Files
headscale/hscontrol/policy/v2/testdata/grant_results/GRANT-V07.json
Kristoffer Dalby aa68fbafc0 hscontrol/policy/v2: add 25 v2 gap-filling grant testdata files
Add GRANT-V01 through GRANT-V25 JSON files captured from Tailscale SaaS
to fill coverage gaps in the grants compatibility test suite.

These tests cover:
- App grants on specific tags (not just wildcards)
- Mixed ip+app grants on specific tags
- Via routes with specific src identities (tags, groups, members)
- Via with multiple dst subnets and multiple via tags
- Drive cap with reverse drive-sharer generation
- autogroup:self with app grants
- autogroup:internet rejection with app grants
- Raw default route CIDR (0.0.0.0/0, ::/0) rejection as grant dst

Updates #2180
2026-03-25 15:17:23 +00:00

485 lines
23 KiB
JSON

{
"test_id": "GRANT-V07",
"timestamp": "2026-02-23T15:40:09Z",
"propagation_wait_seconds": 8,
"input": {
"policy_file": "grant_policies_v2/grant_v07.json",
"full_policy": {
"groups": {
"group:admins": ["kratail2tid@passkey"],
"group:developers": ["kristoffer@dalby.cc", "kratail2tid@passkey"],
"group:monitors": ["monitorpasskeykradalby@passkey"],
"group:empty": []
},
"tagOwners": {
"tag:server": ["kratail2tid@passkey"],
"tag:prod": ["kratail2tid@passkey"],
"tag:client": ["kratail2tid@passkey"],
"tag:router": ["kratail2tid@passkey"],
"tag:exit": ["kratail2tid@passkey"]
},
"hosts": {
"webserver": "100.108.74.26",
"prodbox": "100.103.8.15",
"internal": "10.0.0.0/8"
},
"autoApprovers": {
"routes": {
"10.33.0.0/16": ["tag:router"],
"0.0.0.0/0": ["tag:exit"],
"::/0": ["tag:exit"]
}
},
"grants": [
{
"src": ["*"],
"dst": ["autogroup:internet"],
"ip": ["tcp:443"]
}
]
},
"grants_section": [{ "src": ["*"], "dst": ["autogroup:internet"], "ip": ["tcp:443"] }],
"api_endpoint": "https://api.tailscale.com/api/v2/tailnet/kratail2tid%40passkey/acl",
"api_method": "POST",
"api_response_code": 200
},
"topology": {
"nodes": {
"exit-node": {
"mts_name": "exit-node",
"socket": "/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock",
"hostname": "exit-node",
"user_id": 4041918547170221,
"tags": ["tag:exit"],
"ipv4": "100.85.66.106",
"ipv6": "fd7a:115c:a1e0::7c37:426a"
},
"subnet-router": {
"mts_name": "subnet-router",
"socket": "/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock",
"hostname": "subnet-router",
"user_id": 7489538288452506,
"tags": ["tag:router"],
"ipv4": "100.92.142.61",
"ipv6": "fd7a:115c:a1e0::3e37:8e3d"
},
"tagged-client": {
"mts_name": "tagged-client",
"socket": "/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock",
"hostname": "tagged-client",
"user_id": 4031348162889210,
"tags": ["tag:client"],
"ipv4": "100.83.200.69",
"ipv6": "fd7a:115c:a1e0::c537:c845"
},
"tagged-prod": {
"mts_name": "tagged-prod",
"socket": "/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock",
"hostname": "tagged-prod",
"user_id": 301794218943819,
"tags": ["tag:prod"],
"ipv4": "100.103.8.15",
"ipv6": "fd7a:115c:a1e0::5b37:80f"
},
"tagged-server": {
"mts_name": "tagged-server",
"socket": "/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock",
"hostname": "tagged-server",
"user_id": 1440249486084758,
"tags": ["tag:server"],
"ipv4": "100.108.74.26",
"ipv6": "fd7a:115c:a1e0::b901:4a87"
},
"user-kris": {
"mts_name": "user-kris",
"socket": "/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock",
"hostname": "user-kris",
"user_id": 4538565228176803,
"tags": [],
"ipv4": "100.110.121.96",
"ipv6": "fd7a:115c:a1e0::1737:7960"
},
"user-mon": {
"mts_name": "user-mon",
"socket": "/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock",
"hostname": "user-mon",
"user_id": 3982058329734709,
"tags": [],
"ipv4": "100.103.90.82",
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
},
"user1": {
"mts_name": "user1",
"socket": "/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock",
"hostname": "user1",
"user_id": 4156223528223174,
"tags": [],
"ipv4": "100.90.199.68",
"ipv6": "fd7a:115c:a1e0::2d01:c747"
}
}
},
"captures": {
"exit-node": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.92.142.61": {
"peer_name": "subnet-router",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock whois --json 100.92.142.61",
"response": null
},
"100.83.200.69": {
"peer_name": "tagged-client",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock whois --json 100.83.200.69",
"response": null
},
"100.103.8.15": {
