From 798c8a9edb791d2a97ecec0b79a18d393aa848d1 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Thu, 2 Apr 2026 16:01:40 +0000 Subject: [PATCH] testdata: add subnet-to-subnet route compatibility golden files Add 6 golden files captured from Tailscale SaaS that cover subnet-to-subnet ACL scenarios where both source and destination are subnet CIDRs. These fill a complete gap in the existing 92 ROUTES golden files, none of which tested this pattern. Scenarios covered: f10: exact issue #3157 reproduction (disjoint subnets, host aliases) f11: bidirectional with overlapping big-router f12: host aliases where dst is a superset route f13: disjoint subnets, bidirectional f14: both src and dst overlap on one router f15: cross-router bidirectional All 6 pass TestRoutesCompat, confirming headscale matches Tailscale SaaS behavior for subnet-to-subnet filter rule distribution. Updates #3157 Updates #3169 --- ...UTES-f10_subnet_to_subnet_issue3157.hujson | 274 +++++++++++++++ ...-f11_subnet_to_subnet_bidirectional.hujson | 326 ++++++++++++++++++ ...S-f12_subnet_to_subnet_host_aliases.hujson | 288 ++++++++++++++++ ...OUTES-f13_subnet_to_subnet_disjoint.hujson | 311 +++++++++++++++++ ...et_to_subnet_overlapping_one_router.hujson | 287 +++++++++++++++ ...-f15_subnet_to_subnet_cross_routers.hujson | 312 +++++++++++++++++ 6 files changed, 1798 insertions(+) create mode 100644 hscontrol/policy/v2/testdata/routes_results/ROUTES-f10_subnet_to_subnet_issue3157.hujson create mode 100644 hscontrol/policy/v2/testdata/routes_results/ROUTES-f11_subnet_to_subnet_bidirectional.hujson create mode 100644 hscontrol/policy/v2/testdata/routes_results/ROUTES-f12_subnet_to_subnet_host_aliases.hujson create mode 100644 hscontrol/policy/v2/testdata/routes_results/ROUTES-f13_subnet_to_subnet_disjoint.hujson create mode 100644 hscontrol/policy/v2/testdata/routes_results/ROUTES-f14_subnet_to_subnet_overlapping_one_router.hujson create mode 100644 hscontrol/policy/v2/testdata/routes_results/ROUTES-f15_subnet_to_subnet_cross_routers.hujson diff --git a/hscontrol/policy/v2/testdata/routes_results/ROUTES-f10_subnet_to_subnet_issue3157.hujson b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f10_subnet_to_subnet_issue3157.hujson new file mode 100644 index 00000000..721f965d --- /dev/null +++ b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f10_subnet_to_subnet_issue3157.hujson @@ -0,0 +1,274 @@ +// ROUTES-f10_subnet_to_subnet_issue3157 +// +// ACLs: +// accept: src=['subnet_a'] dst=['subnet_b:*'] +// (hosts: subnet_a=192.168.1.0/24, subnet_b=172.16.0.0/24) +// +// Tests the EXACT scenario from issue #3157: two dedicated subnet routers, +// each with one disjoint subnet, unidirectional ACL using host aliases. +// +// Expected: 1 rule on multi-router (routes 172.16.0.0/24 = dst subnet_b) +{ + "test_id": "ROUTES-f10_subnet_to_subnet_issue3157", + "input": { + "full_policy": { + "groups": { + "group:admins": [ + "kratail2tid@passkey" + ], + "group:developers": [ + "kristoffer@dalby.cc", + "kratail2tid@passkey" + ], + "group:monitors": [ + "monitorpasskeykradalby@passkey" + ], + "group:empty": [] + }, + "tagOwners": { + "tag:server": [ + "kratail2tid@passkey" + ], + "tag:prod": [ + "kratail2tid@passkey" + ], + "tag:client": [ + "kratail2tid@passkey" + ], + "tag:router": [ + "kratail2tid@passkey" + ], + "tag:exit": [ + "kratail2tid@passkey" + ], + "tag:ha": [ + "kratail2tid@passkey" + ] + }, + "hosts": { + "webserver": "100.108.74.26", + "prodbox": "100.103.8.15", + "internal": "10.0.0.0/8", + "subnet24": "192.168.1.0/24", + "subnet_a": "192.168.1.0/24", + "subnet_b": "172.16.0.0/24" + }, + "autoApprovers": { + "routes": { + "10.0.0.0/8": [ + "tag:router" + ], + "172.16.0.0/12": [ + "tag:router" + ], + "192.168.0.0/16": [ + "tag:ha" + ], + "0.0.0.0/0": [ + "tag:exit" + ], + "::/0": [ + "tag:exit" + ] + } + }, + "acls": [ + { + "action": "accept", + "src": [ + "subnet_a" + ], + "dst": [ + "subnet_b:*" + ] + } + ] + } + }, + "topology": { + "nodes": { + "big-router": { + "hostname": "big-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.97.174.21", + "ipv6": "fd7a:115c:a1e0::5137:ae15", + "routable_ips": [ + "10.0.0.0/8" + ], + "approved_routes": [ + "10.0.0.0/8" + ] + }, + "exit-node": { + "hostname": "exit-node", + "tags": [ + "tag:exit" + ], + "ipv4": "100.85.66.106", + "ipv6": "fd7a:115c:a1e0::7c37:426a", + "routable_ips": [ + "0.0.0.0/0", + "::/0" + ], + "approved_routes": [ + "0.0.0.0/0", + "::/0" + ] + }, + "ha-router1": { + "hostname": "ha-router1", + "tags": [ + "tag:ha" + ], + "ipv4": "100.121.186.70", + "ipv6": "fd7a:115c:a1e0::6737:ba46", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "ha-router2": { + "hostname": "ha-router2", + "tags": [ + "tag:ha" + ], + "ipv4": "100.117.104.82", + "ipv6": "fd7a:115c:a1e0::7437:6852", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "multi-router": { + "hostname": "multi-router", + "tags": [ + "tag:exit", + "tag:router" + ], + "ipv4": "100.119.241.111", + "ipv6": "fd7a:115c:a1e0::3337:f16f", + "routable_ips": [ + "172.16.0.0/24" + ], + "approved_routes": [ + "172.16.0.0/24" + ] + }, + "subnet-router": { + "hostname": "subnet-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.92.142.61", + "ipv6": "fd7a:115c:a1e0::3e37:8e3d", + "routable_ips": [ + "10.33.0.0/16" + ], + "approved_routes": [ + "10.33.0.0/16" + ] + }, + "tagged-client": { + "hostname": "tagged-client", + "tags": [ + "tag:client" + ], + "ipv4": "100.83.200.69", + "ipv6": "fd7a:115c:a1e0::c537:c845" + }, + "tagged-prod": { + "hostname": "tagged-prod", + "tags": [ + "tag:prod" + ], + "ipv4": "100.103.8.15", + "ipv6": "fd7a:115c:a1e0::5b37:80f" + }, + "tagged-server": { + "hostname": "tagged-server", + "tags": [ + "tag:server" + ], + "ipv4": "100.108.74.26", + "ipv6": "fd7a:115c:a1e0::b901:4a87" + }, + "user-kris": { + "hostname": "user-kris", + "tags": [], + "ipv4": "100.110.121.96", + "ipv6": "fd7a:115c:a1e0::1737:7960" + }, + "user-mon": { + "hostname": "user-mon", + "tags": [], + "ipv4": "100.103.90.82", + "ipv6": "fd7a:115c:a1e0::9e37:5a52" + }, + "user1": { + "hostname": "user1", + "tags": [], + "ipv4": "100.90.199.68", + "ipv6": "fd7a:115c:a1e0::2d01:c747" + } + } + }, + "captures": { + "big-router": { + "packet_filter_rules": null + }, + "exit-node": { + "packet_filter_rules": null + }, + "ha-router1": { + "packet_filter_rules": null + }, + "ha-router2": { + "packet_filter_rules": null + }, + "multi-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "192.168.1.0/24" + ], + "DstPorts": [ + { + "IP": "172.16.0.0/24", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "subnet-router": { + "packet_filter_rules": null + }, + "tagged-client": { + "packet_filter_rules": null + }, + "tagged-prod": { + "packet_filter_rules": null + }, + "tagged-server": { + "packet_filter_rules": null + }, + "user-kris": { + "packet_filter_rules": null + }, + "user-mon": { + "packet_filter_rules": null + }, + "user1": { + "packet_filter_rules": null + } + } +} diff --git a/hscontrol/policy/v2/testdata/routes_results/ROUTES-f11_subnet_to_subnet_bidirectional.hujson b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f11_subnet_to_subnet_bidirectional.hujson new file mode 100644 index 00000000..8c31dd57 --- /dev/null +++ b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f11_subnet_to_subnet_bidirectional.hujson @@ -0,0 +1,326 @@ +// ROUTES-f11_subnet_to_subnet_bidirectional +// +// ACLs: +// accept: src=['192.168.1.0/24'] dst=['10.33.0.0/16:*'] +// accept: src=['10.33.0.0/16'] dst=['192.168.1.0/24:*'] +// +// Bidirectional subnet-to-subnet with big-router overlapping on 10.0.0.0/8. +// ha-router1 and ha-router2 both route 192.168.1.0/24. +// +// Expected: 4 nodes with rules (big-router, ha-router1, ha-router2, subnet-router) +{ + "test_id": "ROUTES-f11_subnet_to_subnet_bidirectional", + "input": { + "full_policy": { + "groups": { + "group:admins": [ + "kratail2tid@passkey" + ], + "group:developers": [ + "kristoffer@dalby.cc", + "kratail2tid@passkey" + ], + "group:monitors": [ + "monitorpasskeykradalby@passkey" + ], + "group:empty": [] + }, + "tagOwners": { + "tag:server": [ + "kratail2tid@passkey" + ], + "tag:prod": [ + "kratail2tid@passkey" + ], + "tag:client": [ + "kratail2tid@passkey" + ], + "tag:router": [ + "kratail2tid@passkey" + ], + "tag:exit": [ + "kratail2tid@passkey" + ], + "tag:ha": [ + "kratail2tid@passkey" + ] + }, + "hosts": { + "webserver": "100.108.74.26", + "prodbox": "100.103.8.15", + "internal": "10.0.0.0/8", + "subnet24": "192.168.1.0/24" + }, + "autoApprovers": { + "routes": { + "10.0.0.0/8": [ + "tag:router" + ], + "172.16.0.0/12": [ + "tag:router" + ], + "192.168.0.0/16": [ + "tag:ha" + ], + "0.0.0.0/0": [ + "tag:exit" + ], + "::/0": [ + "tag:exit" + ] + } + }, + "acls": [ + { + "action": "accept", + "src": [ + "192.168.1.0/24" + ], + "dst": [ + "10.33.0.0/16:*" + ] + }, + { + "action": "accept", + "src": [ + "10.33.0.0/16" + ], + "dst": [ + "192.168.1.0/24:*" + ] + } + ] + } + }, + "topology": { + "nodes": { + "big-router": { + "hostname": "big-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.97.174.21", + "ipv6": "fd7a:115c:a1e0::5137:ae15", + "routable_ips": [ + "10.0.0.0/8" + ], + "approved_routes": [ + "10.0.0.0/8" + ] + }, + "exit-node": { + "hostname": "exit-node", + "tags": [ + "tag:exit" + ], + "ipv4": "100.85.66.106", + "ipv6": "fd7a:115c:a1e0::7c37:426a", + "routable_ips": [ + "0.0.0.0/0", + "::/0" + ], + "approved_routes": [ + "0.0.0.0/0", + "::/0" + ] + }, + "ha-router1": { + "hostname": "ha-router1", + "tags": [ + "tag:ha" + ], + "ipv4": "100.121.186.70", + "ipv6": "fd7a:115c:a1e0::6737:ba46", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "ha-router2": { + "hostname": "ha-router2", + "tags": [ + "tag:ha" + ], + "ipv4": "100.117.104.82", + "ipv6": "fd7a:115c:a1e0::7437:6852", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "multi-router": { + "hostname": "multi-router", + "tags": [ + "tag:exit", + "tag:router" + ], + "ipv4": "100.119.241.111", + "ipv6": "fd7a:115c:a1e0::3337:f16f", + "routable_ips": [ + "172.16.0.0/24" + ], + "approved_routes": [ + "172.16.0.0/24" + ] + }, + "subnet-router": { + "hostname": "subnet-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.92.142.61", + "ipv6": "fd7a:115c:a1e0::3e37:8e3d", + "routable_ips": [ + "10.33.0.0/16" + ], + "approved_routes": [ + "10.33.0.0/16" + ] + }, + "tagged-client": { + "hostname": "tagged-client", + "tags": [ + "tag:client" + ], + "ipv4": "100.83.200.69", + "ipv6": "fd7a:115c:a1e0::c537:c845" + }, + "tagged-prod": { + "hostname": "tagged-prod", + "tags": [ + "tag:prod" + ], + "ipv4": "100.103.8.15", + "ipv6": "fd7a:115c:a1e0::5b37:80f" + }, + "tagged-server": { + "hostname": "tagged-server", + "tags": [ + "tag:server" + ], + "ipv4": "100.108.74.26", + "ipv6": "fd7a:115c:a1e0::b901:4a87" + }, + "user-kris": { + "hostname": "user-kris", + "tags": [], + "ipv4": "100.110.121.96", + "ipv6": "fd7a:115c:a1e0::1737:7960" + }, + "user-mon": { + "hostname": "user-mon", + "tags": [], + "ipv4": "100.103.90.82", + "ipv6": "fd7a:115c:a1e0::9e37:5a52" + }, + "user1": { + "hostname": "user1", + "tags": [], + "ipv4": "100.90.199.68", + "ipv6": "fd7a:115c:a1e0::2d01:c747" + } + } + }, + "captures": { + "big-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "192.168.1.0/24" + ], + "DstPorts": [ + { + "IP": "10.33.0.0/16", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "exit-node": { + "packet_filter_rules": null + }, + "ha-router1": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "10.33.0.0/16" + ], + "DstPorts": [ + { + "IP": "192.168.1.0/24", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "ha-router2": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "10.33.0.0/16" + ], + "DstPorts": [ + { + "IP": "192.168.1.0/24", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "multi-router": { + "packet_filter_rules": null + }, + "subnet-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "192.168.1.0/24" + ], + "DstPorts": [ + { + "IP": "10.33.0.0/16", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "tagged-client": { + "packet_filter_rules": null + }, + "tagged-prod": { + "packet_filter_rules": null + }, + "tagged-server": { + "packet_filter_rules": null + }, + "user-kris": { + "packet_filter_rules": null + }, + "user-mon": { + "packet_filter_rules": null + }, + "user1": { + "packet_filter_rules": null + } + } +} diff --git