rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

testdata: strip unused fields from all test data files (23MB -> 4MB)

Browse source 
Strip fields not consumed by any test from all 594 HuJSON test data files:

grant_results/ (248 files, 21MB -> 1.8MB):
  - Remove: timestamp, propagation_wait_seconds, input.policy_file,
    input.grants_section, input.api_endpoint, input.api_method,
    topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id,
    captures.commands, captures.packet_filter_matches, captures.whois
  - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes
    + PacketFilterRules) for via_compat_test.go compatibility
  - V17-V25: strip netmap (old topology, incompatible with via_compat harness)

acl_results/ (215 files, 1.4MB -> 1.2MB):
  - Remove: timestamp, propagation_wait_seconds, input.policy_file,
    input.api_endpoint, input.api_response_code, entire topology section
    (parsed by Go struct but completely ignored — nodes are hardcoded)

routes_results/ (92 files, unchanged — topology is actively used):
  - Remove: timestamp, propagation_wait_seconds, input.policy_file,
    input.api_endpoint, input.api_response_code

ssh_results/ (39 files, unchanged — minimal to begin with):
  - Remove: policy_file
This commit is contained in:
Kristoffer Dalby 2026-03-30 17:10:53 +00:00
parent 30dce30a9d
commit 835db974b5
594 changed files with 45359 additions and 535977 deletions
Download patch file Download diff file Expand all files Collapse all files

63
hscontrol/policy/v2/testdata/ssh_results/SSH-A1.hujson vendored
View file

@ -5,14 +5,35 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-A1",
"policy_file": "ssh_policies/ssh_a1.json",
"ssh_section": [{ "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -25,8 +46,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -39,8 +69,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -50,7 +89,11 @@
}
]
},
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

64
hscontrol/policy/v2/testdata/ssh_results/SSH-A2.hujson vendored
View file

@ -5,16 +5,36 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-A2",
"policy_file": "ssh_policies/ssh_a2.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["autogroup:nonroot"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -27,8 +47,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -41,8 +71,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -52,7 +92,11 @@
}
]
},
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

64
hscontrol/policy/v2/testdata/ssh_results/SSH-A3.hujson vendored
View file

@ -5,21 +5,37 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-A3",
"policy_file": "ssh_policies/ssh_a3.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["autogroup:self"],
"users": ["root", "autogroup:nonroot"]
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"root",
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -32,8 +48,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -46,8 +72,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -57,7 +93,11 @@
}
]
},
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

61
hscontrol/policy/v2/testdata/ssh_results/SSH-A4.hujson vendored
View file

@ -5,24 +5,57 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-A4",
"policy_file": "ssh_policies/ssh_a4.json",
"ssh_section": [{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["ubuntu"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"ubuntu"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -32,6 +65,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

60
hscontrol/policy/v2/testdata/ssh_results/SSH-A5.hujson vendored
View file

@ -5,26 +5,58 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-A5",
"policy_file": "ssh_policies/ssh_a5.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["root", "ubuntu"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"root",
"ubuntu"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "root", "ubuntu": "ubuntu" },
"sshUsers": {
"root": "root",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -34,6 +66,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

1
hscontrol/policy/v2/testdata/ssh_results/SSH-A6.hujson vendored
View file

@ -5,7 +5,6 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-A6",
"policy_file": "ssh_policies/ssh_a6.json",
"ssh_section": [
{
"action": "check",

1
hscontrol/policy/v2/testdata/ssh_results/SSH-A7.hujson vendored
View file

@ -5,7 +5,6 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-A7",
"policy_file": "ssh_policies/ssh_a7.json",
"ssh_section": [
{
"action": "check",

1
hscontrol/policy/v2/testdata/ssh_results/SSH-A8.hujson vendored
View file

@ -5,7 +5,6 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-A8",
"policy_file": "ssh_policies/ssh_a8.json",
"ssh_section": [
{
"action": "check",

45
hscontrol/policy/v2/testdata/ssh_results/SSH-B1.hujson vendored
View file

@ -5,17 +5,44 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-B1",
"policy_file": "ssh_policies/ssh_b1.json",
"ssh_section": [{ "action": "accept", "src": ["kristoffer@dalby.cc"], "dst": ["tag:server"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"kristoffer@dalby.cc"
],
"dst": [
"tag:server"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -25,6 +52,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

52
hscontrol/policy/v2/testdata/ssh_results/SSH-B2.hujson vendored
View file

@ -5,22 +5,50 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-B2",
"policy_file": "ssh_policies/ssh_b2.json",
"ssh_section": [{ "action": "accept", "src": ["group:developers"], "dst": ["tag:server"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"group:developers"
],
"dst": [
"tag:server"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" }
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -30,6 +58,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

45
hscontrol/policy/v2/testdata/ssh_results/SSH-B3.hujson vendored
View file

@ -5,17 +5,44 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-B3",
"policy_file": "ssh_policies/ssh_b3.json",
"ssh_section": [{ "action": "accept", "src": ["tag:prod"], "dst": ["tag:server"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"tag:prod"
],
"dst": [
"tag:server"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.8.15" }, { "nodeIP": "fd7a:115c:a1e0::5b37:80f" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.103.8.15"
},
{
"nodeIP": "fd7a:115c:a1e0::5b37:80f"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -25,6 +52,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

52
hscontrol/policy/v2/testdata/ssh_results/SSH-B5.hujson vendored
View file

@ -5,22 +5,50 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-B5",
"policy_file": "ssh_policies/ssh_b5.json",
"ssh_section": [{ "action": "accept", "src": ["user:*@passkey"], "dst": ["tag:server"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"user:*@passkey"
],
"dst": [
"tag:server"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -30,6 +58,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