"peer_name": "tagged-prod",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock whois --json 100.103.8.15",
"response": null
},
"100.108.74.26": {
"peer_name": "tagged-server",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock whois --json 100.108.74.26",
"response": null
},
"100.110.121.96": {
"peer_name": "user-kris",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock whois --json 100.110.121.96",
"response": null
},
"100.103.90.82": {
"peer_name": "user-mon",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock whois --json 100.103.90.82",
"response": null
},
"100.90.199.68": {
"peer_name": "user1",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock whois --json 100.90.199.68",
"response": null
}
}
},
"subnet-router": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.85.66.106": {
"peer_name": "exit-node",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock whois --json 100.85.66.106",
"response": null
},
"100.83.200.69": {
"peer_name": "tagged-client",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock whois --json 100.83.200.69",
"response": null
},
"100.103.8.15": {
"peer_name": "tagged-prod",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock whois --json 100.103.8.15",
"response": null
},
"100.108.74.26": {
"peer_name": "tagged-server",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock whois --json 100.108.74.26",
"response": null
},
"100.110.121.96": {
"peer_name": "user-kris",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock whois --json 100.110.121.96",
"response": null
},
"100.103.90.82": {
"peer_name": "user-mon",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock whois --json 100.103.90.82",
"response": null
},
"100.90.199.68": {
"peer_name": "user1",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock whois --json 100.90.199.68",
"response": null
}
}
},
"tagged-client": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.85.66.106": {
"peer_name": "exit-node",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock whois --json 100.85.66.106",
"response": null
},
"100.92.142.61": {
"peer_name": "subnet-router",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock whois --json 100.92.142.61",
"response": null
},
"100.103.8.15": {
"peer_name": "tagged-prod",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock whois --json 100.103.8.15",
"response": null
},
"100.108.74.26": {
"peer_name": "tagged-server",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock whois --json 100.108.74.26",
"response": null
},
"100.110.121.96": {
"peer_name": "user-kris",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock whois --json 100.110.121.96",
"response": null
},
"100.103.90.82": {
"peer_name": "user-mon",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock whois --json 100.103.90.82",
"response": null
},
"100.90.199.68": {
"peer_name": "user1",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock whois --json 100.90.199.68",
"response": null
}
}
},
"tagged-prod": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.85.66.106": {
"peer_name": "exit-node",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock whois --json 100.85.66.106",
"response": null
},
"100.92.142.61": {
"peer_name": "subnet-router",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock whois --json 100.92.142.61",
"response": null
},
"100.83.200.69": {
"peer_name": "tagged-client",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock whois --json 100.83.200.69",
"response": null
},
"100.108.74.26": {
"peer_name": "tagged-server",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock whois --json 100.108.74.26",
"response": null
},
"100.110.121.96": {
"peer_name": "user-kris",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock whois --json 100.110.121.96",
"response": null
},
"100.103.90.82": {
"peer_name": "user-mon",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock whois --json 100.103.90.82",
"response": null
},
"100.90.199.68": {
"peer_name": "user1",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock whois --json 100.90.199.68",
"response": null
}
}
},
"tagged-server": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.85.66.106": {
"peer_name": "exit-node",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock whois --json 100.85.66.106",
"response": null
},
"100.92.142.61": {
"peer_name": "subnet-router",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock whois --json 100.92.142.61",
