From 9b6bfd05bc5539aba4d4c2667596f224115294e5 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Mon, 13 Apr 2026 14:57:39 +0000 Subject: [PATCH] servertest: approve only SaaS-approved routes in via compat tests Use topology approved_routes instead of approving all advertised routes. Nodes with unapproved exit routes were incorrectly getting exit routes approved, causing AllowedIPs mismatches. Updates #3157 --- hscontrol/servertest/via_compat_test.go | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/hscontrol/servertest/via_compat_test.go b/hscontrol/servertest/via_compat_test.go index 5732d060..d4fde9bb 100644 --- a/hscontrol/servertest/via_compat_test.go +++ b/hscontrol/servertest/via_compat_test.go @@ -196,6 +196,20 @@ func runViaMapCompat(t *testing.T, gf goldenFile) { // approver tag for a route prefix, the node should advertise it. nodeRoutes := inferNodeRoutes(gf) + // Build approved routes from topology. The topology's approved_routes + // field records what SaaS actually approved (which may be a subset of + // routable_ips). Using this instead of approving all advertised routes + // ensures exit routes are only approved when SaaS approved them. + nodeApproved := map[string][]netip.Prefix{} + + for name, node := range gf.Topology.Nodes { + for _, r := range node.ApprovedRoutes { + nodeApproved[name] = append( + nodeApproved[name], netip.MustParsePrefix(r), + ) + } + } + // Advertise and approve routes FIRST. Via grants depend on routes // being advertised for compileViaGrant to produce filter rules. for name, c := range clients { @@ -216,7 +230,9 @@ func runViaMapCompat(t *testing.T, gf goldenFile) { cancel() nodeID := findNodeID(t, srv, name) - _, routeChange, err := srv.State().SetApprovedRoutes(nodeID, routes) + _, routeChange, err := srv.State().SetApprovedRoutes( + nodeID, nodeApproved[name], + ) require.NoError(t, err) srv.App.Change(routeChange) }