devproje/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2024-11-26 08:53:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

use json in TestReduceFilterRules test

Browse source 
This is to allow for the tests to be ran with
the new upcoming parser to ensure we get the
same input.

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby 2024-10-17 01:23:44 +02:00
parent 03fd7f31b4
commit 662dfbf423
No known key found for this signature in database
1 changed files with 290 additions and 203 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

379
hscontrol/policy/acls_test.go
View file

@ -2112,20 +2112,27 @@ func TestReduceFilterRules(t *testing.T) {
name string name string
node *types.Node node *types.Node
peers types.Nodes peers types.Nodes
pol ACLPolicy pol string
want []tailcfg.FilterRule want []tailcfg.FilterRule
}{ }{
{ {
name: "host1-can-reach-host2-no-rules", name: "host1-can-reach-host2-no-rules",
pol: ACLPolicy{ pol: `
ACLs: []ACL{
{ {
Action: "accept", "acls": [
Sources: []string{"100.64.0.1"}, {
Destinations: []string{"100.64.0.2:*"}, "action": "accept",
}, "proto": "",
}, "src": [
}, "100.64.0.1"
],
"dst": [
"100.64.0.2:*"
]
}
],
}
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.1"), IPv4: iap("100.64.0.1"),
IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2221"), IPv6: iap("fd7a:115c:a1e0:ab12:4843:2222:6273:2221"),
@ -2142,23 +2149,37 @@ func TestReduceFilterRules(t *testing.T) {
}, },
{ {
name: "1604-subnet-routers-are-preserved", name: "1604-subnet-routers-are-preserved",
pol: ACLPolicy{ pol: `
Groups: Groups{
"group:admins": {"user1"},
},
ACLs: []ACL{
{ {
Action: "accept", "groups": {
Sources: []string{"group:admins"}, "group:admins": [
Destinations: []string{"group:admins:*"}, "user1"
]
},
"acls": [
{
"action": "accept",
"proto": "",
"src": [
"group:admins"
],
"dst": [
"group:admins:*"
]
}, },
{ {
Action: "accept", "action": "accept",
Sources: []string{"group:admins"}, "proto": "",
Destinations: []string{"10.33.0.0/16:*"}, "src": [
}, "group:admins"
}, ],
}, "dst": [
"10.33.0.0/16:*"
]
}
],
}
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.1"), IPv4: iap("100.64.0.1"),
IPv6: iap("fd7a:115c:a1e0::1"), IPv6: iap("fd7a:115c:a1e0::1"),
@ -2213,31 +2234,42 @@ func TestReduceFilterRules(t *testing.T) {
}, },
{ {
name: "1786-reducing-breaks-exit-nodes-the-client", name: "1786-reducing-breaks-exit-nodes-the-client",
pol: ACLPolicy{ pol: `
Hosts: Hosts{
// Exit node
"internal": netip.MustParsePrefix("100.64.0.100/32"),
},
Groups: Groups{
"group:team": {"user3", "user2", "user1"},
},
ACLs: []ACL{
{ {
Action: "accept", "groups": {
Sources: []string{"group:team"}, "group:team": [
Destinations: []string{ "user3",
"internal:*", "user2",
"user1"
]
}, },
"hosts": {
"internal": "100.64.0.100/32"
},
"acls": [
{
"action": "accept",
"proto": "",
"src": [
"group:team"
],
"dst": [
"internal:*"
]
}, },
{ {
Action: "accept", "action": "accept",
Sources: []string{"group:team"}, "proto": "",
Destinations: []string{ "src": [