"response": null
},
"100.83.200.69": {
"peer_name": "tagged-client",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock whois --json 100.83.200.69",
"response": null
},
"100.103.8.15": {
"peer_name": "tagged-prod",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock whois --json 100.103.8.15",
"response": null
},
"100.110.121.96": {
"peer_name": "user-kris",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock whois --json 100.110.121.96",
"response": null
},
"100.103.90.82": {
"peer_name": "user-mon",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock whois --json 100.103.90.82",
"response": null
},
"100.90.199.68": {
"peer_name": "user1",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock whois --json 100.90.199.68",
"response": null
}
}
},
"user-kris": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.85.66.106": {
"peer_name": "exit-node",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock whois --json 100.85.66.106",
"response": null
},
"100.92.142.61": {
"peer_name": "subnet-router",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock whois --json 100.92.142.61",
"response": null
},
"100.83.200.69": {
"peer_name": "tagged-client",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock whois --json 100.83.200.69",
"response": null
},
"100.103.8.15": {
"peer_name": "tagged-prod",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock whois --json 100.103.8.15",
"response": null
},
"100.108.74.26": {
"peer_name": "tagged-server",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock whois --json 100.108.74.26",
"response": null
},
"100.103.90.82": {
"peer_name": "user-mon",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock whois --json 100.103.90.82",
"response": null
},
"100.90.199.68": {
"peer_name": "user1",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock whois --json 100.90.199.68",
"response": null
}
}
},
"user-mon": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.85.66.106": {
"peer_name": "exit-node",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock whois --json 100.85.66.106",
"response": null
},
"100.92.142.61": {
"peer_name": "subnet-router",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock whois --json 100.92.142.61",
"response": null
},
"100.83.200.69": {
"peer_name": "tagged-client",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock whois --json 100.83.200.69",
"response": null
},
"100.103.8.15": {
"peer_name": "tagged-prod",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock whois --json 100.103.8.15",
"response": null
},
"100.108.74.26": {
"peer_name": "tagged-server",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock whois --json 100.108.74.26",
"response": null
},
"100.110.121.96": {
"peer_name": "user-kris",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock whois --json 100.110.121.96",
"response": null
},
"100.90.199.68": {
"peer_name": "user1",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock whois --json 100.90.199.68",
"response": null
}
}
},
"user1": {
"commands": {
"packet_filter_rules": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock debug localapi POST debug-packet-filter-rules",
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": null,
"packet_filter_matches": [],
"whois": {
"100.85.66.106": {
"peer_name": "exit-node",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock whois --json 100.85.66.106",
"response": null
},
"100.92.142.61": {
"peer_name": "subnet-router",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock whois --json 100.92.142.61",
"response": null
},
"100.83.200.69": {
"peer_name": "tagged-client",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock whois --json 100.83.200.69",
"response": null
},
"100.103.8.15": {
"peer_name": "tagged-prod",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock whois --json 100.103.8.15",
"response": null
},
"100.108.74.26": {
"peer_name": "tagged-server",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock whois --json 100.108.74.26",
"response": null
},
"100.110.121.96": {
"peer_name": "user-kris",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock whois --json 100.110.121.96",
"response": null
},
"100.103.90.82": {
"peer_name": "user-mon",
"command": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock whois --json 100.103.90.82",
"response": null
}
}
}
}
}