mirror of
https://github.com/juanfont/headscale.git
synced 2026-11-04 04:34:07 +09:00
policy/v2: recapture SSH data captures
Every ssh_results row captured again from SaaS. SaaS now maps login "0" to no local user in rules that map root, quotes a refused checkPeriod as written and rewords its tailnet-domain refusal.
This commit is contained in:
Kristoffer Dalby committed
1 parent
363ba7be44
commit
5b578fe95f
112 files changed
+503034
-423051
No files matched your search
@@ -128,9 +128,138 @@ var sshSkipReasons = map[string]string{
|
||||
"ssh-b5": "headscale has no passkey authentication; user:*@passkey wildcard unsupported",
|
||||
"ssh-d10": "headscale has no passkey authentication; user:*@passkey wildcard unsupported",
|
||||
|
||||
"ssh-duplicate-rules/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-duplicate-rules/kakuna/uid-zero": sshUIDZero,
|
||||
"ssh-equal-src-aliases/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-a1/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-a1/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-a1/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-a2/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-a2/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-a2/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-a3/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-a3/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-a3/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-a4/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-a5/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-a6/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-a6/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-a6/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-a7/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-a7/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-a7/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-a8/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-a8/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-a8/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-acceptenv-null/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-acceptenv-omitted/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-b1/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-b2/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-b3/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-b6/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-c1/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-c1/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-c1/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-c2/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-c3/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-c4/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-c4/kakuna/uid-zero": sshUIDZero,
|
||||
"ssh-checkperiod-null/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d11/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d11/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d11/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d11/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d12/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d12/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d12/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d12/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d2/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d2/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d2/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d2/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d3/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d3/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d3/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d3/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d4/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d4/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d4/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d4/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d5/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d5/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d5/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d5/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d6/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d6/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d6/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d6/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d7/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-d7/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d7/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d7/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d8/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d8/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d8/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-d9/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-d9/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-d9/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-dst-trailing-whitespace/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-duplicate-rules/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-duplicate-rules/kakuna/uid-zero": sshUIDZero,
|
||||
"ssh-e5/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-e5/kakuna/uid-zero": sshUIDZero,
|
||||
"ssh-e6/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-e6/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-e6/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-e6/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-equal-src-aliases/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-f1/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-f1/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-f1/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-f1/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-f2/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-f3/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-f3/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-f3/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-f3/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-f4/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-f4/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-f4/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-f4/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-f5/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-f5/bulbasaur/uid-zero": sshUIDZero,
|
||||
"ssh-f5/ivysaur/uid-zero": sshUIDZero,
|
||||
"ssh-f5/venusaur/uid-zero": sshUIDZero,
|
||||
"ssh-g1/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-g2/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-acceptenv-bad-glob/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-acceptenv-glob-shapes/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-action-whitespace/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-checkperiod-exact-max/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-checkperiod-too-short/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-checkperiod-zero/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-autogroup-internet/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-autogroup-member/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-autogroup-self/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-autogroup-tagged/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-group-prefix/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-localpart-empty/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-localpart-no-at/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-localpart-no-domain/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-localpart-no-glob/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-tag-prefix/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-malformed-user-whitespace-leading/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-many-tags-as-dst/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-many-tags-as-dst/kakuna/uid-zero": sshUIDZero,
|
||||
"ssh-multi-rule-accept-then-check/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-multi-rule-check-then-accept/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-multi-rule-disjoint-srcs/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-multi-rule-overlap-conflicting-acceptenv/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-multi-rule-overlap-different-users/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-multi-src-multi-dst-multi-user/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-multi-src-multi-dst-multi-user/kakuna/uid-zero": sshUIDZero,
|
||||
"ssh-src-autogroup-tagged-no-tagged-nodes/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-src-leading-whitespace/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-tab-in-user/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-unicode-emoji-user/beedrill/uid-zero": sshUIDZero,
|
||||
"ssh-unicode-rtl-user/beedrill/uid-zero": sshUIDZero,
|
||||
}
|
||||
|
||||
const sshUIDZero = `SSH_UID_ZERO: SaaS maps login "0" to no local user in every rule; headscale leaves it out`
|
||||
@@ -145,7 +274,8 @@ var sshRejectSkipReasons = map[string]string{
|
||||
"ssh-e2": "headscale has no associated-tailnet-domains config; user:*@domain / localpart:*@domain are not domain-validated",
|
||||
"ssh-malformed-user-localpart-multi-glob": "headscale has no associated-tailnet-domains config; user:*@domain / localpart:*@domain are not domain-validated",
|
||||
|
||||
"ssh-check-tag-src/refused": "SSH_CHECK_TAG_SRC: SaaS refuses a check rule with a tag source; headscale accepts it",
|
||||
"ssh-check-tag-src/refused": "SSH_CHECK_TAG_SRC: SaaS refuses a check rule with a tag source; headscale accepts it",
|
||||
"ssh-malformed-checkperiod-too-long/message": "SSH_CHECKPERIOD_TEXT: SaaS quotes a refused checkPeriod as written; headscale prints the parsed duration",
|
||||
}
|
||||
|
||||
// TestSSHDataCompat loads every ssh-*.hujson capture, parses the policy
|
||||
|
||||
+6288
-4250
File diff suppressed because it is too large.
Load diff
+6612
-4574
File diff suppressed because it is too large.
Load diff
+6442
-4404
File diff suppressed because it is too large.
Load diff
+6558
-4518
File diff suppressed because it is too large.
Load diff
+6558
-4506
File diff suppressed because it is too large.