a/hscontrol/policy/v2/testdata/routes_results/ROUTES-f12_subnet_to_subnet_host_aliases.hujson b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f12_subnet_to_subnet_host_aliases.hujson new file mode 100644 index 00000000..aa6d0492 --- /dev/null +++ b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f12_subnet_to_subnet_host_aliases.hujson @@ -0,0 +1,288 @@ +// ROUTES-f12_subnet_to_subnet_host_aliases +// +// ACLs: +// accept: src=['subnet24'] dst=['internal:*'] +// (hosts: subnet24=192.168.1.0/24, internal=10.0.0.0/8) +// +// Host aliases where dst is a superset route. big-router routes 10.0.0.0/8 +// which exactly matches dst 'internal'. subnet-router routes 10.33.0.0/16 +// which is a subset of dst — Tailscale SaaS gives it the SAME rule. +// +// Expected: 2 nodes with rules (big-router, subnet-router) +{ + "test_id": "ROUTES-f12_subnet_to_subnet_host_aliases", + "input": { + "full_policy": { + "groups": { + "group:admins": [ + "kratail2tid@passkey" + ], + "group:developers": [ + "kristoffer@dalby.cc", + "kratail2tid@passkey" + ], + "group:monitors": [ + "monitorpasskeykradalby@passkey" + ], + "group:empty": [] + }, + "tagOwners": { + "tag:server": [ + "kratail2tid@passkey" + ], + "tag:prod": [ + "kratail2tid@passkey" + ], + "tag:client": [ + "kratail2tid@passkey" + ], + "tag:router": [ + "kratail2tid@passkey" + ], + "tag:exit": [ + "kratail2tid@passkey" + ], + "tag:ha": [ + "kratail2tid@passkey" + ] + }, + "hosts": { + "webserver": "100.108.74.26", + "prodbox": "100.103.8.15", + "internal": "10.0.0.0/8", + "subnet24": "192.168.1.0/24" + }, + "autoApprovers": { + "routes": { + "10.0.0.0/8": [ + "tag:router" + ], + "172.16.0.0/12": [ + "tag:router" + ], + "192.168.0.0/16": [ + "tag:ha" + ], + "0.0.0.0/0": [ + "tag:exit" + ], + "::/0": [ + "tag:exit" + ] + } + }, + "acls": [ + { + "action": "accept", + "src": [ + "subnet24" + ], + "dst": [ + "internal:*" + ] + } + ] + } + }, + "topology": { + "nodes": { + "big-router": { + "hostname": "big-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.97.174.21", + "ipv6": "fd7a:115c:a1e0::5137:ae15", + "routable_ips": [ + "10.0.0.0/8" + ], + "approved_routes": [ + "10.0.0.0/8" + ] + }, + "exit-node": { + "hostname": "exit-node", + "tags": [ + "tag:exit" + ], + "ipv4": "100.85.66.106", + "ipv6": "fd7a:115c:a1e0::7c37:426a", + "routable_ips": [ + "0.0.0.0/0", + "::/0" + ], + "approved_routes": [ + "0.0.0.0/0", + "::/0" + ] + }, + "ha-router1": { + "hostname": "ha-router1", + "tags": [ + "tag:ha" + ], + "ipv4": "100.121.186.70", + "ipv6": "fd7a:115c:a1e0::6737:ba46", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "ha-router2": { + "hostname": "ha-router2", + "tags": [ + "tag:ha" + ], + "ipv4": "100.117.104.82", + "ipv6": "fd7a:115c:a1e0::7437:6852", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "multi-router": { + "hostname": "multi-router", + "tags": [ + "tag:exit", + "tag:router" + ], + "ipv4": "100.119.241.111", + "ipv6": "fd7a:115c:a1e0::3337:f16f", + "routable_ips": [ + "172.16.0.0/24" + ], + "approved_routes": [ + "172.16.0.0/24" + ] + }, + "subnet-router": { + "hostname": "subnet-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.92.142.61", + "ipv6": "fd7a:115c:a1e0::3e37:8e3d", + "routable_ips": [ + "10.33.0.0/16" + ], + "approved_routes": [ + "10.33.0.0/16" + ] + }, + "tagged-client": { + "hostname": "tagged-client", + "tags": [ + "tag:client" + ], + "ipv4": "100.83.200.69", + "ipv6": "fd7a:115c:a1e0::c537:c845" + }, + "tagged-prod": { + "hostname": "tagged-prod", + "tags": [ + "tag:prod" + ], + "ipv4": "100.103.8.15", + "ipv6": "fd7a:115c:a1e0::5b37:80f" + }, + "tagged-server": { + "hostname": "tagged-server", + "tags": [ + "tag:server" + ], + "ipv4": "100.108.74.26", + "ipv6": "fd7a:115c:a1e0::b901:4a87" + }, + "user-kris": { + "hostname": "user-kris", + "tags": [], + "ipv4": "100.110.121.96", + "ipv6": "fd7a:115c:a1e0::1737:7960" + }, + "user-mon": { + "hostname": "user-mon", + "tags": [], + "ipv4": "100.103.90.82", + "ipv6": "fd7a:115c:a1e0::9e37:5a52" + }, + "user1": { + "hostname": "user1", + "tags": [], + "ipv4": "100.90.199.68", + "ipv6": "fd7a:115c:a1e0::2d01:c747" + } + } + }, + "captures": { + "big-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "192.168.1.0/24" + ], + "DstPorts": [ + { + "IP": "10.0.0.0/8", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "exit-node": { + "packet_filter_rules": null + }, + "ha-router1": { + "packet_filter_rules": null + }, + "ha-router2": { + "packet_filter_rules": null + }, + "multi-router": { + "packet_filter_rules": null + }, + "subnet-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "192.168.1.0/24" + ], + "DstPorts": [ + { + "IP": "10.0.0.0/8", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "tagged-client": { + "packet_filter_rules": null + }, + "tagged-prod": { + "packet_filter_rules": null + }, + "tagged-server": { + "packet_filter_rules": null + }, + "user-kris": { + "packet_filter_rules": null + }, + "user-mon": { + "packet_filter_rules": null + }, + "user1": { + "packet_filter_rules": null + } + } +} diff --git a/hscontrol/policy/v2/testdata/routes_results/ROUTES-f13_subnet_to_subnet_disjoint.hujson b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f13_subnet_to_subnet_disjoint.hujson new file mode 100644 index 00000000..d58a63ca --- /dev/null +++ b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f13_subnet_to_subnet_disjoint.hujson @@ -0,0 +1,311 @@ +// ROUTES-f13_subnet_to_subnet_disjoint +// +// ACLs: +// accept: src=['192.168.1.0/24'] dst=['172.16.0.0/24:*'] +// accept: src=['172.16.0.0/24'] dst=['192.168.1.0/24:*'] +// +// Disjoint subnets, bidirectional. ha-router1 and ha-router2 route 192.168.1.0/24, +// multi-router routes 172.16.0.0/24. big-router (10.0.0.0/8) has NO overlap. +// +// Expected: 3 nodes with rules (ha-router1, ha-router2, multi-router) +{ + "test_id": "ROUTES-f13_subnet_to_subnet_disjoint", + "input": { + "full_policy": { + "groups": { + "group:admins": [ + "kratail2tid@passkey" + ], + "group:developers": [ + "kristoffer@dalby.cc", + "kratail2tid@passkey" + ], + "group:monitors": [ + "monitorpasskeykradalby@passkey" + ], + "group:empty": [] + }, + "tagOwners": { + "tag:server": [ + "kratail2tid@passkey" + ], + "tag:prod": [ + "kratail2tid@passkey" + ], + "tag:client": [ + "kratail2tid@passkey" + ], + "tag:router": [ + "kratail2tid@passkey" + ], + "tag:exit": [ + "kratail2tid@passkey" + ], + "tag:ha": [ + "kratail2tid@passkey" + ] + }, + "hosts": { + "webserver": "100.108.74.26", + "prodbox": "100.103.8.15", + "internal": "10.0.0.0/8", + "subnet24": "192.168.1.0/24" + }, + "autoApprovers": { + "routes": { + "10.0.0.0/8": [ + "tag:router" + ], + "172.16.0.0/12": [ + "tag:router" + ], + "192.168.0.0/16": [ + "tag:ha" + ], + "0.0.0.0/0": [ + "tag:exit" + ], + "::/0": [ + "tag:exit" + ] + } + }, + "acls": [ + { + "action": "accept", + "src": [ + "192.168.1.0/24" + ], + "dst": [ + "172.16.0.0/24:*" + ] + }, + { + "action": "accept", + "src": [ + "172.16.0.0/24" + ], + "dst": [ + "192.168.1.0/24:*" + ] + } + ] + } + }, + "topology": { + "nodes": { + "big-router": { + "hostname": "big-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.97.174.21", + "ipv6": "fd7a:115c:a1e0::5137:ae15", + "routable_ips": [ + "10.0.0.0/8" + ], + "approved_routes": [ + "10.0.0.0/8" + ] + }, + "exit-node": { + "hostname": "exit-node", + "tags": [ + "tag:exit" + ], + "ipv4": "100.85.66.106", + "ipv6": "fd7a:115c:a1e0::7c37:426a", + "routable_ips": [ + "0.0.0.0/0", + "::/0" + ], + "approved_routes": [ + "0.0.0.0/0", + "::/0" + ] + }, + "ha-router1": { + "hostname": "ha-router1", + "tags": [ + "tag:ha" + ], + "ipv4": "100.121.186.70", + "ipv6": "fd7a:115c:a1e0::6737:ba46", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "ha-router2": { + "hostname": "ha-router2", + "tags": [ + "tag:ha" + ], + "ipv4": "100.117.104.82", + "ipv6": "fd7a:115c:a1e0::7437:6852", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "multi-router": { + "hostname": "multi-router", + "tags": [ + "tag:exit", + "tag:router" + ], + "ipv4": "100.119.241.111", + "ipv6": "fd7a:115c:a1e0::3337:f16f", + "routable_ips": [ + "172.16.0.0/24" + ], + "approved_routes": [ + "172.16.0.0/24" + ] + }, + "subnet-router": { + "hostname": "subnet-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.92.142.61", + "ipv6": "fd7a:115c:a1e0::3e37:8e3d", + "routable_ips": [ + "10.33.0.0/16" + ], + "approved_routes": [ + "10.33.0.0/16" + ] + }, + "tagged-client": { + "hostname": "tagged-client", + "tags": [ + "tag:client" + ], + "ipv4": "100.83.200.69", + "ipv6": "fd7a:115c:a1e0::c537:c845" + }, + "tagged-prod": { + "hostname": "tagged-prod", + "tags": [ + "tag:prod" + ], + "ipv4": "100.103.8.15", + "ipv6": "fd7a:115c:a1e0::5b37:80f" + }, + "tagged-server": { + "hostname": "tagged-server", + "tags": [ + "tag:server" + ], + "ipv4": "100.108.74.26", + "ipv6": "fd7a:115c:a1e0::b901:4a87" + }, + "user-kris": { + "hostname": "user-kris", + "tags": [], + "ipv4": "100.110.121.96", + "ipv6": "fd7a:115c:a1e0::1737:7960" + }, + "user-mon": { + "hostname": "user-mon", + "tags": [], + "ipv4": "100.103.90.82", + "ipv6": "fd7a:115c:a1e0::9e37:5a52" + }, + "user1": { + "hostname": "user1", + "tags": [], + "ipv4": "100.90.199.68", + "ipv6": "fd7a:115c:a1e0::2d01:c747" + } + } + }, + "captures": { + "big-router": { + "packet_filter_rules": null + }, + "exit-node": { + "packet_filter_rules": null + }, + "ha-router1": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "172.16.0.0/24" + ], + "DstPorts": [ + { + "IP": "192.168.1.0/24", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "ha-router2": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "172.16.0.0/24" + ], + "DstPorts": [ + { + "IP": "192.168.1.0/24", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "multi-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "192.168.1.0/24" + ], + "DstPorts": [ + { + "IP": "172.16.0.0/24", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "subnet-router": { + "packet_filter_rules": null + }, + "tagged-client": { + "packet_filter_rules": null + }, + "tagged-prod": { + "packet_filter_rules": null + }, + "tagged-server": { + "packet_filter_rules": null + }, + "user-kris": { + "packet_filter_rules": null + }, + "user-mon": { + "packet_filter_rules": null + }, + "user1": { + "packet_filter_rules": null + } + } +} diff --git a/hscontrol/policy/v2/testdata/routes_results/ROUTES-f14_subnet_to_subnet_overlapping_one_router.hujson b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f14_subnet_to_subnet_overlapping_one_router.hujson new file mode 100644 index 00000000..759d2833 --- /dev/null +++ b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f14_subnet_to_subnet_overlapping_one_router.hujson @@ -0,0 +1,287 @@ +// ROUTES-f14_subnet_to_subnet_overlapping_one_router +// +// ACLs: +// accept: src=['10.0.0.0/8'] dst=['10.33.0.0/16:*'] +// +// Both src and dst overlap on big-router's 10.0.0.0/8 route. +// subnet-router routes 10.33.0.0/16 (subset of src 10.0.0.0/8). +// Tailscale SaaS gives rules to BOTH big-router and subnet-router. +// +// Expected: 2 nodes with rules (big-router, subnet-router) +{ + "test_id": "ROUTES-f14_subnet_to_subnet_overlapping_one_router", + "input": { + "full_policy": { + "groups": { + "group:admins": [ + "kratail2tid@passkey" + ], + "group:developers": [ + "kristoffer@dalby.cc", + "kratail2tid@passkey" + ], + "group:monitors": [ + "monitorpasskeykradalby@passkey" + ], + "group:empty": [] + }, + "tagOwners": { + "tag:server": [ + "kratail2tid@passkey" + ], + "tag:prod": [ + "kratail2tid@passkey" + ], + "tag:client": [ + "kratail2tid@passkey" + ], + "tag:router": [ + "kratail2tid@passkey" + ], + "tag:exit": [ + "kratail2tid@passkey" + ], + "tag:ha": [ + "kratail2tid@passkey" + ] + }, + "hosts": { + "webserver": "100.108.74.26", + "prodbox": "100.103.8.15", + "internal": "10.0.0.0/8", + "subnet24": "192.168.1.0/24" + }, + "autoApprovers": { + "routes": { + "10.0.0.0/8": [ + "tag:router" + ], + "172.16.0.0/12": [ + "tag:router" + ], + "192.168.0.0/16": [ + "tag:ha" + ], + "0.0.0.0/0": [ + "tag:exit" + ], + "::/0": [ + "tag:exit" + ] + } + }, + "acls": [ + { + "action": "accept", + "src": [ + "10.0.0.0/8" + ], + "dst": [ + "10.33.0.0/16:*" + ] + } + ] + } + }, + "topology": { + "nodes": { + "big-router": { + "hostname": "big-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.97.174.21", + "ipv6": "fd7a:115c:a1e0::5137:ae15", + "routable_ips": [ + "10.0.0.0/8" + ], + "approved_routes": [ + "10.0.0.0/8" + ] + }, + "exit-node": { + "hostname": "exit-node", + "tags": [ + "tag:exit" + ], + "ipv4": "100.85.66.106", + "ipv6": "fd7a:115c:a1e0::7c37:426a", + "routable_ips": [ + "0.0.0.0/0", + "::/0" + ], + "approved_routes": [ + "0.0.0.0/0", + "::/0" + ] + }, + "ha-router1": { + "hostname": "ha-router1", + "tags": [ + "tag:ha" + ], + "ipv4": "100.121.186.70", + "ipv6": "fd7a:115c:a1e0::6737:ba46", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "ha-router2": { + "hostname": "ha-router2", + "tags": [ + "tag:ha" + ], + "ipv4": "100.117.104.82", + "ipv6": "fd7a:115c:a1e0::7437:6852", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "multi-router": { + "hostname": "multi-router", + "tags": [ + "tag:exit", + "tag:router" + ], + "ipv4": "100.119.241.111", + "ipv6": "fd7a:115c:a1e0::3337:f16f", + "routable_ips": [ + "172.16.0.0/24" + ], + "approved_routes": [ + "172.16.0.0/24" + ] + }, + "subnet-router": { + "hostname": "subnet-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.92.142.61", + "ipv6": "fd7a:115c:a1e0::3e37:8e3d", + "routable_ips": [ + "10.33.0.0/16" + ], + "approved_routes": [ + "10.33.0.0/16" + ] + }, + "tagged-client": { + "hostname": "tagged-client", + "tags": [ + "tag:client" + ], + "ipv4": "100.83.200.69", + "ipv6": "fd7a:115c:a1e0::c537:c845" + }, + "tagged-prod": { + "hostname": "tagged-prod", + "tags": [ + "tag:prod" + ], + "ipv4": "100.103.8.15", + "ipv6": "fd7a:115c:a1e0::5b37:80f" + }, + "tagged-server": { + "hostname": "tagged-server", + "tags": [ + "tag:server" + ], + "ipv4": "100.108.74.26", + "ipv6": "fd7a:115c:a1e0::b901:4a87" + }, + "user-kris": { + "hostname": "user-kris", + "tags": [], + "ipv4": "100.110.121.96", + "ipv6": "fd7a:115c:a1e0::1737:7960" + }, + "user-mon": { + "hostname": "user-mon", + "tags": [], + "ipv4": "100.103.90.82", + "ipv6": "fd7a:115c:a1e0::9e37:5a52" + }, + "user1": { + "hostname": "user1", + "tags": [], + "ipv4": "100.90.199.68", + "ipv6": "fd7a:115c:a1e0::2d01:c747" + } + } + }, + "captures": { + "big-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "10.0.0.0/8" + ], + "DstPorts": [ + { + "IP": "10.33.0.0/16", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "exit-node": { + "packet_filter_rules": null + }, + "ha-router1": { + "packet_filter_rules": null + }, + "ha-router2": { + "packet_filter_rules": null + }, + "multi-router": { + "packet_filter_rules": null + }, + "subnet-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "10.0.0.0/8" + ], + "DstPorts": [ + { + "IP": "10.33.0.0/16", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "tagged-client": { + "packet_filter_rules": null + }, + "tagged-prod": { + "packet_filter_rules": null + }, + "tagged-server": { + "packet_filter_rules": null + }, + "user-kris": { + "packet_filter_rules": null + }, + "user-mon": { + "packet_filter_rules": null + }, + "user1": { + "packet_filter_rules": null + } + } +} diff --git a/hscontrol/policy/v2/testdata/routes_results/ROUTES-f15_subnet_to_subnet_cross_routers.hujson b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f15_subnet_to_subnet_cross_routers.hujson new file mode 100644 index 00000000..9578f85a --- /dev/null +++ b/hscontrol/policy/v2/testdata/routes_results/ROUTES-f15_subnet_to_subnet_cross_routers.hujson @@ -0,0 +1,312 @@ +// ROUTES-f15_subnet_to_subnet_cross_routers +// +// ACLs: +// accept: src=['10.33.0.0/16'] dst=['172.16.0.0/24:*'] +// accept: src=['172.16.0.0/24'] dst=['10.33.0.0/16:*'] +// +// Cross-router bidirectional. big-router (10.0.0.0/8) overlaps with +// src/dst 10.33.0.0/16. multi-router routes 172.16.0.0/24. +// subnet-router routes 10.33.0.0/16. +// +// Expected: 3 nodes with rules (big-router, multi-router, subnet-router) +{ + "test_id": "ROUTES-f15_subnet_to_subnet_cross_routers", + "input": { + "full_policy": { + "groups": { + "group:admins": [ + "kratail2tid@passkey" + ], + "group:developers": [ + "kristoffer@dalby.cc", + "kratail2tid@passkey" + ], + "group:monitors": [ + "monitorpasskeykradalby@passkey" + ], + "group:empty": [] + }, + "tagOwners": { + "tag:server": [ + "kratail2tid@passkey" + ], + "tag:prod": [ + "kratail2tid@passkey" + ], + "tag:client": [ + "kratail2tid@passkey" + ], + "tag:router": [ + "kratail2tid@passkey" + ], + "tag:exit": [ + "kratail2tid@passkey" + ], + "tag:ha": [ + "kratail2tid@passkey" + ] + }, + "hosts": { + "webserver": "100.108.74.26", + "prodbox": "100.103.8.15", + "internal": "10.0.0.0/8", + "subnet24": "192.168.1.0/24" + }, + "autoApprovers": { + "routes": { + "10.0.0.0/8": [ + "tag:router" + ], + "172.16.0.0/12": [ + "tag:router" + ], + "192.168.0.0/16": [ + "tag:ha" + ], + "0.0.0.0/0": [ + "tag:exit" + ], + "::/0": [ + "tag:exit" + ] + } + }, + "acls": [ + { + "action": "accept", + "src": [ + "10.33.0.0/16" + ], + "dst": [ + "172.16.0.0/24:*" + ] + }, + { + "action": "accept", + "src": [ + "172.16.0.0/24" + ], + "dst": [ + "10.33.0.0/16:*" + ] + } + ] + } + }, + "topology": { + "nodes": { + "big-router": { + "hostname": "big-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.97.174.21", + "ipv6": "fd7a:115c:a1e0::5137:ae15", + "routable_ips": [ + "10.0.0.0/8" + ], + "approved_routes": [ + "10.0.0.0/8" + ] + }, + "exit-node": { + "hostname": "exit-node", + "tags": [ + "tag:exit" + ], + "ipv4": "100.85.66.106", + "ipv6": "fd7a:115c:a1e0::7c37:426a", + "routable_ips": [ + "0.0.0.0/0", + "::/0" + ], + "approved_routes": [ + "0.0.0.0/0", + "::/0" + ] + }, + "ha-router1": { + "hostname": "ha-router1", + "tags": [ + "tag:ha" + ], + "ipv4": "100.121.186.70", + "ipv6": "fd7a:115c:a1e0::6737:ba46", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "ha-router2": { + "hostname": "ha-router2", + "tags": [ + "tag:ha" + ], + "ipv4": "100.117.104.82", + "ipv6": "fd7a:115c:a1e0::7437:6852", + "routable_ips": [ + "192.168.1.0/24" + ], + "approved_routes": [ + "192.168.1.0/24" + ] + }, + "multi-router": { + "hostname": "multi-router", + "tags": [ + "tag:exit", + "tag:router" + ], + "ipv4": "100.119.241.111", + "ipv6": "fd7a:115c:a1e0::3337:f16f", + "routable_ips": [ + "172.16.0.0/24" + ], + "approved_routes": [ + "172.16.0.0/24" + ] + }, + "subnet-router": { + "hostname": "subnet-router", + "tags": [ + "tag:router" + ], + "ipv4": "100.92.142.61", + "ipv6": "fd7a:115c:a1e0::3e37:8e3d", + "routable_ips": [ + "10.33.0.0/16" + ], + "approved_routes": [ + "10.33.0.0/16" + ] + }, + "tagged-client": { + "hostname": "tagged-client", + "tags": [ + "tag:client" + ], + "ipv4": "100.83.200.69", + "ipv6": "fd7a:115c:a1e0::c537:c845" + }, + "tagged-prod": { + "hostname": "tagged-prod", + "tags": [ + "tag:prod" + ], + "ipv4": "100.103.8.15", + "ipv6": "fd7a:115c:a1e0::5b37:80f" + }, + "tagged-server": { + "hostname": "tagged-server", + "tags": [ + "tag:server" + ], + "ipv4": "100.108.74.26", + "ipv6": "fd7a:115c:a1e0::b901:4a87" + }, + "user-kris": { + "hostname": "user-kris", + "tags": [], + "ipv4": "100.110.121.96", + "ipv6": "fd7a:115c:a1e0::1737:7960" + }, + "user-mon": { + "hostname": "user-mon", + "tags": [], + "ipv4": "100.103.90.82", + "ipv6": "fd7a:115c:a1e0::9e37:5a52" + }, + "user1": { + "hostname": "user1", + "tags": [], + "ipv4": "100.90.199.68", + "ipv6": "fd7a:115c:a1e0::2d01:c747" + } + } + }, + "captures": { + "big-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "172.16.0.0/24" + ], + "DstPorts": [ + { + "IP": "10.33.0.0/16", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "exit-node": { + "packet_filter_rules": null + }, + "ha-router1": { + "packet_filter_rules": null + }, + "ha-router2": { + "packet_filter_rules": null + }, + "multi-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "10.33.0.0/16" + ], + "DstPorts": [ + { + "IP": "172.16.0.0/24", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "subnet-router": { + "packet_filter_rules": [ + { + "SrcIPs": [ + "172.16.0.0/24" + ], + "DstPorts": [ + { + "IP": "10.33.0.0/16", + "Ports": { + "First": 0, + "Last": 65535 + } + } + ] + } + ] + }, + "tagged-client": { + "packet_filter_rules": null + }, + "tagged-prod": { + "packet_filter_rules": null + }, + "tagged-server": { + "packet_filter_rules": null + }, + "user-kris": { + "packet_filter_rules": null + }, + "user-mon": { + "packet_filter_rules": null + }, + "user1": { + "packet_filter_rules": null + } + } +}