rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
headscale/hscontrol/policy/v2/testdata/acl_results/ACL-K01.hujson

146 lines
3.3 KiB
Text
Raw Normal View History

testdata: convert .json to .hujson with header comments Rename all 594 test data files from .json to .hujson and add descriptive header comments to each file documenting what policy rules are under test and what outcome is expected. Update test loaders in all 5 _test.go files to parse HuJSON via hujson.Parse/Standardize/Pack before json.Unmarshal. Add cross-dependency warning to via_compat_test.go documenting that GRANT-V29/V30/V31/V36 are shared with TestGrantsCompat. Add .gitignore exemption for testdata HuJSON files.
2026-03-30 17:08:26 +00:00
// ACL-K01
//
// ACL: accept: src=['*', 'autogroup:member', 'autogroup:tagged', 'group:admins', 'tag:client', 'webserver', '100.90.199.68'] dst=['tag:server:22']
//
// Expected: Rules on tagged-server
policy/v2: convert ACL compat tests to data-driven format with Tailscale SaaS captures Replace 9,937 lines of inline Go test expectations with 215 JSON golden files captured from Tailscale SaaS. The new data-driven test driver compares headscale's filter compilation output against real Tailscale behavior for each node in an 8-node topology. Updates #2180
2026-03-17 11:13:04 +00:00
{
"test_id": "ACL-K01",
"input": {
"full_policy": {
"groups": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"group:admins": [
"kratail2tid@passkey"
],
"group:developers": [
"kristoffer@dalby.cc",
"kratail2tid@passkey"
],
"group:monitors": [
"monitorpasskeykradalby@passkey"
],
policy/v2: convert ACL compat tests to data-driven format with Tailscale SaaS captures Replace 9,937 lines of inline Go test expectations with 215 JSON golden files captured from Tailscale SaaS. The new data-driven test driver compares headscale's filter compilation output against real Tailscale behavior for each node in an 8-node topology. Updates #2180
2026-03-17 11:13:04 +00:00
"group:empty": []
},
"tagOwners": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"tag:server": [
"kratail2tid@passkey"
],
"tag:prod": [
"kratail2tid@passkey"
],
"tag:client": [
"kratail2tid@passkey"
],
"tag:router": [
"kratail2tid@passkey"
],
"tag:exit": [
"kratail2tid@passkey"
]
policy/v2: convert ACL compat tests to data-driven format with Tailscale SaaS captures Replace 9,937 lines of inline Go test expectations with 215 JSON golden files captured from Tailscale SaaS. The new data-driven test driver compares headscale's filter compilation output against real Tailscale behavior for each node in an 8-node topology. Updates #2180
2026-03-17 11:13:04 +00:00
},
"hosts": {
"webserver": "100.108.74.26",
"prodbox": "100.103.8.15",
"internal": "10.0.0.0/8",
"subnet24": "192.168.1.0/24"
},
"autoApprovers": {
"routes": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"10.33.0.0/16": [
"tag:router"
],
"0.0.0.0/0": [
"tag:exit"
],
"::/0": [
"tag:exit"
]
policy/v2: convert ACL compat tests to data-driven format with Tailscale SaaS captures Replace 9,937 lines of inline Go test expectations with 215 JSON golden files captured from Tailscale SaaS. The new data-driven test driver compares headscale's filter compilation output against real Tailscale behavior for each node in an 8-node topology. Updates #2180
2026-03-17 11:13:04 +00:00
}
},
"acls": [
{
"action": "accept",
"src": [
"*",
"autogroup:member",
"autogroup:tagged",
"group:admins",
"tag:client",
"webserver",
"100.90.199.68"
],
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"dst": [
"tag:server:22"
]
policy/v2: convert ACL compat tests to data-driven format with Tailscale SaaS captures Replace 9,937 lines of inline Go test expectations with 215 JSON golden files captured from Tailscale SaaS. The new data-driven test driver compares headscale's filter compilation output against real Tailscale behavior for each node in an 8-node topology. Updates #2180
2026-03-17 11:13:04 +00:00
}
]
}
},
"captures": {
"exit-node": {
"packet_filter_rules": null
},
"subnet-router": {
"packet_filter_rules": null
},
"tagged-client": {
"packet_filter_rules": null
},
"tagged-prod": {
"packet_filter_rules": null
},
"tagged-server": {
"packet_filter_rules": [
{
"SrcIPs": [
"10.33.0.0/16",
"100.103.8.15",
"100.103.90.82",
"100.108.74.26",
"100.110.121.96",
"100.115.94.0-100.127.255.255",
"100.64.0.0-100.115.91.255",
"100.83.200.69",
"100.85.66.106",
"100.90.199.68",
"100.92.142.61",
"fd7a:115c:a1e0::/48",
"fd7a:115c:a1e0::1737:7960",
"fd7a:115c:a1e0::2d01:c747",
"fd7a:115c:a1e0::3e37:8e3d",
"fd7a:115c:a1e0::5b37:80f",
"fd7a:115c:a1e0::7c37:426a",
"fd7a:115c:a1e0::9e37:5a52",
"fd7a:115c:a1e0::b901:4a87",
"fd7a:115c:a1e0::c537:c845"
],
"DstPorts": [
{
"IP": "100.108.74.26",
"Ports": {
"First": 22,
"Last": 22
}
},
{
"IP": "fd7a:115c:a1e0::b901:4a87",
"Ports": {
"First": 22,
"Last": 22
}
}
]
}
]
},
"user-kris": {
"packet_filter_rules": null
},
"user-mon": {
"packet_filter_rules": null
},
"user1": {
"packet_filter_rules": null
}
}
}
Reference in a new issue Copy permalink