Load diff
+6449
-4411
File diff suppressed because it is too large.
Load diff
+6511
-4473
File diff suppressed because it is too large.
Load diff
+6686
-4648
File diff suppressed because it is too large.
Load diff
+3283
-4858
File diff suppressed because it is too large.
Load diff
+3272
-4847
File diff suppressed because it is too large.
Load diff
+6503
-4463
File diff suppressed because it is too large.
Load diff
+6599
-4559
File diff suppressed because it is too large.
Load diff
+6618
-4572
File diff suppressed because it is too large.
Load diff
+6401
-4319
File diff suppressed because it is too large.
Load diff
+6034
-3994
File diff suppressed because it is too large.
Load diff
+5968
-3901
File diff suppressed because it is too large.
Load diff
+6660
-4607
File diff suppressed because it is too large.
Load diff
+6554
-4514
File diff suppressed because it is too large.
Load diff
+6264
-4224
File diff suppressed because it is too large.
Load diff
+6241
-4203
File diff suppressed because it is too large.
Load diff
+3055
-2155
File diff suppressed because it is too large.
Load diff
+3266
-4841
File diff suppressed because it is too large.
Load diff
+6692
-4636
File diff suppressed because it is too large.
Load diff
+6269
-4216
File diff suppressed because it is too large.
Load diff
+6524
-4488
File diff suppressed because it is too large.
Load diff
+6575
-4539
File diff suppressed because it is too large.
Load diff
+6592
-4556
File diff suppressed because it is too large.
Load diff
+6151
-4100
File diff suppressed because it is too large.
Load diff
+6454
-4407
File diff suppressed because it is too large.
Load diff
+6454
-4418
File diff suppressed because it is too large.
Load diff
+6286
-4250
File diff suppressed because it is too large.
Load diff
+6707
-4671
File diff suppressed because it is too large.
Load diff
+6339
-4301
File diff suppressed because it is too large.
Load diff
+6612
-4574
File diff suppressed because it is too large.
Load diff
+3264
-4839
File diff suppressed because it is too large.
Load diff
+4421
-5996
File diff suppressed because it is too large.
Load diff
+3075
-2175
File diff suppressed because it is too large.
Load diff
+6357
-4301
File diff suppressed because it is too large.
Load diff
+6272
-4216
File diff suppressed because it is too large.
Load diff
+6381
-4324
File diff suppressed because it is too large.
Load diff
+6374
-4332
File diff suppressed because it is too large.
Load diff
+6169
-4131
File diff suppressed because it is too large.
Load diff
+6162
-4126
File diff suppressed because it is too large.
Load diff
+3055
-2155
File diff suppressed because it is too large.
Load diff
+6546
-4510
File diff suppressed because it is too large.
Load diff
+6288
-4233
File diff suppressed because it is too large.
Load diff
+6490
-4454
File diff suppressed because it is too large.
Load diff
+6543
-4507
File diff suppressed because it is too large.
Load diff
+6235
-4199
File diff suppressed because it is too large.
Load diff
+6197
-4112
File diff suppressed because it is too large.
Load diff
+6298
-4243
File diff suppressed because it is too large.
Load diff
+3292
-4642
File diff suppressed because it is too large.
Load diff
+3264
-4614
File diff suppressed because it is too large.
Load diff
+3277
-4627
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3278
-4628
File diff suppressed because it is too large.
Load diff
+3277
-4627
File diff suppressed because it is too large.
Load diff
+4458
-3783
File diff suppressed because it is too large.
Load diff
+3280
-2605
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3268
-2593
File diff suppressed because it is too large.
Load diff
+3260
-2585
File diff suppressed because it is too large.
Load diff
+3264
-2589
File diff suppressed because it is too large.
Load diff
+3268
-2593
File diff suppressed because it is too large.
Load diff
+3296
-2621
File diff suppressed because it is too large.
Load diff
+3276
-2601
File diff suppressed because it is too large.
Load diff
+3298
-2623
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3283
-2608
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3290
-2615
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3290
-2615
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3279
-2604
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3281
-2606
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3280
-2605
File diff suppressed because it is too large.
Load diff
+3274
-2599
File diff suppressed because it is too large.
Load diff
+3280
-2605
File diff suppressed because it is too large.
Load diff
+3276
-2601
File diff suppressed because it is too large.
Load diff
+3284
-2609
File diff suppressed because it is too large.
Load diff
+3263
-2588
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3288
-2613
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3270
-2595
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3300
-2617
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3272
-2597
File diff suppressed because it is too large.
Load diff
+3268
-2593
File diff suppressed because it is too large.
Load diff
+3268
-2593
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3280
-2605
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3267
-2592
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3296
-2613
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3313
-2630
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3304
-2629
File diff suppressed because it is too large.
Load diff
+3296
-2621
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3298
-2623
File diff suppressed because it is too large.
Load diff
+3276
-2601
File diff suppressed because it is too large.
Load diff
+3297
-2622
File diff suppressed because it is too large.
Load diff
+3294
-2619
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3266
-2591
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3261
-2586
File diff suppressed because it is too large.
Load diff
+3268
-4618
File diff suppressed because it is too large.
Load diff
+4426
-5551
File diff suppressed because it is too large.
Load diff
+3270
-4395
File diff suppressed because it is too large.
Load diff
+3300
-4650
File diff suppressed because it is too large.
Load diff
Generated
Vendored
+3272
-4622
File diff suppressed because it is too large.
Load diff
Loaded 100 of 112 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user