mirror of
https://github.com/juanfont/headscale.git
synced 2026-10-27 16:56:49 +09:00
Kristoffer Dalby
b2d891c9d1
Empty-dst-nodes fails loudly. Compat runner uses per-capture topology so capture IPs match. Test rows tightened; stale godoc and goto fixed.
112 lines
3.7 KiB
Go
112 lines
3.7 KiB
Go
// Compatibility tests for the policy `sshTests` block, replaying captures
|
|
// recorded against a real Tailscale SaaS tailnet. The runner mirrors the
|
|
// pattern in policytester_compat_test.go: a single Glob over a testdata
|
|
// directory, one t.Run per file. Each capture is one of:
|
|
//
|
|
// - APIResponseCode != 200 — the policy was rejected by SaaS, the
|
|
// captured Message is the body the user saw, and headscale must
|
|
// reject the same input with an error string that contains the same
|
|
// body (substring match, allowing wrapping like "test(s) failed:\n…").
|
|
// - APIResponseCode == 200 — SaaS accepted the policy (its sshTests
|
|
// block passed); headscale's evaluateSSHTests must also pass.
|
|
//
|
|
// Captures live in testdata/sshtest_results/*.hujson. Scenarios in
|
|
// knownSSHTesterDivergences are skipped with their tracking note —
|
|
// these are real Tailscale ↔ headscale divergences that need engine-level
|
|
// fixes in follow-up PRs.
|
|
//
|
|
// Source format: github.com/juanfont/headscale/hscontrol/types/testcapture
|
|
|
|
package v2
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/juanfont/headscale/hscontrol/types/testcapture"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// knownSSHTesterDivergences tracks scenarios where headscale and SaaS
|
|
// disagree on whether a policy is accepted. Each entry should describe
|
|
// the engine area a follow-up PR needs to touch.
|
|
var knownSSHTesterDivergences = map[string]string{
|
|
// SaaS rejects `users: ["*"]` on an `ssh` rule at policy-parse
|
|
// time with `user "*" is not valid`; headscale accepts the
|
|
// wildcard and proceeds to evaluate sshTests against it. Fix in
|
|
// hscontrol/policy/v2/types.go — reject `*` as an SSH login user
|
|
// during SSH-rule validation.
|
|
"sshtest-user-wildcard": "headscale accepts `users: [\"*\"]` on ssh rules; SaaS rejects with `user \"*\" is not valid`",
|
|
}
|
|
|
|
func TestSSHTesterCompat(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
files, err := filepath.Glob(filepath.Join("testdata", "sshtest_results", "*.hujson"))
|
|
require.NoError(t, err, "failed to glob test files")
|
|
|
|
if len(files) == 0 {
|
|
t.Skip("no sshtest captures yet")
|
|
}
|
|
|
|
users := setupSSHDataCompatUsers()
|
|
|
|
for _, file := range files {
|
|
c, err := testcapture.Read(file)
|
|
require.NoError(t, err, "reading %s", file)
|
|
|
|
t.Run(c.TestID, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
if reason, skip := knownSSHTesterDivergences[c.TestID]; skip {
|
|
t.Skip(reason)
|
|
}
|
|
|
|
// Per-capture nodes mean the topology IPs (which a
|
|
// policy `hosts` mapping references by literal IP)
|
|
// resolve to real nodes in the test fixture. Without
|
|
// this the static fixture's IPs do not overlap with
|
|
// the captures and host-alias dsts resolve to no
|
|
// nodes — that path is now a load-bearing failure.
|
|
nodes := buildGrantsNodesFromCapture(users, c)
|
|
|
|
policyJSON := []byte(c.Input.FullPolicy)
|
|
|
|
pm, parseErr := NewPolicyManager(policyJSON, users, nodes.ViewSlice())
|
|
|
|
if c.Input.APIResponseCode == 200 {
|
|
require.NoError(t, parseErr,
|
|
"tailscale accepted this policy; headscale must parse it")
|
|
|
|
_, setErr := pm.SetPolicy(policyJSON)
|
|
require.NoError(t, setErr,
|
|
"tailscale accepted this policy; headscale sshTests must pass")
|
|
|
|
return
|
|
}
|
|
|
|
var got error
|
|
|
|
switch {
|
|
case parseErr != nil:
|
|
got = parseErr
|
|
default:
|
|
_, setErr := pm.SetPolicy(policyJSON)
|
|
got = setErr
|
|
}
|
|
|
|
require.Error(t, got, "tailscale rejected; headscale must reject too")
|
|
|
|
if c.Input.APIResponseBody == nil || c.Input.APIResponseBody.Message == "" {
|
|
return
|
|
}
|
|
|
|
want := c.Input.APIResponseBody.Message
|
|
if !strings.Contains(got.Error(), want) {
|
|
t.Errorf("error body mismatch\n tailscale wants: %q\n headscale got: %q", want, got.Error())
|
|
}
|
|
})
|
|
}
|
|
}
|