"autogroup:internet:*", "group:team"
}, ],
}, "dst": [
}, "autogroup:internet:*"
}, ]
}
],
}
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.1"), IPv4: iap("100.64.0.1"),
IPv6: iap("fd7a:115c:a1e0::1"), IPv6: iap("fd7a:115c:a1e0::1"),
@ -2263,31 +2295,42 @@ func TestReduceFilterRules(t *testing.T) {
}, },
{ {
name: "1786-reducing-breaks-exit-nodes-the-exit", name: "1786-reducing-breaks-exit-nodes-the-exit",
pol: ACLPolicy{ pol: `
Hosts: Hosts{
// Exit node
"internal": netip.MustParsePrefix("100.64.0.100/32"),
},
Groups: Groups{
"group:team": {"user3", "user2", "user1"},
},
ACLs: []ACL{
{ {
Action: "accept", "groups": {
Sources: []string{"group:team"}, "group:team": [
Destinations: []string{ "user3",
"internal:*", "user2",
"user1"
]
}, },
"hosts": {
"internal": "100.64.0.100/32"
},
"acls": [
{
"action": "accept",
"proto": "",
"src": [
"group:team"
],
"dst": [
"internal:*"
]
}, },
{ {
Action: "accept", "action": "accept",
Sources: []string{"group:team"}, "proto": "",
Destinations: []string{ "src": [
"autogroup:internet:*", "group:team"
}, ],
}, "dst": [
}, "autogroup:internet:*"
}, ]
}
],
}
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.100"), IPv4: iap("100.64.0.100"),
IPv6: iap("fd7a:115c:a1e0::100"), IPv6: iap("fd7a:115c:a1e0::100"),
@ -2340,26 +2383,36 @@ func TestReduceFilterRules(t *testing.T) {
}, },
{ {
name: "1786-reducing-breaks-exit-nodes-the-example-from-issue", name: "1786-reducing-breaks-exit-nodes-the-example-from-issue",
pol: ACLPolicy{ pol: `
Hosts: Hosts{
// Exit node
"internal": netip.MustParsePrefix("100.64.0.100/32"),
},
Groups: Groups{
"group:team": {"user3", "user2", "user1"},
},
ACLs: []ACL{
{ {
Action: "accept", "groups": {
Sources: []string{"group:team"}, "group:team": [
Destinations: []string{ "user3",
"internal:*", "user2",
"user1"
]
}, },
"hosts": {
"internal": "100.64.0.100/32"
},
"acls": [
{
"action": "accept",
"proto": "",
"src": [
"group:team"
],
"dst": [
"internal:*"
]
}, },
{ {
Action: "accept", "action": "accept",
Sources: []string{"group:team"}, "proto": "",
Destinations: []string{ "src": [
"group:team"
],
"dst": [
"0.0.0.0/5:*", "0.0.0.0/5:*",
"8.0.0.0/7:*", "8.0.0.0/7:*",
"11.0.0.0/8:*", "11.0.0.0/8:*",
@ -2389,11 +2442,12 @@ func TestReduceFilterRules(t *testing.T) {
"194.0.0.0/7:*", "194.0.0.0/7:*",
"196.0.0.0/6:*", "196.0.0.0/6:*",
"200.0.0.0/5:*", "200.0.0.0/5:*",
"208.0.0.0/4:*", "208.0.0.0/4:*"
}, ]
}, }
}, ],
}, }
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.100"), IPv4: iap("100.64.0.100"),
IPv6: iap("fd7a:115c:a1e0::100"), IPv6: iap("fd7a:115c:a1e0::100"),
@ -2480,32 +2534,43 @@ func TestReduceFilterRules(t *testing.T) {
}, },
{ {
name: "1786-reducing-breaks-exit-nodes-app-connector-like", name: "1786-reducing-breaks-exit-nodes-app-connector-like",
pol: ACLPolicy{ pol: `
Hosts: Hosts{
// Exit node
"internal": netip.MustParsePrefix("100.64.0.100/32"),
},
Groups: Groups{
"group:team": {"user3", "user2", "user1"},
},
ACLs: []ACL{
{ {
Action: "accept", "groups": {
