From e9d9d4234aef03ef3bfcf3279562d5975b5621ec Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Wed, 21 Oct 2026 09:40:47 +0000 Subject: [PATCH] policy/v2, servertest: add bare IPv6 sshTests destination capture SaaS fails an accept to a bare IPv6 dst, checking the source at ::ffff:100.64.0.0, which no device holds; the IPv4 twin passes. Headscale checks the source's own addresses and accepts. --- hscontrol/policy/v2/sshtester_compat_test.go | 4 +- .../sshtest-malformed-dst-bare-ipv6.hujson | 190 ++++++++++++++++++ hscontrol/servertest/policy_test.go | 1 + 3 files changed, 194 insertions(+), 1 deletion(-) create mode 100644 hscontrol/policy/v2/testdata/sshtest_results/sshtest-malformed-dst-bare-ipv6.hujson diff --git a/hscontrol/policy/v2/sshtester_compat_test.go b/hscontrol/policy/v2/sshtester_compat_test.go index 9f5f92f0f..3e2e0ff31 100644 --- a/hscontrol/policy/v2/sshtester_compat_test.go +++ b/hscontrol/policy/v2/sshtester_compat_test.go @@ -14,7 +14,9 @@ import ( // knownSSHTesterDivergences names the engine gap for each check where // headscale and upstream disagree, keyed /. -var knownSSHTesterDivergences = map[string]string{} +var knownSSHTesterDivergences = map[string]string{ + "sshtest-malformed-dst-bare-ipv6/verdict": "bare-IPv6 sshTests dst: upstream parse-accepts then engine-rejects; headscale accepts (IPv4 mirror passes both sides)", +} func TestSSHTesterCompat(t *testing.T) { t.Parallel() diff --git a/hscontrol/policy/v2/testdata/sshtest_results/sshtest-malformed-dst-bare-ipv6.hujson b/hscontrol/policy/v2/testdata/sshtest_results/sshtest-malformed-dst-bare-ipv6.hujson new file mode 100644 index 000000000..60c2d6512 --- /dev/null +++ b/hscontrol/policy/v2/testdata/sshtest_results/sshtest-malformed-dst-bare-ipv6.hujson @@ -0,0 +1,190 @@ +// sshtest-malformed-dst-bare-ipv6 +// +// sshTests dst with bare IPv6 literal +// +// Steps: 1 +// Captured at: 2026-10-17T15:48:35Z +// tool version: tscap/e3511f1 +// schema version: 1 +{ + "schema_version": 1, + "test_id": "sshtest-malformed-dst-bare-ipv6", + "description": "sshTests dst with bare IPv6 literal", + "category": "sshtest", + "captured_at": "2026-10-17T15:48:35.630660254Z", + "tool_version": "tscap/e3511f1", + "tailnet": "odin@example.com", + "error": true, + "input": { + "api_response_code": 400, + "api_response_body": {"message": "test(s) failed", "data": [{"user": "odin@example.com", "errors": [ + "[ssh test error]: src \"odin@example.com\" at \"::ffff:100.64.0.0\", dst \"fd7a:115c:a1e0::10\" at \"fd7a:115c:a1e0::10\", ssh user \"root\": want: \"accept\" got: \"deny\"" + ]}]}, + "tailnet": { + "dns": {"magic_dns": false, "nameservers": [], "search_paths": [], "split_dns": {}}, + "settings": {} + }, + "scenario_hujson": " \n \n \n \n{\n\t\"category\": \"sshtest\",\n\t\"description\": \"sshTests dst with bare IPv6 