public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 04:34:07 +09:00
Code Issues Packages Projects Releases Wiki Activity

servertest: compare a single-use key presented by three devices

Browse Source 
SaaS converts two live devices that keep their node key with one
single-use key, spends it only on a third with a new node key, and
keeps key expiry on for a same-key conversion. Headscale spends it once.
This commit is contained in:
Kristoffer Dalby committed 2026-10-30 14:55:37 +00:00
1 parent e13a595f3d
commit 6413c4a81b
1 file changed
+20 -22
Download Patch File Download Diff File Expand all files Collapse all files
hscontrol/servertest/reauth_compat_test.go
+20 -22
View File
@@ -37,6 +37,20 @@ import (
// <test_id>/<step>[/<node>]/<check>. A listed check that matches fails, so a
// fix must delete its entry.
var reauthSkipReasons = map[string]string{
"reauth-user/a8-convert/u-convert/expiry": sameKeyConversionKeepsExpiry,
"reauth-user/a8-convert/key:A-Kp": singleUseKeyReused,
"reauth-user/a9-used-tagged-key/key:A-Kp": singleUseKeyReused,
"reauth-user/a9-used-tagged-key/u-loser-same/owner": singleUseKeyReused,
"reauth-user/a9-used-tagged-key/u-loser-same/outcome": singleUseKeyReused,
"reauth-user/a9-used-tagged-key/obs/filter": singleUseKeyReused,
"reauth-user/a9-used-tagged-key/t-server/filter": singleUseKeyReused,
"reauth-user/a10-used-tagged-key-force/u-loser-force/owner": singleUseKeyReused,
"reauth-user/a10-used-tagged-key-force/u-loser-force/outcome": singleUseKeyReused,
"reauth-user/a10-used-tagged-key-force/u-loser-force/node-key": singleUseKeyReused,
"reauth-user/a10-used-tagged-key-force/u-loser-force/expiry": singleUseKeyReused,
"reauth-user/a10-used-tagged-key-force/obs/filter": singleUseKeyReused,
"reauth-user/a10-used-tagged-key-force/t-server/filter": singleUseKeyReused,
"reauth/late-pak-spent-key/late-pak/text": refusalText,
"reauth/late-pak-spent-key/late-pak/legacy-text": refusalText,
@@ -50,23 +64,11 @@ const (
refusalText = "REFUSAL_TEXT: SaaS refuses a key by naming its ID; headscale says why the key is refused"
)
// reauthNotCompared lists, by key prefix, checks left out: SaaS's answer
// there is in doubt, so it is no reference.
var reauthNotCompared = []string{
"reauth-user/a8-convert/key:A-Kp",
"reauth-user/a8-convert/u-convert/expiry",
"reauth-user/a9-used-tagged-key/key:A-Kp",
"reauth-user/a9-used-tagged-key/u-loser-same/owner",
"reauth-user/a9-used-tagged-key/u-loser-same/outcome",
"reauth-user/a9-used-tagged-key/obs/filter",
"reauth-user/a9-used-tagged-key/t-server/filter",
"reauth-user/a10-used-tagged-key-force/u-loser-force/owner",
"reauth-user/a10-used-tagged-key-force/u-loser-force/outcome",
"reauth-user/a10-used-tagged-key-force/u-loser-force/node-key",
"reauth-user/a10-used-tagged-key-force/u-loser-force/expiry",
"reauth-user/a10-used-tagged-key-force/obs/filter",
"reauth-user/a10-used-tagged-key-force/t-server/filter",
}
// SaaS behaviour recorded as it is, not followed.
const (
sameKeyConversionKeepsExpiry = "SAME_KEY_CONVERSION_KEEPS_EXPIRY: SaaS keeps key expiry on when a tagged key converts a device that keeps its node key, and turns it off for the same conversion with a new node key; headscale turns it off on every tagged node"
singleUseKeyReused = "SINGLE_USE_KEY_REUSED: SaaS lets one single-use tagged key convert several devices that keep their node key and spends it only with a new node key; headscale spends it on first use and refuses it after"
)
// reauthCompatTests are the captures [runReauthCompat] replays.
var reauthCompatTests = []string{"reauth", "reauth-foreign", "reauth-owner", "identity", "reauth-user", "tag-owner-chain"}
@@ -261,13 +263,9 @@ func (run *reauthRun) step(t *testing.T, step testcapture.Step) {
checks = append(checks, r.filterChecks(t, step, devices)...)
}
prefix := run.c.TestID + "/" + step.Name + "/"
checks = slices.DeleteFunc(checks, func(ch stepCheck) bool {
return notCompared(reauthNotCompared, prefix+ch.name)
})
// Marked here, so a run filtered to other steps does not call these
// entries stale.
prefix := run.c.TestID + "/" + step.Name + "/"
for _, ch := range checks {
run.evaluated[prefix+ch.name] = true
}