Mirrors/juanfont.headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2025-08-14 13:51:01 +02:00
Code Issues Projects Releases Wiki Activity

policy: fixup tests which violated tag constraing

Browse Source 
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
This commit is contained in:
Kristoffer Dalby 2025-05-09 09:42:25 +02:00
parent c8b57c441a
commit e68ffb86c9
No known key found for this signature in database
1 changed files with 30 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
hscontrol/policy/policy_test.go
View File

@ -709,6 +709,9 @@ func TestReduceFilterRules(t *testing.T) {
name: "1817-reduce-breaks-32-mask", name: "1817-reduce-breaks-32-mask",
pol: ` pol: `
{ {
"tagOwners": {
"tag:access-servers": ["user100@"],
},
"groups": { "groups": {
"group:access": [ "group:access": [
"user1@" "user1@"
@ -1688,6 +1691,9 @@ func TestSSHPolicyRules(t *testing.T) {
targetNode: taggedServer, targetNode: taggedServer,
peers: types.Nodes{&nodeUser1, &nodeUser2}, peers: types.Nodes{&nodeUser1, &nodeUser2},
policy: `{ policy: `{
"tagOwners": {
"tag:server": ["user3@"],
},
"groups": { "groups": {
"group:users": ["user1@", "user2@"] "group:users": ["user1@", "user2@"]
}, },
@ -1726,6 +1732,9 @@ func TestSSHPolicyRules(t *testing.T) {
targetNode: nodeUser1, targetNode: nodeUser1,
peers: types.Nodes{&taggedClient}, peers: types.Nodes{&taggedClient},
policy: `{ policy: `{
"tagOwners": {
"tag:client": ["user1@"],
},
"ssh": [ "ssh": [
{ {
"action": "accept", "action": "accept",
@ -1756,6 +1765,10 @@ func TestSSHPolicyRules(t *testing.T) {
targetNode: taggedServer, targetNode: taggedServer,
peers: types.Nodes{&taggedClient}, peers: types.Nodes{&taggedClient},
policy: `{ policy: `{
"tagOwners": {
"tag:client": ["user2@"],
"tag:server": ["user3@"],
},
"ssh": [ "ssh": [
{ {
"action": "accept", "action": "accept",
@ -1818,29 +1831,14 @@ func TestSSHPolicyRules(t *testing.T) {
// we skip this test for v1 and not let it hold up v2 replacing it. // we skip this test for v1 and not let it hold up v2 replacing it.
skipV1: true, skipV1: true,
}, },
{
name: "invalid-source-user-not-allowed",
targetNode: nodeUser1,
peers: types.Nodes{&nodeUser2},
policy: `{
"ssh": [
{
"action": "accept",
"src": ["user2@"],
"dst": ["user1@"],
"users": ["autogroup:nonroot"]
}
]
}`,
expectErr: true,
errorMessage: "not supported",
skipV1: true,
},
{ {
name: "check-period-specified", name: "check-period-specified",
targetNode: nodeUser1, targetNode: nodeUser1,
peers: types.Nodes{&taggedClient}, peers: types.Nodes{&taggedClient},
policy: `{ policy: `{
"tagOwners": {
"tag:client": ["user1@"],
},
"ssh": [ "ssh": [
{ {
"action": "check", "action": "check",
@ -1873,6 +1871,9 @@ func TestSSHPolicyRules(t *testing.T) {
targetNode: nodeUser2, targetNode: nodeUser2,
peers: types.Nodes{&nodeUser1}, peers: types.Nodes{&nodeUser1},
policy: `{ policy: `{
"tagOwners": {
"tag:client": ["user1@"],
},
"ssh": [ "ssh": [
{ {
"action": "accept", "action": "accept",
@ -1926,14 +1927,17 @@ func TestSSHPolicyRules(t *testing.T) {
targetNode: nodeUser1, targetNode: nodeUser1,
peers: types.Nodes{&taggedClient}, peers: types.Nodes{&taggedClient},
policy: `{ policy: `{
"ssh": [ "tagOwners": {
{ "tag:client": ["user1@"],
"action": "accept", },
"src": ["tag:client"], "ssh": [
"dst": ["user1@"], {
"users": ["alice", "bob"] "action": "accept",
} "src": ["tag:client"],
] "dst": ["user1@"],
"users": ["alice", "bob"]
}
]
}`, }`,
wantSSH: &tailcfg.SSHPolicy{Rules: []*tailcfg.SSHRule{ wantSSH: &tailcfg.SSHPolicy{Rules: []*tailcfg.SSHRule{
{ {