Mirrors/juanfont.headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2025-09-25 17:51:11 +02:00
Code Issues Projects Releases Wiki Activity

policy: add tests for invalid fields

Browse Source 
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby 2025-09-10 11:01:49 +02:00
parent ccc9b68d93
commit 462ef80f42
No known key found for this signature in database
1 changed files with 102 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

102
hscontrol/policy/v2/types_test.go
View File

@ -1014,6 +1014,108 @@ func TestUnmarshalPolicy(t *testing.T) {
`,
wantErr: `unknown field "BAD"`,
},
{
name: "disallow-unsupported-fields-groups-level",
input: `
{
"groups": {
"group:test": ["user@example.com"],
"INVALID_GROUP_FIELD": "should fail"
}
}
`,
wantErr: `cannot unmarshal JSON string into Go []string`,
},
{
name: "disallow-unsupported-fields-hosts-level",
input: `
{
"hosts": {
"host1": "10.0.0.1",
"INVALID_HOST_FIELD": "should fail"
}
}
`,
wantErr: `Hostname "INVALID_HOST_FIELD" contains an invalid IP address: "should fail"`,
},
{
name: "disallow-unsupported-fields-tagowners-level",
input: `
{
"tagOwners": {
"tag:test": ["user@example.com"],
"INVALID_TAG_FIELD": "should fail"
}
}
`,
wantErr: `tag has to start with "tag:", got: "INVALID_TAG_FIELD"`,
},
{
name: "disallow-unsupported-fields-acls-level",
input: `
{
"acls": [
{
"action": "accept",
"proto": "tcp",
"src": ["*"],
"dst": ["*:*"],
"INVALID_ACL_FIELD": "should fail"
}
]
}
`,
wantErr: `unknown field "INVALID_ACL_FIELD"`,
},
{
name: "disallow-unsupported-fields-ssh-level",
input: `
{
"ssh": [
{
"action": "accept",
"src": ["user@example.com"],
"dst": ["user@example.com"],
"users": ["root"],
"INVALID_SSH_FIELD": "should fail"
}
]
}
`,
wantErr: `unknown field "INVALID_SSH_FIELD"`,
},
{
name: "disallow-unsupported-fields-policy-level",
input: `
{
"acls": [
{
"action": "accept",
"proto": "tcp",
"src": ["*"],
"dst": ["*:*"]
}
],
"INVALID_POLICY_FIELD": "should fail at policy level"
}
`,
wantErr: `unknown field "INVALID_POLICY_FIELD"`,
},
{
name: "disallow-unsupported-fields-autoapprovers-level",
input: `
{
"autoApprovers": {
"routes": {
"10.0.0.0/8": ["user@example.com"]
},
"exitNode": ["user@example.com"],
"INVALID_AUTO_APPROVER_FIELD": "should fail"
}
}
`,
wantErr: `unknown field "INVALID_AUTO_APPROVER_FIELD"`,
},
// headscale-admin uses # in some field names to add metadata, so we will ignore
// those to ensure it doesnt break.
// https://github.com/GoodiesHQ/headscale-admin/blob/214a44a9c15c92d2b42383f131b51df10c84017c/src/lib/common/acl.svelte.ts#L38