0/0": [
|
||||
"tag:exit"
|
||||
],
|
||||
"::/0": [
|
||||
"tag:exit"
|
||||
]
|
||||
}
|
||||
},
|
||||
"acls": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"subnet24"
|
||||
],
|
||||
"dst": [
|
||||
"internal:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"topology": {
|
||||
"nodes": {
|
||||
"big-router": {
|
||||
"hostname": "big-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.97.174.21",
|
||||
"ipv6": "fd7a:115c:a1e0::5137:ae15",
|
||||
"routable_ips": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.0.0.0/8"
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"hostname": "exit-node",
|
||||
"tags": [
|
||||
"tag:exit"
|
||||
],
|
||||
"ipv4": "100.85.66.106",
|
||||
"ipv6": "fd7a:115c:a1e0::7c37:426a",
|
||||
"routable_ips": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
],
|
||||
"approved_routes": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
]
|
||||
},
|
||||
"ha-router1": {
|
||||
"hostname": "ha-router1",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.121.186.70",
|
||||
"ipv6": "fd7a:115c:a1e0::6737:ba46",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"hostname": "ha-router2",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.117.104.82",
|
||||
"ipv6": "fd7a:115c:a1e0::7437:6852",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"hostname": "multi-router",
|
||||
"tags": [
|
||||
"tag:exit",
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.119.241.111",
|
||||
"ipv6": "fd7a:115c:a1e0::3337:f16f",
|
||||
"routable_ips": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"172.16.0.0/24"
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"hostname": "subnet-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.92.142.61",
|
||||
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
|
||||
"routable_ips": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.33.0.0/16"
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"hostname": "tagged-client",
|
||||
"tags": [
|
||||
"tag:client"
|
||||
],
|
||||
"ipv4": "100.83.200.69",
|
||||
"ipv6": "fd7a:115c:a1e0::c537:c845"
|
||||
},
|
||||
"tagged-prod": {
|
||||
"hostname": "tagged-prod",
|
||||
"tags": [
|
||||
"tag:prod"
|
||||
],
|
||||
"ipv4": "100.103.8.15",
|
||||
"ipv6": "fd7a:115c:a1e0::5b37:80f"
|
||||
},
|
||||
"tagged-server": {
|
||||
"hostname": "tagged-server",
|
||||
"tags": [
|
||||
"tag:server"
|
||||
],
|
||||
"ipv4": "100.108.74.26",
|
||||
"ipv6": "fd7a:115c:a1e0::b901:4a87"
|
||||
},
|
||||
"user-kris": {
|
||||
"hostname": "user-kris",
|
||||
"tags": [],
|
||||
"ipv4": "100.110.121.96",
|
||||
"ipv6": "fd7a:115c:a1e0::1737:7960"
|
||||
},
|
||||
"user-mon": {
|
||||
"hostname": "user-mon",
|
||||
"tags": [],
|
||||
"ipv4": "100.103.90.82",
|
||||
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
|
||||
},
|
||||
"user1": {
|
||||
"hostname": "user1",
|
||||
"tags": [],
|
||||
"ipv4": "100.90.199.68",
|
||||
"ipv6": "fd7a:115c:a1e0::2d01:c747"
|
||||
}
|
||||
}
|
||||
},
|
||||
"captures": {
|
||||
"big-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.0.0.0/8",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router1": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router2": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"multi-router": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"subnet-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.0.0.0/8",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-prod": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-server": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-kris": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-mon": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user1": {
|
||||
"packet_filter_rules": null
|
||||
}
|
||||
}
|
||||
}
|
||||
+311
@@ -0,0 +1,311 @@
|
||||
// ROUTES-f13_subnet_to_subnet_disjoint
|
||||
//
|
||||
// ACLs:
|
||||
// accept: src=['192.168.1.0/24'] dst=['172.16.0.0/24:*']
|
||||
// accept: src=['172.16.0.0/24'] dst=['192.168.1.0/24:*']
|
||||
//
|
||||
// Disjoint subnets, bidirectional. ha-router1 and ha-router2 route 192.168.1.0/24,
|
||||
// multi-router routes 172.16.0.0/24. big-router (10.0.0.0/8) has NO overlap.
