2023-05-21 19:37:59 +03:00
|
|
|
package policy
|
2021-07-03 11:55:32 +02:00
|
|
|
|
|
|
|
import (
|
2024-11-24 00:13:27 +01:00
|
|
|
"database/sql"
|
2022-02-05 17:18:39 +01:00
|
|
|
"errors"
|
2024-11-24 00:13:27 +01:00
|
|
|
"math/rand/v2"
|
2022-09-02 00:05:43 +02:00
|
|
|
"net/netip"
|
2024-10-02 09:06:09 +02:00
|
|
|
"slices"
|
2024-11-24 00:13:27 +01:00
|
|
|
"sort"
|
2022-02-07 16:12:05 +01:00
|
|
|
"testing"
|
2022-02-05 17:18:39 +01:00
|
|
|
|
2023-04-26 14:04:12 +02:00
|
|
|
"github.com/google/go-cmp/cmp"
|
2024-07-22 08:56:00 +02:00
|
|
|
"github.com/juanfont/headscale/hscontrol/types"
|
|
|
|
"github.com/juanfont/headscale/hscontrol/util"
|
2023-04-26 14:04:12 +02:00
|
|
|
"github.com/rs/zerolog/log"
|
2023-06-12 15:29:34 +02:00
|
|
|
"github.com/spf13/viper"
|
2024-11-22 16:54:58 +01:00
|
|
|
"github.com/stretchr/testify/require"
|
2023-04-28 16:11:02 +02:00
|
|
|
"go4.org/netipx"
|
2021-07-03 11:55:32 +02:00
|
|
|
"gopkg.in/check.v1"
|
2024-11-24 00:13:27 +01:00
|
|
|
"gorm.io/gorm"
|
2024-10-02 09:06:09 +02:00
|
|
|
"tailscale.com/net/tsaddr"
|
2022-02-07 16:12:05 +01:00
|
|
|
"tailscale.com/tailcfg"
|
2021-07-03 11:55:32 +02:00
|
|
|
)
|
|
|
|
|
2024-04-17 07:03:06 +02:00
|
|
|
var iap = func(ipStr string) *netip.Addr {
|
|
|
|
ip := netip.MustParseAddr(ipStr)
|
|
|
|
return &ip
|
|
|
|
}
|
|
|
|
|
2023-05-21 19:37:59 +03:00
|
|
|
func Test(t *testing.T) {
|
|
|
|
check.TestingT(t)
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ = check.Suite(&Suite{})
|
|
|
|
|
|
|
|
type Suite struct{}
|
|
|
|
|
2021-07-03 11:55:32 +02:00
|
|
|
func (s *Suite) TestWrongPath(c *check.C) {
|
2023-05-21 19:37:59 +03:00
|
|
|
_, err := LoadACLPolicyFromPath("asdfg")
|
2021-07-03 11:55:32 +02:00
|
|
|
c.Assert(err, check.NotNil)
|
|
|
|
}
|
|
|
|
|
2023-06-13 10:03:22 +02:00
|
|
|
func TestParsing(t *testing.T) {
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
format string
|
|
|
|
acl string
|
|
|
|
want []tailcfg.FilterRule
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "invalid-hujson",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
2023-05-10 10:19:16 +02:00
|
|
|
{
|
2023-06-13 10:03:22 +02:00
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "valid-hujson-invalid-content",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
|
|
|
{
|
|
|
|
"valid_json": true,
|
|
|
|
"but_a_policy_though": false
|
2021-07-03 11:55:32 +02:00
|
|
|
}
|
2023-06-13 10:03:22 +02:00
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "invalid-cidr",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
|
|
|
{"example-host-1": "100.100.100.100/42"}
|
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "basic-rule",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
|
|
|
{
|
|
|
|
"hosts": {
|
|
|
|
"host-1": "100.100.100.100",
|
|
|
|
"subnet-1": "100.100.101.100/24",
|
|
|
|
},
|
2021-07-03 11:55:32 +02:00
|
|
|
|
2023-06-13 10:03:22 +02:00
|
|
|
"acls": [
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"subnet-1",
|
|
|
|
"192.168.1.0/24"
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"*:22,3389",
|
|
|
|
"host-1:*",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
|
|
|
}
|
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.100.101.0/24", "192.168.1.0/24"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "0.0.0.0/0", Ports: tailcfg.PortRange{First: 22, Last: 22}},
|
|
|
|
{IP: "0.0.0.0/0", Ports: tailcfg.PortRange{First: 3389, Last: 3389}},
|
|
|
|
{IP: "::/0", Ports: tailcfg.PortRange{First: 22, Last: 22}},
|
|
|
|
{IP: "::/0", Ports: tailcfg.PortRange{First: 3389, Last: 3389}},
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "parse-protocol",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
|
|
|
{
|
|
|
|
"hosts": {
|
|
|
|
"host-1": "100.100.100.100",
|
|
|
|
"subnet-1": "100.100.101.100/24",
|
|
|
|
},
|
|
|
|
|
|
|
|
"acls": [
|
|
|
|
{
|
|
|
|
"Action": "accept",
|
|
|
|
"src": [
|
|
|
|
"*",
|
|
|
|
],
|
|
|
|
"proto": "tcp",
|
|
|
|
"dst": [
|
|
|
|
"host-1:*",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"Action": "accept",
|
|
|
|
"src": [
|
|
|
|
"*",
|
|
|
|
],
|
|
|
|
"proto": "udp",
|
|
|
|
"dst": [
|
|
|
|
"host-1:53",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"Action": "accept",
|
|
|
|
"src": [
|
|
|
|
"*",
|
|
|
|
],
|
|
|
|
"proto": "icmp",
|
|
|
|
"dst": [
|
|
|
|
"host-1:*",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
|
|
|
}`,
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"0.0.0.0/0", "::/0"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
IPProto: []int{protocolTCP},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"0.0.0.0/0", "::/0"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRange{First: 53, Last: 53}},
|
|
|
|
},
|
|
|
|
IPProto: []int{protocolUDP},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"0.0.0.0/0", "::/0"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
IPProto: []int{protocolICMP, protocolIPv6ICMP},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "port-wildcard",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
2023-05-10 10:19:16 +02:00
|
|
|
{
|
2023-06-13 10:03:22 +02:00
|
|
|
"hosts": {
|
|
|
|
"host-1": "100.100.100.100",
|
|
|
|
"subnet-1": "100.100.101.100/24",
|
|
|
|
},
|
|
|
|
|
|
|
|
"acls": [
|
|
|
|
{
|
|
|
|
"Action": "accept",
|
|
|
|
"src": [
|
|
|
|
"*",
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"host-1:*",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
2023-05-10 10:19:16 +02:00
|
|
|
}
|
2023-06-13 10:03:22 +02:00
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"0.0.0.0/0", "::/0"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "port-range",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
|
|
|
{
|
|
|
|
"hosts": {
|
|
|
|
"host-1": "100.100.100.100",
|
|
|
|
"subnet-1": "100.100.101.100/24",
|
|
|
|
},
|
|
|
|
|
|
|
|
"acls": [
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"subnet-1",
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"host-1:5400-5500",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
2021-07-03 11:55:32 +02:00
|
|
|
}
|
2023-06-13 10:03:22 +02:00
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.100.101.0/24"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "100.100.100.100/32",
|
|
|
|
Ports: tailcfg.PortRange{First: 5400, Last: 5500},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "port-group",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
|
|
|
{
|
|
|
|
"groups": {
|
|
|
|
"group:example": [
|
|
|
|
"testuser",
|
|
|
|
],
|
|
|
|
},
|
2021-07-03 11:55:32 +02:00
|
|
|
|
2023-06-13 10:03:22 +02:00
|
|
|
"hosts": {
|
|
|
|
"host-1": "100.100.100.100",
|
|
|
|
"subnet-1": "100.100.101.100/24",
|
|
|
|
},
|
|
|
|
|
|
|
|
"acls": [
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"group:example",
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"host-1:*",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
2023-06-13 10:03:22 +02:00
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"200.200.200.200/32"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "port-user",
|
|
|
|
format: "hujson",
|
|
|
|
acl: `
|
|
|
|
{
|
|
|
|
"hosts": {
|
|
|
|
"host-1": "100.100.100.100",
|
|
|
|
"subnet-1": "100.100.101.100/24",
|
|
|
|
},
|
2021-07-03 17:31:32 +02:00
|
|
|
|
2023-06-13 10:03:22 +02:00
|
|
|
"acls": [
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"testuser",
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"host-1:*",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
|
|
|
}
|
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"200.200.200.200/32"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2024-07-18 11:08:25 +05:30
|
|
|
name: "ipv6",
|
|
|
|
format: "hujson",
|
2023-06-13 10:03:22 +02:00
|
|
|
acl: `
|
2024-07-18 11:08:25 +05:30
|
|
|
{
|
|
|
|
"hosts": {
|
|
|
|
"host-1": "100.100.100.100/32",
|
|
|
|
"subnet-1": "100.100.101.100/24",
|
|
|
|
},
|
|
|
|
|
|
|
|
"acls": [
|
2023-06-13 10:03:22 +02:00
|
|
|
{
|
2024-07-18 11:08:25 +05:30
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"*",
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"host-1:*",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
2024-10-02 09:06:09 +02:00
|
|
|
}
|
2023-06-13 10:03:22 +02:00
|
|
|
`,
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"0.0.0.0/0", "::/0"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.100.100.100/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2024-07-18 11:08:25 +05:30
|
|
|
pol, err := LoadACLPolicyFromBytes([]byte(tt.acl))
|
2023-06-13 10:03:22 +02:00
|
|
|
|
|
|
|
if tt.wantErr && err == nil {
|
|
|
|
t.Errorf("parsing() error = %v, wantErr %v", err, tt.wantErr)
|
|
|
|
|
|
|
|
return
|
|
|
|
} else if !tt.wantErr && err != nil {
|
|
|
|
t.Errorf("parsing() error = %v, wantErr %v", err, tt.wantErr)
|
|
|
|
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
user := types.User{
|
|
|
|
Model: gorm.Model{ID: 1},
|
|
|
|
Name: "testuser",
|
|
|
|
}
|
|
|
|
rules, err := pol.CompileFilterRules(
|
|
|
|
[]types.User{
|
|
|
|
user,
|
2023-06-13 10:03:22 +02:00
|
|
|
},
|
2024-11-24 00:13:27 +01:00
|
|
|
types.Nodes{
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.100.100.100"),
|
2023-06-13 10:03:22 +02:00
|
|
|
},
|
2024-11-24 00:13:27 +01:00
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("200.200.200.200"),
|
|
|
|
User: user,
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
|
|
|
},
|
|
|
|
})
|
2023-06-13 10:03:22 +02:00
|
|
|
|
|
|
|
if (err != nil) != tt.wantErr {
|
|
|
|
t.Errorf("parsing() error = %v, wantErr %v", err, tt.wantErr)
|
|
|
|
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
if diff := cmp.Diff(tt.want, rules); diff != "" {
|
|
|
|
t.Errorf("parsing() unexpected result (-want +got):\n%s", diff)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Suite) TestRuleInvalidGeneration(c *check.C) {
|
2023-05-10 10:19:16 +02:00
|
|
|
acl := []byte(`
|
|
|
|
{
|
2023-05-11 09:09:18 +02:00
|
|
|
// Declare static groups of users beyond those in the identity service.
|
|
|
|
"groups": {
|
|
|
|
"group:example": [
|
|
|
|
"user1@example.com",
|
|
|
|
"user2@example.com",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
// Declare hostname aliases to use in place of IP addresses or subnets.
|
|
|
|
"hosts": {
|
|
|
|
"example-host-1": "100.100.100.100",
|
|
|
|
"example-host-2": "100.100.101.100/24",
|
|
|
|
},
|
|
|
|
// Define who is allowed to use which tags.
|
|
|
|
"tagOwners": {
|
|
|
|
// Everyone in the montreal-admins or global-admins group are
|
|
|
|
// allowed to tag servers as montreal-webserver.
|
|
|
|
"tag:montreal-webserver": [
|
|
|
|
"group:montreal-admins",
|
|
|
|
"group:global-admins",
|
|
|
|
],
|
|
|
|
// Only a few admins are allowed to create API servers.
|
|
|
|
"tag:api-server": [
|
|
|
|
"group:global-admins",
|
|
|
|
"example-host-1",
|
|
|
|
],
|
|
|
|
},
|
|
|
|
// Access control lists.
|
|
|
|
"acls": [
|
|
|
|
// Engineering users, plus the president, can access port 22 (ssh)
|
|
|
|
// and port 3389 (remote desktop protocol) on all servers, and all
|
|
|
|
// ports on git-server or ci-server.
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"group:engineering",
|
|
|
|
"president@example.com"
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"*:22,3389",
|
|
|
|
"git-server:*",
|
|
|
|
"ci-server:*"
|
|
|
|
],
|
|
|
|
},
|
|
|
|
// Allow engineer users to access any port on a device tagged with
|
|
|
|
// tag:production.
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"group:engineers"
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"tag:production:*"
|
|
|
|
],
|
|
|
|
},
|
|
|
|
// Allow servers in the my-subnet host and 192.168.1.0/24 to access hosts
|
|
|
|
// on both networks.
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"my-subnet",
|
|
|
|
"192.168.1.0/24"
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"my-subnet:*",
|
|
|
|
"192.168.1.0/24:*"
|
|
|
|
],
|
|
|
|
},
|
|
|
|
// Allow every user of your network to access anything on the network.
|
|
|
|
// Comment out this section if you want to define specific ACL
|
|
|
|
// restrictions above.
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"*"
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"*:*"
|
|
|
|
],
|
|
|
|
},
|
|
|
|
// All users in Montreal are allowed to access the Montreal web
|
|
|
|
// servers.
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"group:montreal-users"
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"tag:montreal-webserver:80,443"
|
|
|
|
],
|
|
|
|
},
|
|
|
|
// Montreal web servers are allowed to make outgoing connections to
|
|
|
|
// the API servers, but only on https port 443.
|
|
|
|
// In contrast, this doesn't grant API servers the right to initiate
|
|
|
|
// any connections.
|
|
|
|
{
|
|
|
|
"action": "accept",
|
|
|
|
"src": [
|
|
|
|
"tag:montreal-webserver"
|
|
|
|
],
|
|
|
|
"dst": [
|
|
|
|
"tag:api-server:443"
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
|
|
|
// Declare tests to check functionality of ACL rules
|
|
|
|
"tests": [
|
|
|
|
{
|
|
|
|
"src": "user1@example.com",
|
|
|
|
"accept": [
|
|
|
|
"example-host-1:22",
|
|
|
|
"example-host-2:80"
|
|
|
|
],
|
|
|
|
"deny": [
|
2024-05-19 23:49:27 +02:00
|
|
|
"example-host-2:100"
|
2023-05-11 09:09:18 +02:00
|
|
|
],
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"src": "user2@example.com",
|
|
|
|
"accept": [
|
|
|
|
"100.60.3.4:22"
|
|
|
|
],
|
|
|
|
},
|
|
|
|
],
|
2023-05-10 10:19:16 +02:00
|
|
|
}
|
|
|
|
`)
|
2024-07-18 11:08:25 +05:30
|
|
|
pol, err := LoadACLPolicyFromBytes(acl)
|
2023-05-21 19:37:59 +03:00
|
|
|
c.Assert(pol.ACLs, check.HasLen, 6)
|
|
|
|
c.Assert(err, check.IsNil)
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
rules, err := pol.CompileFilterRules([]types.User{}, types.Nodes{})
|
2021-07-03 17:31:32 +02:00
|
|
|
c.Assert(err, check.NotNil)
|
2023-05-21 19:37:59 +03:00
|
|
|
c.Assert(rules, check.IsNil)
|
2021-07-03 17:31:32 +02:00
|
|
|
}
|
|
|
|
|
2022-02-21 21:48:05 +01:00
|
|
|
// TODO(kradalby): Make tests values safe, independent and descriptive.
|
2022-02-05 17:18:39 +01:00
|
|
|
func (s *Suite) TestInvalidAction(c *check.C) {
|
2023-05-21 19:37:59 +03:00
|
|
|
pol := &ACLPolicy{
|
2022-02-05 17:18:39 +01:00
|
|
|
ACLs: []ACL{
|
2022-08-04 10:47:00 +02:00
|
|
|
{
|
|
|
|
Action: "invalidAction",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
2022-02-05 17:18:39 +01:00
|
|
|
},
|
|
|
|
}
|
2024-11-24 00:13:27 +01:00
|
|
|
_, _, err := GenerateFilterAndSSHRulesForTests(
|
|
|
|
pol,
|
|
|
|
&types.Node{},
|
|
|
|
types.Nodes{},
|
|
|
|
[]types.User{},
|
|
|
|
)
|
2023-05-21 19:37:59 +03:00
|
|
|
c.Assert(errors.Is(err, ErrInvalidAction), check.Equals, true)
|
2022-09-30 20:44:23 +02:00
|
|
|
}
|
|
|
|
|
2022-02-05 17:18:39 +01:00
|
|
|
func (s *Suite) TestInvalidGroupInGroup(c *check.C) {
|
2022-06-08 13:40:15 +02:00
|
|
|
// this ACL is wrong because the group in Sources sections doesn't exist
|
2023-05-21 19:37:59 +03:00
|
|
|
pol := &ACLPolicy{
|
2022-02-14 15:54:51 +01:00
|
|
|
Groups: Groups{
|
|
|
|
"group:test": []string{"foo"},
|
|
|
|
"group:error": []string{"foo", "group:test"},
|
|
|
|
},
|
2022-02-05 17:18:39 +01:00
|
|
|
ACLs: []ACL{
|
2022-08-04 10:47:00 +02:00
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:error"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
2022-02-05 17:18:39 +01:00
|
|
|
},
|
|
|
|
}
|
2024-11-24 00:13:27 +01:00
|
|
|
_, _, err := GenerateFilterAndSSHRulesForTests(
|
|
|
|
pol,
|
|
|
|
&types.Node{},
|
|
|
|
types.Nodes{},
|
|
|
|
[]types.User{},
|
|
|
|
)
|
2023-05-21 19:37:59 +03:00
|
|
|
c.Assert(errors.Is(err, ErrInvalidGroup), check.Equals, true)
|
2022-02-05 17:18:39 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Suite) TestInvalidTagOwners(c *check.C) {
|
|
|
|
// this ACL is wrong because no tagOwners own the requested tag for the server
|
2023-05-21 19:37:59 +03:00
|
|
|
pol := &ACLPolicy{
|
2022-02-05 17:18:39 +01:00
|
|
|
ACLs: []ACL{
|
2022-08-04 10:47:00 +02:00
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"tag:foo"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
2022-02-05 17:18:39 +01:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
_, _, err := GenerateFilterAndSSHRulesForTests(
|
|
|
|
pol,
|
|
|
|
&types.Node{},
|
|
|
|
types.Nodes{},
|
|
|
|
[]types.User{},
|
|
|
|
)
|
2023-05-21 19:37:59 +03:00
|
|
|
c.Assert(errors.Is(err, ErrInvalidTag), check.Equals, true)
|
2022-02-05 17:18:39 +01:00
|
|
|
}
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
func Test_expandGroup(t *testing.T) {
|
2023-04-26 10:58:26 +02:00
|
|
|
type field struct {
|
|
|
|
pol ACLPolicy
|
|
|
|
}
|
2022-02-07 16:12:05 +01:00
|
|
|
type args struct {
|
2023-06-12 15:29:34 +02:00
|
|
|
group string
|
|
|
|
stripEmail bool
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
2023-04-26 10:58:26 +02:00
|
|
|
field field
|
2022-02-07 16:12:05 +01:00
|
|
|
args args
|
|
|
|
want []string
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "simple test",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
2022-02-14 15:54:51 +01:00
|
|
|
Groups: Groups{
|
2022-02-20 23:00:31 +01:00
|
|
|
"group:test": []string{"user1", "user2", "user3"},
|
|
|
|
"group:foo": []string{"user2", "user3"},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-04-26 10:58:26 +02:00
|
|
|
},
|
|
|
|
args: args{
|
2023-06-12 15:29:34 +02:00
|
|
|
group: "group:test",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2022-02-20 23:00:31 +01:00
|
|
|
want: []string{"user1", "user2", "user3"},
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2024-05-19 23:49:27 +02:00
|
|
|
name: "InexistentGroup",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
2022-02-14 15:54:51 +01:00
|
|
|
Groups: Groups{
|
2022-02-20 23:00:31 +01:00
|
|
|
"group:test": []string{"user1", "user2", "user3"},
|
|
|
|
"group:foo": []string{"user2", "user3"},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-04-26 10:58:26 +02:00
|
|
|
},
|
|
|
|
args: args{
|
2023-06-12 15:29:34 +02:00
|
|
|
group: "group:undefined",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
want: []string{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
2022-03-01 21:01:46 +01:00
|
|
|
{
|
|
|
|
name: "Expand emails in group",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
2022-03-01 21:01:46 +01:00
|
|
|
Groups: Groups{
|
|
|
|
"group:admin": []string{
|
|
|
|
"joe.bar@gmail.com",
|
|
|
|
"john.doe@yahoo.fr",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-04-26 10:58:26 +02:00
|
|
|
},
|
|
|
|
args: args{
|
2023-06-12 15:29:34 +02:00
|
|
|
group: "group:admin",
|
2022-03-01 21:01:46 +01:00
|
|
|
},
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 14:50:17 +02:00
|
|
|
want: []string{"joe.bar@gmail.com", "john.doe@yahoo.fr"},
|
2022-03-01 21:01:46 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
for _, test := range tests {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2023-06-12 15:29:34 +02:00
|
|
|
viper.Set("oidc.strip_email_domain", test.args.stripEmail)
|
|
|
|
|
2023-06-19 09:17:50 +02:00
|
|
|
got, err := test.field.pol.expandUsersFromGroup(
|
2022-03-01 21:01:46 +01:00
|
|
|
test.args.group,
|
|
|
|
)
|
2023-06-12 15:29:34 +02:00
|
|
|
|
2022-02-14 15:26:54 +01:00
|
|
|
if (err != nil) != test.wantErr {
|
|
|
|
t.Errorf("expandGroup() error = %v, wantErr %v", err, test.wantErr)
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
return
|
|
|
|
}
|
2023-06-12 15:29:34 +02:00
|
|
|
|
|
|
|
if diff := cmp.Diff(test.want, got); diff != "" {
|
|
|
|
t.Errorf("expandGroup() unexpected result (-want +got):\n%s", diff)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_expandTagOwners(t *testing.T) {
|
|
|
|
type args struct {
|
2023-06-12 15:29:34 +02:00
|
|
|
aclPolicy *ACLPolicy
|
|
|
|
tag string
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
args args
|
|
|
|
want []string
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
2022-02-20 23:00:31 +01:00
|
|
|
name: "simple tag expansion",
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-02-20 23:00:31 +01:00
|
|
|
TagOwners: TagOwners{"tag:test": []string{"user1"}},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
tag: "tag:test",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2022-02-20 23:00:31 +01:00
|
|
|
want: []string{"user1"},
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2022-02-20 23:00:31 +01:00
|
|
|
name: "expand with tag and group",
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-02-20 23:00:31 +01:00
|
|
|
Groups: Groups{"group:foo": []string{"user1", "user2"}},
|
2022-02-07 16:12:05 +01:00
|
|
|
TagOwners: TagOwners{"tag:test": []string{"group:foo"}},
|
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
tag: "tag:test",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2022-02-20 23:00:31 +01:00
|
|
|
want: []string{"user1", "user2"},
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2023-01-17 17:43:44 +01:00
|
|
|
name: "expand with user and group",
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-02-20 23:00:31 +01:00
|
|
|
Groups: Groups{"group:foo": []string{"user1", "user2"}},
|
|
|
|
TagOwners: TagOwners{"tag:test": []string{"group:foo", "user3"}},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
tag: "tag:test",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2022-02-20 23:00:31 +01:00
|
|
|
want: []string{"user1", "user2", "user3"},
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "invalid tag",
|
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-02-20 23:00:31 +01:00
|
|
|
TagOwners: TagOwners{"tag:foo": []string{"group:foo", "user1"}},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
tag: "tag:test",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
want: []string{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "invalid group",
|
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-02-20 23:00:31 +01:00
|
|
|
Groups: Groups{"group:bar": []string{"user1", "user2"}},
|
|
|
|
TagOwners: TagOwners{"tag:test": []string{"group:foo", "user2"}},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
tag: "tag:test",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
want: []string{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
for _, test := range tests {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2023-06-19 09:17:50 +02:00
|
|
|
got, err := expandOwnersFromTag(
|
2022-03-01 21:01:46 +01:00
|
|
|
test.args.aclPolicy,
|
|
|
|
test.args.tag,
|
|
|
|
)
|
2022-02-14 15:26:54 +01:00
|
|
|
if (err != nil) != test.wantErr {
|
|
|
|
t.Errorf("expandTagOwners() error = %v, wantErr %v", err, test.wantErr)
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
return
|
|
|
|
}
|
2023-06-21 08:12:24 +02:00
|
|
|
if diff := cmp.Diff(test.want, got); diff != "" {
|
|
|
|
t.Errorf("expandTagOwners() = (-want +got):\n%s", diff)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_expandPorts(t *testing.T) {
|
|
|
|
type args struct {
|
2022-06-08 17:43:59 +02:00
|
|
|
portsStr string
|
|
|
|
needsWildcard bool
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
args args
|
|
|
|
want *[]tailcfg.PortRange
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "wildcard",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "*", needsWildcard: true},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: &[]tailcfg.PortRange{
|
|
|
|
{First: portRangeBegin, Last: portRangeEnd},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
2022-06-08 17:43:59 +02:00
|
|
|
{
|
|
|
|
name: "needs wildcard but does not require it",
|
|
|
|
args: args{portsStr: "*", needsWildcard: false},
|
|
|
|
want: &[]tailcfg.PortRange{
|
|
|
|
{First: portRangeBegin, Last: portRangeEnd},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "needs wildcard but gets port",
|
|
|
|
args: args{portsStr: "80,443", needsWildcard: true},
|
|
|
|
want: nil,
|
|
|
|
wantErr: true,
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
{
|
2022-06-08 13:40:15 +02:00
|
|
|
name: "two Destinations",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "80,443", needsWildcard: false},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: &[]tailcfg.PortRange{
|
|
|
|
{First: 80, Last: 80},
|
|
|
|
{First: 443, Last: 443},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "a range and a port",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "80-1024,443", needsWildcard: false},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: &[]tailcfg.PortRange{
|
|
|
|
{First: 80, Last: 1024},
|
|
|
|
{First: 443, Last: 443},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "out of bounds",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "854038", needsWildcard: false},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: nil,