literal\",\n\t\"id\": \"sshtest-malformed-dst-bare-ipv6\",\n\t\"options\": {\"expect_api_error\": true},\n\t\"policy\": {\"grants\": [{\"dst\": [\"*\"], \"ip\": [\"*\"], \"src\": [\"*\"]}], \"ssh\": [{\n\t\t\"action\": \"accept\",\n\t\t\"dst\": [\"tag:server\"],\n\t\t\"src\": [\"autogroup:member\"],\n\t\t\"users\": [\"root\"]\n\t}], \"sshTests\": [{\n\t\t\"accept\": [\"root\"],\n\t\t\"dst\": [\"fd7a:115c:a1e0::10\"],\n\t\t\"src\": \"odin@example.com\"\n\t}], \"tagOwners\": {\n\t\t\"tag:prod\": [\"odin@example.com\"],\n\t\t\"tag:server\": [\"odin@example.com\"]\n\t}},\n\t\"tailnet\": {\n\t\t\"dns\": {\"magic_dns\": false, \"nameservers\": [], \"search_paths\": [], \"split_dns\": {}},\n\t\t\"settings\": {}\n\t},\n\t\"topology\": \"../_topologies/grant.hujson\"\n}\n", + "scenario_path": "scenarios/sshtest-edges-baremip/sshtest-malformed-dst-bare-ipv6.hujson", + "full_policy": { + "grants": [{"dst": ["*"], "ip": ["*"], "src": ["*"]}], + "ssh": [{ + "action": "accept", + "dst": ["tag:server"], + "src": ["autogroup:member"], + "users": ["root"] + }], + "sshTests": [{ + "accept": ["root"], + "dst": ["fd7a:115c:a1e0::10"], + "src": "odin@example.com" + }], + "tagOwners": {"tag:prod": ["odin@example.com"], "tag:server": ["odin@example.com"]} + } + }, + "topology": {"users": [ + {"id": 1, "name": "odin", "email": "odin@example.com"}, + {"id": 2, "name": "thor", "email": "thor@example.org"}, + {"id": 3, "name": "freya", "email": "freya@example.com"} + ], "nodes": {"beedrill": { + "hostname": "beedrill", + "tags": ["tag:server"], + "ipv4": "100.64.0.16", + "ipv6": "fd7a:115c:a1e0::10", + "routable_ips": [], + "approved_routes": [] + }, "blastoise": { + "hostname": "blastoise", + "tags": ["tag:exit", "tag:router"], + "ipv4": "100.64.0.9", + "ipv6": "fd7a:115c:a1e0::9", + "routable_ips": ["10.33.0.0/16", "0.0.0.0/0", "::/0"], + "approved_routes": [] + }, "bulbasaur": { + "hostname": "bulbasaur", + "tags": [], + "ipv4": "100.64.0.19", + "ipv6": "fd7a:115c:a1e0::13", + "user": "odin", + "routable_ips": [], + "approved_routes": [] + }, "charmander": { + "hostname": "charmander", + "tags": ["tag:exit"], + "ipv4": "100.64.0.4", + "ipv6": "fd7a:115c:a1e0::4", + "routable_ips": ["0.0.0.0/0", "::/0"], + "approved_routes": [] + }, "fearow": { + "hostname": "fearow", + "tags": ["tag:fearow"], + "ipv4": "100.64.0.12", + "ipv6": "fd7a:115c:a1e0::c", + "routable_ips": ["10.55.0.0/16"], + "approved_routes": [] + }, "ivysaur": { + "hostname": "ivysaur", + "tags": [], + "ipv4": "100.64.0.17", + "ipv6": "fd7a:115c:a1e0::11", + "user": "thor", + "routable_ips": [], + "approved_routes": [] + }, "kakuna": { + "hostname": "kakuna", + "tags": ["tag:prod"], + "ipv4": "100.64.0.15", + "ipv6": "fd7a:115c:a1e0::f", + "routable_ips": [], + "approved_routes": [] + }, "pidgeotto": { + "hostname": "pidgeotto", + "tags": ["tag:pidgeotto"], + "ipv4": "100.64.0.3", + "ipv6": "fd7a:115c:a1e0::3", + "routable_ips": ["0.0.0.0/0", "::/0"], + "approved_routes": [] + }, "pidgey