mirror of
https://github.com/juanfont/headscale.git
synced 2026-09-16 13:32:03 +09:00
Kristoffer Dalby
2c76d5c5b7
Go 1.27 allows setting promoted fields of embedded structs directly in composite literals, so gorm.Model wrappers go away. Plus strings.Cut, errors.AsType, reflect.TypeAssert and one gofumpt nit.
119 lines
3.7 KiB
Go
119 lines
3.7 KiB
Go
package v2
|
|
|
|
import (
|
|
"net/netip"
|
|
"slices"
|
|
"testing"
|
|
|
|
"github.com/juanfont/headscale/hscontrol/types"
|
|
"github.com/stretchr/testify/require"
|
|
"tailscale.com/tailcfg"
|
|
)
|
|
|
|
const issue3267AliceEmail = "alice@headscale.net"
|
|
|
|
// TestIssue3267ViaGrantBroaderDestination locks the SaaS contract for
|
|
// a via grant whose destination is a host alias broader than (or
|
|
// narrower than) the router's advertised subnet route. Alice's only
|
|
// path into the subnet is via tag:subnet-router. The grant destination
|
|
// resolves to a /64 (IPv6) or /16 (IPv4), and the router advertises a
|
|
// contained /120 / /24. Pre-fix the policy compiler emitted no rule
|
|
// and ViaRoutesForPeer left Include empty because the prefix relation
|
|
// was checked by slices.Contains (exact equality). SaaS behaviour is
|
|
// the authority — see testdata/grant_results/via-grant-v47..v51 for
|
|
// the equivalent compatibility regression.
|
|
func TestIssue3267ViaGrantBroaderDestination(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
users := types.Users{
|
|
{ID: 1, Name: "alice", Email: issue3267AliceEmail}, //nolint:goconst
|
|
}
|
|
|
|
cases := []struct {
|
|
name string
|
|
hostAlias string
|
|
dst string // value the hosts alias resolves to
|
|
advertised string // narrower prefix the router actually serves
|
|
}{
|
|
{
|
|
name: "ipv6_4via6_64_dst_with_120_advertised",
|
|
hostAlias: "example-4via6",
|
|
dst: "fd7a:115c:a1e0:b1a::/64",
|
|
advertised: "fd7a:115c:a1e0:b1a:0:13:ad2:7300/120",
|
|
},
|
|
{
|
|
name: "ipv4_16_dst_with_24_advertised",
|
|
hostAlias: "subnet",
|
|
dst: "10.33.0.0/16",
|
|
advertised: "10.33.5.0/24",
|
|
},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
aliceLaptop := node("alice-laptop", "100.64.0.10", "fd7a:115c:a1e0::a", users[0])
|
|
aliceLaptop.ID = 1
|
|
|
|
router := node("subnet-router", "100.64.0.11", "fd7a:115c:a1e0::b", users[0])
|
|
router.ID = 2
|
|
router.Tags = []string{"tag:subnet-router"}
|
|
route := netip.MustParsePrefix(tc.advertised)
|
|
router.Hostinfo = &tailcfg.Hostinfo{RoutableIPs: []netip.Prefix{route}}
|
|
router.ApprovedRoutes = []netip.Prefix{route}
|
|
|
|
nodes := types.Nodes{aliceLaptop, router}
|
|
|
|
policy := `{
|
|
"tagOwners": {
|
|
"tag:subnet-router": ["` + issue3267AliceEmail + `"]
|
|
},
|
|
"hosts": {
|
|
"` + tc.hostAlias + `": "` + tc.dst + `"
|
|
},
|
|
"grants": [
|
|
{
|
|
"src": ["` + issue3267AliceEmail + `"],
|
|
"dst": ["` + tc.hostAlias + `"],
|
|
"via": ["tag:subnet-router"],
|
|
"ip": ["icmp:*"]
|
|
}
|
|
]
|
|
}`
|
|
|
|
pm, err := NewPolicyManager([]byte(policy), users, nodes.ViewSlice())
|
|
require.NoError(t, err)
|
|
|
|
pol, err := unmarshalPolicy([]byte(policy))
|
|
require.NoError(t, err)
|
|
require.NoError(t, pol.validate())
|
|
|
|
t.Run("compileFilterRulesForNode_emits_rule_with_grant_dst", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
rules := pol.compileFilterRulesForNode(users, router.View(), nodes.ViewSlice())
|
|
|
|
found := slices.ContainsFunc(rules, func(r tailcfg.FilterRule) bool {
|
|
return slices.ContainsFunc(r.DstPorts, func(d tailcfg.NetPortRange) bool {
|
|
return d.IP == tc.dst
|
|
})
|
|
})
|
|
require.Truef(t, found,
|
|
"router %s must receive a via filter rule whose DstPorts.IP equals the grant dst %q; got rules=%+v",
|
|
router.Hostname, tc.dst, rules)
|
|
})
|
|
|
|
t.Run("ViaRoutesForPeer_includes_advertised_prefix", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
result := pm.ViaRoutesForPeer(aliceLaptop.View(), router.View())
|
|
require.Contains(t, result.Include, route,
|
|
"alice viewing tag:subnet-router must Include advertised prefix %s — drives AllowedIPs in state.RoutesForPeer", route)
|
|
require.Empty(t, result.Exclude,
|
|
"alice viewing tag:subnet-router must not Exclude any prefix — there is no competing via tag")
|
|
})
|
|
})
|
|
}
|
|
}
|