policy/v2: separate exit node and 0.0.0.0/0 routes (#2578)
* policy: add tests for route auto approval Reproduce #2568 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> * policy/v2: separate exit node and 0.0.0.0/0 routes Fixes #2568 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com> --------- Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby
GitHub
parent
377b854dd8
commit
37dc0dad35
4 changed files with 873 additions and 40 deletions
809
hscontrol/policy/route_approval_test.go
Normal file
809
hscontrol/policy/route_approval_test.go
Normal file
|
|
@ -0,0 +1,809 @@
|
|||
package policy
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/netip"
|
||||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"github.com/juanfont/headscale/hscontrol/types"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
func TestNodeCanApproveRoute(t *testing.T) {
|
||||
users := []types.User{
|
||||
{Name: "user1", Model: gorm.Model{ID: 1}},
|
||||
{Name: "user2", Model: gorm.Model{ID: 2}},
|
||||
{Name: "user3", Model: gorm.Model{ID: 3}},
|
||||
}
|
||||
|
||||
// Create standard node setups used across tests
|
||||
normalNode := types.Node{
|
||||
ID: 1,
|
||||
Hostname: "user1-device",
|
||||
IPv4: ap("100.64.0.1"),
|
||||
UserID: 1,
|
||||
User: users[0],
|
||||
}
|
||||
|
||||
exitNode := types.Node{
|
||||
ID: 2,
|
||||
Hostname: "user2-device",
|
||||
IPv4: ap("100.64.0.2"),
|
||||
UserID: 2,
|
||||
User: users[1],
|
||||
}
|
||||
|
||||
taggedNode := types.Node{
|
||||
ID: 3,
|
||||
Hostname: "tagged-server",
|
||||
IPv4: ap("100.64.0.3"),
|
||||
UserID: 3,
|
||||
User: users[2],
|
||||
ForcedTags: []string{"tag:router"},
|
||||
}
|
||||
|
||||
multiTagNode := types.Node{
|
||||
ID: 4,
|
||||
Hostname: "multi-tag-node",
|
||||
IPv4: ap("100.64.0.4"),
|
||||
UserID: 2,
|
||||
User: users[1],
|
||||
ForcedTags: []string{"tag:router", "tag:server"},
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
node types.Node
|
||||
route netip.Prefix
|
||||
policy string
|
||||
canApprove bool
|
||||
skipV1 bool
|
||||
}{
|
||||
{
|
||||
name: "allow-all-routes-for-admin-user",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.0.0/16": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "deny-route-that-doesnt-match-autoApprovers",
|
||||
node: normalNode,
|
||||
route: p("10.0.0.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.0.0/16": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "user-not-in-group",
|
||||
node: exitNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.0.0/16": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "tagged-node-can-approve",
|
||||
node: taggedNode,
|
||||
route: p("10.0.0.0/8"),
|
||||
policy: `{
|
||||
"tagOwners": {
|
||||
"tag:router": ["user3@"]
|
||||
},
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/8": ["tag:router"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "multiple-routes-in-policy",
|
||||
node: normalNode,
|
||||
route: p("172.16.10.0/24"),
|
||||
policy: `{
|
||||
"tagOwners": {
|
||||
"tag:router": ["user3@"]
|
||||
},
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.0.0/16": ["group:admin"],
|
||||
"172.16.0.0/12": ["group:admin"],
|
||||
"10.0.0.0/8": ["tag:router"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "match-specific-route-within-range",
|
||||
node: normalNode,
|
||||
route: p("192.168.5.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.0.0/16": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "ip-address-within-range",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.5/32"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.1.0/24": ["group:admin"],
|
||||
"192.168.1.128/25": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "all-IPv4-routes-(0.0.0.0/0)-approval",
|
||||
node: normalNode,
|
||||
route: p("0.0.0.0/0"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"0.0.0.0/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "all-IPv4-routes-exitnode-approval",
|
||||
node: normalNode,
|
||||
route: p("0.0.0.0/0"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"exitNode": ["group:admin"]
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "all-IPv6-routes-exitnode-approval",
|
||||
node: normalNode,
|
||||
route: p("::/0"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"exitNode": ["group:admin"]
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "specific-IPv4-route-with-exitnode-only-approval",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"exitNode": ["group:admin"]
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "specific-IPv6-route-with-exitnode-only-approval",
|
||||
node: normalNode,
|
||||
route: p("fd00::/8"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"exitNode": ["group:admin"]
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "specific-IPv4-route-with-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("10.0.0.0/8"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"0.0.0.0/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "all-IPv6-routes-(::0/0)-approval",
|
||||
node: normalNode,
|
||||
route: p("::/0"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"::/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "specific-IPv6-route-with-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("fd00::/8"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"::/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "IPv6-route-with-IPv4-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("fd00::/8"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"0.0.0.0/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "IPv4-route-with-IPv6-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("10.0.0.0/8"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"::/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "both-IPv4-and-IPv6-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"0.0.0.0/0": ["group:admin"],
|
||||
