hscontrol/policy/v2: convert routes compat tests to JSON-driven format

Replace 8,286 lines of inline Go struct test expectations in
tailscale_routes_compat_test.go with 92 JSON golden files in
testdata/routes_results/ROUTES-*.json and a ~300-line Go driver in
tailscale_routes_data_compat_test.go.

Unlike the ACL and grants compat tests which use shared hardcoded node
topologies, the routes driver builds nodes from JSON topology data.
Each test file embeds its full topology including routable_ips and
approved_routes, making test files self-contained. This naturally
handles the IPv6 tests which use a different 4-node topology from the
standard 9-node setup.

Test count is preserved: 92 test cases across 19 original test
functions (SubnetBasics, ExitNodes, HARouters, FilterPlacement,
RouteCoverage, Overlapping, TagResolution, ProtocolPort, IPv6,
EdgeCases, AutoApprover, and additional variants).

Updates #2180

hscontrol/policy/v2/tailscale_routes_data_compat_test.go

@@ -0,0 +1,294 @@
+// This file implements a data-driven test runner for routes compatibility tests.
+// It loads JSON golden files from testdata/routes_results/ROUTES-*.json and
+// compares headscale's route-aware ACL engine output against the expected
+// packet filter rules.
+//
+// Each JSON file contains:
+//   - A full policy (groups, tagOwners, hosts, acls)
+//   - A topology section with nodes, including routable_ips and approved_routes
+//   - Expected packet_filter_rules per node
+//
+// Test data source: testdata/routes_results/ROUTES-*.json
+// Original source: Tailscale SaaS captures + headscale-generated expansions
+
+package v2
+
+import (
+	"encoding/json"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/juanfont/headscale/hscontrol/policy/policyutil"
+	"github.com/juanfont/headscale/hscontrol/types"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+	"tailscale.com/tailcfg"
+)
+
+// routesTestFile represents the JSON structure of a captured routes test file.
+type routesTestFile struct {
+	TestID     string `json:"test_id"`
+	Source     string `json:"source"`
+	ParentTest string `json:"parent_test"`
+	Input      struct {
+		FullPolicy json.RawMessage `json:"full_policy"`
+	} `json:"input"`
+	Topology routesTopology `json:"topology"`
+	Captures map[string]struct {
+		PacketFilterRules json.RawMessage `json:"packet_filter_rules"`
+	} `json:"captures"`
+}
+
+// routesTopology describes the node topology for a routes test.
+type routesTopology struct {
+	Users []struct {
+		ID   uint   `json:"id"`
+		Name string `json:"name"`
+	} `json:"users"`
+	Nodes map[string]routesNodeDef `json:"nodes"`
+}
+
+// routesNodeDef describes a single node in the routes test topology.
+type routesNodeDef struct {
+	ID             int      `json:"id"`
+	Hostname       string   `json:"hostname"`
+	IPv4           string   `json:"ipv4"`
+	IPv6           string   `json:"ipv6"`
+	Tags           []string `json:"tags"`
+	User           string   `json:"user,omitempty"`
+	RoutableIPs    []string `json:"routable_ips"`
+	ApprovedRoutes []string `json:"approved_routes"`
+}
+
+// loadRoutesTestFile loads and parses a single routes test JSON file.
+func loadRoutesTestFile(t *testing.T, path string) routesTestFile {
+	t.Helper()
+
+	content, err := os.ReadFile(path)
+	require.NoError(t, err, "failed to read test file %s", path)
+
+	var tf routesTestFile
+
+	err = json.Unmarshal(content, &tf)
+	require.NoError(t, err, "failed to parse test file %s", path)
+
+	return tf
+}
+
+// buildRoutesUsersAndNodes constructs types.Users and types.Nodes from the
+// JSON topology definition. This allows each test file to define its own
+// topology (e.g., the IPv6 tests use different nodes than the standard tests).
+func buildRoutesUsersAndNodes(
+	t *testing.T,
+	topo routesTopology,
+) (types.Users, types.Nodes) {
+	t.Helper()
+
+	// Build users
+	users := make(types.Users, 0, len(topo.Users))
+	for _, u := range topo.Users {
+		users = append(users, types.User{
+			Model: gorm.Model{ID: u.ID},
+			Name:  u.Name,
+		})
+	}
+
+	// Build nodes
+	nodes := make(types.Nodes, 0, len(topo.Nodes))
+
+	for _, nodeDef := range topo.Nodes {
+		node := &types.Node{
+			ID:        types.NodeID(nodeDef.ID), //nolint:gosec
+			GivenName: nodeDef.Hostname,
+			IPv4:      ptrAddr(nodeDef.IPv4),
+			IPv6:      ptrAddr(nodeDef.IPv6),
+			Tags:      nodeDef.Tags,
+		}
+
+		// Set up Hostinfo with RoutableIPs
+		hostinfo := &tailcfg.Hostinfo{}
+
+		if len(nodeDef.RoutableIPs) > 0 {
+			routableIPs := make(
+				[]netip.Prefix,
+				0,
+				len(nodeDef.RoutableIPs),
+			)
+			for _, r := range nodeDef.RoutableIPs {
+				routableIPs = append(
+					routableIPs,
+					netip.MustParsePrefix(r),
+				)
+			}
+
+			hostinfo.RoutableIPs = routableIPs
+		}
+
+		node.Hostinfo = hostinfo
+
+		// Set ApprovedRoutes
+		if len(nodeDef.ApprovedRoutes) > 0 {
+			approvedRoutes := make(
+				[]netip.Prefix,
+				0,
+				len(nodeDef.ApprovedRoutes),
+			)
+			for _, r := range nodeDef.ApprovedRoutes {
+				approvedRoutes = append(
+					approvedRoutes,
+					netip.MustParsePrefix(r),
+				)
+			}
+
+			node.ApprovedRoutes = approvedRoutes
+		} else {
+			node.ApprovedRoutes = []netip.Prefix{}
+		}
+
+		// Assign user if specified
+		if nodeDef.User != "" {
+			for i := range users {
+				if users[i].Name == nodeDef.User {
+					node.User = &users[i]
+					node.UserID = &users[i].ID
+
+					break
+				}
+			}
+		}
+
+		nodes = append(nodes, node)
+	}
+
+	return users, nodes
+}
+
+// routesSkipReasons documents WHY tests are expected to fail.
+var routesSkipReasons = map[string]string{}
+
+// TestRoutesCompat is a data-driven test that loads all ROUTES-*.json test
+// files and compares headscale's route-aware ACL engine output against the
+// expected behavior.
+func TestRoutesCompat(t *testing.T) {
+	t.Parallel()
+
+	files, err := filepath.Glob(
+		filepath.Join("testdata", "routes_results", "ROUTES-*.json"),
+	)
+	require.NoError(t, err, "failed to glob test files")
+	require.NotEmpty(
+		t,
+		files,
+		"no ROUTES-*.json test files found in testdata/routes_results/",
+	)
+
+	t.Logf("Loaded %d routes test files", len(files))
+
+	for _, file := range files {
+		tf := loadRoutesTestFile(t, file)
+
+		t.Run(tf.TestID, func(t *testing.T) {
+			t.Parallel()
+
+			if reason, ok := routesSkipReasons[tf.TestID]; ok {
+				t.Skipf(
+					"TODO: %s — see routesSkipReasons for details",
+					reason,
+				)
+
+				return
+			}
+
+			// Build topology from JSON
+			users, nodes := buildRoutesUsersAndNodes(t, tf.Topology)
+
+			// Parse and validate policy
+			pol, err := unmarshalPolicy(tf.Input.FullPolicy)
+			require.NoError(
+				t,
+				err,
+				"%s: policy should parse successfully",
+				tf.TestID,
+			)
+
+			err = pol.validate()
+			require.NoError(
+				t,
+				err,
+				"%s: policy should validate successfully",
+				tf.TestID,
+			)
+
+			for nodeName, capture := range tf.Captures {
+				t.Run(nodeName, func(t *testing.T) {
+					captureIsNull := len(capture.PacketFilterRules) == 0 ||
+						string(capture.PacketFilterRules) == "null" //nolint:goconst
+
+					node := findNodeByGivenName(nodes, nodeName)
+					if node == nil {
+						t.Skipf(
+							"node %s not found in topology",
+							nodeName,
+						)
+
+						return
+					}
+
+					compiledRules, err := pol.compileFilterRulesForNode(
+						users,
+						node.View(),
+						nodes.ViewSlice(),
+					)
+					require.NoError(
+						t,
+						err,
+						"%s/%s: failed to compile filter rules",
+						tf.TestID,
+						nodeName,
+					)
+
+					gotRules := policyutil.ReduceFilterRules(
+						node.View(),
+						compiledRules,
+					)
+
+					var wantRules []tailcfg.FilterRule
+					if !captureIsNull {
+						err = json.Unmarshal(
+							capture.PacketFilterRules,
+							&wantRules,
+						)
+						require.NoError(
+							t,
+							err,
+							"%s/%s: failed to unmarshal expected rules",
+							tf.TestID,
+							nodeName,
+						)
+					}
+
+					opts := append(
+						cmpOptions(),
+						cmpopts.EquateEmpty(),
+					)
+					if diff := cmp.Diff(
+						wantRules,
+						gotRules,
+						opts...,
+					); diff != "" {
+						t.Errorf(
+							"%s/%s: filter rules mismatch (-want +got):\n%s",
+							tf.TestID,
+							nodeName,
+							diff,
+						)
+					}
+				})
+			}
+		})
+	}
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-A1_wildcard_acl_includes_routes_in_srcips.json

@@ -0,0 +1,285 @@
+{
+  "test_id": "ROUTES-A1_wildcard_acl_includes_routes_in_srcips",
+  "source": "headscale_adapted",
+  "parent_test": "SubnetBasics",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.64.0.0/10",
+            "fd7a:115c:a1e0::/48",
+            "10.0.0.0/8",
+            "10.33.0.0/16",
+            "172.16.0.0/24",
+            "192.168.1.0/24"
+          ],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "client2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "user1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-A2_tag_based_acl_excludes_routes.json

@@ -0,0 +1,202 @@
+{
+  "test_id": "ROUTES-A2_tag_based_acl_excludes_routes",
+  "source": "headscale_adapted",
+  "parent_test": "SubnetBasics",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:router"],
+          "dst": ["tag:router:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "100.100.100.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.119.139.79/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::4001:8ba0/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::6401:6401/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-A3_explicit_subnet_filter_to_router.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-A3_explicit_subnet_filter_to_router",
+  "source": "headscale_adapted",
+  "parent_test": "SubnetBasics",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-A3b_autogroup_member_to_subnet.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-A3b_autogroup_member_to_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "SubnetBasics",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-A4_multiple_routes_same_router.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-A4_multiple_routes_same_router",
+  "source": "headscale_adapted",
+  "parent_test": "SubnetBasics",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["172.16.0.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-A5_host_alias_to_subnet.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-A5_host_alias_to_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "SubnetBasics",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["internal:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B10_exit_routes_not_in_primaryroutes.json

@@ -0,0 +1,124 @@
+{
+  "test_id": "ROUTES-B10_exit_routes_not_in_primaryroutes",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {}
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B1_exit_routes_not_in_srcips.json

@@ -0,0 +1,124 @@
+{
+  "test_id": "ROUTES-B1_exit_routes_not_in_srcips",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {}
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B2_tag_exit_excludes_exit_routes.json

@@ -0,0 +1,232 @@
+{
+  "test_id": "ROUTES-B2_tag_exit_excludes_exit_routes",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:exit"],
+          "dst": ["tag:exit:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.121.32.1/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::7f01:2004/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "100.121.32.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::7f01:2004/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.121.32.1/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::7f01:2004/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "100.121.32.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::7f01:2004/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B3_exit_node_advertises_routes.json

@@ -0,0 +1,124 @@
+{
+  "test_id": "ROUTES-B3_exit_node_advertises_routes",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {}
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B4_multi_router_has_both_route_types.json

@@ -0,0 +1,173 @@
+{
+  "test_id": "ROUTES-B4_multi_router_has_both_route_types",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "100.64.0.0/10",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::/48",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B5_exit_with_wildcard_dst.json

@@ -0,0 +1,124 @@
+{
+  "test_id": "ROUTES-B5_exit_with_wildcard_dst",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {}
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B6_exit_node_option_field.json

@@ -0,0 +1,171 @@
+{
+  "test_id": "ROUTES-B6_exit_node_option_field",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:exit"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.121.32.1/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::7f01:2004/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B7_multiple_exit_nodes.json

@@ -0,0 +1,153 @@
+{
+  "test_id": "ROUTES-B7_multiple_exit_nodes",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:exit"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.121.32.1/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::7f01:2004/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B8_autogroup_internet_no_filters.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-B8_autogroup_internet_no_filters",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["autogroup:internet:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-B9_exit_routes_in_allowedips.json

@@ -0,0 +1,124 @@
+{
+  "test_id": "ROUTES-B9_exit_routes_in_allowedips",
+  "source": "headscale_adapted",
+  "parent_test": "ExitNodes",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {}
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D10_auto_approval_retroactive.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-D10_auto_approval_retroactive",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D11_overlapping_auto_approvers.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-D11_overlapping_auto_approvers",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.0.0.0/8:80"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.0.0.0/8",
+              "Ports": {
+                "First": 80,
+                "Last": 80
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.0.0.0/8",
+              "Ports": {
+                "First": 80,
+                "Last": 80
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.0.0.0/8",
+              "Ports": {
+                "First": 80,
+                "Last": 80
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.0.0.0/8",
+              "Ports": {
+                "First": 80,
+                "Last": 80
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D1_basic_route_auto_approval.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-D1_basic_route_auto_approval",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D2_nested_prefix_approval.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-D2_nested_prefix_approval",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D3_exact_prefix_approval.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-D3_exact_prefix_approval",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D4_prefix_not_covered.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-D4_prefix_not_covered",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D5_wrong_tag_not_approved.json

@@ -0,0 +1,236 @@
+{
+  "test_id": "ROUTES-D5_wrong_tag_not_approved",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:router"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D6_exit_node_auto_approval.json

@@ -0,0 +1,142 @@
+{
+  "test_id": "ROUTES-D6_exit_node_auto_approval",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D7_exit_auto_approval_wrong_tag.json

@@ -0,0 +1,147 @@
+{
+  "test_id": "ROUTES-D7_exit_auto_approval_wrong_tag",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:exit"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.121.32.1/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::7f01:2004/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D8_auto_approval_acl_interaction.json

@@ -0,0 +1,236 @@
+{
+  "test_id": "ROUTES-D8_auto_approval_acl_interaction",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.33.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-D9_auto_approval_triggers_on_advertise.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-D9_auto_approval_triggers_on_advertise",
+  "source": "headscale_adapted",
+  "parent_test": "AutoApprover",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-E1_ha_two_routers_same_subnet.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-E1_ha_two_routers_same_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "HARouters",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-E2_ha_primary_in_allowedips.json

@@ -0,0 +1,131 @@
+{
+  "test_id": "ROUTES-E2_ha_primary_in_allowedips",
+  "source": "headscale_adapted",
+  "parent_test": "HARouters",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-E3_ha_secondary_no_route_in_allowedips.json

@@ -0,0 +1,131 @@
+{
+  "test_id": "ROUTES-E3_ha_secondary_no_route_in_allowedips",
+  "source": "headscale_adapted",
+  "parent_test": "HARouters",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-E4_ha_both_get_filters_host_alias.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-E4_ha_both_get_filters_host_alias",
+  "source": "headscale_adapted",
+  "parent_test": "HARouters",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["subnet24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-E5_first_advertiser_is_primary.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-E5_first_advertiser_is_primary",
+  "source": "headscale_adapted",
+  "parent_test": "HARouters",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F1_filter_on_destination_not_source.json

@@ -0,0 +1,194 @@
+{
+  "test_id": "ROUTES-F1_filter_on_destination_not_source",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.33.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F2_subnet_as_acl_source.json

@@ -0,0 +1,299 @@
+{
+  "test_id": "ROUTES-F2_subnet_as_acl_source",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["10.33.0.0/16"],
+          "dst": ["autogroup:member:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["10.33.0.0/16"],
+          "DstPorts": [
+            {
+              "IP": "100.116.73.38/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.89.42.23/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.90.199.68/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::a801:4949/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::d01:2a2e/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::2d01:c747/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "client2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["10.33.0.0/16"],
+          "DstPorts": [
+            {
+              "IP": "100.116.73.38/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.89.42.23/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.90.199.68/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::a801:4949/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::d01:2a2e/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::2d01:c747/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "user1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["10.33.0.0/16"],
+          "DstPorts": [
+            {
+              "IP": "100.116.73.38/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.89.42.23/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.90.199.68/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::a801:4949/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::d01:2a2e/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::2d01:c747/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F3_wildcard_src_specific_dst.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-F3_wildcard_src_specific_dst",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F4_specific_src_wildcard_dst.json

@@ -0,0 +1,173 @@
+{
+  "test_id": "ROUTES-F4_specific_src_wildcard_dst",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:router"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F5_bidirectional_subnet_access.json

@@ -0,0 +1,248 @@
+{
+  "test_id": "ROUTES-F5_bidirectional_subnet_access",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.33.0.0/16:*"]
+        },
+        {
+          "action": "accept",
+          "src": ["10.33.0.0/16"],
+          "dst": ["autogroup:member:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["10.33.0.0/16"],
+          "DstPorts": [
+            {
+              "IP": "100.116.73.38/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.89.42.23/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.90.199.68/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::2d01:c747/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::a801:4949/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::d01:2a2e/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::2d01:c747/128",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::2d01:c747/128",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F6_filter_srcips_expansion.json

@@ -0,0 +1,194 @@
+{
+  "test_id": "ROUTES-F6_filter_srcips_expansion",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::2d01:c747/128",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::2d01:c747/128",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F7_filter_dstports_shows_acl_cidr.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-F7_filter_dstports_shows_acl_cidr",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.0/24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.1.0/24",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.1.0/24",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F8_route_enabled_acl_denies.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-F8_route_enabled_acl_denies",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["group:empty"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-F9_route_disabled_acl_allows.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-F9_route_disabled_acl_allows",
+  "source": "headscale_adapted",
+  "parent_test": "FilterPlacement",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.99.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G1_port_restriction_subnet.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-G1_port_restriction_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "ProtocolPort",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.33.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G2_port_range_subnet.json

@@ -0,0 +1,137 @@
+{
+  "test_id": "ROUTES-G2_port_range_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "ProtocolPort",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:80-443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G3_multiple_ports_subnet.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-G3_multiple_ports_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalG",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:22,80,443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G4_protocol_icmp_subnet.json

@@ -0,0 +1,209 @@
+{
+  "test_id": "ROUTES-G4_protocol_icmp_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalProtocol",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:*"],
+          "proto": "icmp"
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [1]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [1]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [1]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [1]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G5_protocol_tcp_only.json

@@ -0,0 +1,209 @@
+{
+  "test_id": "ROUTES-G5_protocol_tcp_only",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalProtocol",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:22"],
+          "proto": "tcp"
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G6_protocol_udp_only.json

@@ -0,0 +1,209 @@
+{
+  "test_id": "ROUTES-G6_protocol_udp_only",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalProtocol",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:53"],
+          "proto": "udp"
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [17]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [17]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [17]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [17]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G7_all_ports_wildcard.json

@@ -0,0 +1,137 @@
+{
+  "test_id": "ROUTES-G7_all_ports_wildcard",
+  "source": "headscale_adapted",
+  "parent_test": "ProtocolPort",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.33.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-G8_default_ipproto.json

@@ -0,0 +1,131 @@
+{
+  "test_id": "ROUTES-G8_default_ipproto",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalG",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H10_very_small_prefix.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-H10_very_small_prefix",
+  "source": "headscale_adapted",
+  "parent_test": "EdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.100/32:80"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.100/32",
+              "Ports": {
+                "First": 80,
+                "Last": 80
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.100/32",
+              "Ports": {
+                "First": 80,
+                "Last": 80
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H11_ipv6_small_prefix.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-H11_ipv6_small_prefix",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalEdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["fd00::1/128:443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "fd00::1/128",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "fd00::1/128",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H1_wildcard_srcips_format.json

@@ -0,0 +1,157 @@
+{
+  "test_id": "ROUTES-H1_wildcard_srcips_format",
+  "source": "headscale_adapted",
+  "parent_test": "EdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["tag:router:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.64.0.0/10",
+            "fd7a:115c:a1e0::/48",
+            "10.0.0.0/8",
+            "10.33.0.0/16",
+            "172.16.0.0/24",
+            "192.168.1.0/24"
+          ]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H2_wildcard_dstports_format.json

@@ -0,0 +1,173 @@
+{
+  "test_id": "ROUTES-H2_wildcard_dstports_format",
+  "source": "headscale_adapted",
+  "parent_test": "EdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::2d01:c747/128",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H3_cgnat_range_expansion.json

@@ -0,0 +1,201 @@
+{
+  "test_id": "ROUTES-H3_cgnat_range_expansion",
+  "source": "headscale_adapted",
+  "parent_test": "EdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["tag:router:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "100.100.100.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.119.139.79/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::4001:8ba0/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::6401:6401/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H4_ipv6_range_in_srcips.json

@@ -0,0 +1,166 @@
+{
+  "test_id": "ROUTES-H4_ipv6_range_in_srcips",
+  "source": "headscale_adapted",
+  "parent_test": "EdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H5_subnet_overlaps_cgnat.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-H5_subnet_overlaps_cgnat",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalEdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["100.64.0.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "100.64.0.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "100.64.0.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H6_loopback_routes_not_distributed.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-H6_loopback_routes_not_distributed",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalEdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["127.0.0.1/32:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "127.0.0.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "127.0.0.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H7_two_nodes_same_subnet.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-H7_two_nodes_same_subnet",
+  "source": "headscale_adapted",
+  "parent_test": "EdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H8_cgnat_overlap_blocked.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-H8_cgnat_overlap_blocked",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalEdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["100.100.0.0/16:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-H9_large_prefix_works.json

@@ -0,0 +1,173 @@
+{
+  "test_id": "ROUTES-H9_large_prefix_works",
+  "source": "headscale_adapted",
+  "parent_test": "EdgeCases",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["10.0.0.0/8:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::2d01:c747/128",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "10.0.0.0/8",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-I1_ipv6_subnet_route.json

@@ -0,0 +1,104 @@
+{
+  "test_id": "ROUTES-I1_ipv6_subnet_route",
+  "source": "headscale_adapted",
+  "parent_test": "IPv6",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "ipv6-router": {
+        "id": 2,
+        "hostname": "ipv6-router",
+        "ipv4": "100.119.139.80",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba1",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00::/48"],
+        "approved_routes": ["fd00::/48"]
+      },
+      "ipv6-child-router": {
+        "id": 3,
+        "hostname": "ipv6-child-router",
+        "ipv4": "100.119.139.81",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba2",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00:1::/64"],
+        "approved_routes": ["fd00:1::/64"]
+      },
+      "ipv6-exit": {
+        "id": 4,
+        "hostname": "ipv6-exit",
+        "ipv4": "100.121.32.2",
+        "ipv6": "fd7a:115c:a1e0::7f01:2005",
+        "tags": ["tag:exit"],
+        "routable_ips": ["::/0"],
+        "approved_routes": ["::/0"]
+      }
+    }
+  },
+  "captures": {
+    "ipv6-router": {
+      "packet_filter_rules": null
+    },
+    "ipv6-child-router": {
+      "packet_filter_rules": null
+    },
+    "ipv6-exit": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd00::/48", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-I2_ipv6_exit_route.json

@@ -0,0 +1,142 @@
+{
+  "test_id": "ROUTES-I2_ipv6_exit_route",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalIPv6",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-I3_ipv6_in_wildcard_srcips.json

@@ -0,0 +1,195 @@
+{
+  "test_id": "ROUTES-I3_ipv6_in_wildcard_srcips",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalIPv6",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["tag:router:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "100.100.100.1/32",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            },
+            {
+              "IP": "100.119.139.79/32",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::4001:8ba0/128",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::6401:6401/128",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 22,
+                "Last": 22
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-I4_ipv6_specific_acl.json

@@ -0,0 +1,132 @@
+{
+  "test_id": "ROUTES-I4_ipv6_specific_acl",
+  "source": "headscale_adapted",
+  "parent_test": "IPv6",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["fd00:1::/64:443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "ipv6-router": {
+        "id": 2,
+        "hostname": "ipv6-router",
+        "ipv4": "100.119.139.80",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba1",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00::/48"],
+        "approved_routes": ["fd00::/48"]
+      },
+      "ipv6-child-router": {
+        "id": 3,
+        "hostname": "ipv6-child-router",
+        "ipv4": "100.119.139.81",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba2",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00:1::/64"],
+        "approved_routes": ["fd00:1::/64"]
+      },
+      "ipv6-exit": {
+        "id": 4,
+        "hostname": "ipv6-exit",
+        "ipv4": "100.121.32.2",
+        "ipv6": "fd7a:115c:a1e0::7f01:2005",
+        "tags": ["tag:exit"],
+        "routable_ips": ["::/0"],
+        "approved_routes": ["::/0"]
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "ipv6-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "fd00:1::/64",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ipv6-child-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "fd00:1::/64",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ipv6-exit": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "fd00:1::/64",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-I5_ipv6_parent_child_routes.json

@@ -0,0 +1,118 @@
+{
+  "test_id": "ROUTES-I5_ipv6_parent_child_routes",
+  "source": "headscale_adapted",
+  "parent_test": "IPv6",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["fd00:1:2::/80:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "ipv6-router": {
+        "id": 2,
+        "hostname": "ipv6-router",
+        "ipv4": "100.119.139.80",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba1",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00::/48"],
+        "approved_routes": ["fd00::/48"]
+      },
+      "ipv6-child-router": {
+        "id": 3,
+        "hostname": "ipv6-child-router",
+        "ipv4": "100.119.139.81",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba2",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00:1::/64"],
+        "approved_routes": ["fd00:1::/64"]
+      },
+      "ipv6-exit": {
+        "id": 4,
+        "hostname": "ipv6-exit",
+        "ipv4": "100.121.32.2",
+        "ipv6": "fd7a:115c:a1e0::7f01:2005",
+        "tags": ["tag:exit"],
+        "routable_ips": ["::/0"],
+        "approved_routes": ["::/0"]
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "ipv6-child-router": {
+      "packet_filter_rules": null
+    },
+    "ipv6-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.116.73.38/32", "fd7a:115c:a1e0::a801:4949/128"],
+          "DstPorts": [
+            {
+              "IP": "fd00:1:2::/80",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ipv6-exit": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.116.73.38/32", "fd7a:115c:a1e0::a801:4949/128"],
+          "DstPorts": [
+            {
+              "IP": "fd00:1:2::/80",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-I6_dual_stack_node.json

@@ -0,0 +1,185 @@
+{
+  "test_id": "ROUTES-I6_dual_stack_node",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalIPv6",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:*"]
+        },
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["fd00:1::/64:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.0.0/16",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-I7_ipv6_exit_coverage.json

@@ -0,0 +1,104 @@
+{
+  "test_id": "ROUTES-I7_ipv6_exit_coverage",
+  "source": "headscale_adapted",
+  "parent_test": "IPv6",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["2001:db8::/32:443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "ipv6-router": {
+        "id": 2,
+        "hostname": "ipv6-router",
+        "ipv4": "100.119.139.80",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba1",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00::/48"],
+        "approved_routes": ["fd00::/48"]
+      },
+      "ipv6-child-router": {
+        "id": 3,
+        "hostname": "ipv6-child-router",
+        "ipv4": "100.119.139.81",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba2",
+        "tags": ["tag:router"],
+        "routable_ips": ["fd00:1::/64"],
+        "approved_routes": ["fd00:1::/64"]
+      },
+      "ipv6-exit": {
+        "id": 4,
+        "hostname": "ipv6-exit",
+        "ipv4": "100.121.32.2",
+        "ipv6": "fd7a:115c:a1e0::7f01:2005",
+        "tags": ["tag:exit"],
+        "routable_ips": ["::/0"],
+        "approved_routes": ["::/0"]
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "ipv6-router": {
+      "packet_filter_rules": null
+    },
+    "ipv6-child-router": {
+      "packet_filter_rules": null
+    },
+    "ipv6-exit": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "2001:db8::/32",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O10_acl_dest_covered_by_multiple.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O10_acl_dest_covered_by_multiple",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalO",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.0/24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O11_acl_dest_not_covered.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O11_acl_dest_not_covered",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalO",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.99.0/24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O12_filter_dest_is_acl_cidr.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O12_filter_dest_is_acl_cidr",
+  "source": "headscale_adapted",
+  "parent_test": "Overlapping",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.0/24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O1_overlapping_routes_not_merged.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O1_overlapping_routes_not_merged",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalO",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O2_ha_routers_both_get_filter.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O2_ha_routers_both_get_filter",
+  "source": "headscale_adapted",
+  "parent_test": "Overlapping",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O3_parent_child_different_nodes.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O3_parent_child_different_nodes",
+  "source": "headscale_adapted",
+  "parent_test": "Overlapping",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.0/24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O4_three_way_hierarchy.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O4_three_way_hierarchy",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalO",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.128/25:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O5_sibling_routes_with_parent_acl.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O5_sibling_routes_with_parent_acl",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalO",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.0.0.0/8:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O6_exit_route_expands_filter_dist.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-O6_exit_route_expands_filter_dist",
+  "source": "headscale_adapted",
+  "parent_test": "Overlapping",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["8.8.8.0/24:53"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "8.8.8.0/24",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "8.8.8.0/24",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O7_specific_ip_targeting.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-O7_specific_ip_targeting",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalO",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.100/32:80"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O8_same_node_overlapping_routes.json

@@ -0,0 +1,208 @@
+{
+  "test_id": "ROUTES-O8_same_node_overlapping_routes",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalOverlapping",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "big-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "10.33.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-O9_different_nodes_same_route.json

@@ -0,0 +1,236 @@
+{
+  "test_id": "ROUTES-O9_different_nodes_same_route",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalOverlapping",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["autogroup:member"],
+          "dst": ["192.168.1.0/24:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "ha-router2": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.116.73.38/32",
+            "100.89.42.23/32",
+            "100.90.199.68/32",
+            "fd7a:115c:a1e0::a801:4949/128",
+            "fd7a:115c:a1e0::d01:2a2e/128",
+            "fd7a:115c:a1e0::2d01:c747/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "192.168.1.0/24",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R1_exit_covers_external_dest.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-R1_exit_covers_external_dest",
+  "source": "headscale_adapted",
+  "parent_test": "RouteCoverage",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["8.8.8.0/24:53"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "8.8.8.0/24",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "8.8.8.0/24",
+              "Ports": {
+                "First": 53,
+                "Last": 53
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R2_parent_route_covers_child_dest.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-R2_parent_route_covers_child_dest",
+  "source": "headscale_adapted",
+  "parent_test": "RouteCoverage",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.0/24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R3_sibling_routes_no_coverage.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-R3_sibling_routes_no_coverage",
+  "source": "headscale_adapted",
+  "parent_test": "RouteCoverage",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.34.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R4_exact_match_route.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-R4_exact_match_route",
+  "source": "headscale_adapted",
+  "parent_test": "RouteCoverage",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R5_route_coverage_check_logic.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-R5_route_coverage_check_logic",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalR",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.1.0/24:22"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R6_ipv6_route_coverage.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-R6_ipv6_route_coverage",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalR",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["fd7a:115c:a1e0::1/128:443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R7_exit_ipv6_coverage.json

@@ -0,0 +1,180 @@
+{
+  "test_id": "ROUTES-R7_exit_ipv6_coverage",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalR",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["2001:db8::1/128:443"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "2001:db8::1/128",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": ["100.64.0.0/10", "fd7a:115c:a1e0::/48"],
+          "DstPorts": [
+            {
+              "IP": "2001:db8::1/128",
+              "Ports": {
+                "First": 443,
+                "Last": 443
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-R8_mixed_ipv4_ipv6_coverage.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-R8_mixed_ipv4_ipv6_coverage",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalR",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["10.33.0.0/16:*", "fd7a:115c:a1e0::/64:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-T1_tags_resolve_to_ips_not_routes.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-T1_tags_resolve_to_ips_not_routes",
+  "source": "headscale_adapted",
+  "parent_test": "TagResolution",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:router"],
+          "dst": ["tag:router:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-T2_tag_to_tag_with_exit.json

@@ -0,0 +1,232 @@
+{
+  "test_id": "ROUTES-T2_tag_to_tag_with_exit",
+  "source": "headscale_adapted",
+  "parent_test": "TagResolution",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:exit"],
+          "dst": ["tag:exit:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.121.32.1/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::7f01:2004/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "100.121.32.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::7f01:2004/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.121.32.1/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::7f01:2004/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "100.121.32.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::7f01:2004/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-T3_tag_src_includes_all_tagged.json

@@ -0,0 +1,165 @@
+{
+  "test_id": "ROUTES-T3_tag_src_includes_all_tagged",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalT",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:router"],
+          "dst": ["*:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "client1": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [],
+          "DstPorts": [
+            {
+              "IP": "*",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-T4_tag_dst_includes_all_tagged.json

@@ -0,0 +1,152 @@
+{
+  "test_id": "ROUTES-T4_tag_dst_includes_all_tagged",
+  "source": "headscale_adapted",
+  "parent_test": "AdditionalT",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["*"],
+          "dst": ["tag:ha:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": null
+    },
+    "multi-router": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    }
+  }
+}

hscontrol/policy/v2/testdata/routes_results/ROUTES-T5_multi_tag_node_in_both.json

@@ -0,0 +1,236 @@
+{
+  "test_id": "ROUTES-T5_multi_tag_node_in_both",
+  "source": "headscale_adapted",
+  "parent_test": "TagResolution",
+  "input": {
+    "full_policy": {
+      "groups": {
+        "group:admins": ["kratail2tid@"],
+        "group:empty": []
+      },
+      "tagOwners": {
+        "tag:router": ["kratail2tid@"],
+        "tag:exit": ["kratail2tid@"],
+        "tag:ha": ["kratail2tid@"]
+      },
+      "hosts": {
+        "internal": "10.0.0.0/8",
+        "subnet24": "192.168.1.0/24"
+      },
+      "acls": [
+        {
+          "action": "accept",
+          "src": ["tag:router"],
+          "dst": ["tag:exit:*"]
+        }
+      ]
+    }
+  },
+  "topology": {
+    "users": [
+      {
+        "id": 1,
+        "name": "kratail2tid"
+      }
+    ],
+    "nodes": {
+      "client1": {
+        "id": 1,
+        "hostname": "client1",
+        "ipv4": "100.116.73.38",
+        "ipv6": "fd7a:115c:a1e0::a801:4949",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "client2": {
+        "id": 2,
+        "hostname": "client2",
+        "ipv4": "100.89.42.23",
+        "ipv6": "fd7a:115c:a1e0::d01:2a2e",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      },
+      "subnet-router": {
+        "id": 3,
+        "hostname": "subnet-router",
+        "ipv4": "100.119.139.79",
+        "ipv6": "fd7a:115c:a1e0::4001:8ba0",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.33.0.0/16"],
+        "approved_routes": ["10.33.0.0/16"]
+      },
+      "exit-node": {
+        "id": 4,
+        "hostname": "exit-node",
+        "ipv4": "100.121.32.1",
+        "ipv6": "fd7a:115c:a1e0::7f01:2004",
+        "tags": ["tag:exit"],
+        "routable_ips": ["0.0.0.0/0", "::/0"],
+        "approved_routes": ["0.0.0.0/0", "::/0"]
+      },
+      "multi-router": {
+        "id": 5,
+        "hostname": "multi-router",
+        "ipv4": "100.74.117.7",
+        "ipv6": "fd7a:115c:a1e0::c401:7508",
+        "tags": ["tag:router", "tag:exit"],
+        "routable_ips": ["172.16.0.0/24", "0.0.0.0/0", "::/0"],
+        "approved_routes": ["172.16.0.0/24", "0.0.0.0/0", "::/0"]
+      },
+      "ha-router1": {
+        "id": 6,
+        "hostname": "ha-router1",
+        "ipv4": "100.85.37.108",
+        "ipv6": "fd7a:115c:a1e0::f101:2597",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "ha-router2": {
+        "id": 7,
+        "hostname": "ha-router2",
+        "ipv4": "100.119.130.32",
+        "ipv6": "fd7a:115c:a1e0::4501:82a9",
+        "tags": ["tag:ha"],
+        "routable_ips": ["192.168.1.0/24"],
+        "approved_routes": ["192.168.1.0/24"]
+      },
+      "big-router": {
+        "id": 8,
+        "hostname": "big-router",
+        "ipv4": "100.100.100.1",
+        "ipv6": "fd7a:115c:a1e0::6401:6401",
+        "tags": ["tag:router"],
+        "routable_ips": ["10.0.0.0/8"],
+        "approved_routes": ["10.0.0.0/8"]
+      },
+      "user1": {
+        "id": 9,
+        "hostname": "user1",
+        "ipv4": "100.90.199.68",
+        "ipv6": "fd7a:115c:a1e0::2d01:c747",
+        "tags": [],
+        "user": "kratail2tid",
+        "routable_ips": [],
+        "approved_routes": []
+      }
+    }
+  },
+  "captures": {
+    "client1": {
+      "packet_filter_rules": null
+    },
+    "client2": {
+      "packet_filter_rules": null
+    },
+    "subnet-router": {
+      "packet_filter_rules": null
+    },
+    "ha-router1": {
+      "packet_filter_rules": null
+    },
+    "ha-router2": {
+      "packet_filter_rules": null
+    },
+    "big-router": {
+      "packet_filter_rules": null
+    },
+    "user1": {
+      "packet_filter_rules": null
+    },
+    "exit-node": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "100.121.32.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::7f01:2004/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    },
+    "multi-router": {
+      "packet_filter_rules": [
+        {
+          "SrcIPs": [
+            "100.100.100.1/32",
+            "100.119.139.79/32",
+            "100.74.117.7/32",
+            "fd7a:115c:a1e0::4001:8ba0/128",
+            "fd7a:115c:a1e0::6401:6401/128",
+            "fd7a:115c:a1e0::c401:7508/128"
+          ],
+          "DstPorts": [
+            {
+              "IP": "100.121.32.1/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "100.74.117.7/32",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::7f01:2004/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            },
+            {
+              "IP": "fd7a:115c:a1e0::c401:7508/128",
+              "Ports": {
+                "First": 0,
+                "Last": 65535
+              }
+            }
+          ],
+          "IPProto": [6, 17, 1, 58]
+        }
+      ]
+    }
+  }
+}