": { + "hostname": "pidgey", + "tags": ["tag:pidgey"], + "ipv4": "100.64.0.2", + "ipv6": "fd7a:115c:a1e0::2", + "routable_ips": ["0.0.0.0/0", "::/0"], + "approved_routes": [] + }, "raticate": { + "hostname": "raticate", + "tags": ["tag:group-b"], + "ipv4": "100.64.0.6", + "ipv6": "fd7a:115c:a1e0::6", + "routable_ips": [], + "approved_routes": [] + }, "rattata": { + "hostname": "rattata", + "tags": ["tag:group-a"], + "ipv4": "100.64.0.5", + "ipv6": "fd7a:115c:a1e0::5", + "routable_ips": [], + "approved_routes": [] + }, "spearow": { + "hostname": "spearow", + "tags": ["tag:spearow"], + "ipv4": "100.64.0.11", + "ipv6": "fd7a:115c:a1e0::b", + "routable_ips": ["10.44.0.0/16"], + "approved_routes": [] + }, "squirtle": { + "hostname": "squirtle", + "tags": ["tag:router"], + "ipv4": "100.64.0.13", + "ipv6": "fd7a:115c:a1e0::d", + "routable_ips": ["10.33.0.0/16"], + "approved_routes": [] + }, "venusaur": { + "hostname": "venusaur", + "tags": [], + "ipv4": "100.64.0.18", + "ipv6": "fd7a:115c:a1e0::12", + "user": "freya", + "routable_ips": [], + "approved_routes": [] + }, "weedle": { + "hostname": "weedle", + "tags": ["tag:client"], + "ipv4": "100.64.0.14", + "ipv6": "fd7a:115c:a1e0::e", + "routable_ips": [], + "approved_routes": [] + }}}, + "captures": {}, + "steps": [{ + "name": "validate", + "at": "2026-10-17T15:48:41.613248342Z", + "result": "observed", + "actions": [{ + "kind": "api", + "principal": "admin", + "method": "POST", + "path": "/tailnet/-/acl/validate", + "header": {"Content-Type": "application/hujson"}, + "body": { + "grants": [{"dst": ["*"], "ip": ["*"], "src": ["*"]}], + "ssh": [{ + "action": "accept", + "dst": ["tag:server"], + "src": ["autogroup:member"], + "users": ["root"] + }], + "sshTests": [{ + "accept": ["root"], + "dst": ["fd7a:115c:a1e0::10"], + "src": "odin@example.com" + }], + "tagOwners": {"tag:prod": ["odin@example.com"], "tag:server": ["odin@example.com"]} + }, + "status": 200, + "response": {"data": [{"errors": [ + "[ssh test error]: src \"odin@example.com\" at \"::ffff:100.64.0.0\", dst \"fd7a:115c:a1e0::10\" at \"fd7a:115c:a1e0::10\", ssh user \"root\": want: \"accept\" got: \"deny\"" + ], "user": "odin@example.com"}], "message": "test(s) failed"} + }] + }] +} diff --git a/hscontrol/servertest/policy_test.go b/hscontrol/servertest/policy_test.go index 4baa4dd56..644dad933 100644 --- a/hscontrol/servertest/policy_test.go +++ b/hscontrol/servertest/policy_test.go @@ -316,6 +316,7 @@ var rejectedPolicySkipReasons = map[string]string{ "ssh-e1/refused": noTailnetDomains, "ssh-e2/refused": noTailnetDomains, "ssh-malformed-user-localpart-multi-glob/refused": noTailnetDomains, + "sshtest-malformed-dst-bare-ipv6/refused": "SSHTEST_BARE_IPV6_DST: headscale accepts a bare IPv6 sshTests destination", } const noTailnetDomains = "NO_TAILNET_DOMAINS: headscale does not check user:*@domain or localpart:*@domain against the tailnet's domains"