mirror of
https://github.com/juanfont/headscale.git
synced 2026-04-24 17:48:49 +02:00
tags: process tags on registration, simplify policy (#2931)
This PR investigates, adds tests and aims to correctly implement Tailscale's model for how Tags should be accepted, assigned and used to identify nodes in the Tailscale access and ownership model. When evaluating in Headscale's policy, Tags are now only checked against a nodes "tags" list, which defines the source of truth for all tags for a given node. This simplifies the code for dealing with tags greatly, and should help us have less access bugs related to nodes belonging to tags or users. A node can either be owned by a user, or a tag. Next, to ensure the tags list on the node is correctly implemented, we first add tests for every registration scenario and combination of user, pre auth key and pre auth key with tags with the same registration expectation as observed by trying them all with the Tailscale control server. This should ensure that we implement the correct behaviour and that it does not change or break over time. Lastly, the missing parts of the auth has been added, or changed in the cases where it was wrong. This has in large parts allowed us to delete and simplify a lot of code. Now, tags can only be changed when a node authenticates or if set via the CLI/API. Tags can only be fully overwritten/replaced and any use of either auth or CLI will replace the current set if different. A user owned device can be converted to a tagged device, but it cannot be changed back. A tagged device can never remove the last tag either, it has to have a minimum of one.
This commit is contained in:
Kristoffer Dalby
@@ -26,6 +26,9 @@ type PolicyManager interface {
|
||||
// NodeCanHaveTag reports whether the given node can have the given tag.
|
||||
NodeCanHaveTag(types.NodeView, string) bool
|
||||
|
||||
// TagExists reports whether the given tag is defined in the policy.
|
||||
TagExists(tag string) bool
|
||||
|
||||
// NodeCanApproveRoute reports whether the given node can approve the given route.
|
||||
NodeCanApproveRoute(types.NodeView, netip.Prefix) bool
|
||||
|
||||
|
||||
@@ -1,7 +1,9 @@
|
||||
package v2
|
||||
|
||||
import (
|
||||
"cmp"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/netip"
|
||||
"slices"
|
||||
@@ -19,6 +21,9 @@ import (
|
||||
"tailscale.com/util/deephash"
|
||||
)
|
||||
|
||||
// ErrInvalidTagOwner is returned when a tag owner is not an Alias type.
|
||||
var ErrInvalidTagOwner = errors.New("tag owner is not an Alias")
|
||||
|
||||
type PolicyManager struct {
|
||||
mu sync.Mutex
|
||||
pol *Policy
|
||||
@@ -536,23 +541,108 @@ func (pm *PolicyManager) SetNodes(nodes views.Slice[types.NodeView]) (bool, erro
|
||||
return false, nil
|
||||
}
|
||||
|
||||
// NodeCanHaveTag checks if a node can have the specified tag during client-initiated
|
||||
// registration or reauth flows (e.g., tailscale up --advertise-tags).
|
||||
//
|
||||
// This function is NOT used by the admin API's SetNodeTags - admins can set any
|
||||
// existing tag on any node by calling State.SetNodeTags directly, which bypasses
|
||||
// this authorization check.
|
||||
func (pm *PolicyManager) NodeCanHaveTag(node types.NodeView, tag string) bool {
|
||||
if pm == nil {
|
||||
if pm == nil || pm.pol == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
pm.mu.Lock()
|
||||
defer pm.mu.Unlock()
|
||||
|
||||
// Check if tag exists in policy
|
||||
owners, exists := pm.pol.TagOwners[Tag(tag)]
|
||||
if !exists {
|
||||
return false
|
||||
}
|
||||
|
||||
// Check if node's owner can assign this tag via the pre-resolved tagOwnerMap.
|
||||
// The tagOwnerMap contains IP sets built from resolving TagOwners entries
|
||||
// (usernames/groups) to their nodes' IPs, so checking if the node's IP
|
||||
// is in the set answers "does this node's owner own this tag?"
|
||||
if ips, ok := pm.tagOwnerMap[Tag(tag)]; ok {
|
||||
if slices.ContainsFunc(node.IPs(), ips.Contains) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
// For new nodes being registered, their IP may not yet be in the tagOwnerMap.
|
||||
// Fall back to checking the node's user directly against the TagOwners.
|
||||
// This handles the case where a user registers a new node with --advertise-tags.
|
||||
if node.User().Valid() {
|
||||
for _, owner := range owners {
|
||||
if pm.userMatchesOwner(node.User(), owner) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// userMatchesOwner checks if a user matches a tag owner entry.
|
||||
// This is used as a fallback when the node's IP is not in the tagOwnerMap.
|
||||
func (pm *PolicyManager) userMatchesOwner(user types.UserView, owner Owner) bool {
|
||||
switch o := owner.(type) {
|
||||
case *Username:
|
||||
if o == nil {
|
||||
return false
|
||||
}
|
||||
// Resolve the username to find the user it refers to
|
||||
resolvedUser, err := o.resolveUser(pm.users)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
|
||||
return user.ID() == resolvedUser.ID
|
||||
|
||||
case *Group:
|
||||
if o == nil || pm.pol == nil {
|
||||
return false
|
||||
}
|
||||
// Resolve the group to get usernames
|
||||
usernames, ok := pm.pol.Groups[*o]
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
// Check if the user matches any username in the group
|
||||
for _, uname := range usernames {
|
||||
resolvedUser, err := uname.resolveUser(pm.users)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
|
||||
if user.ID() == resolvedUser.ID {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// TagExists reports whether the given tag is defined in the policy.
|
||||
func (pm *PolicyManager) TagExists(tag string) bool {
|
||||
if pm == nil || pm.pol == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
pm.mu.Lock()
|
||||
defer pm.mu.Unlock()
|
||||
|
||||
_, exists := pm.pol.TagOwners[Tag(tag)]
|
||||
|
||||
return exists
|
||||
}
|
||||
|
||||
func (pm *PolicyManager) NodeCanApproveRoute(node types.NodeView, route netip.Prefix) bool {
|
||||
if pm == nil {
|
||||
return false
|
||||
@@ -834,3 +924,126 @@ func (pm *PolicyManager) invalidateGlobalPolicyCache(newNodes views.Slice[types.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// flattenTags flattens the TagOwners by resolving nested tags and detecting cycles.
|
||||
// It will return a Owners list where all the Tag types have been resolved to their underlying Owners.
|
||||
func flattenTags(tagOwners TagOwners, tag Tag, visiting map[Tag]bool, chain []Tag) (Owners, error) {
|
||||
if visiting[tag] {
|
||||
cycleStart := 0
|
||||
|
||||
for i, t := range chain {
|
||||
if t == tag {
|
||||
cycleStart = i
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
cycleTags := make([]string, len(chain[cycleStart:]))
|
||||
for i, t := range chain[cycleStart:] {
|
||||
cycleTags[i] = string(t)
|
||||
}
|
||||
|
||||
slices.Sort(cycleTags)
|
||||
|
||||
return nil, fmt.Errorf("%w: %s", ErrCircularReference, strings.Join(cycleTags, " -> "))
|
||||
}
|
||||
|
||||
visiting[tag] = true
|
||||
|
||||
chain = append(chain, tag)
|
||||
defer delete(visiting, tag)
|
||||
|
||||
var result Owners
|
||||
|
||||
for _, owner := range tagOwners[tag] {
|
||||
switch o := owner.(type) {
|
||||
case *Tag:
|
||||
if _, ok := tagOwners[*o]; !ok {
|
||||
return nil, fmt.Errorf("tag %q %w %q", tag, ErrUndefinedTagReference, *o)
|
||||
}
|
||||
|
||||
nested, err := flattenTags(tagOwners, *o, visiting, chain)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
result = append(result, nested...)
|
||||
default:
|
||||
result = append(result, owner)
|
||||
}
|
||||
}
|
||||
|
||||
return result, nil
|
||||
}
|
||||
|
||||
// flattenTagOwners flattens all TagOwners by resolving nested tags and detecting cycles.
|
||||
// It will return a new TagOwners map where all the Tag types have been resolved to their underlying Owners.
|
||||
func flattenTagOwners(tagOwners TagOwners) (TagOwners, error) {
|
||||
ret := make(TagOwners)
|
||||
|
||||
for tag := range tagOwners {
|
||||
flattened, err := flattenTags(tagOwners, tag, make(map[Tag]bool), nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
slices.SortFunc(flattened, func(a, b Owner) int {
|
||||
return cmp.Compare(a.String(), b.String())
|
||||
})
|
||||
ret[tag] = slices.CompactFunc(flattened, func(a, b Owner) bool {
|
||||
return a.String() == b.String()
|
||||
})
|
||||
}
|
||||
|
||||
return ret, nil
|
||||
}
|
||||
|
||||
// resolveTagOwners resolves the TagOwners to a map of Tag to netipx.IPSet.
|
||||
// The resulting map can be used to quickly look up the IPSet for a given Tag.
|
||||
// It is intended for internal use in a PolicyManager.
|
||||
func resolveTagOwners(p *Policy, users types.Users, nodes views.Slice[types.NodeView]) (map[Tag]*netipx.IPSet, error) {
|
||||
if p == nil {
|
||||
return make(map[Tag]*netipx.IPSet), nil
|
||||
}
|
||||
|
||||
if len(p.TagOwners) == 0 {
|
||||
return make(map[Tag]*netipx.IPSet), nil
|
||||
}
|
||||
|
||||
ret := make(map[Tag]*netipx.IPSet)
|
||||
|
||||
tagOwners, err := flattenTagOwners(p.TagOwners)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for tag, owners := range tagOwners {
|
||||
var ips netipx.IPSetBuilder
|
||||
|
||||
for _, owner := range owners {
|
||||
switch o := owner.(type) {
|
||||
case *Tag:
|
||||
// After flattening, Tag types should not appear in the owners list.
|
||||
// If they do, skip them as they represent already-resolved references.
|
||||
|
||||
case Alias:
|
||||
// If it does not resolve, that means the tag is not associated with any IP addresses.
|
||||
resolved, _ := o.Resolve(p, users, nodes)
|
||||
ips.AddSet(resolved)
|
||||
|
||||
default:
|
||||
// Should never happen - after flattening, all owners should be Alias types
|
||||
return nil, fmt.Errorf("%w: %v", ErrInvalidTagOwner, owner)
|
||||
}
|
||||
}
|
||||
|
||||
ipSet, err := ips.IPSet()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
ret[tag] = ipSet
|
||||
}
|
||||
|
||||
return ret, nil
|
||||
}
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package v2
|
||||
|
||||
import (
|
||||
"cmp"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/netip"
|
||||
@@ -307,35 +306,11 @@ func (t *Tag) UnmarshalJSON(b []byte) error {
|
||||
func (t Tag) Resolve(p *Policy, users types.Users, nodes views.Slice[types.NodeView]) (*netipx.IPSet, error) {
|
||||
var ips netipx.IPSetBuilder
|
||||
|
||||
// TODO(kradalby): This is currently resolved twice, and should be resolved once.
|
||||
// It is added temporary until we sort out the story on how and when we resolve tags
|
||||
// from the three places they can be "approved":
|
||||
// - As part of a PreAuthKey (handled in HasTag)
|
||||
// - As part of ForcedTags (set via CLI) (handled in HasTag)
|
||||
// - As part of HostInfo.RequestTags and approved by policy (this is happening here)
|
||||
// Part of #2417
|
||||
tagMap, err := resolveTagOwners(p, users, nodes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for _, node := range nodes.All() {
|
||||
// Check if node has this tag
|
||||
if node.HasTag(string(t)) {
|
||||
node.AppendToIPSet(&ips)
|
||||
}
|
||||
|
||||
// TODO(kradalby): remove as part of #2417, see comment above
|
||||
if tagMap != nil {
|
||||
if tagips, ok := tagMap[t]; ok && node.InIPSet(tagips) && node.Hostinfo().Valid() {
|
||||
for _, tag := range node.RequestTagsSlice().All() {
|
||||
if tag == string(t) {
|
||||
node.AppendToIPSet(&ips)
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return ips.IPSet()
|
||||
@@ -545,61 +520,26 @@ func (ag AutoGroup) Resolve(p *Policy, users types.Users, nodes views.Slice[type
|
||||
return util.TheInternet(), nil
|
||||
|
||||
case AutoGroupMember:
|
||||
// autogroup:member represents all untagged devices in the tailnet.
|
||||
tagMap, err := resolveTagOwners(p, users, nodes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for _, node := range nodes.All() {
|
||||
// Skip if node is tagged
|
||||
if node.IsTagged() {
|
||||
continue
|
||||
}
|
||||
|
||||
// Skip if node has any allowed requested tags
|
||||
hasAllowedTag := false
|
||||
if node.RequestTagsSlice().Len() != 0 {
|
||||
for _, tag := range node.RequestTagsSlice().All() {
|
||||
if _, ok := tagMap[Tag(tag)]; ok {
|
||||
hasAllowedTag = true
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
if hasAllowedTag {
|
||||
continue
|
||||
}
|
||||
|
||||
// Node is a member if it has no forced tags and no allowed requested tags
|
||||
// Node is a member if it is not tagged
|
||||
node.AppendToIPSet(&build)
|
||||
}
|
||||
|
||||
return build.IPSet()
|
||||
|
||||
case AutoGroupTagged:
|
||||
// autogroup:tagged represents all devices with a tag in the tailnet.
|
||||
tagMap, err := resolveTagOwners(p, users, nodes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for _, node := range nodes.All() {
|
||||
// Include if node is tagged
|
||||
if node.IsTagged() {
|
||||
node.AppendToIPSet(&build)
|
||||
if !node.IsTagged() {
|
||||
continue
|
||||
}
|
||||
|
||||
// Include if node has any allowed requested tags
|
||||
if node.RequestTagsSlice().Len() != 0 {
|
||||
for _, tag := range node.RequestTagsSlice().All() {
|
||||
if _, ok := tagMap[Tag(tag)]; ok {
|
||||
node.AppendToIPSet(&build)
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
node.AppendToIPSet(&build)
|
||||
}
|
||||
|
||||
return build.IPSet()
|
||||
@@ -1177,129 +1117,6 @@ func (to TagOwners) Contains(tagOwner *Tag) error {
|
||||
return fmt.Errorf(`Tag %q is not defined in the Policy, please define or remove the reference to it`, tagOwner)
|
||||
}
|
||||
|
||||
// resolveTagOwners resolves the TagOwners to a map of Tag to netipx.IPSet.
|
||||
// The resulting map can be used to quickly look up the IPSet for a given Tag.
|
||||
// It is intended for internal use in a PolicyManager.
|
||||
func resolveTagOwners(p *Policy, users types.Users, nodes views.Slice[types.NodeView]) (map[Tag]*netipx.IPSet, error) {
|
||||
if p == nil {
|
||||
return make(map[Tag]*netipx.IPSet), nil
|
||||
}
|
||||
|
||||
if len(p.TagOwners) == 0 {
|
||||
return make(map[Tag]*netipx.IPSet), nil
|
||||
}
|
||||
|
||||
ret := make(map[Tag]*netipx.IPSet)
|
||||
|
||||
tagOwners, err := flattenTagOwners(p.TagOwners)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for tag, owners := range tagOwners {
|
||||
var ips netipx.IPSetBuilder
|
||||
|
||||
for _, owner := range owners {
|
||||
switch o := owner.(type) {
|
||||
case *Tag:
|
||||
// After flattening, Tag types should not appear in the owners list.
|
||||
// If they do, skip them as they represent already-resolved references.
|
||||
|
||||
case Alias:
|
||||
// If it does not resolve, that means the tag is not associated with any IP addresses.
|
||||
resolved, _ := o.Resolve(p, users, nodes)
|
||||
ips.AddSet(resolved)
|
||||
|
||||
default:
|
||||
// Should never happen
|
||||
return nil, fmt.Errorf("owner %v is not an Alias", owner)
|
||||
}
|
||||
}
|
||||
|
||||
ipSet, err := ips.IPSet()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
ret[tag] = ipSet
|
||||
}
|
||||
|
||||
return ret, nil
|
||||
}
|
||||
|
||||
// flattenTags flattens the TagOwners by resolving nested tags and detecting cycles.
|
||||
// It will return a Owners list where all the Tag types have been resolved to their underlying Owners.
|
||||
func flattenTags(tagOwners TagOwners, tag Tag, visiting map[Tag]bool, chain []Tag) (Owners, error) {
|
||||
if visiting[tag] {
|
||||
cycleStart := 0
|
||||
|
||||
for i, t := range chain {
|
||||
if t == tag {
|
||||
cycleStart = i
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
cycleTags := make([]string, len(chain[cycleStart:]))
|
||||
for i, t := range chain[cycleStart:] {
|
||||
cycleTags[i] = string(t)
|
||||
}
|
||||
|
||||
slices.Sort(cycleTags)
|
||||
|
||||
return nil, fmt.Errorf("%w: %s", ErrCircularReference, strings.Join(cycleTags, " -> "))
|
||||
}
|
||||
|
||||
visiting[tag] = true
|
||||
|
||||
chain = append(chain, tag)
|
||||
defer delete(visiting, tag)
|
||||
|
||||
var result Owners
|
||||
|
||||
for _, owner := range tagOwners[tag] {
|
||||
switch o := owner.(type) {
|
||||
case *Tag:
|
||||
if _, ok := tagOwners[*o]; !ok {
|
||||
return nil, fmt.Errorf("tag %q %w %q", tag, ErrUndefinedTagReference, *o)
|
||||
}
|
||||
|
||||
nested, err := flattenTags(tagOwners, *o, visiting, chain)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
result = append(result, nested...)
|
||||
default:
|
||||
result = append(result, owner)
|
||||
}
|
||||
}
|
||||
|
||||
return result, nil
|
||||
}
|
||||
|
||||
// flattenTagOwners flattens all TagOwners by resolving nested tags and detecting cycles.
|
||||
// It will return a new TagOwners map where all the Tag types have been resolved to their underlying Owners.
|
||||
func flattenTagOwners(tagOwners TagOwners) (TagOwners, error) {
|
||||
ret := make(TagOwners)
|
||||
|
||||
for tag := range tagOwners {
|
||||
flattened, err := flattenTags(tagOwners, tag, make(map[Tag]bool), nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
slices.SortFunc(flattened, func(a, b Owner) int {
|
||||
return cmp.Compare(a.String(), b.String())
|
||||
})
|
||||
ret[tag] = slices.CompactFunc(flattened, func(a, b Owner) bool {
|
||||
return a.String() == b.String()
|
||||
})
|
||||
}
|
||||
|
||||
return ret, nil
|
||||
}
|
||||
|
||||
type AutoApproverPolicy struct {
|
||||
Routes map[netip.Prefix]AutoApprovers `json:"routes,omitempty"`
|
||||
ExitNode AutoApprovers `json:"exitNode,omitempty"`
|
||||
|
||||
@@ -1862,124 +1862,108 @@ func TestResolvePolicy(t *testing.T) {
|
||||
name: "autogroup-member-comprehensive",
|
||||
toResolve: ptr.To(AutoGroup(AutoGroupMember)),
|
||||
nodes: types.Nodes{
|
||||
// Node with no tags (should be included)
|
||||
// Node with no tags (should be included - is a member)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
IPv4: ap("100.100.101.1"),
|
||||
},
|
||||
// Node with forced tags (should be excluded)
|
||||
// Node with single tag (should be excluded - tagged nodes are not members)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Tags: []string{"tag:test"},
|
||||
IPv4: ap("100.100.101.2"),
|
||||
},
|
||||
// Node with allowed requested tag (should be excluded)
|
||||
// Node with multiple tags, all defined in policy (should be excluded)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:test"},
|
||||
},
|
||||
Tags: []string{"tag:test", "tag:other"},
|
||||
IPv4: ap("100.100.101.3"),
|
||||
},
|
||||
// Node with non-allowed requested tag (should be included)
|
||||
// Node with tag not defined in policy (should be excluded - still tagged)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:notallowed"},
|
||||
},
|
||||
Tags: []string{"tag:undefined"},
|
||||
IPv4: ap("100.100.101.4"),
|
||||
},
|
||||
// Node with multiple requested tags, one allowed (should be excluded)
|
||||
// Node with mixed tags - some defined, some not (should be excluded)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:test", "tag:notallowed"},
|
||||
},
|
||||
Tags: []string{"tag:test", "tag:undefined"},
|
||||
IPv4: ap("100.100.101.5"),
|
||||
},
|
||||
// Node with multiple requested tags, none allowed (should be included)
|
||||
// Another untagged node from different user (should be included)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:notallowed1", "tag:notallowed2"},
|
||||
},
|
||||
User: ptr.To(testuser2),
|
||||
IPv4: ap("100.100.101.6"),
|
||||
},
|
||||
},
|
||||
pol: &Policy{
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:test"): Owners{ptr.To(Username("testuser@"))},
|
||||
Tag("tag:test"): Owners{ptr.To(Username("testuser@"))},
|
||||
Tag("tag:other"): Owners{ptr.To(Username("testuser@"))},
|
||||
},
|
||||
},
|
||||
want: []netip.Prefix{
|
||||
mp("100.100.101.1/32"), // No tags
|
||||
mp("100.100.101.4/32"), // Non-allowed requested tag
|
||||
mp("100.100.101.6/32"), // Multiple non-allowed requested tags
|
||||
mp("100.100.101.1/32"), // No tags - is a member
|
||||
mp("100.100.101.6/32"), // No tags, different user - is a member
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "autogroup-tagged",
|
||||
toResolve: ptr.To(AutoGroup(AutoGroupTagged)),
|
||||
nodes: types.Nodes{
|
||||
// Node with no tags (should be excluded)
|
||||
// Node with no tags (should be excluded - not tagged)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
IPv4: ap("100.100.101.1"),
|
||||
},
|
||||
// Node with forced tag (should be included)
|
||||
// Node with single tag defined in policy (should be included)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Tags: []string{"tag:test"},
|
||||
IPv4: ap("100.100.101.2"),
|
||||
},
|
||||
// Node with allowed requested tag (should be included)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:test"},
|
||||
},
|
||||
IPv4: ap("100.100.101.3"),
|
||||
},
|
||||
// Node with non-allowed requested tag (should be excluded)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:notallowed"},
|
||||
},
|
||||
IPv4: ap("100.100.101.4"),
|
||||
},
|
||||
// Node with multiple requested tags, one allowed (should be included)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:test", "tag:notallowed"},
|
||||
},
|
||||
IPv4: ap("100.100.101.5"),
|
||||
},
|
||||
// Node with multiple requested tags, none allowed (should be excluded)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:notallowed1", "tag:notallowed2"},
|
||||
},
|
||||
IPv4: ap("100.100.101.6"),
|
||||
},
|
||||
// Node with multiple forced tags (should be included)
|
||||
// Node with multiple tags, all defined in policy (should be included)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Tags: []string{"tag:test", "tag:other"},
|
||||
IPv4: ap("100.100.101.3"),
|
||||
},
|
||||
// Node with tag not defined in policy (should be included - still tagged)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Tags: []string{"tag:undefined"},
|
||||
IPv4: ap("100.100.101.4"),
|
||||
},
|
||||
// Node with mixed tags - some defined, some not (should be included)
|
||||
{
|
||||
User: ptr.To(testuser),
|
||||
Tags: []string{"tag:test", "tag:undefined"},
|
||||
IPv4: ap("100.100.101.5"),
|
||||
},
|
||||
// Another untagged node from different user (should be excluded)
|
||||
{
|
||||
User: ptr.To(testuser2),
|
||||
IPv4: ap("100.100.101.6"),
|
||||
},
|
||||
// Tagged node from different user (should be included)
|
||||
{
|
||||
User: ptr.To(testuser2),
|
||||
Tags: []string{"tag:server"},
|
||||
IPv4: ap("100.100.101.7"),
|
||||
},
|
||||
},
|
||||
pol: &Policy{
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:test"): Owners{ptr.To(Username("testuser@"))},
|
||||
Tag("tag:test"): Owners{ptr.To(Username("testuser@"))},
|
||||
Tag("tag:other"): Owners{ptr.To(Username("testuser@"))},
|
||||
Tag("tag:server"): Owners{ptr.To(Username("testuser2@"))},
|
||||
},
|
||||
},
|
||||
want: []netip.Prefix{
|
||||
mp("100.100.101.2/31"), // Forced tag and allowed requested tag consecutive IPs are put in 31 prefix
|
||||
mp("100.100.101.5/32"), // Multiple requested tags, one allowed
|
||||
mp("100.100.101.7/32"), // Multiple forced tags
|
||||
mp("100.100.101.2/31"), // .2, .3 consecutive tagged nodes
|
||||
mp("100.100.101.4/31"), // .4, .5 consecutive tagged nodes
|
||||
mp("100.100.101.7/32"), // Tagged node from different user
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -2001,9 +1985,7 @@ func TestResolvePolicy(t *testing.T) {
|
||||
},
|
||||
{
|
||||
User: ptr.To(testuser2),
|
||||
Hostinfo: &tailcfg.Hostinfo{
|
||||
RequestTags: []string{"tag:test"},
|
||||
},
|
||||
Tags: []string{"tag:test"},
|
||||
IPv4: ap("100.100.101.4"),
|
||||
},
|
||||
},
|
||||
@@ -2738,6 +2720,127 @@ func TestNodeCanHaveTag(t *testing.T) {
|
||||
tag: "tag:dev", // This tag is not defined in tagOwners
|
||||
want: false,
|
||||
},
|
||||
// Test cases for nodes without IPs (new registration scenario)
|
||||
// These test the user-based fallback in NodeCanHaveTag
|
||||
{
|
||||
name: "node-without-ip-user-owns-tag",
|
||||
policy: &Policy{
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:test"): Owners{ptr.To(Username("user1@"))},
|
||||
},
|
||||
},
|
||||
node: &types.Node{
|
||||
// No IPv4 or IPv6 - simulates new node registration
|
||||
User: &users[0],
|
||||
UserID: ptr.To(users[0].ID),
|
||||
},
|
||||
tag: "tag:test",
|
||||
want: true, // Should succeed via user-based fallback
|
||||
},
|
||||
{
|
||||
name: "node-without-ip-user-does-not-own-tag",
|
||||
policy: &Policy{
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:test"): Owners{ptr.To(Username("user2@"))},
|
||||
},
|
||||
},
|
||||
node: &types.Node{
|
||||
// No IPv4 or IPv6 - simulates new node registration
|
||||
User: &users[0], // user1, but tag owned by user2
|
||||
UserID: ptr.To(users[0].ID),
|
||||
},
|
||||
tag: "tag:test",
|
||||
want: false, // user1 does not own tag:test
|
||||
},
|
||||
{
|
||||
name: "node-without-ip-group-owns-tag",
|
||||
policy: &Policy{
|
||||
Groups: Groups{
|
||||
"group:admins": Usernames{"user1@", "user2@"},
|
||||
},
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:admin"): Owners{ptr.To(Group("group:admins"))},
|
||||
},
|
||||
},
|
||||
node: &types.Node{
|
||||
// No IPv4 or IPv6 - simulates new node registration
|
||||
User: &users[1], // user2 is in group:admins
|
||||
UserID: ptr.To(users[1].ID),
|
||||
},
|
||||
tag: "tag:admin",
|
||||
want: true, // Should succeed via group membership
|
||||
},
|
||||
{
|
||||
name: "node-without-ip-not-in-group",
|
||||
policy: &Policy{
|
||||
Groups: Groups{
|
||||
"group:admins": Usernames{"user1@"},
|
||||
},
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:admin"): Owners{ptr.To(Group("group:admins"))},
|
||||
},
|
||||
},
|
||||
node: &types.Node{
|
||||
// No IPv4 or IPv6 - simulates new node registration
|
||||
User: &users[1], // user2 is NOT in group:admins
|
||||
UserID: ptr.To(users[1].ID),
|
||||
},
|
||||
tag: "tag:admin",
|
||||
want: false, // user2 is not in group:admins
|
||||
},
|
||||
{
|
||||
name: "node-without-ip-no-user",
|
||||
policy: &Policy{
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:test"): Owners{ptr.To(Username("user1@"))},
|
||||
},
|
||||
},
|
||||
node: &types.Node{
|
||||
// No IPv4, IPv6, or User - edge case
|
||||
},
|
||||
tag: "tag:test",
|
||||
want: false, // No user means can't authorize via user-based fallback
|
||||
},
|
||||
{
|
||||
name: "node-without-ip-mixed-owners-user-match",
|
||||
policy: &Policy{
|
||||
Groups: Groups{
|
||||
"group:ops": Usernames{"user3@"},
|
||||
},
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:server"): Owners{
|
||||
ptr.To(Username("user1@")),
|
||||
ptr.To(Group("group:ops")),
|
||||
},
|
||||
},
|
||||
},
|
||||
node: &types.Node{
|
||||
User: &users[0], // user1 directly owns the tag
|
||||
UserID: ptr.To(users[0].ID),
|
||||
},
|
||||
tag: "tag:server",
|
||||
want: true,
|
||||
},
|
||||
{
|
||||
name: "node-without-ip-mixed-owners-group-match",
|
||||
policy: &Policy{
|
||||
Groups: Groups{
|
||||
"group:ops": Usernames{"user3@"},
|
||||
},
|
||||
TagOwners: TagOwners{
|
||||
Tag("tag:server"): Owners{
|
||||
ptr.To(Username("user1@")),
|
||||
ptr.To(Group("group:ops")),
|
||||
},
|
||||
},
|
||||
},
|
||||
node: &types.Node{
|
||||
User: &users[2], // user3 is in group:ops
|
||||
UserID: ptr.To(users[2].ID),
|
||||
},
|
||||
tag: "tag:server",
|
||||
want: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
@@ -2760,6 +2863,106 @@ func TestNodeCanHaveTag(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestUserMatchesOwner(t *testing.T) {
|
||||
users := types.Users{
|
||||
{Model: gorm.Model{ID: 1}, Name: "user1"},
|
||||
{Model: gorm.Model{ID: 2}, Name: "user2"},
|
||||
{Model: gorm.Model{ID: 3}, Name: "user3"},
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
policy *Policy
|
||||
user types.User
|
||||
owner Owner
|
||||
want bool
|
||||
}{
|
||||
{
|
||||
name: "username-match",
|
||||
policy: &Policy{},
|
||||
user: users[0],
|
||||
owner: ptr.To(Username("user1@")),
|
||||
want: true,
|
||||
},
|
||||
{
|
||||
name: "username-no-match",
|
||||
policy: &Policy{},
|
||||
user: users[0],
|
||||
owner: ptr.To(Username("user2@")),
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "group-match",
|
||||
policy: &Policy{
|
||||
Groups: Groups{
|
||||
"group:admins": Usernames{"user1@", "user2@"},
|
||||
},
|
||||
},
|
||||
user: users[1], // user2 is in group:admins
|
||||
owner: ptr.To(Group("group:admins")),
|
||||
want: true,
|
||||
},
|
||||
{
|
||||
name: "group-no-match",
|
||||
policy: &Policy{
|
||||
Groups: Groups{
|
||||
"group:admins": Usernames{"user1@"},
|
||||
},
|
||||
},
|
||||
user: users[1], // user2 is NOT in group:admins
|
||||
owner: ptr.To(Group("group:admins")),
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "group-not-defined",
|
||||
policy: &Policy{
|
||||
Groups: Groups{},
|
||||
},
|
||||
user: users[0],
|
||||
owner: ptr.To(Group("group:undefined")),
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "nil-username-owner",
|
||||
policy: &Policy{},
|
||||
user: users[0],
|
||||
owner: (*Username)(nil),
|
||||
want: false,
|
||||
},
|
||||
{
|
||||
name: "nil-group-owner",
|
||||
policy: &Policy{},
|
||||
user: users[0],
|
||||
owner: (*Group)(nil),
|
||||
want: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Create a minimal PolicyManager for testing
|
||||
// We need nodes with IPs to initialize the tagOwnerMap
|
||||
nodes := types.Nodes{
|
||||
{
|
||||
IPv4: ap("100.64.0.1"),
|
||||
User: &users[0],
|
||||
},
|
||||
}
|
||||
|
||||
b, err := json.Marshal(tt.policy)
|
||||
require.NoError(t, err)
|
||||
|
||||
pm, err := NewPolicyManager(b, users, nodes.ViewSlice())
|
||||
require.NoError(t, err)
|
||||
|
||||
got := pm.userMatchesOwner(tt.user.View(), tt.owner)
|
||||
if got != tt.want {
|
||||
t.Errorf("userMatchesOwner() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestACL_UnmarshalJSON_WithCommentFields(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
|
||||
Reference in New Issue
Block a user