|
||||
//
|
||||
// Expected: 3 nodes with rules (ha-router1, ha-router2, multi-router)
|
||||
{
|
||||
"test_id": "ROUTES-f13_subnet_to_subnet_disjoint",
|
||||
"input": {
|
||||
"full_policy": {
|
||||
"groups": {
|
||||
"group:admins": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:developers": [
|
||||
"kristoffer@dalby.cc",
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:monitors": [
|
||||
"monitorpasskeykradalby@passkey"
|
||||
],
|
||||
"group:empty": []
|
||||
},
|
||||
"tagOwners": {
|
||||
"tag:server": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:prod": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:client": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:router": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:exit": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:ha": [
|
||||
"kratail2tid@passkey"
|
||||
]
|
||||
},
|
||||
"hosts": {
|
||||
"webserver": "100.108.74.26",
|
||||
"prodbox": "100.103.8.15",
|
||||
"internal": "10.0.0.0/8",
|
||||
"subnet24": "192.168.1.0/24"
|
||||
},
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/8": [
|
||||
"tag:router"
|
||||
],
|
||||
"172.16.0.0/12": [
|
||||
"tag:router"
|
||||
],
|
||||
"192.168.0.0/16": [
|
||||
"tag:ha"
|
||||
],
|
||||
"0.0.0.0/0": [
|
||||
"tag:exit"
|
||||
],
|
||||
"::/0": [
|
||||
"tag:exit"
|
||||
]
|
||||
}
|
||||
},
|
||||
"acls": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"dst": [
|
||||
"172.16.0.0/24:*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"dst": [
|
||||
"192.168.1.0/24:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"topology": {
|
||||
"nodes": {
|
||||
"big-router": {
|
||||
"hostname": "big-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.97.174.21",
|
||||
"ipv6": "fd7a:115c:a1e0::5137:ae15",
|
||||
"routable_ips": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.0.0.0/8"
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"hostname": "exit-node",
|
||||
"tags": [
|
||||
"tag:exit"
|
||||
],
|
||||
"ipv4": "100.85.66.106",
|
||||
"ipv6": "fd7a:115c:a1e0::7c37:426a",
|
||||
"routable_ips": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
],
|
||||
"approved_routes": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
]
|
||||
},
|
||||
"ha-router1": {
|
||||
"hostname": "ha-router1",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.121.186.70",
|
||||
"ipv6": "fd7a:115c:a1e0::6737:ba46",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"hostname": "ha-router2",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.117.104.82",
|
||||
"ipv6": "fd7a:115c:a1e0::7437:6852",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"hostname": "multi-router",
|
||||
"tags": [
|
||||
"tag:exit",
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.119.241.111",
|
||||
"ipv6": "fd7a:115c:a1e0::3337:f16f",
|
||||
"routable_ips": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"172.16.0.0/24"
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"hostname": "subnet-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.92.142.61",
|
||||
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
|
||||
"routable_ips": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.33.0.0/16"
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"hostname": "tagged-client",
|
||||
"tags": [
|
||||
"tag:client"
|
||||
],
|
||||
"ipv4": "100.83.200.69",
|
||||
"ipv6": "fd7a:115c:a1e0::c537:c845"
|
||||
},
|
||||
"tagged-prod": {
|
||||
"hostname": "tagged-prod",
|
||||
"tags": [
|
||||
"tag:prod"
|
||||
],
|
||||
"ipv4": "100.103.8.15",
|
||||
"ipv6": "fd7a:115c:a1e0::5b37:80f"
|
||||
},
|
||||
"tagged-server": {
|
||||
"hostname": "tagged-server",
|
||||
"tags": [
|
||||
"tag:server"
|
||||
],
|
||||
"ipv4": "100.108.74.26",
|
||||
"ipv6": "fd7a:115c:a1e0::b901:4a87"
|
||||
},
|
||||
"user-kris": {
|
||||
"hostname": "user-kris",
|
||||
"tags": [],
|
||||
"ipv4": "100.110.121.96",
|
||||
"ipv6": "fd7a:115c:a1e0::1737:7960"
|
||||
},
|
||||
"user-mon": {
|
||||
"hostname": "user-mon",
|
||||
"tags": [],
|
||||
"ipv4": "100.103.90.82",
|
||||
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
|
||||
},
|
||||
"user1": {
|
||||
"hostname": "user1",
|
||||
"tags": [],
|
||||
"ipv4": "100.90.199.68",
|
||||
"ipv6": "fd7a:115c:a1e0::2d01:c747"
|
||||
}
|
||||
}
|
||||
},
|
||||
"captures": {
|
||||
"big-router": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"exit-node": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router1": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "192.168.1.0/24",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "192.168.1.0/24",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "172.16.0.0/24",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-client": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-prod": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-server": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-kris": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-mon": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user1": {
|
||||
"packet_filter_rules": null
|
||||
}
|
||||
}
|
||||
}
|
||||
+287
@@ -0,0 +1,287 @@
|
||||
// ROUTES-f14_subnet_to_subnet_overlapping_one_router
|
||||
//
|
||||
// ACLs:
|
||||
// accept: src=['10.0.0.0/8'] dst=['10.33.0.0/16:*']
|
||||
//
|
||||
// Both src and dst overlap on big-router's 10.0.0.0/8 route.