Sources: []string{"group:team"}, "group:team": [
Destinations: []string{ "user3",
"internal:*", "user2",
"user1"
]
}, },
"hosts": {
"internal": "100.64.0.100/32"
},
"acls": [
{
"action": "accept",
"proto": "",
"src": [
"group:team"
],
"dst": [
"internal:*"
]
}, },
{ {
Action: "accept", "action": "accept",
Sources: []string{"group:team"}, "proto": "",
Destinations: []string{ "src": [
"group:team"
],
"dst": [
"8.0.0.0/8:*", "8.0.0.0/8:*",
"16.0.0.0/8:*", "16.0.0.0/8:*"
}, ]
}, }
}, ],
}, }
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.100"), IPv4: iap("100.64.0.100"),
IPv6: iap("fd7a:115c:a1e0::100"), IPv6: iap("fd7a:115c:a1e0::100"),
@ -2570,32 +2635,43 @@ func TestReduceFilterRules(t *testing.T) {
}, },
{ {
name: "1786-reducing-breaks-exit-nodes-app-connector-like2", name: "1786-reducing-breaks-exit-nodes-app-connector-like2",
pol: ACLPolicy{ pol: `
Hosts: Hosts{
// Exit node
"internal": netip.MustParsePrefix("100.64.0.100/32"),
},
Groups: Groups{
"group:team": {"user3", "user2", "user1"},
},
ACLs: []ACL{
{ {
Action: "accept", "groups": {
Sources: []string{"group:team"}, "group:team": [
Destinations: []string{ "user3",
"internal:*", "user2",
"user1"
]
}, },
"hosts": {
"internal": "100.64.0.100/32"
},
"acls": [
{
"action": "accept",
"proto": "",
"src": [
"group:team"
],
"dst": [
"internal:*"
]
}, },
{ {
Action: "accept", "action": "accept",
Sources: []string{"group:team"}, "proto": "",
Destinations: []string{ "src": [
"group:team"
],
"dst": [
"8.0.0.0/16:*", "8.0.0.0/16:*",
"16.0.0.0/16:*", "16.0.0.0/16:*"
}, ]
}, }
}, ],
}, }
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.100"), IPv4: iap("100.64.0.100"),
IPv6: iap("fd7a:115c:a1e0::100"), IPv6: iap("fd7a:115c:a1e0::100"),
@ -2660,25 +2736,32 @@ func TestReduceFilterRules(t *testing.T) {
}, },
{ {
name: "1817-reduce-breaks-32-mask", name: "1817-reduce-breaks-32-mask",
pol: ACLPolicy{ pol: `
Hosts: Hosts{
"vlan1": netip.MustParsePrefix("172.16.0.0/24"),
"dns1": netip.MustParsePrefix("172.16.0.21/32"),
},
Groups: Groups{
"group:access": {"user1"},
},
ACLs: []ACL{
{ {
Action: "accept", "groups": {
Sources: []string{"group:access"}, "group:access": [
Destinations: []string{ "user1"
]
},
"hosts": {
"dns1": "172.16.0.21/32",
"vlan1": "172.16.0.0/24"
},
"acls": [
{
"action": "accept",
"proto": "",
"src": [
"group:access"
],
"dst": [
"tag:access-servers:*", "tag:access-servers:*",
"dns1:*", "dns1:*"
}, ]
}, }
}, ],
}, }
`,
node: &types.Node{ node: &types.Node{
IPv4: iap("100.64.0.100"), IPv4: iap("100.64.0.100"),
IPv6: iap("fd7a:115c:a1e0::100"), IPv6: iap("fd7a:115c:a1e0::100"),
@ -2719,7 +2802,11 @@ func TestReduceFilterRules(t *testing.T) {
for _, tt := range tests { for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) { t.Run(tt.name, func(t *testing.T) {
got, _ := tt.pol.CompileFilterRules( pol, err := LoadACLPolicyFromBytes([]byte(tt.pol))
if err != nil {
t.Fatalf("parsing policy: %s", err)
}
got, _ := pol.CompileFilterRules(
users, users,
append(tt.peers, tt.node), append(tt.peers, tt.node),
) )