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "wrong port",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "85a38", needsWildcard: false},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: nil,
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "wrong port in first",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "a-80", needsWildcard: false},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: nil,
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "wrong port in last",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "80-85a38", needsWildcard: false},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: nil,
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "wrong port format",
|
2022-06-08 17:43:59 +02:00
|
|
|
args: args{portsStr: "80-85a38-3", needsWildcard: false},
|
2022-02-07 16:12:05 +01:00
|
|
|
want: nil,
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
for _, test := range tests {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2022-06-08 17:43:59 +02:00
|
|
|
got, err := expandPorts(test.args.portsStr, test.args.needsWildcard)
|
2022-02-14 15:26:54 +01:00
|
|
|
if (err != nil) != test.wantErr {
|
|
|
|
t.Errorf("expandPorts() error = %v, wantErr %v", err, test.wantErr)
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
return
|
|
|
|
}
|
2023-06-21 08:12:24 +02:00
|
|
|
if diff := cmp.Diff(test.want, got); diff != "" {
|
|
|
|
t.Errorf("expandPorts() = (-want +got):\n%s", diff)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
func Test_filterNodesByUser(t *testing.T) {
|
|
|
|
users := []types.User{
|
|
|
|
{Model: gorm.Model{ID: 1}, Name: "marc"},
|
|
|
|
{Model: gorm.Model{ID: 2}, Name: "joe", Email: "joe@headscale.net"},
|
|
|
|
{
|
|
|
|
Model: gorm.Model{ID: 3},
|
|
|
|
Name: "mikael",
|
|
|
|
Email: "mikael@headscale.net",
|
|
|
|
ProviderIdentifier: sql.NullString{String: "http://oidc.org/1234", Valid: true},
|
|
|
|
},
|
|
|
|
{Model: gorm.Model{ID: 4}, Name: "mikael2", Email: "mikael@headscale.net"},
|
|
|
|
{Model: gorm.Model{ID: 5}, Name: "mikael", Email: "mikael2@headscale.net"},
|
|
|
|
{Model: gorm.Model{ID: 6}, Name: "http://oidc.org/1234", Email: "mikael@headscale.net"},
|
|
|
|
{Model: gorm.Model{ID: 7}, Name: "1"},
|
|
|
|
{Model: gorm.Model{ID: 8}, Name: "alex", Email: "alex@headscale.net"},
|
|
|
|
{Model: gorm.Model{ID: 9}, Name: "alex@headscale.net"},
|
|
|
|
{Model: gorm.Model{ID: 10}, Email: "http://oidc.org/1234"},
|
|
|
|
}
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
type args struct {
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes types.Nodes
|
|
|
|
user string
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
args args
|
2023-09-24 13:42:05 +02:00
|
|
|
want types.Nodes
|
2022-02-07 16:12:05 +01:00
|
|
|
}{
|
|
|
|
{
|
2023-09-24 13:42:05 +02:00
|
|
|
name: "1 node in user",
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
2024-11-24 00:13:27 +01:00
|
|
|
&types.Node{User: users[1]},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-01-17 17:43:44 +01:00
|
|
|
user: "joe",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
2024-11-24 00:13:27 +01:00
|
|
|
&types.Node{User: users[1]},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2023-09-24 13:42:05 +02:00
|
|
|
name: "3 nodes, 2 in user",
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
2024-11-24 00:13:27 +01:00
|
|
|
&types.Node{ID: 1, User: users[1]},
|
|
|
|
&types.Node{ID: 2, User: users[0]},
|
|
|
|
&types.Node{ID: 3, User: users[0]},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-01-17 17:43:44 +01:00
|
|
|
user: "marc",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
2024-11-24 00:13:27 +01:00
|
|
|
&types.Node{ID: 2, User: users[0]},
|
|
|
|
&types.Node{ID: 3, User: users[0]},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2023-09-24 13:42:05 +02:00
|
|
|
name: "5 nodes, 0 in user",
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
2024-11-24 00:13:27 +01:00
|
|
|
&types.Node{ID: 1, User: users[1]},
|
|
|
|
&types.Node{ID: 2, User: users[0]},
|
|
|
|
&types.Node{ID: 3, User: users[0]},
|
|
|
|
&types.Node{ID: 4, User: users[0]},
|
|
|
|
&types.Node{ID: 5, User: users[0]},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-01-17 17:43:44 +01:00
|
|
|
user: "mickael",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2024-06-23 22:06:50 +02:00
|
|
|
want: nil,
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2024-11-24 00:13:27 +01:00
|
|
|
{
|
|
|
|
name: "match-by-provider-ident",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[1]},
|
|
|
|
&types.Node{ID: 2, User: users[2]},
|
|
|
|
},
|
|
|
|
user: "http://oidc.org/1234",
|
|
|
|
},
|
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{ID: 2, User: users[2]},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "match-by-email",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[1]},
|
|
|
|
&types.Node{ID: 2, User: users[2]},
|
|
|
|
&types.Node{ID: 8, User: users[7]},
|
|
|
|
},
|
|
|
|
user: "joe@headscale.net",
|
|
|
|
},
|
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[1]},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "multi-match-is-zero",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[1]},
|
|
|
|
&types.Node{ID: 2, User: users[2]},
|
|
|
|
&types.Node{ID: 3, User: users[3]},
|
|
|
|
},
|
|
|
|
user: "mikael@headscale.net",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "multi-email-first-match-is-zero",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
// First match email, then provider id
|
|
|
|
&types.Node{ID: 3, User: users[3]},
|
|
|
|
&types.Node{ID: 2, User: users[2]},
|
|
|
|
},
|
|
|
|
user: "mikael@headscale.net",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "multi-username-first-match-is-zero",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
// First match username, then provider id
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 2, User: users[2]},
|
|
|
|
},
|
|
|
|
user: "mikael",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-duplicate-username-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
},
|
|
|
|
user: "mikael",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-unique-username-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
},
|
|
|
|
user: "marc",
|
|
|
|
},
|
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-no-username-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
},
|
|
|
|
user: "not-working",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-duplicate-email-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
},
|
|
|
|
user: "mikael@headscale.net",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-duplicate-email-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
&types.Node{ID: 8, User: users[7]},
|
|
|
|
},
|
|
|
|
user: "joe@headscale.net",
|
|
|
|
},
|
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "email-as-username-duplicate",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[7]},
|
|
|
|
&types.Node{ID: 2, User: users[8]},
|
|
|
|
},
|
|
|
|
user: "alex@headscale.net",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-no-email-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
},
|
|
|
|
user: "not-working@headscale.net",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-provider-id-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
&types.Node{ID: 6, User: users[5]},
|
|
|
|
},
|
|
|
|
user: "http://oidc.org/1234",
|
|
|
|
},
|
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all-users-no-provider-id-random-order",
|
|
|
|
args: args{
|
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{ID: 1, User: users[0]},
|
|
|
|
&types.Node{ID: 2, User: users[1]},
|
|
|
|
&types.Node{ID: 3, User: users[2]},
|
|
|
|
&types.Node{ID: 4, User: users[3]},
|
|
|
|
&types.Node{ID: 5, User: users[4]},
|
|
|
|
&types.Node{ID: 6, User: users[5]},
|
|
|
|
},
|
|
|
|
user: "http://oidc.org/4321",
|
|
|
|
},
|
|
|
|
want: nil,
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
2022-02-14 18:24:37 +01:00
|
|
|
for _, test := range tests {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2024-11-24 00:13:27 +01:00
|
|
|
for range 1000 {
|
|
|
|
ns := test.args.nodes
|
|
|
|
rand.Shuffle(len(ns), func(i, j int) {
|
|
|
|
ns[i], ns[j] = ns[j], ns[i]
|
|
|
|
})
|
|
|
|
us := users
|
|
|
|
rand.Shuffle(len(us), func(i, j int) {
|
|
|
|
us[i], us[j] = us[j], us[i]
|
|
|
|
})
|
|
|
|
got := filterNodesByUser(ns, us, test.args.user)
|
|
|
|
sort.Slice(got, func(i, j int) bool {
|
|
|
|
return got[i].ID < got[j].ID
|
|
|
|
})
|
|
|
|
|
|
|
|
if diff := cmp.Diff(test.want, got, util.Comparers...); diff != "" {
|
|
|
|
t.Errorf("filterNodesByUser() = (-want +got):\n%s", diff)
|
|
|
|
}
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_expandAlias(t *testing.T) {
|
2023-04-28 16:11:02 +02:00
|
|
|
set := func(ips []string, prefixes []string) *netipx.IPSet {
|
|
|
|
var builder netipx.IPSetBuilder
|
|
|
|
|
|
|
|
for _, ip := range ips {
|
|
|
|
builder.Add(netip.MustParseAddr(ip))
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, pre := range prefixes {
|
|
|
|
builder.AddPrefix(netip.MustParsePrefix(pre))
|
|
|
|
}
|
|
|
|
|
|
|
|
s, _ := builder.IPSet()
|
|
|
|
|
|
|
|
return s
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
users := []types.User{
|
|
|
|
{Model: gorm.Model{ID: 1}, Name: "joe"},
|
|
|
|
{Model: gorm.Model{ID: 2}, Name: "marc"},
|
|
|
|
{Model: gorm.Model{ID: 3}, Name: "mickael"},
|
|
|
|
}
|
|
|
|
|
2023-04-26 10:58:26 +02:00
|
|
|
type field struct {
|
|
|
|
pol ACLPolicy
|
|
|
|
}
|
2022-02-07 16:12:05 +01:00
|
|
|
type args struct {
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes types.Nodes
|
2023-06-12 15:29:34 +02:00
|
|
|
aclPolicy ACLPolicy
|
|
|
|
alias string
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
2023-04-26 10:58:26 +02:00
|
|
|
field field
|
2022-02-07 16:12:05 +01:00
|
|
|
args args
|
2023-04-28 16:11:02 +02:00
|
|
|
want *netipx.IPSet
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "wildcard",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
|
|
|
alias: "*",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-07-26 11:53:42 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.78.84.227"),
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{}, []string{
|
|
|
|
"0.0.0.0/0",
|
|
|
|
"::/0",
|
|
|
|
}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple group",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Groups: Groups{"group:accountant": []string{"joe", "marc"}},
|
|
|
|
},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2022-02-20 23:00:31 +01:00
|
|
|
alias: "group:accountant",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{
|
|
|
|
"100.64.0.1", "100.64.0.2", "100.64.0.3",
|
|
|
|
}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "wrong group",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Groups: Groups{"group:accountant": []string{"joe", "marc"}},
|
|
|
|
},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2022-02-20 23:00:31 +01:00
|
|
|
alias: "group:hr",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple ipaddress",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
alias: "10.0.0.3",
|
|
|
|
nodes: types.Nodes{},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{
|
|
|
|
"10.0.0.3",
|
|
|
|
}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2023-04-16 12:26:35 +02:00
|
|
|
name: "simple host by ip passed through",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
alias: "10.0.0.1",
|
|
|
|
nodes: types.Nodes{},
|
2023-04-16 12:26:35 +02:00
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{
|
|
|
|
"10.0.0.1",
|
|
|
|
}, []string{}),
|
2023-04-16 12:26:35 +02:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple host by ipv4 single ipv4",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2023-04-16 12:26:35 +02:00
|
|
|
args: args{
|
|
|
|
alias: "10.0.0.1",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("10.0.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{
|
|
|
|
"10.0.0.1",
|
|
|
|
}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2023-04-16 12:26:35 +02:00
|
|
|
name: "simple host by ipv4 single dual stack",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-04-16 12:26:35 +02:00
|
|
|
alias: "10.0.0.1",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("10.0.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2222"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
2023-04-16 12:26:35 +02:00
|
|
|
},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{
|
|
|
|
"10.0.0.1", "fd7a:115c:a1e0:ab12:4843:2222:6273:2222",
|
|
|
|
}, []string{}),
|
2023-04-16 12:26:35 +02:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple host by ipv6 single dual stack",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2023-04-16 12:26:35 +02:00
|
|
|
args: args{
|
|
|
|
alias: "fd7a:115c:a1e0:ab12:4843:2222:6273:2222",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("10.0.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2222"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
2023-04-16 12:26:35 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{
|
|
|
|
"fd7a:115c:a1e0:ab12:4843:2222:6273:2222", "10.0.0.1",
|
|
|
|
}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
2023-01-30 09:39:27 +01:00
|
|
|
{
|
|
|
|
name: "simple host by hostname alias",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
2023-01-30 09:39:27 +01:00
|
|
|
Hosts: Hosts{
|
|
|
|
"testy": netip.MustParsePrefix("10.0.0.132/32"),
|
|
|
|
},
|
|
|
|
},
|
2023-04-26 10:58:26 +02:00