|
||||
// subnet-router routes 10.33.0.0/16 (subset of src 10.0.0.0/8).
|
||||
// Tailscale SaaS gives rules to BOTH big-router and subnet-router.
|
||||
//
|
||||
// Expected: 2 nodes with rules (big-router, subnet-router)
|
||||
{
|
||||
"test_id": "ROUTES-f14_subnet_to_subnet_overlapping_one_router",
|
||||
"input": {
|
||||
"full_policy": {
|
||||
"groups": {
|
||||
"group:admins": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:developers": [
|
||||
"kristoffer@dalby.cc",
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:monitors": [
|
||||
"monitorpasskeykradalby@passkey"
|
||||
],
|
||||
"group:empty": []
|
||||
},
|
||||
"tagOwners": {
|
||||
"tag:server": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:prod": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:client": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:router": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:exit": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:ha": [
|
||||
"kratail2tid@passkey"
|
||||
]
|
||||
},
|
||||
"hosts": {
|
||||
"webserver": "100.108.74.26",
|
||||
"prodbox": "100.103.8.15",
|
||||
"internal": "10.0.0.0/8",
|
||||
"subnet24": "192.168.1.0/24"
|
||||
},
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/8": [
|
||||
"tag:router"
|
||||
],
|
||||
"172.16.0.0/12": [
|
||||
"tag:router"
|
||||
],
|
||||
"192.168.0.0/16": [
|
||||
"tag:ha"
|
||||
],
|
||||
"0.0.0.0/0": [
|
||||
"tag:exit"
|
||||
],
|
||||
"::/0": [
|
||||
"tag:exit"
|
||||
]
|
||||
}
|
||||
},
|
||||
"acls": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"dst": [
|
||||
"10.33.0.0/16:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"topology": {
|
||||
"nodes": {
|
||||
"big-router": {
|
||||
"hostname": "big-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.97.174.21",
|
||||
"ipv6": "fd7a:115c:a1e0::5137:ae15",
|
||||
"routable_ips": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.0.0.0/8"
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"hostname": "exit-node",
|
||||
"tags": [
|
||||
"tag:exit"
|
||||
],
|
||||
"ipv4": "100.85.66.106",
|
||||
"ipv6": "fd7a:115c:a1e0::7c37:426a",
|
||||
"routable_ips": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
],
|
||||
"approved_routes": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
]
|
||||
},
|
||||
"ha-router1": {
|
||||
"hostname": "ha-router1",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.121.186.70",
|
||||
"ipv6": "fd7a:115c:a1e0::6737:ba46",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"hostname": "ha-router2",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.117.104.82",
|
||||
"ipv6": "fd7a:115c:a1e0::7437:6852",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"hostname": "multi-router",
|
||||
"tags": [
|
||||
"tag:exit",
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.119.241.111",
|
||||
"ipv6": "fd7a:115c:a1e0::3337:f16f",
|
||||
"routable_ips": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"172.16.0.0/24"
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"hostname": "subnet-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.92.142.61",
|
||||
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
|
||||
"routable_ips": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.33.0.0/16"
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"hostname": "tagged-client",
|
||||
"tags": [
|
||||
"tag:client"
|
||||
],
|
||||
"ipv4": "100.83.200.69",
|
||||
"ipv6": "fd7a:115c:a1e0::c537:c845"
|
||||
},
|
||||
"tagged-prod": {
|
||||
"hostname": "tagged-prod",
|
||||
"tags": [
|
||||
"tag:prod"
|
||||
],
|
||||
"ipv4": "100.103.8.15",
|
||||
"ipv6": "fd7a:115c:a1e0::5b37:80f"
|
||||
},
|
||||
"tagged-server": {
|
||||
"hostname": "tagged-server",
|
||||
"tags": [
|
||||
"tag:server"
|
||||
],
|
||||
"ipv4": "100.108.74.26",
|
||||
