mirror of
https://github.com/juanfont/headscale.git
synced 2026-11-01 11:14:09 +09:00
Kristoffer Dalby
c504f891cf
Recapture all golden test data from Tailscale SaaS with: - All 19 nodes online (12 routes + 7 grant v2 topology) - All routes approved via API - Trimmed netmap data per capture (Peers with AllowedIPs, PrimaryRoutes, Tags; SelfNode with RoutableIPs) - 20-30s propagation wait for correct data Topology expanded from netmap peers to include all 19 nodes that contribute to filter rule SrcIPs. Each node has routable_ips and approved_routes derived from netmap SelfNode data. New files: b11-b16 (autogroup:internet), i8-i9 (IPv6 fd00:1::/64), pa1-pa2 (partial route approval), V31-SLOW. Updates #3157 Updates #3169
620 lines
14 KiB
Plaintext
620 lines
14 KiB
Plaintext
// ACL-R01
|
|
//
|
|
// ACLs: 2 rules
|
|
// accept: src=['tag:client'] dst=['tag:server:22']
|
|
// accept: src=['tag:prod'] dst=['tag:server:80']
|
|
//
|
|
// Nodes with filter rules: 2 of 8
|
|
{
|
|
"test_id": "ACL-R01",
|
|
"timestamp": "2026-04-05T20:42:37Z",
|
|
"propagation_wait_seconds": 20,
|
|
"input": {
|
|
"policy_file": "acl_policies/acl_r01.json",
|
|
"full_policy": {
|
|
"groups": {
|
|
"group:admins": [
|
|
"kratail2tid@passkey"
|
|
],
|
|
"group:developers": [
|
|
"kristoffer@dalby.cc",
|
|
"kratail2tid@passkey"
|
|
],
|
|
"group:monitors": [
|
|
"monitorpasskeykradalby@passkey"
|
|
],
|
|
"group:empty": []
|
|
},
|
|
"tagOwners": {
|
|
"tag:server": [
|
|
"kratail2tid@passkey"
|
|
],
|
|
"tag:prod": [
|
|
"kratail2tid@passkey"
|
|
],
|
|
"tag:client": [
|
|
"kratail2tid@passkey"
|
|
],
|
|
"tag:router": [
|
|
"kratail2tid@passkey"
|
|
],
|
|
"tag:exit": [
|
|
"kratail2tid@passkey"
|
|
]
|
|
},
|
|
"hosts": {
|
|
"webserver": "100.108.74.26",
|
|
"prodbox": "100.103.8.15",
|
|
"internal": "10.0.0.0/8",
|
|
"subnet24": "192.168.1.0/24"
|
|
},
|
|
"autoApprovers": {
|
|
"routes": {
|
|
"10.33.0.0/16": [
|
|
"tag:router"
|
|
],
|
|
"0.0.0.0/0": [
|
|
"tag:exit"
|
|
],
|
|
"::/0": [
|
|
"tag:exit"
|
|
]
|
|
}
|
|
},
|
|
"acls": [
|
|
{
|
|
"action": "accept",
|
|
"src": [
|
|
"tag:client"
|
|
],
|
|
"dst": [
|
|
"tag:server:22"
|
|
]
|
|
},
|
|
{
|
|
"action": "accept",
|
|
"src": [
|
|
"tag:prod"
|
|
],
|
|
"dst": [
|
|
"tag:server:80"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"api_endpoint": "https://api.tailscale.com/api/v2/tailnet/kratail2tid%40passkey/acl",
|
|
"api_response_code": 200
|
|
},
|
|
"topology": {
|
|
"nodes": {
|
|
"exit-node": {
|
|
"hostname": "exit-node",
|
|
"tags": [
|
|
"tag:exit"
|
|
],
|
|
"ipv4": "100.85.66.106",
|
|
"ipv6": "fd7a:115c:a1e0::7c37:426a",
|
|
"routable_ips": [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
],
|
|
"approved_routes": [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
},
|
|
"subnet-router": {
|
|
"hostname": "subnet-router",
|
|
"tags": [
|
|
"tag:router"
|
|
],
|
|
"ipv4": "100.92.142.61",
|
|
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
|
|
"routable_ips": [
|
|
"10.33.0.0/16",
|
|
"fd00:1::/64"
|
|
],
|
|
"approved_routes": [
|
|
"10.33.0.0/16",
|
|
"fd00:1::/64"
|
|
]
|
|
},
|
|
"tagged-client": {
|
|
"hostname": "tagged-client",
|
|
"tags": [
|
|
"tag:client"
|
|
],
|
|
"ipv4": "100.83.200.69",
|
|
"ipv6": "fd7a:115c:a1e0::c537:c845",
|
|
"routable_ips": [],
|
|
"approved_routes": []
|
|
},
|
|
"tagged-prod": {
|
|
"hostname": "tagged-prod",
|
|
"tags": [
|
|
"tag:prod"
|
|
],
|
|
"ipv4": "100.103.8.15",
|
|
"ipv6": "fd7a:115c:a1e0::5b37:80f",
|
|
"routable_ips": [],
|
|
"approved_routes": []
|
|
},
|
|
"tagged-server": {
|
|
"hostname": "tagged-server",