|
|
|
},
|
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
alias: "testy",
|
|
|
|
nodes: types.Nodes{},
|
2023-01-30 09:39:27 +01:00
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{}, []string{"10.0.0.132/32"}),
|
2023-01-30 09:39:27 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
2023-04-16 12:26:35 +02:00
|
|
|
{
|
|
|
|
name: "private network",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
2023-04-16 12:26:35 +02:00
|
|
|
Hosts: Hosts{
|
|
|
|
"homeNetwork": netip.MustParsePrefix("192.168.1.0/24"),
|
|
|
|
},
|
|
|
|
},
|
2023-04-26 10:58:26 +02:00
|
|
|
},
|
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
alias: "homeNetwork",
|
|
|
|
nodes: types.Nodes{},
|
2023-04-16 12:26:35 +02:00
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{}, []string{"192.168.1.0/24"}),
|
2023-04-16 12:26:35 +02:00
|
|
|
wantErr: false,
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
{
|
|
|
|
name: "simple CIDR",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2023-06-12 15:29:34 +02:00
|
|
|
alias: "10.0.0.0/16",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{},
|
2023-06-12 15:29:34 +02:00
|
|
|
aclPolicy: ACLPolicy{},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{}, []string{"10.0.0.0/16"}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple tag",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
TagOwners: TagOwners{"tag:hr-webserver": []string{"joe"}},
|
|
|
|
},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2022-02-20 23:00:31 +01:00
|
|
|
alias: "tag:hr-webserver",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{
|
|
|
|
"100.64.0.1", "100.64.0.2",
|
|
|
|
}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "No tag defined",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Groups: Groups{"group:accountant": []string{"joe", "marc"}},
|
|
|
|
TagOwners: TagOwners{
|
|
|
|
"tag:accountant-webserver": []string{"group:accountant"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2022-02-20 23:00:31 +01:00
|
|
|
alias: "tag:hr-webserver",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: true,
|
|
|
|
},
|
2022-04-15 18:01:13 +02:00
|
|
|
{
|
|
|
|
name: "Forced tag defined",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{},
|
|
|
|
},
|
2022-04-15 18:01:13 +02:00
|
|
|
args: args{
|
|
|
|
alias: "tag:hr-webserver",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-04-15 18:01:13 +02:00
|
|
|
ForcedTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-04-15 18:01:13 +02:00
|
|
|
ForcedTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2022-04-15 18:01:13 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2022-04-15 18:01:13 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{"100.64.0.1", "100.64.0.2"}, []string{}),
|
2022-06-01 15:39:59 +02:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "Forced tag with legitimate tagOwner",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
TagOwners: TagOwners{
|
|
|
|
"tag:hr-webserver": []string{"joe"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2022-06-01 15:39:59 +02:00
|
|
|
args: args{
|
|
|
|
alias: "tag:hr-webserver",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2022-06-01 15:39:59 +02:00
|
|
|
ForcedTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-06-01 15:39:59 +02:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2022-06-01 15:39:59 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2022-06-01 15:39:59 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{"100.64.0.1", "100.64.0.2"}, []string{}),
|
2022-04-15 18:01:13 +02:00
|
|
|
wantErr: false,
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
{
|
2023-01-17 17:43:44 +01:00
|
|
|
name: "list host in user without correctly tagged servers",
|
2023-04-26 10:58:26 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
|
|
|
|
},
|
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
args: args{
|
2022-02-20 23:00:31 +01:00
|
|
|
alias: "joe",
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:accountant-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:accountant-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
2023-04-28 16:11:02 +02:00
|
|
|
want: set([]string{"100.64.0.4"}, []string{}),
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
for _, test := range tests {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2023-05-21 19:37:59 +03:00
|
|
|
got, err := test.field.pol.ExpandAlias(
|
2023-09-24 13:42:05 +02:00
|
|
|
test.args.nodes,
|
2024-11-24 00:13:27 +01:00
|
|
|
users,
|
2022-02-14 15:54:51 +01:00
|
|
|
test.args.alias,
|
|
|
|
)
|
2022-02-14 15:26:54 +01:00
|
|
|
if (err != nil) != test.wantErr {
|
|
|
|
t.Errorf("expandAlias() error = %v, wantErr %v", err, test.wantErr)
|
|
|
|
|
2022-02-07 16:12:05 +01:00
|
|
|
return
|
|
|
|
}
|
2023-04-28 16:11:02 +02:00
|
|
|
if diff := cmp.Diff(test.want, got); diff != "" {
|
2023-05-31 09:59:37 +02:00
|
|
|
t.Errorf("expandAlias() unexpected result (-want +got):\n%s", diff)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_excludeCorrectlyTaggedNodes(t *testing.T) {
|
|
|
|
type args struct {
|
2023-06-12 15:29:34 +02:00
|
|
|
aclPolicy *ACLPolicy
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes types.Nodes
|
2023-06-12 15:29:34 +02:00
|
|
|
user string
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
args args
|
2023-09-24 13:42:05 +02:00
|
|
|
want types.Nodes
|
2022-02-07 16:12:05 +01:00
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "exclude nodes with valid tags",
|
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-02-20 23:00:31 +01:00
|
|
|
TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:accountant-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:accountant-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2023-11-21 18:20:06 +01:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
user: "joe",
|
2022-08-04 10:42:47 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-08-04 10:42:47 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exclude nodes with valid tags, and owner is in a group",
|
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-08-04 10:42:47 +02:00
|
|
|
Groups: Groups{
|
|
|
|
"group:accountant": []string{"joe", "bar"},
|
|
|
|
},
|
2022-08-04 10:47:00 +02:00
|
|
|
TagOwners: TagOwners{
|
|
|
|
"tag:accountant-webserver": []string{"group:accountant"},
|
|
|
|
},
|
2022-08-04 10:42:47 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-08-04 10:42:47 +02:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:accountant-webserver"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-08-04 10:42:47 +02:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:accountant-webserver"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2023-11-21 18:20:06 +01:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-08-04 10:42:47 +02:00
|
|
|
},
|
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
user: "joe",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-04-15 18:01:13 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "exclude nodes with valid tags and with forced tags",
|
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-04-15 18:01:13 +02:00
|
|
|
TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-04-15 18:01:13 +02:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "foo",
|
|
|
|
RequestTags: []string{"tag:accountant-webserver"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2022-04-15 18:01:13 +02:00
|
|
|
ForcedTags: []string{"tag:accountant-webserver"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-04-15 18:01:13 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2023-11-21 18:20:06 +01:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-04-15 18:01:13 +02:00
|
|
|
},
|
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
user: "joe",
|
2022-04-15 18:01:13 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "all nodes have invalid tags, don't exclude them",
|
|
|
|
args: args{
|
2023-04-26 10:58:26 +02:00
|
|
|
aclPolicy: &ACLPolicy{
|
2022-02-20 23:00:31 +01:00
|
|
|
TagOwners: TagOwners{"tag:accountant-webserver": []string{"joe"}},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "hr-web1",
|
|
|
|
RequestTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "hr-web2",
|
|
|
|
RequestTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2023-11-21 18:20:06 +01:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-06-12 15:29:34 +02:00
|
|
|
user: "joe",
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "hr-web1",
|
|
|
|
RequestTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2022-03-01 16:34:35 +00:00
|
|
|
OS: "centos",
|
|
|
|
Hostname: "hr-web2",
|
|
|
|
RequestTags: []string{"tag:hr-webserver"},
|
|
|
|
},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
2023-11-21 18:20:06 +01:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{},
|
2022-02-14 15:54:51 +01:00
|
|
|
},
|
2022-02-07 16:12:05 +01:00
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
2022-02-14 15:26:54 +01:00
|
|
|
for _, test := range tests {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2022-03-02 08:15:14 +00:00
|
|
|
got := excludeCorrectlyTaggedNodes(
|
2022-02-14 15:54:51 +01:00
|
|
|
test.args.aclPolicy,
|
|
|
|
test.args.nodes,
|
2023-01-17 17:43:44 +01:00
|
|
|
test.args.user,
|
2022-02-14 15:54:51 +01:00
|
|
|
)
|
2023-12-09 18:09:24 +01:00
|
|
|
if diff := cmp.Diff(test.want, got, util.Comparers...); diff != "" {
|
2023-06-21 08:12:24 +02:00
|
|
|
t.Errorf("excludeCorrectlyTaggedNodes() (-want +got):\n%s", diff)
|
2022-02-07 16:12:05 +01:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2023-04-03 10:08:48 +02:00
|
|
|
|
2023-04-26 14:04:12 +02:00
|
|
|
func TestACLPolicy_generateFilterRules(t *testing.T) {
|
|
|
|
type field struct {
|
|
|
|
pol ACLPolicy
|
|
|
|
}
|
|
|
|
type args struct {
|
2024-02-23 10:59:24 +01:00
|
|
|
nodes types.Nodes
|
2023-04-26 14:04:12 +02:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
field field
|
|
|
|
args args
|
|
|
|
want []tailcfg.FilterRule
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "no-policy",
|
|
|
|
field: field{},
|
|
|
|
args: args{},
|
2024-06-23 22:06:50 +02:00
|
|
|
want: nil,
|
2023-04-26 14:04:12 +02:00
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2023-04-26 17:27:51 +02:00
|
|
|
name: "allow-all",
|
2023-04-26 14:04:12 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
args: args{
|
2024-02-23 10:59:24 +01:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2221"),
|
2023-06-13 10:03:22 +02:00
|
|
|
},
|
|
|
|
},
|
2023-04-26 14:04:12 +02:00
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
2023-04-28 16:11:02 +02:00
|
|
|
SrcIPs: []string{"0.0.0.0/0", "::/0"},
|
2023-04-26 14:04:12 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
2023-04-28 16:11:02 +02:00
|
|
|
IP: "0.0.0.0/0",
|
|
|
|
Ports: tailcfg.PortRange{
|
|
|
|
First: 0,
|
|
|
|
Last: 65535,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "::/0",
|
2023-04-26 14:04:12 +02:00
|
|
|
Ports: tailcfg.PortRange{
|
|
|
|
First: 0,
|
|
|
|
Last: 65535,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
2023-06-16 16:42:30 +02:00
|
|
|
name: "host1-can-reach-host2-full",
|
2023-04-26 14:04:12 +02:00
|
|
|
field: field{
|
|
|
|
pol: ACLPolicy{
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
2023-06-13 10:03:22 +02:00
|
|
|
Sources: []string{"100.64.0.2"},
|
|
|
|
Destinations: []string{"100.64.0.1:*"},
|
2023-04-26 14:04:12 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
args: args{
|
2024-02-23 10:59:24 +01:00
|
|
|
nodes: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2221"),
|
2024-02-23 10:59:24 +01:00
|
|
|
User: types.User{Name: "mickael"},
|
2023-04-26 14:04:12 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2222"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
2023-04-26 14:04:12 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
2023-05-21 19:37:59 +03:00
|
|
|
SrcIPs: []string{
|
2023-06-13 10:03:22 +02:00
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0:ab12:4843:2222:6273:2222/128",
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
2023-04-26 14:04:12 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
2023-06-13 10:03:22 +02:00
|
|
|
IP: "100.64.0.1/32",
|
2023-04-26 14:04:12 +02:00
|
|
|
Ports: tailcfg.PortRange{
|
|
|
|
First: 0,
|
|
|
|
Last: 65535,
|
|
|
|
},
|
|
|
|
},
|
2023-04-26 17:27:51 +02:00
|
|
|
{
|
2023-06-13 10:03:22 +02:00
|
|
|
IP: "fd7a:115c:a1e0:ab12:4843:2222:6273:2221/128",
|
2023-04-26 17:27:51 +02:00
|
|
|
Ports: tailcfg.PortRange{
|
|
|
|
First: 0,
|
|
|
|
Last: 65535,
|
|
|
|
},
|
|
|
|
},
|
2023-04-26 14:04:12 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
2023-06-16 16:42:30 +02:00
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2024-02-23 10:59:24 +01:00
|
|
|
got, err := tt.field.pol.CompileFilterRules(
|
2024-11-24 00:13:27 +01:00
|
|
|
[]types.User{},
|
2024-02-23 10:59:24 +01:00
|
|
|
tt.args.nodes,
|
2023-06-16 16:42:30 +02:00
|
|
|
)
|
|
|
|
if (err != nil) != tt.wantErr {
|
|
|
|
t.Errorf("ACLgenerateFilterRules() error = %v, wantErr %v", err, tt.wantErr)
|
|
|
|
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
if diff := cmp.Diff(tt.want, got); diff != "" {
|
|
|
|
log.Trace().Interface("got", got).Msg("result")
|
|
|
|
t.Errorf("ACLgenerateFilterRules() unexpected result (-want +got):\n%s", diff)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-04-30 07:23:16 +02:00
|
|
|
// tsExitNodeDest is the list of destination IP ranges that are allowed when
|
|
|
|
// you dump the filter list from a Tailscale node connected to Tailscale SaaS.