"ipv6": "fd7a:115c:a1e0::b901:4a87"
|
||||
},
|
||||
"user-kris": {
|
||||
"hostname": "user-kris",
|
||||
"tags": [],
|
||||
"ipv4": "100.110.121.96",
|
||||
"ipv6": "fd7a:115c:a1e0::1737:7960"
|
||||
},
|
||||
"user-mon": {
|
||||
"hostname": "user-mon",
|
||||
"tags": [],
|
||||
"ipv4": "100.103.90.82",
|
||||
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
|
||||
},
|
||||
"user1": {
|
||||
"hostname": "user1",
|
||||
"tags": [],
|
||||
"ipv4": "100.90.199.68",
|
||||
"ipv6": "fd7a:115c:a1e0::2d01:c747"
|
||||
}
|
||||
}
|
||||
},
|
||||
"captures": {
|
||||
"big-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.33.0.0/16",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router1": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router2": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"multi-router": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"subnet-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.33.0.0/16",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-prod": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-server": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-kris": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-mon": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user1": {
|
||||
"packet_filter_rules": null
|
||||
}
|
||||
}
|
||||
}
|
||||
Vendored
+312
@@ -0,0 +1,312 @@
|
||||
// ROUTES-f15_subnet_to_subnet_cross_routers
|
||||
//
|
||||
// ACLs:
|
||||
// accept: src=['10.33.0.0/16'] dst=['172.16.0.0/24:*']
|
||||
// accept: src=['172.16.0.0/24'] dst=['10.33.0.0/16:*']
|
||||
//
|
||||
// Cross-router bidirectional. big-router (10.0.0.0/8) overlaps with
|
||||
// src/dst 10.33.0.0/16. multi-router routes 172.16.0.0/24.
|
||||
// subnet-router routes 10.33.0.0/16.
|
||||
//
|
||||
// Expected: 3 nodes with rules (big-router, multi-router, subnet-router)
|
||||
{
|
||||
"test_id": "ROUTES-f15_subnet_to_subnet_cross_routers",
|
||||
"input": {
|
||||
"full_policy": {
|
||||
"groups": {
|
||||
"group:admins": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:developers": [
|
||||
"kristoffer@dalby.cc",
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"group:monitors": [
|
||||
"monitorpasskeykradalby@passkey"
|
||||
],
|
||||
"group:empty": []
|
||||
},
|
||||
"tagOwners": {
|
||||
"tag:server": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:prod": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:client": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:router": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:exit": [
|
||||
"kratail2tid@passkey"
|
||||
],
|
||||
"tag:ha": [
|
||||
"kratail2tid@passkey"
|
||||
]
|
||||
},
|
||||
"hosts": {
|
||||
"webserver": "100.108.74.26",
|
||||
"prodbox": "100.103.8.15",
|
||||
"internal": "10.0.0.0/8",
|
||||
"subnet24": "192.168.1.0/24"
|
||||
},
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/8": [
|
||||
"tag:router"
|
||||
],
|
||||
"172.16.0.0/12": [
|
||||
"tag:router"
|
||||
],
|
||||
"192.168.0.0/16": [
|
||||
"tag:ha"
|
||||
],
|
||||
"0.0.0.0/0": [
|
||||
"tag:exit"
|
||||
],
|
||||
"::/0": [
|
||||
"tag:exit"
|
||||
]
|
||||
}
|
||||
},
|
||||
"acls": [
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"dst": [
|
||||
"172.16.0.0/24:*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"action": "accept",
|
||||
"src": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"dst": [
|
||||
"10.33.0.0/16:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"topology": {
|
||||
"nodes": {
|
||||
"big-router": {
|
||||
"hostname": "big-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.97.174.21",
|
||||
"ipv6": "fd7a:115c:a1e0::5137:ae15",
|
||||
"routable_ips": [
|
||||
"10.0.0.0/8"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.0.0.0/8"
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"hostname": "exit-node",