|
|
"tags": [
|
|
"tag:server"
|
|
],
|
|
"ipv4": "100.108.74.26",
|
|
"ipv6": "fd7a:115c:a1e0::b901:4a87",
|
|
"routable_ips": [],
|
|
"approved_routes": []
|
|
},
|
|
"user-kris": {
|
|
"hostname": "user-kris",
|
|
"tags": [],
|
|
"ipv4": "100.110.121.96",
|
|
"ipv6": "fd7a:115c:a1e0::1737:7960",
|
|
"routable_ips": [],
|
|
"approved_routes": []
|
|
},
|
|
"user-mon": {
|
|
"hostname": "user-mon",
|
|
"tags": [],
|
|
"ipv4": "100.103.90.82",
|
|
"ipv6": "fd7a:115c:a1e0::9e37:5a52",
|
|
"routable_ips": [],
|
|
"approved_routes": []
|
|
},
|
|
"user1": {
|
|
"hostname": "user1",
|
|
"tags": [],
|
|
"ipv4": "100.90.199.68",
|
|
"ipv6": "fd7a:115c:a1e0::2d01:c747",
|
|
"routable_ips": [],
|
|
"approved_routes": []
|
|
}
|
|
}
|
|
},
|
|
"captures": {
|
|
"exit-node": {
|
|
"packet_filter_rules": [
|
|
{
|
|
"SrcIPs": [
|
|
"100.83.200.69",
|
|
"fd7a:115c:a1e0::c537:c845"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SrcIPs": [
|
|
"100.103.8.15",
|
|
"fd7a:115c:a1e0::5b37:80f"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"netmap": {
|
|
"PacketFilterRules": [
|
|
{
|
|
"SrcIPs": [
|
|
"100.83.200.69",
|
|
"fd7a:115c:a1e0::c537:c845"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SrcIPs": [
|
|
"100.103.8.15",
|
|
"fd7a:115c:a1e0::5b37:80f"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"SelfNode": {
|
|
"Name": "exit-node.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.85.66.106/32",
|
|
"fd7a:115c:a1e0::7c37:426a/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.85.66.106/32",
|
|
"fd7a:115c:a1e0::7c37:426a/128",
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
],
|
|
"Tags": [
|
|
"tag:exit"
|
|
],
|
|
"Hostinfo": {
|
|
"RoutableIPs": [
|
|
"0.0.0.0/0",
|
|
"::/0"
|
|
]
|
|
}
|
|
},
|
|
"Peers": []
|
|
}
|
|
},
|
|
"subnet-router": {
|
|
"packet_filter_rules": null,
|
|
"netmap": {
|
|
"PacketFilterRules": null,
|
|
"SelfNode": {
|
|
"Name": "subnet-router.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.92.142.61/32",
|
|
"fd7a:115c:a1e0::3e37:8e3d/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.92.142.61/32",
|
|
"fd7a:115c:a1e0::3e37:8e3d/128",
|
|
"10.33.0.0/16",
|
|
"fd00:1::/64"
|
|
],
|
|
"Tags": [
|
|
"tag:router"
|
|
],
|
|
"Hostinfo": {
|
|
"RoutableIPs": [
|
|
"10.33.0.0/16",
|
|
"fd00:1::/64"
|
|
]
|
|
}
|
|
},
|
|
"Peers": []
|
|
}
|
|
},
|
|
"tagged-client": {
|
|
"packet_filter_rules": null,
|
|
"netmap": {
|
|
"PacketFilterRules": null,
|
|
"SelfNode": {
|
|
"Name": "tagged-client.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.83.200.69/32",
|
|
"fd7a:115c:a1e0::c537:c845/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.83.200.69/32",
|
|
"fd7a:115c:a1e0::c537:c845/128"
|
|
],
|
|
"Tags": [
|
|
"tag:client"
|
|
],
|
|
"Hostinfo": {
|
|
"RoutableIPs": []
|
|
}
|
|
},
|
|
"Peers": [
|
|
{
|
|
"Name": "tagged-server.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.108.74.26/32",
|
|
"fd7a:115c:a1e0::b901:4a87/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.108.74.26/32",
|
|
"fd7a:115c:a1e0::b901:4a87/128"
|
|
],
|
|
"PrimaryRoutes": null,
|
|
"Tags": [
|
|
"tag:server"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"tagged-prod": {
|
|
"packet_filter_rules": null,
|
|
"netmap": {
|
|
"PacketFilterRules": null,
|
|
"SelfNode": {
|
|
"Name": "tagged-prod.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.103.8.15/32",
|
|
"fd7a:115c:a1e0::5b37:80f/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.103.8.15/32",
|
|
"fd7a:115c:a1e0::5b37:80f/128"
|
|
],
|
|
"Tags": [
|
|
"tag:prod"
|
|
],
|
|
"Hostinfo": {
|
|
"RoutableIPs": []
|
|
}