|
|
|
|
var tsExitNodeDest = []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "0.0.0.0-9.255.255.255",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "11.0.0.0-100.63.255.255",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "100.128.0.0-169.253.255.255",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "169.255.0.0-172.15.255.255",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "172.32.0.0-192.167.255.255",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "192.169.0.0-255.255.255.255",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "2000::-3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
// hsExitNodeDest is the list of destination IP ranges that are allowed when
|
2024-07-22 08:56:00 +02:00
|
|
|
// we use headscale "autogroup:internet".
|
2024-04-30 07:23:16 +02:00
|
|
|
var hsExitNodeDest = []tailcfg.NetPortRange{
|
|
|
|
{IP: "0.0.0.0/5", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "8.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "11.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "12.0.0.0/6", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "16.0.0.0/4", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "32.0.0.0/3", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "64.0.0.0/3", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "96.0.0.0/6", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "100.0.0.0/10", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "100.128.0.0/9", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "101.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "102.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "104.0.0.0/5", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "112.0.0.0/4", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "128.0.0.0/3", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "160.0.0.0/5", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "168.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.0.0.0/9", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.128.0.0/10", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.192.0.0/11", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.224.0.0/12", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.240.0.0/13", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.248.0.0/14", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.252.0.0/15", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "169.255.0.0/16", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "170.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.0.0.0/12", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.32.0.0/11", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.64.0.0/10", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.128.0.0/9", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "173.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "174.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "176.0.0.0/4", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.0.0.0/9", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.128.0.0/11", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.160.0.0/13", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.169.0.0/16", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.170.0.0/15", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.172.0.0/14", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.176.0.0/12", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.192.0.0/10", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "193.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "194.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "196.0.0.0/6", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "200.0.0.0/5", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "208.0.0.0/4", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "224.0.0.0/3", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "2000::/3", Ports: tailcfg.PortRangeAny},
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestTheInternet(t *testing.T) {
|
|
|
|
internetSet := theInternet()
|
|
|
|
|
|
|
|
internetPrefs := internetSet.Prefixes()
|
|
|
|
|
2024-07-22 08:56:00 +02:00
|
|
|
for i := range internetPrefs {
|
2024-04-30 07:23:16 +02:00
|
|
|
if internetPrefs[i].String() != hsExitNodeDest[i].IP {
|
2024-11-22 16:54:58 +01:00
|
|
|
t.Errorf(
|
|
|
|
"prefix from internet set %q != hsExit list %q",
|
|
|
|
internetPrefs[i].String(),
|
|
|
|
hsExitNodeDest[i].IP,
|
|
|
|
)
|
2024-04-30 07:23:16 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(internetPrefs) != len(hsExitNodeDest) {
|
2024-11-22 16:54:58 +01:00
|
|
|
t.Fatalf(
|
|
|
|
"expected same length of prefixes, internet: %d, hsExit: %d",
|
|
|
|
len(internetPrefs),
|
|
|
|
len(hsExitNodeDest),
|
|
|
|
)
|
2024-04-30 07:23:16 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-06-16 16:42:30 +02:00
|
|
|
func TestReduceFilterRules(t *testing.T) {
|
2024-11-24 00:13:27 +01:00
|
|
|
users := []types.User{
|
|
|
|
{Model: gorm.Model{ID: 1}, Name: "mickael"},
|
|
|
|
{Model: gorm.Model{ID: 2}, Name: "user1"},
|
|
|
|
{Model: gorm.Model{ID: 3}, Name: "user2"},
|
|
|
|
{Model: gorm.Model{ID: 4}, Name: "user100"},
|
|
|
|
}
|
|
|
|
|
2023-06-16 16:42:30 +02:00
|
|
|
tests := []struct {
|
2023-09-24 13:42:05 +02:00
|
|
|
name string
|
|
|
|
node *types.Node
|
|
|
|
peers types.Nodes
|
|
|
|
pol ACLPolicy
|
|
|
|
want []tailcfg.FilterRule
|
2023-06-16 16:42:30 +02:00
|
|
|
}{
|
2023-06-13 10:03:22 +02:00
|
|
|
{
|
|
|
|
name: "host1-can-reach-host2-no-rules",
|
2023-06-16 16:42:30 +02:00
|
|
|
pol: ACLPolicy{
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"100.64.0.1"},
|
|
|
|
Destinations: []string{"100.64.0.2:*"},
|
2023-06-13 10:03:22 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2221"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2222"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[0],
|
2023-06-13 10:03:22 +02:00
|
|
|
},
|
|
|
|
},
|
2023-06-16 16:42:30 +02:00
|
|
|
want: []tailcfg.FilterRule{},
|
2023-06-13 10:03:22 +02:00
|
|
|
},
|
2024-01-18 17:30:25 +01:00
|
|
|
{
|
|
|
|
name: "1604-subnet-routers-are-preserved",
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Groups: Groups{
|
|
|
|
"group:admins": {"user1"},
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:admins"},
|
|
|
|
Destinations: []string{"group:admins:*"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:admins"},
|
|
|
|
Destinations: []string{"10.33.0.0/16:*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-01-18 17:30:25 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
|
|
|
RoutableIPs: []netip.Prefix{
|
|
|
|
netip.MustParsePrefix("10.33.0.0/16"),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-01-18 17:30:25 +01:00
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "100.64.0.1/32",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "fd7a:115c:a1e0::1/128",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "10.33.0.0/16",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
{
|
|
|
|
name: "1786-reducing-breaks-exit-nodes-the-client",
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Hosts: Hosts{
|
|
|
|
// Exit node
|
|
|
|
"internal": netip.MustParsePrefix("100.64.0.100/32"),
|
|
|
|
},
|
|
|
|
Groups: Groups{
|
|
|
|
"group:team": {"user3", "user2", "user1"},
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"internal:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"autogroup:internet:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
// "internal" exit node
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.100"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::100"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[3],
|
2024-04-30 07:23:16 +02:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2024-10-02 09:06:09 +02:00
|
|
|
RoutableIPs: tsaddr.ExitRoutes(),
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "1786-reducing-breaks-exit-nodes-the-exit",
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Hosts: Hosts{
|
|
|
|
// Exit node
|
|
|
|
"internal": netip.MustParsePrefix("100.64.0.100/32"),
|
|
|
|
},
|
|
|
|
Groups: Groups{
|
|
|
|
"group:team": {"user3", "user2", "user1"},
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"internal:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"autogroup:internet:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
|
|
|
IPv4: iap("100.64.0.100"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::100"),
|
|
|
|
User: types.User{Name: "user100"},
|
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2024-10-02 09:06:09 +02:00
|
|
|
RoutableIPs: tsaddr.ExitRoutes(),
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "100.64.0.100/32",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "fd7a:115c:a1e0::100/128",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: hsExitNodeDest,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "1786-reducing-breaks-exit-nodes-the-example-from-issue",
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Hosts: Hosts{
|
|
|
|
// Exit node
|
|
|
|
"internal": netip.MustParsePrefix("100.64.0.100/32"),
|
|
|
|
},
|
|
|
|
Groups: Groups{
|
|
|
|
"group:team": {"user3", "user2", "user1"},
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"internal:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"0.0.0.0/5:*",
|
|
|
|
"8.0.0.0/7:*",
|
|
|
|
"11.0.0.0/8:*",
|
|
|
|
"12.0.0.0/6:*",
|
|
|
|
"16.0.0.0/4:*",
|
|
|
|
"32.0.0.0/3:*",
|
|
|
|
"64.0.0.0/2:*",
|
|
|
|
"128.0.0.0/3:*",
|
|
|
|
"160.0.0.0/5:*",
|
|
|
|
"168.0.0.0/6:*",
|
|
|
|
"172.0.0.0/12:*",
|
|
|
|
"172.32.0.0/11:*",
|
|
|
|
"172.64.0.0/10:*",
|
|
|
|
"172.128.0.0/9:*",
|
|
|
|
"173.0.0.0/8:*",
|
|
|
|
"174.0.0.0/7:*",
|
|
|
|
"176.0.0.0/4:*",
|
|
|
|
"192.0.0.0/9:*",
|
|
|
|
"192.128.0.0/11:*",
|
|
|
|
"192.160.0.0/13:*",
|
|
|
|
"192.169.0.0/16:*",
|
|
|
|
"192.170.0.0/15:*",
|
|
|
|
"192.172.0.0/14:*",
|
|
|
|
"192.176.0.0/12:*",
|
|
|
|
"192.192.0.0/10:*",
|
|
|
|
"193.0.0.0/8:*",
|
|
|
|
"194.0.0.0/7:*",
|
|
|
|
"196.0.0.0/6:*",
|
|
|
|
"200.0.0.0/5:*",
|
|
|
|
"208.0.0.0/4:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
|
|
|
IPv4: iap("100.64.0.100"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::100"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[3],
|
2024-04-30 07:23:16 +02:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2024-10-02 09:06:09 +02:00
|
|
|
RoutableIPs: tsaddr.ExitRoutes(),
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "100.64.0.100/32",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "fd7a:115c:a1e0::100/128",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "0.0.0.0/5", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "8.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "11.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "12.0.0.0/6", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "16.0.0.0/4", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "32.0.0.0/3", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "64.0.0.0/2", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::1/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::2/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::100/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "128.0.0.0/3", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "160.0.0.0/5", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "168.0.0.0/6", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.0.0.0/12", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.32.0.0/11", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.64.0.0/10", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "172.128.0.0/9", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "173.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "174.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "176.0.0.0/4", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.0.0.0/9", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.128.0.0/11", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.160.0.0/13", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.169.0.0/16", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.170.0.0/15", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.172.0.0/14", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.176.0.0/12", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "192.192.0.0/10", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "193.0.0.0/8", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "194.0.0.0/7", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "196.0.0.0/6", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "200.0.0.0/5", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "208.0.0.0/4", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "1786-reducing-breaks-exit-nodes-app-connector-like",
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Hosts: Hosts{
|
|
|
|
// Exit node
|
|
|
|
"internal": netip.MustParsePrefix("100.64.0.100/32"),
|
|
|
|
},
|
|
|
|
Groups: Groups{
|
|
|
|
"group:team": {"user3", "user2", "user1"},
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"internal:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"8.0.0.0/8:*",
|
|
|
|
"16.0.0.0/8:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
|
|
|
IPv4: iap("100.64.0.100"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::100"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[3],
|
2024-04-30 07:23:16 +02:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2024-11-22 16:54:58 +01:00
|
|
|
RoutableIPs: []netip.Prefix{
|
|
|
|
netip.MustParsePrefix("8.0.0.0/16"),
|
|
|
|
netip.MustParsePrefix("16.0.0.0/16"),
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "100.64.0.100/32",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "fd7a:115c:a1e0::100/128",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "8.0.0.0/8",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "16.0.0.0/8",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "1786-reducing-breaks-exit-nodes-app-connector-like2",
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Hosts: Hosts{
|
|
|
|
// Exit node
|
|
|
|
"internal": netip.MustParsePrefix("100.64.0.100/32"),
|
|
|
|
},
|
|
|
|
Groups: Groups{
|
|
|
|