|
||||
"tags": [
|
||||
"tag:exit"
|
||||
],
|
||||
"ipv4": "100.85.66.106",
|
||||
"ipv6": "fd7a:115c:a1e0::7c37:426a",
|
||||
"routable_ips": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
],
|
||||
"approved_routes": [
|
||||
"0.0.0.0/0",
|
||||
"::/0"
|
||||
]
|
||||
},
|
||||
"ha-router1": {
|
||||
"hostname": "ha-router1",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.121.186.70",
|
||||
"ipv6": "fd7a:115c:a1e0::6737:ba46",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"ha-router2": {
|
||||
"hostname": "ha-router2",
|
||||
"tags": [
|
||||
"tag:ha"
|
||||
],
|
||||
"ipv4": "100.117.104.82",
|
||||
"ipv6": "fd7a:115c:a1e0::7437:6852",
|
||||
"routable_ips": [
|
||||
"192.168.1.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"192.168.1.0/24"
|
||||
]
|
||||
},
|
||||
"multi-router": {
|
||||
"hostname": "multi-router",
|
||||
"tags": [
|
||||
"tag:exit",
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.119.241.111",
|
||||
"ipv6": "fd7a:115c:a1e0::3337:f16f",
|
||||
"routable_ips": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"approved_routes": [
|
||||
"172.16.0.0/24"
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"hostname": "subnet-router",
|
||||
"tags": [
|
||||
"tag:router"
|
||||
],
|
||||
"ipv4": "100.92.142.61",
|
||||
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
|
||||
"routable_ips": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"approved_routes": [
|
||||
"10.33.0.0/16"
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"hostname": "tagged-client",
|
||||
"tags": [
|
||||
"tag:client"
|
||||
],
|
||||
"ipv4": "100.83.200.69",
|
||||
"ipv6": "fd7a:115c:a1e0::c537:c845"
|
||||
},
|
||||
"tagged-prod": {
|
||||
"hostname": "tagged-prod",
|
||||
"tags": [
|
||||
"tag:prod"
|
||||
],
|
||||
"ipv4": "100.103.8.15",
|
||||
"ipv6": "fd7a:115c:a1e0::5b37:80f"
|
||||
},
|
||||
"tagged-server": {
|
||||
"hostname": "tagged-server",
|
||||
"tags": [
|
||||
"tag:server"
|
||||
],
|
||||
"ipv4": "100.108.74.26",
|
||||
"ipv6": "fd7a:115c:a1e0::b901:4a87"
|
||||
},
|
||||
"user-kris": {
|
||||
"hostname": "user-kris",
|
||||
"tags": [],
|
||||
"ipv4": "100.110.121.96",
|
||||
"ipv6": "fd7a:115c:a1e0::1737:7960"
|
||||
},
|
||||
"user-mon": {
|
||||
"hostname": "user-mon",
|
||||
"tags": [],
|
||||
"ipv4": "100.103.90.82",
|
||||
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
|
||||
},
|
||||
"user1": {
|
||||
"hostname": "user1",
|
||||
"tags": [],
|
||||
"ipv4": "100.90.199.68",
|
||||
"ipv6": "fd7a:115c:a1e0::2d01:c747"
|
||||
}
|
||||
}
|
||||
},
|
||||
"captures": {
|
||||
"big-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.33.0.0/16",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"exit-node": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router1": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"ha-router2": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"multi-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"10.33.0.0/16"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "172.16.0.0/24",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"subnet-router": {
|
||||
"packet_filter_rules": [
|
||||
{
|
||||
"SrcIPs": [
|
||||
"172.16.0.0/24"
|
||||
],
|
||||
"DstPorts": [
|
||||
{
|
||||
"IP": "10.33.0.0/16",
|
||||
"Ports": {
|
||||
"First": 0,
|
||||
"Last": 65535
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"tagged-client": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-prod": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"tagged-server": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-kris": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user-mon": {
|
||||
"packet_filter_rules": null
|
||||
},
|
||||
"user1": {
|
||||
"packet_filter_rules": null
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user