|
|
},
|
|
"Peers": [
|
|
{
|
|
"Name": "tagged-server.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.108.74.26/32",
|
|
"fd7a:115c:a1e0::b901:4a87/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.108.74.26/32",
|
|
"fd7a:115c:a1e0::b901:4a87/128"
|
|
],
|
|
"PrimaryRoutes": null,
|
|
"Tags": [
|
|
"tag:server"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"tagged-server": {
|
|
"packet_filter_rules": [
|
|
{
|
|
"SrcIPs": [
|
|
"100.83.200.69",
|
|
"fd7a:115c:a1e0::c537:c845"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SrcIPs": [
|
|
"100.103.8.15",
|
|
"fd7a:115c:a1e0::5b37:80f"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"netmap": {
|
|
"PacketFilterRules": [
|
|
{
|
|
"SrcIPs": [
|
|
"100.83.200.69",
|
|
"fd7a:115c:a1e0::c537:c845"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 22,
|
|
"Last": 22
|
|
}
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"SrcIPs": [
|
|
"100.103.8.15",
|
|
"fd7a:115c:a1e0::5b37:80f"
|
|
],
|
|
"DstPorts": [
|
|
{
|
|
"IP": "100.108.74.26",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
},
|
|
{
|
|
"IP": "fd7a:115c:a1e0::b901:4a87",
|
|
"Ports": {
|
|
"First": 80,
|
|
"Last": 80
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"SelfNode": {
|
|
"Name": "tagged-server.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.108.74.26/32",
|
|
"fd7a:115c:a1e0::b901:4a87/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.108.74.26/32",
|
|
"fd7a:115c:a1e0::b901:4a87/128"
|
|
],
|
|
"Tags": [
|
|
"tag:server"
|
|
],
|
|
"Hostinfo": {
|
|
"RoutableIPs": []
|
|
}
|
|
},
|
|
"Peers": [
|
|
{
|
|
"Name": "tagged-prod.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.103.8.15/32",
|
|
"fd7a:115c:a1e0::5b37:80f/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.103.8.15/32",
|
|
"fd7a:115c:a1e0::5b37:80f/128"
|
|
],
|
|
"PrimaryRoutes": null,
|
|
"Tags": [
|
|
"tag:prod"
|
|
]
|
|
},
|
|
{
|
|
"Name": "tagged-client.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.83.200.69/32",
|
|
"fd7a:115c:a1e0::c537:c845/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.83.200.69/32",
|
|
"fd7a:115c:a1e0::c537:c845/128"
|
|
],
|
|
"PrimaryRoutes": null,
|
|
"Tags": [
|
|
"tag:client"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"user-kris": {
|
|
"packet_filter_rules": null,
|
|
"netmap": {
|
|
"PacketFilterRules": null,
|
|
"SelfNode": {
|
|
"Name": "user-kris.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.110.121.96/32",
|
|
"fd7a:115c:a1e0::1737:7960/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.110.121.96/32",
|
|
"fd7a:115c:a1e0::1737:7960/128"
|
|
],
|
|
"Tags": null,
|
|
"Hostinfo": {
|
|
"RoutableIPs": []
|
|
}
|
|
},
|
|
"Peers": []
|
|
}
|
|
},
|
|
"user-mon": {
|
|
"packet_filter_rules": null,
|
|
"netmap": {
|
|
"PacketFilterRules": null,
|
|
"SelfNode": {
|
|
"Name": "user-mon.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.103.90.82/32",
|
|
"fd7a:115c:a1e0::9e37:5a52/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.103.90.82/32",
|
|
"fd7a:115c:a1e0::9e37:5a52/128"
|
|
],
|
|
"Tags": null,
|
|
"Hostinfo": {
|
|
"RoutableIPs": []
|
|
}
|
|
},
|
|
"Peers": []
|
|
}
|
|
},
|
|
"user1": {
|
|
"packet_filter_rules": null,
|
|
"netmap": {
|
|
"PacketFilterRules": null,
|
|
"SelfNode": {
|
|
"Name": "user1.tail78f774.ts.net.",
|
|
"Addresses": [
|
|
"100.90.199.68/32",
|
|
"fd7a:115c:a1e0::2d01:c747/128"
|
|
],
|
|
"AllowedIPs": [
|
|
"100.90.199.68/32",
|
|
"fd7a:115c:a1e0::2d01:c747/128"
|
|
],
|
|
"Tags": null,
|
|
"Hostinfo": {
|
|
"RoutableIPs": []
|
|
}
|
|
},
|
|
"Peers": []
|
|
}
|
|
}
|
|
}
|
|
}
|