"group:team": {"user3", "user2", "user1"},
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"internal:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:team"},
|
|
|
|
Destinations: []string{
|
|
|
|
"8.0.0.0/16:*",
|
|
|
|
"16.0.0.0/16:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
|
|
|
IPv4: iap("100.64.0.100"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::100"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[3],
|
2024-04-30 07:23:16 +02:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2024-11-22 16:54:58 +01:00
|
|
|
RoutableIPs: []netip.Prefix{
|
|
|
|
netip.MustParsePrefix("8.0.0.0/8"),
|
|
|
|
netip.MustParsePrefix("16.0.0.0/8"),
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::2"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[2],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "100.64.0.100/32",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "fd7a:115c:a1e0::100/128",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2024-11-22 16:54:58 +01:00
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
2024-04-30 07:23:16 +02:00
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "8.0.0.0/16",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "16.0.0.0/16",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "1817-reduce-breaks-32-mask",
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Hosts: Hosts{
|
|
|
|
"vlan1": netip.MustParsePrefix("172.16.0.0/24"),
|
|
|
|
"dns1": netip.MustParsePrefix("172.16.0.21/32"),
|
|
|
|
},
|
|
|
|
Groups: Groups{
|
|
|
|
"group:access": {"user1"},
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:access"},
|
|
|
|
Destinations: []string{
|
|
|
|
"tag:access-servers:*",
|
|
|
|
"dns1:*",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
|
|
|
IPv4: iap("100.64.0.100"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::100"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[3],
|
2024-04-30 07:23:16 +02:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
|
|
|
RoutableIPs: []netip.Prefix{netip.MustParsePrefix("172.16.0.0/24")},
|
|
|
|
},
|
2024-10-02 11:41:58 +02:00
|
|
|
ForcedTags: []string{"tag:access-servers"},
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
2024-11-24 00:13:27 +01:00
|
|
|
User: users[1],
|
2024-04-30 07:23:16 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.1/32", "fd7a:115c:a1e0::1/128"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "100.64.0.100/32",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "fd7a:115c:a1e0::100/128",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
IP: "172.16.0.21/32",
|
|
|
|
Ports: tailcfg.PortRangeAny,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-04-26 14:04:12 +02:00
|
|
|
}
|
2023-06-16 16:42:30 +02:00
|
|
|
|
2023-04-26 14:04:12 +02:00
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2024-04-30 07:23:16 +02:00
|
|
|
got, _ := tt.pol.CompileFilterRules(
|
2024-11-24 00:13:27 +01:00
|
|
|
users,
|
2024-02-23 10:59:24 +01:00
|
|
|
append(tt.peers, tt.node),
|
2023-04-26 14:04:12 +02:00
|
|
|
)
|
|
|
|
|
2024-04-30 07:23:16 +02:00
|
|
|
got = ReduceFilterRules(tt.node, got)
|
2023-04-26 14:04:12 +02:00
|
|
|
|
|
|
|
if diff := cmp.Diff(tt.want, got); diff != "" {
|
|
|
|
log.Trace().Interface("got", got).Msg("result")
|
2023-06-16 16:42:30 +02:00
|
|
|
t.Errorf("TestReduceFilterRules() unexpected result (-want +got):\n%s", diff)
|
2023-05-21 19:37:59 +03:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_getTags(t *testing.T) {
|
2024-12-19 13:10:10 +01:00
|
|
|
users := []types.User{
|
|
|
|
{
|
|
|
|
Model: gorm.Model{ID: 1},
|
|
|
|
Name: "joe",
|
|
|
|
},
|
|
|
|
}
|
2023-05-21 19:37:59 +03:00
|
|
|
type args struct {
|
2023-06-12 15:29:34 +02:00
|
|
|
aclPolicy *ACLPolicy
|
2023-09-24 13:42:05 +02:00
|
|
|
node *types.Node
|
2023-05-21 19:37:59 +03:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
args args
|
|
|
|
wantInvalid []string
|
|
|
|
wantValid []string
|
|
|
|
}{
|
|
|
|
{
|
2023-09-24 13:42:05 +02:00
|
|
|
name: "valid tag one nodes",
|
2023-05-21 19:37:59 +03:00
|
|
|
args: args{
|
|
|
|
aclPolicy: &ACLPolicy{
|
|
|
|
TagOwners: TagOwners{
|
|
|
|
"tag:valid": []string{"joe"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2023-05-21 19:37:59 +03:00
|
|
|
RequestTags: []string{"tag:valid"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantValid: []string{"tag:valid"},
|
|
|
|
wantInvalid: nil,
|
|
|
|
},
|
|
|
|
{
|
2023-09-24 13:42:05 +02:00
|
|
|
name: "invalid tag and valid tag one nodes",
|
2023-05-21 19:37:59 +03:00
|
|
|
args: args{
|
|
|
|
aclPolicy: &ACLPolicy{
|
|
|
|
TagOwners: TagOwners{
|
|
|
|
"tag:valid": []string{"joe"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2023-05-21 19:37:59 +03:00
|
|
|
RequestTags: []string{"tag:valid", "tag:invalid"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantValid: []string{"tag:valid"},
|
|
|
|
wantInvalid: []string{"tag:invalid"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "multiple invalid and identical tags, should return only one invalid tag",
|
|
|
|
args: args{
|
|
|
|
aclPolicy: &ACLPolicy{
|
|
|
|
TagOwners: TagOwners{
|
|
|
|
"tag:valid": []string{"joe"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2023-05-21 19:37:59 +03:00
|
|
|
RequestTags: []string{
|
|
|
|
"tag:invalid",
|
|
|
|
"tag:valid",
|
|
|
|
"tag:invalid",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantValid: []string{"tag:valid"},
|
|
|
|
wantInvalid: []string{"tag:invalid"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "only invalid tags",
|
|
|
|
args: args{
|
|
|
|
aclPolicy: &ACLPolicy{
|
|
|
|
TagOwners: TagOwners{
|
|
|
|
"tag:valid": []string{"joe"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2023-05-21 19:37:59 +03:00
|
|
|
RequestTags: []string{"tag:invalid", "very-invalid"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantValid: nil,
|
|
|
|
wantInvalid: []string{"tag:invalid", "very-invalid"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "empty ACLPolicy should return empty tags and should not panic",
|
|
|
|
args: args{
|
|
|
|
aclPolicy: &ACLPolicy{},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &tailcfg.Hostinfo{
|
2023-05-21 19:37:59 +03:00
|
|
|
RequestTags: []string{"tag:invalid", "very-invalid"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
wantValid: nil,
|
|
|
|
wantInvalid: []string{"tag:invalid", "very-invalid"},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for _, test := range tests {
|
|
|
|
t.Run(test.name, func(t *testing.T) {
|
2023-09-24 13:42:05 +02:00
|
|
|
gotValid, gotInvalid := test.args.aclPolicy.TagsOfNode(
|
2024-12-19 13:10:10 +01:00
|
|
|
users,
|
2023-09-24 13:42:05 +02:00
|
|
|
test.args.node,
|
2023-05-21 19:37:59 +03:00
|
|
|
)
|
|
|
|
for _, valid := range gotValid {
|
2024-10-02 09:06:09 +02:00
|
|
|
if !slices.Contains(test.wantValid, valid) {
|
2023-05-21 19:37:59 +03:00
|
|
|
t.Errorf(
|
|
|
|
"valids: getTags() = %v, want %v",
|
|
|
|
gotValid,
|
|
|
|
test.wantValid,
|
|
|
|
)
|
|
|
|
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
for _, invalid := range gotInvalid {
|
2024-10-02 09:06:09 +02:00
|
|
|
if !slices.Contains(test.wantInvalid, invalid) {
|
2023-05-21 19:37:59 +03:00
|
|
|
t.Errorf(
|
|
|
|
"invalids: getTags() = %v, want %v",
|
|
|
|
gotInvalid,
|
|
|
|
test.wantInvalid,
|
|
|
|
)
|
|
|
|
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_getFilteredByACLPeers(t *testing.T) {
|
|
|
|
type args struct {
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes types.Nodes
|
|
|
|
rules []tailcfg.FilterRule
|
|
|
|
node *types.Node
|
2023-05-21 19:37:59 +03:00
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
args args
|
2023-09-24 13:42:05 +02:00
|
|
|
want types.Nodes
|
2023-05-21 19:37:59 +03:00
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "all hosts can talk to each other",
|
|
|
|
args: args{
|
2024-05-19 23:49:27 +02:00
|
|
|
nodes: types.Nodes{ // list of all nodes in the database
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.1", "100.64.0.2", "100.64.0.3"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
User: types.User{Name: "joe"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
User: types.User{Name: "marc"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
User: types.User{Name: "mickael"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "One host can talk to another, but not all hosts",
|
|
|
|
args: args{
|
2024-05-19 23:49:27 +02:00
|
|
|
nodes: types.Nodes{ // list of all nodes in the database
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.1", "100.64.0.2", "100.64.0.3"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.2"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
User: types.User{Name: "joe"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
User: types.User{Name: "marc"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "host cannot directly talk to destination, but return path is authorized",
|
|
|
|
args: args{
|
2024-05-19 23:49:27 +02:00
|
|
|
nodes: types.Nodes{ // list of all nodes in the database
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.3"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.2"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
User: types.User{Name: "marc"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
User: types.User{Name: "mickael"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "rules allows all hosts to reach one destination",
|
|
|
|
args: args{
|
2024-05-19 23:49:27 +02:00
|
|
|
nodes: types.Nodes{ // list of all nodes in the database
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"*"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.2"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "rules allows all hosts to reach one destination, destination can reach all hosts",
|
|
|
|
args: args{
|
2024-05-19 23:49:27 +02:00
|
|
|
nodes: types.Nodes{ // list of all nodes in the database
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"*"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.2"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "rule allows all hosts to reach all destinations",
|
|
|
|
args: args{
|
2024-05-19 23:49:27 +02:00
|
|
|
nodes: types.Nodes{ // list of all nodes in the database
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"*"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
User: types.User{Name: "marc"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
User: types.User{Name: "mickael"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "without rule all communications are forbidden",
|
|
|
|
args: args{
|
2024-05-19 23:49:27 +02:00
|
|
|
nodes: types.Nodes{ // list of all nodes in the database
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "joe"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "marc"},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
2023-05-21 19:37:59 +03:00
|
|
|
User: types.User{Name: "mickael"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
User: types.User{Name: "marc"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
2024-06-23 22:06:50 +02:00
|
|
|
want: nil,
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
{
|
|
|
|
// Investigating 699
|
2023-09-24 13:42:05 +02:00
|
|
|
// Found some nodes: [ts-head-8w6paa ts-unstable-lys2ib ts-head-upcrmb ts-unstable-rlwpvr] nodes=ts-head-8w6paa
|
2023-05-21 19:37:59 +03:00
|
|
|
// ACL rules generated ACL=[{"DstPorts":[{"Bits":null,"IP":"*","Ports":{"First":0,"Last":65535}}],"SrcIPs":["fd7a:115c:a1e0::3","100.64.0.3","fd7a:115c:a1e0::4","100.64.0.4"]}]
|
|
|
|
// ACL Cache Map={"100.64.0.3":{"*":{}},"100.64.0.4":{"*":{}},"fd7a:115c:a1e0::3":{"*":{}},"fd7a:115c:a1e0::4":{"*":{}}}
|
|
|
|
name: "issue-699-broken-star",
|
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: types.Nodes{ //
|
|
|
|
&types.Node{
|
2023-05-21 19:37:59 +03:00
|
|
|
ID: 1,
|
|
|
|
Hostname: "ts-head-upcrmb",
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::3"),
|
|
|
|
User: types.User{Name: "user1"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2023-05-21 19:37:59 +03:00
|
|
|
ID: 2,
|
|
|
|
Hostname: "ts-unstable-rlwpvr",
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::4"),
|
|
|
|
User: types.User{Name: "user1"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2023-05-21 19:37:59 +03:00
|
|
|
ID: 3,
|
|
|
|
Hostname: "ts-head-8w6paa",
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
|
|
|
User: types.User{Name: "user2"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2023-05-21 19:37:59 +03:00
|
|
|
ID: 4,
|
|
|
|
Hostname: "ts-unstable-lys2ib",
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::2"),
|
|
|
|
User: types.User{Name: "user2"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{ // list of all ACLRules registered
|
|
|
|
{
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{
|
|
|
|
IP: "*",
|
|
|
|
Ports: tailcfg.PortRange{First: 0, Last: 65535},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
SrcIPs: []string{
|
|
|
|
"fd7a:115c:a1e0::3", "100.64.0.3",
|
|
|
|
"fd7a:115c:a1e0::4", "100.64.0.4",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{ // current nodes
|
2023-05-21 19:37:59 +03:00
|
|
|
ID: 3,
|
|
|
|
Hostname: "ts-head-8w6paa",
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::1"),
|
|
|
|
User: types.User{Name: "user2"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: types.Nodes{
|
|
|
|
&types.Node{
|
2023-05-21 19:37:59 +03:00
|
|
|
ID: 1,
|
|
|
|
Hostname: "ts-head-upcrmb",
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::3"),
|
|
|
|
User: types.User{Name: "user1"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
&types.Node{
|
2023-05-21 19:37:59 +03:00
|
|
|
ID: 2,
|
|
|
|
Hostname: "ts-unstable-rlwpvr",
|
2024-04-17 07:03:06 +02:00
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
IPv6: iap("fd7a:115c:a1e0::4"),
|
|
|
|
User: types.User{Name: "user1"},
|
2023-05-21 19:37:59 +03:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-05-31 18:45:04 +02:00
|
|
|
{
|
|
|
|
name: "failing-edge-case-during-p3-refactor",
|
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: []*types.Node{
|
2023-05-31 18:45:04 +02:00
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
Hostname: "peer1",
|
|
|
|
User: types.User{Name: "mini"},