"::/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "ip-address-with-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("192.168.101.5/32"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"0.0.0.0/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "specific-IPv6-host-route-with-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("2001:db8::1/128"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"::/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "multiple-groups-allowed-to-approve-same-route",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"],
|
||||
"group:netadmin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.1.0/24": ["group:admin", "group:netadmin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "overlapping-routes-with-different-groups",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"],
|
||||
"group:restricted": ["user2@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"192.168.0.0/16": ["group:restricted"],
|
||||
"192.168.1.0/24": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "unique-local-IPv6-address-with-all-routes-policy",
|
||||
node: normalNode,
|
||||
route: p("fc00::/7"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"::/0": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "exact-prefix-match-in-policy",
|
||||
node: normalNode,
|
||||
route: p("203.0.113.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"203.0.113.0/24": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "narrower-range-than-policy",
|
||||
node: normalNode,
|
||||
route: p("203.0.113.0/26"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"203.0.113.0/24": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "wider-range-than-policy-should-fail",
|
||||
node: normalNode,
|
||||
route: p("203.0.113.0/23"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"203.0.113.0/24": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "adjacent-route-to-policy-route-should-fail",
|
||||
node: normalNode,
|
||||
route: p("203.0.114.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"203.0.113.0/24": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "combined-routes-and-exitnode-approvers-specific-route",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"exitNode": ["group:admin"],
|
||||
"routes": {
|
||||
"192.168.1.0/24": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "partly-overlapping-route-with-policy-should-fail",
|
||||
node: normalNode,
|
||||
route: p("203.0.113.128/23"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"203.0.113.0/24": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "multiple-routes-with-aggregatable-ranges",
|
||||
node: normalNode,
|
||||
route: p("10.0.0.0/8"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.0.0.0/9": ["group:admin"],
|
||||
"10.128.0.0/9": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "non-standard-IPv6-notation",
|
||||
node: normalNode,
|
||||
route: p("2001:db8::1/128"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"2001:db8::/32": ["group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "node-with-multiple-tags-all-required",
|
||||
node: multiTagNode,
|
||||
route: p("10.10.0.0/16"),
|
||||
policy: `{
|
||||
"tagOwners": {
|
||||
"tag:router": ["user2@"],
|
||||
"tag:server": ["user2@"]
|
||||
},
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.10.0.0/16": ["tag:router", "tag:server"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "node-with-multiple-tags-one-matching-is-sufficient",
|
||||
node: multiTagNode,
|
||||
route: p("10.10.0.0/16"),
|
||||
policy: `{
|
||||
"tagOwners": {
|
||||
"tag:router": ["user2@"],
|
||||
"tag:server": ["user2@"]
|
||||
},
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.10.0.0/16": ["tag:router", "group:admin"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "node-with-multiple-tags-missing-required-tag",
|
||||
node: multiTagNode,
|
||||
route: p("10.10.0.0/16"),
|
||||
policy: `{
|
||||
"tagOwners": {
|
||||
"tag:othertag": ["user1@"]
|
||||
},
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.10.0.0/16": ["tag:othertag"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "node-with-tag-and-group-membership",
|
||||
node: normalNode,
|
||||
route: p("10.20.0.0/16"),
|
||||
policy: `{
|
||||
"tagOwners": {
|
||||
"tag:router": ["user3@"]
|
||||
},
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"routes": {
|
||||
"10.20.0.0/16": ["group:admin", "tag:router"]
|
||||
}
|
||||
}
|
||||
}`,
|
||||
canApprove: true,
|
||||
},
|
||||
{
|
||||
name: "small-subnet-with-exitnode-only-approval",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.1/32"),
|
||||
policy: `{
|
||||
"groups": {
|
||||
"group:admin": ["user1@"]
|
||||
},
|
||||
"acls": [
|
||||
{"action": "accept", "src": ["group:admin"], "dst": ["*:*"]}
|
||||
],
|
||||
"autoApprovers": {
|
||||
"exitNode": ["group:admin"]
|
||||
}
|
||||
}`,
|
||||
canApprove: false,
|
||||
},
|
||||
{
|
||||
name: "empty-policy",
|
||||
node: normalNode,
|
||||
route: p("192.168.1.0/24"),
|
||||
policy: `{"acls":[{"action":"accept","src":["*"],"dst":["*:*"]}]}`,
|
||||
canApprove: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Initialize all policy manager implementations
|
||||
policyManagers, err := PolicyManagersForTest([]byte(tt.policy), users, types.Nodes{&tt.node})
|
||||
if tt.name == "empty policy" {
|
||||
// We expect this one to have a valid but empty policy
|
||||
require.NoError(t, err)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
} else {
|
||||
require.NoError(t, err)
|
||||
}
|
||||
|
||||
for i, pm := range policyManagers {
|
||||
versionNum := i + 1
|
||||
if versionNum == 1 && tt.skipV1 {
|
||||
// Skip V1 policy manager for specific tests
|
||||
continue
|
||||
}
|
||||
|
||||
t.Run(fmt.Sprintf("PolicyV%d", versionNum), func(t *testing.T) {
|
||||
result := pm.NodeCanApproveRoute(&tt.node, tt.route)
|
||||
|
||||
if diff := cmp.Diff(tt.canApprove, result); diff != "" {
|
||||
t.Errorf("NodeCanApproveRoute() mismatch (-want +got):\n%s", diff)
|
||||
}
|
||||
assert.Equal(t, tt.canApprove, result, "Unexpected route approval result")
|
||||
})
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue