mirror of
https://github.com/juanfont/headscale.git
synced 2026-04-17 22:39:53 +02:00
162e1dc35b
Replace the headscale-adapted ACL golden files with authoritative captures from Tailscale SaaS using the 8-node grant topology. The golden data was captured via debug-packet-filter-rules (FilterRule wire format) from each of the 8 nodes after pushing each ACL policy to the Tailscale API. This gives us the exact format Tailscale sends to clients: - SrcIPs use IP ranges (100.64.0.0-100.115.91.255) not CIDRs - SrcIPs include subnet routes (10.33.0.0/16) for wildcard sources - IPProto is omitted for default all-protocol rules - DstPorts use bare IPs without /32 suffix - Identity aliases include both IPv4 and IPv6 addresses The test driver is updated to use the 8-node topology (3 users, 5 tagged nodes) matching the grant compat tests, with the same email conversion (kratail2tid@passkey -> @example.com). 215 test cases: 199 success + 16 error (captured from API 400s). All captured from Tailscale SaaS, no headscale-adapted values. Updates #2180
47 lines
1.4 KiB
JSON
47 lines
1.4 KiB
JSON
{
|
|
"test_id": "ACL-SF08",
|
|
"timestamp": "2026-03-17T14:45:45Z",
|
|
"error": true,
|
|
"input": {
|
|
"policy_file": "acl_policies/acl_sf08.json",
|
|
"full_policy": {
|
|
"groups": {
|
|
"group:admins": ["kratail2tid@passkey"],
|
|
"group:developers": ["kristoffer@dalby.cc", "kratail2tid@passkey"],
|
|
"group:monitors": ["monitorpasskeykradalby@passkey"],
|
|
"group:empty": []
|
|
},
|
|
"tagOwners": {
|
|
"tag:server": ["kratail2tid@passkey"],
|
|
"tag:prod": ["kratail2tid@passkey"],
|
|
"tag:client": ["kratail2tid@passkey"],
|
|
"tag:router": ["kratail2tid@passkey"],
|
|
"tag:exit": ["kratail2tid@passkey"]
|
|
},
|
|
"hosts": {
|
|
"webserver": "100.108.74.26",
|
|
"prodbox": "100.103.8.15",
|
|
"internal": "10.0.0.0/8",
|
|
"subnet24": "192.168.1.0/24"
|
|
},
|
|
"autoApprovers": {
|
|
"routes": {
|
|
"10.33.0.0/16": ["tag:router"],
|
|
"0.0.0.0/0": ["tag:exit"],
|
|
"::/0": ["tag:exit"]
|
|
}
|
|
},
|
|
"acls": [
|
|
{
|
|
"action": "accept",
|
|
"src": ["autogroup:member", "tag:client"],
|
|
"dst": ["autogroup:self:*"]
|
|
}
|
|
]
|
|
},
|
|
"api_endpoint": "https://api.tailscale.com/api/v2/tailnet/kratail2tid%40passkey/acl",
|
|
"api_response_code": 400,
|
|
"api_response_body": { "message": "autogroup:self can only be used with users, groups, or supported autogroups" }
|
|
}
|
|
}
|