|
2023-05-31 18:45:04 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
Hostname: "peer2",
|
|
|
|
User: types.User{Name: "peer2"},
|
2023-05-31 18:45:04 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.1/32"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.3/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "::/0", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 0,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
Hostname: "mini",
|
|
|
|
User: types.User{Name: "mini"},
|
2023-05-31 18:45:04 +02:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: []*types.Node{
|
2023-05-31 18:45:04 +02:00
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
Hostname: "peer2",
|
|
|
|
User: types.User{Name: "peer2"},
|
2023-05-31 18:45:04 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-06-16 16:42:30 +02:00
|
|
|
{
|
|
|
|
name: "p4-host-in-netmap-user2-dest-bug",
|
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: []*types.Node{
|
2023-06-16 16:42:30 +02:00
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
Hostname: "user1-2",
|
|
|
|
User: types.User{Name: "user1"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 0,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
Hostname: "user1-1",
|
|
|
|
User: types.User{Name: "user1"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
Hostname: "user2-2",
|
|
|
|
User: types.User{Name: "user2"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.3/32",
|
|
|
|
"100.64.0.4/32",
|
|
|
|
"fd7a:115c:a1e0::3/128",
|
|
|
|
"fd7a:115c:a1e0::4/128",
|
|
|
|
},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.3/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "100.64.0.4/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::3/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::4/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.3/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "100.64.0.4/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::3/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::4/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
Hostname: "user-2-1",
|
|
|
|
User: types.User{Name: "user2"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: []*types.Node{
|
2023-06-16 16:42:30 +02:00
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
Hostname: "user1-2",
|
|
|
|
User: types.User{Name: "user1"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 0,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
Hostname: "user1-1",
|
|
|
|
User: types.User{Name: "user1"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
Hostname: "user2-2",
|
|
|
|
User: types.User{Name: "user2"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "p4-host-in-netmap-user1-dest-bug",
|
|
|
|
args: args{
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes: []*types.Node{
|
2023-06-16 16:42:30 +02:00
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
Hostname: "user1-2",
|
|
|
|
User: types.User{Name: "user1"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
Hostname: "user-2-1",
|
|
|
|
User: types.User{Name: "user2"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
Hostname: "user2-2",
|
|
|
|
User: types.User{Name: "user2"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.1/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "100.64.0.2/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::1/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::2/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
"100.64.0.2/32",
|
|
|
|
"fd7a:115c:a1e0::1/128",
|
|
|
|
"fd7a:115c:a1e0::2/128",
|
|
|
|
},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.3/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "100.64.0.4/32", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::3/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
{IP: "fd7a:115c:a1e0::4/128", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
node: &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 0,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
Hostname: "user1-1",
|
|
|
|
User: types.User{Name: "user1"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
want: []*types.Node{
|
2023-06-16 16:42:30 +02:00
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
Hostname: "user1-2",
|
|
|
|
User: types.User{Name: "user1"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.3"),
|
|
|
|
Hostname: "user-2-1",
|
|
|
|
User: types.User{Name: "user2"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 3,
|
|
|
|
IPv4: iap("100.64.0.4"),
|
|
|
|
Hostname: "user2-2",
|
|
|
|
User: types.User{Name: "user2"},
|
2023-06-16 16:42:30 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2024-02-12 11:44:37 +01:00
|
|
|
|
|
|
|
{
|
|
|
|
name: "subnet-router-with-only-route",
|
|
|
|
args: args{
|
|
|
|
nodes: []*types.Node{
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
Hostname: "user1",
|
|
|
|
User: types.User{Name: "user1"},
|
2024-02-12 11:44:37 +01:00
|
|
|
},
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
Hostname: "router",
|
|
|
|
User: types.User{Name: "router"},
|
2024-02-12 11:44:37 +01:00
|
|
|
Routes: types.Routes{
|
|
|
|
types.Route{
|
|
|
|
NodeID: 2,
|
2024-10-02 11:41:58 +02:00
|
|
|
Prefix: netip.MustParsePrefix("10.33.0.0/16"),
|
2024-02-12 11:44:37 +01:00
|
|
|
IsPrimary: true,
|
|
|
|
Enabled: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
rules: []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{
|
|
|
|
"100.64.0.1/32",
|
|
|
|
},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "10.33.0.0/16", Ports: tailcfg.PortRangeAny},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
node: &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
Hostname: "user1",
|
|
|
|
User: types.User{Name: "user1"},
|
2024-02-12 11:44:37 +01:00
|
|
|
},
|
|
|
|
},
|
|
|
|
want: []*types.Node{
|
|
|
|
{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 2,
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
Hostname: "router",
|
|
|
|
User: types.User{Name: "router"},
|
2024-02-12 11:44:37 +01:00
|
|
|
Routes: types.Routes{
|
|
|
|
types.Route{
|
|
|
|
NodeID: 2,
|
2024-10-02 11:41:58 +02:00
|
|
|
Prefix: netip.MustParsePrefix("10.33.0.0/16"),
|
2024-02-12 11:44:37 +01:00
|
|
|
IsPrimary: true,
|
|
|
|
Enabled: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2023-05-21 19:37:59 +03:00
|
|
|
}
|
2024-02-12 11:44:37 +01:00
|
|
|
|
2023-05-21 19:37:59 +03:00
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2023-09-24 13:42:05 +02:00
|
|
|
got := FilterNodesByACL(
|
|
|
|
tt.args.node,
|
|
|
|
tt.args.nodes,
|
2023-05-21 19:37:59 +03:00
|
|
|
tt.args.rules,
|
|
|
|
)
|
2024-10-02 11:41:58 +02:00
|
|
|
if diff := cmp.Diff(tt.want, got, util.Comparers...); diff != "" {
|
2023-09-24 13:42:05 +02:00
|
|
|
t.Errorf("FilterNodesByACL() unexpected result (-want +got):\n%s", diff)
|
2023-04-26 14:04:12 +02:00
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2023-06-08 19:50:59 +02:00
|
|
|
|
|
|
|
func TestSSHRules(t *testing.T) {
|
2024-12-19 13:10:10 +01:00
|
|
|
users := []types.User{
|
|
|
|
{
|
|
|
|
Name: "user1",
|
|
|
|
},
|
|
|
|
}
|
2023-06-08 19:50:59 +02:00
|
|
|
tests := []struct {
|
2023-09-24 13:42:05 +02:00
|
|
|
name string
|
|
|
|
node types.Node
|
|
|
|
peers types.Nodes
|
|
|
|
pol ACLPolicy
|
2024-02-23 10:59:24 +01:00
|
|
|
want *tailcfg.SSHPolicy
|
2023-06-08 19:50:59 +02:00
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "peers-can-connect",
|
2023-09-24 13:42:05 +02:00
|
|
|
node: types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
Hostname: "testnodes",
|
|
|
|
IPv4: iap("100.64.99.42"),
|
|
|
|
UserID: 0,
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
Hostname: "testnodes2",
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
UserID: 0,
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Groups: Groups{
|
|
|
|
"group:test": []string{"user1"},
|
|
|
|
},
|
|
|
|
Hosts: Hosts{
|
|
|
|
"client": netip.PrefixFrom(netip.MustParseAddr("100.64.99.42"), 32),
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
SSHs: []SSH{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:test"},
|
|
|
|
Destinations: []string{"client"},
|
|
|
|
Users: []string{"autogroup:nonroot"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"client"},
|
|
|
|
Users: []string{"autogroup:nonroot"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:test"},
|
|
|
|
Destinations: []string{"100.64.99.42"},
|
|
|
|
Users: []string{"autogroup:nonroot"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"100.64.99.42"},
|
|
|
|
Users: []string{"autogroup:nonroot"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2024-02-23 10:59:24 +01:00
|
|
|
want: &tailcfg.SSHPolicy{Rules: []*tailcfg.SSHRule{
|
2023-06-08 19:50:59 +02:00
|
|
|
{
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{
|
|
|
|
{
|
|
|
|
UserLogin: "user1",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"autogroup:nonroot": "=",
|
|
|
|
},
|
2024-11-22 16:54:58 +01:00
|
|
|
Action: &tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
AllowAgentForwarding: true,
|
|
|
|
AllowLocalPortForwarding: true,
|
|
|
|
},
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
|
|
|
{
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"autogroup:nonroot": "=",
|
|
|
|
},
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{
|
|
|
|
{
|
|
|
|
Any: true,
|
|
|
|
},
|
|
|
|
},
|
2024-11-22 16:54:58 +01:00
|
|
|
Action: &tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
AllowAgentForwarding: true,
|
|
|
|
AllowLocalPortForwarding: true,
|
|
|
|
},
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
|
|
|
{
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{
|
|
|
|
{
|
|
|
|
UserLogin: "user1",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"autogroup:nonroot": "=",
|
|
|
|
},
|
2024-11-22 16:54:58 +01:00
|
|
|
Action: &tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
AllowAgentForwarding: true,
|
|
|
|
AllowLocalPortForwarding: true,
|
|
|
|
},
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
|
|
|
{
|
|
|
|
SSHUsers: map[string]string{
|
|
|
|
"autogroup:nonroot": "=",
|
|
|
|
},
|
|
|
|
Principals: []*tailcfg.SSHPrincipal{
|
|
|
|
{
|
|
|
|
Any: true,
|
|
|
|
},
|
|
|
|
},
|
2024-11-22 16:54:58 +01:00
|
|
|
Action: &tailcfg.SSHAction{
|
|
|
|
Accept: true,
|
|
|
|
AllowAgentForwarding: true,
|
|
|
|
AllowLocalPortForwarding: true,
|
|
|
|
},
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
2024-02-23 10:59:24 +01:00
|
|
|
}},
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "peers-cannot-connect",
|
2023-09-24 13:42:05 +02:00
|
|
|
node: types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
Hostname: "testnodes",
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
UserID: 0,
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
2023-09-24 13:42:05 +02:00
|
|
|
peers: types.Nodes{
|
|
|
|
&types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
Hostname: "testnodes2",
|
|
|
|
IPv4: iap("100.64.99.42"),
|
|
|
|
UserID: 0,
|
2024-12-19 13:10:10 +01:00
|
|
|
User: users[0],
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
|
|
|
},
|
|
|
|
pol: ACLPolicy{
|
|
|
|
Groups: Groups{
|
|
|
|
"group:test": []string{"user1"},
|
|
|
|
},
|
|
|
|
Hosts: Hosts{
|
|
|
|
"client": netip.PrefixFrom(netip.MustParseAddr("100.64.99.42"), 32),
|
|
|
|
},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
SSHs: []SSH{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"group:test"},
|
|
|
|
Destinations: []string{"100.64.99.42"},
|
|
|
|
Users: []string{"autogroup:nonroot"},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"100.64.99.42"},
|
|
|
|
Users: []string{"autogroup:nonroot"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
2024-06-23 22:06:50 +02:00
|
|
|
want: &tailcfg.SSHPolicy{Rules: nil},
|
2023-06-08 19:50:59 +02:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
2024-12-19 13:10:10 +01:00
|
|
|
got, err := tt.pol.CompileSSHPolicy(&tt.node, users, tt.peers)
|
2024-11-22 16:54:58 +01:00
|
|
|
require.NoError(t, err)
|
2023-06-08 19:50:59 +02:00
|
|
|
|
|
|
|
if diff := cmp.Diff(tt.want, got); diff != "" {
|
|
|
|
t.Errorf("TestSSHRules() unexpected result (-want +got):\n%s", diff)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2023-06-12 15:59:05 +02:00
|
|
|
|
|
|
|
func TestParseDestination(t *testing.T) {
|
|
|
|
tests := []struct {
|
|
|
|
dest string
|
|
|
|
wantAlias string
|
|
|
|
wantPort string
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
dest: "git-server:*",
|
|
|
|
wantAlias: "git-server",
|
|
|
|
wantPort: "*",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
dest: "192.168.1.0/24:22",
|
|
|
|
wantAlias: "192.168.1.0/24",
|
|
|
|
wantPort: "22",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
dest: "192.168.1.1:22",
|
|
|
|
wantAlias: "192.168.1.1",
|
|
|
|
wantPort: "22",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
dest: "fd7a:115c:a1e0::2:22",
|
|
|
|
wantAlias: "fd7a:115c:a1e0::2",
|
|
|
|
wantPort: "22",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
dest: "fd7a:115c:a1e0::2/128:22",
|
|
|
|
wantAlias: "fd7a:115c:a1e0::2/128",
|
|
|
|
wantPort: "22",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
dest: "tag:montreal-webserver:80,443",
|
|
|
|
wantAlias: "tag:montreal-webserver",
|
|
|
|
wantPort: "80,443",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
dest: "tag:api-server:443",
|
|
|
|
wantAlias: "tag:api-server",
|
|
|
|
wantPort: "443",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
dest: "example-host-1:*",
|
|
|
|
wantAlias: "example-host-1",
|
|
|
|
wantPort: "*",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.dest, func(t *testing.T) {
|
|
|
|
alias, port, _ := parseDestination(tt.dest)
|
|
|
|
|
|
|
|
if alias != tt.wantAlias {
|
|
|
|
t.Errorf("unexpected alias: want(%s) != got(%s)", tt.wantAlias, alias)
|
|
|
|
}
|
|
|
|
|
|
|
|
if port != tt.wantPort {
|
|
|
|
t.Errorf("unexpected port: want(%s) != got(%s)", tt.wantPort, port)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2023-06-19 08:48:49 +02:00
|
|
|
|
|
|
|
// this test should validate that we can expand a group in a TagOWner section and
|
|
|
|
// match properly the IP's of the related hosts. The owner is valid and the tag is also valid.
|
|
|
|
// the tag is matched in the Sources section.
|
|
|
|
func TestValidExpandTagOwnersInSources(t *testing.T) {
|
|
|
|
hostInfo := tailcfg.Hostinfo{
|
|
|
|
OS: "centos",
|
2023-09-24 13:42:05 +02:00
|
|
|
Hostname: "testnodes",
|
2023-06-19 08:48:49 +02:00
|
|
|
RequestTags: []string{"tag:test"},
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
user := types.User{
|
|
|
|
Model: gorm.Model{ID: 1},
|
|
|
|
Name: "user1",
|
|
|
|
}
|
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
node := &types.Node{
|
2024-11-24 00:13:27 +01:00
|
|
|
ID: 0,
|
|
|
|
Hostname: "testnodes",
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
UserID: 0,
|
|
|
|
User: user,
|
2023-06-19 08:48:49 +02:00
|
|
|
RegisterMethod: util.RegisterMethodAuthKey,
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &hostInfo,
|
2023-06-19 08:48:49 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
pol := &ACLPolicy{
|
|
|
|
Groups: Groups{"group:test": []string{"user1", "user2"}},
|
|
|
|
TagOwners: TagOwners{"tag:test": []string{"user3", "group:test"}},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"tag:test"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
got, _, err := GenerateFilterAndSSHRulesForTests(pol, node, types.Nodes{}, []types.User{user})
|
2024-11-22 16:54:58 +01:00
|
|
|
require.NoError(t, err)
|
2023-06-19 08:48:49 +02:00
|
|
|
|
|
|
|
want := []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.1/32"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "0.0.0.0/0", Ports: tailcfg.PortRange{Last: 65535}},
|
|
|
|
{IP: "::/0", Ports: tailcfg.PortRange{Last: 65535}},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
if diff := cmp.Diff(want, got); diff != "" {
|
|
|
|
t.Errorf("TestValidExpandTagOwnersInSources() unexpected result (-want +got):\n%s", diff)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// need a test with:
|
|
|
|
// tag on a host that isn't owned by a tag owners. So the user
|
|
|
|
// of the host should be valid.
|
|
|
|
func TestInvalidTagValidUser(t *testing.T) {
|
|
|
|
hostInfo := tailcfg.Hostinfo{
|
|
|
|
OS: "centos",
|
2023-09-24 13:42:05 +02:00
|
|
|
Hostname: "testnodes",
|
2023-06-19 08:48:49 +02:00
|
|
|
RequestTags: []string{"tag:foo"},
|
|
|
|
}
|
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
node := &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
Hostname: "testnodes",
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
UserID: 1,
|
2023-06-19 08:48:49 +02:00
|
|
|
User: types.User{
|
2024-11-24 00:13:27 +01:00
|
|
|
Model: gorm.Model{ID: 1},
|
|
|
|
Name: "user1",
|
2023-06-19 08:48:49 +02:00
|
|
|
},
|
|
|
|
RegisterMethod: util.RegisterMethodAuthKey,
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &hostInfo,
|
2023-06-19 08:48:49 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
pol := &ACLPolicy{
|
|
|
|
TagOwners: TagOwners{"tag:test": []string{"user1"}},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"user1"},
|
|
|
|
Destinations: []string{"*:*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
got, _, err := GenerateFilterAndSSHRulesForTests(
|
|
|
|
pol,
|
|
|
|
node,
|
|
|
|
types.Nodes{},
|
|
|
|
[]types.User{node.User},
|
|
|
|
)
|
2024-11-22 16:54:58 +01:00
|
|
|
require.NoError(t, err)
|
2023-06-19 08:48:49 +02:00
|
|
|
|
|
|
|
want := []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.1/32"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "0.0.0.0/0", Ports: tailcfg.PortRange{Last: 65535}},
|
|
|
|
{IP: "::/0", Ports: tailcfg.PortRange{Last: 65535}},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
if diff := cmp.Diff(want, got); diff != "" {
|
|
|
|
t.Errorf("TestInvalidTagValidUser() unexpected result (-want +got):\n%s", diff)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// this test should validate that we can expand a group in a TagOWner section and
|
|
|
|
// match properly the IP's of the related hosts. The owner is valid and the tag is also valid.
|
|
|
|
// the tag is matched in the Destinations section.
|
|
|
|
func TestValidExpandTagOwnersInDestinations(t *testing.T) {
|
|
|
|
hostInfo := tailcfg.Hostinfo{
|
|
|
|
OS: "centos",
|
2023-09-24 13:42:05 +02:00
|
|
|
Hostname: "testnodes",
|
2023-06-19 08:48:49 +02:00
|
|
|
RequestTags: []string{"tag:test"},
|
|
|
|
}
|
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
node := &types.Node{
|
2024-04-17 07:03:06 +02:00
|
|
|
ID: 1,
|
|
|
|
Hostname: "testnodes",
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
UserID: 1,
|
2023-06-19 08:48:49 +02:00
|
|
|
User: types.User{
|
2024-11-24 00:13:27 +01:00
|
|
|
Model: gorm.Model{ID: 1},
|
|
|
|
Name: "user1",
|
2023-06-19 08:48:49 +02:00
|
|
|
},
|
|
|
|
RegisterMethod: util.RegisterMethodAuthKey,
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &hostInfo,
|
2023-06-19 08:48:49 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
pol := &ACLPolicy{
|
|
|
|
Groups: Groups{"group:test": []string{"user1", "user2"}},
|
|
|
|
TagOwners: TagOwners{"tag:test": []string{"user3", "group:test"}},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"*"},
|
|
|
|
Destinations: []string{"tag:test:*"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
// rules, _, err := GenerateFilterRules(pol, &node, peers, false)
|
2023-06-19 08:48:49 +02:00
|
|
|
// c.Assert(err, check.IsNil)
|
|
|
|
//
|
|
|
|
// c.Assert(rules, check.HasLen, 1)
|
|
|
|
// c.Assert(rules[0].DstPorts, check.HasLen, 1)
|
|
|
|
// c.Assert(rules[0].DstPorts[0].IP, check.Equals, "100.64.0.1/32")
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
got, _, err := GenerateFilterAndSSHRulesForTests(
|
|
|
|
pol,
|
|
|
|
node,
|
|
|
|
types.Nodes{},
|
|
|
|
[]types.User{node.User},
|
|
|
|
)
|
2024-11-22 16:54:58 +01:00
|
|
|
require.NoError(t, err)
|
2023-06-19 08:48:49 +02:00
|
|
|
|
|
|
|
want := []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"0.0.0.0/0", "::/0"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.1/32", Ports: tailcfg.PortRange{Last: 65535}},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
if diff := cmp.Diff(want, got); diff != "" {
|
|
|
|
t.Errorf(
|
|
|
|
"TestValidExpandTagOwnersInDestinations() unexpected result (-want +got):\n%s",
|
|
|
|
diff,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// tag on a host is owned by a tag owner, the tag is valid.
|
|
|
|
// an ACL rule is matching the tag to a user. It should not be valid since the
|
|
|
|
// host should be tied to the tag now.
|
|
|
|
func TestValidTagInvalidUser(t *testing.T) {
|
|
|
|
hostInfo := tailcfg.Hostinfo{
|
|
|
|
OS: "centos",
|
|
|
|
Hostname: "webserver",
|
|
|
|
RequestTags: []string{"tag:webapp"},
|
|
|
|
}
|
2024-11-24 00:13:27 +01:00
|
|
|
user := types.User{
|
|
|
|
Model: gorm.Model{ID: 1},
|
|
|
|
Name: "user1",
|
|
|
|
}
|
2023-06-19 08:48:49 +02:00
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
node := &types.Node{
|
2024-11-24 00:13:27 +01:00
|
|
|
ID: 1,
|
|
|
|
Hostname: "webserver",
|
|
|
|
IPv4: iap("100.64.0.1"),
|
|
|
|
UserID: 1,
|
|
|
|
User: user,
|
2023-06-19 08:48:49 +02:00
|
|
|
RegisterMethod: util.RegisterMethodAuthKey,
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &hostInfo,
|
2023-06-19 08:48:49 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
hostInfo2 := tailcfg.Hostinfo{
|
|
|
|
OS: "debian",
|
|
|
|
Hostname: "Hostname",
|
|
|
|
}
|
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes2 := &types.Node{
|
2024-11-24 00:13:27 +01:00
|
|
|
ID: 2,
|
|
|
|
Hostname: "user",
|
|
|
|
IPv4: iap("100.64.0.2"),
|
|
|
|
UserID: 1,
|
|
|
|
User: user,
|
2023-06-19 08:48:49 +02:00
|
|
|
RegisterMethod: util.RegisterMethodAuthKey,
|
2023-11-21 18:20:06 +01:00
|
|
|
Hostinfo: &hostInfo2,
|
2023-06-19 08:48:49 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
pol := &ACLPolicy{
|
|
|
|
TagOwners: TagOwners{"tag:webapp": []string{"user1"}},
|
|
|
|
ACLs: []ACL{
|
|
|
|
{
|
|
|
|
Action: "accept",
|
|
|
|
Sources: []string{"user1"},
|
|
|
|
Destinations: []string{"tag:webapp:80,443"},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2024-11-24 00:13:27 +01:00
|
|
|
got, _, err := GenerateFilterAndSSHRulesForTests(
|
|
|
|
pol,
|
|
|
|
node,
|
|
|
|
types.Nodes{nodes2},
|
|
|
|
[]types.User{user},
|
|
|
|
)
|
2024-11-22 16:54:58 +01:00
|
|
|
require.NoError(t, err)
|
2023-06-19 08:48:49 +02:00
|
|
|
|
|
|
|
want := []tailcfg.FilterRule{
|
|
|
|
{
|
|
|
|
SrcIPs: []string{"100.64.0.2/32"},
|
|
|
|
DstPorts: []tailcfg.NetPortRange{
|
|
|
|
{IP: "100.64.0.1/32", Ports: tailcfg.PortRange{First: 80, Last: 80}},
|
|
|
|
{IP: "100.64.0.1/32", Ports: tailcfg.PortRange{First: 443, Last: 443}},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
if diff := cmp.Diff(want, got); diff != "" {
|
|
|
|
t.Errorf("TestValidTagInvalidUser() unexpected result (-want +got):\n%s", diff)
|
|
|
|
}
|
|
|
|
}
|