52
hscontrol/policy/v2/testdata/ssh_results/SSH-B6.hujson vendored
View file

@ -5,22 +5,50 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-B6",
"policy_file": "ssh_policies/ssh_b6.json",
"ssh_section": [{ "action": "accept", "src": ["autogroup:tagged"], "dst": ["tag:server"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"autogroup:tagged"
],
"dst": [
"tag:server"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.8.15" },
{ "nodeIP": "100.108.74.26" },
{ "nodeIP": "fd7a:115c:a1e0::5b37:80f" },
{ "nodeIP": "fd7a:115c:a1e0::b901:4a87" }
{
"nodeIP": "100.103.8.15"
},
{
"nodeIP": "100.108.74.26"
},
{
"nodeIP": "fd7a:115c:a1e0::5b37:80f"
},
{
"nodeIP": "fd7a:115c:a1e0::b901:4a87"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -30,6 +58,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

63
hscontrol/policy/v2/testdata/ssh_results/SSH-C1.hujson vendored
View file

@ -5,14 +5,35 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-C1",
"policy_file": "ssh_policies/ssh_c1.json",
"ssh_section": [{ "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -25,8 +46,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -39,8 +69,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -50,7 +89,11 @@
}
]
},
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

60
hscontrol/policy/v2/testdata/ssh_results/SSH-C2.hujson vendored
View file

@ -5,24 +5,56 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-C2",
"policy_file": "ssh_policies/ssh_c2.json",
"ssh_section": [{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["root"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -32,6 +64,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

43
hscontrol/policy/v2/testdata/ssh_results/SSH-C3.hujson vendored
View file

@ -5,17 +5,38 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-C3",
"policy_file": "ssh_policies/ssh_c3.json",
"ssh_section": [
{ "action": "accept", "src": ["kristoffer@dalby.cc"], "dst": ["kristoffer@dalby.cc"], "users": ["root"] }
{
"action": "accept",
"src": [
"kristoffer@dalby.cc"
],
"dst": [
"kristoffer@dalby.cc"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -25,8 +46,14 @@
}
]
},
"user-mon": { "rules": [] },
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

83
hscontrol/policy/v2/testdata/ssh_results/SSH-C4.hujson vendored
View file

@ -5,26 +5,57 @@
// Expected: SSH rules on 2 of 5 nodes
{
"test_id": "SSH-C4",
"policy_file": "ssh_policies/ssh_c4.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server", "tag:prod"], "users": ["root"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server",
"tag:prod"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -38,14 +69,28 @@
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,

126
hscontrol/policy/v2/testdata/ssh_results/SSH-D10.hujson vendored
View file

@ -5,16 +5,35 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-D10",
"policy_file": "ssh_policies/ssh_d10.json",
"ssh_section": [
{ "action": "accept", "src": ["user:*@passkey"], "dst": ["tag:server"], "users": ["localpart:*@passkey"] }
{
"action": "accept",
"src": [
"user:*@passkey"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -23,8 +42,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -34,12 +62,23 @@
}
]
},
"user-kris": { "rules": [] },
"user-kris": {
"rules": []
},
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -48,8 +87,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -62,8 +110,17 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -72,8 +129,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -82,8 +148,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -92,8 +167,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -103,6 +187,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

154
hscontrol/policy/v2/testdata/ssh_results/SSH-D11.hujson vendored
View file

@ -5,21 +5,37 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D11",
"policy_file": "ssh_policies/ssh_d11.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["localpart:*@passkey", "ubuntu"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey",
"ubuntu"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +44,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -42,8 +67,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -56,8 +91,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -66,8 +111,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -80,8 +134,18 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -90,8 +154,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -100,8 +173,18 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -110,8 +193,18 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -120,8 +213,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -131,6 +233,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

154
hscontrol/policy/v2/testdata/ssh_results/SSH-D12.hujson vendored
View file

@ -5,21 +5,37 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D12",
"policy_file": "ssh_policies/ssh_d12.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["localpart:*@passkey", "ubuntu"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey",
"ubuntu"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +44,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -42,8 +67,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -56,8 +91,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -66,8 +111,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -80,8 +134,18 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -90,8 +154,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -100,8 +173,18 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -110,8 +193,18 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "", "ubuntu": "ubuntu" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "",
"ubuntu": "ubuntu"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -120,8 +213,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -131,6 +233,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

148
hscontrol/policy/v2/testdata/ssh_results/SSH-D2.hujson vendored
View file

@ -5,16 +5,35 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D2",
"policy_file": "ssh_policies/ssh_d2.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["localpart:*@passkey"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -23,8 +42,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -37,8 +65,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -51,8 +88,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -61,8 +107,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -75,8 +130,17 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -85,8 +149,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -95,8 +168,17 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -105,8 +187,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -115,8 +206,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -126,6 +226,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

149
hscontrol/policy/v2/testdata/ssh_results/SSH-D3.hujson vendored
View file

@ -5,16 +5,36 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D3",
"policy_file": "ssh_policies/ssh_d3.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["localpart:*@passkey", "root"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey",
"root"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -23,8 +43,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -37,8 +66,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -51,8 +89,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -61,8 +108,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -75,8 +131,17 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -85,8 +150,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -95,8 +169,17 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -105,8 +188,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -115,8 +207,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -126,6 +227,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

154
hscontrol/policy/v2/testdata/ssh_results/SSH-D4.hujson vendored
View file

@ -5,21 +5,37 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D4",
"policy_file": "ssh_policies/ssh_d4.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["localpart:*@passkey", "autogroup:nonroot"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey",
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +44,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -42,8 +67,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -56,8 +91,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -66,8 +111,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -80,8 +134,18 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -90,8 +154,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -100,8 +173,18 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -110,8 +193,18 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -120,8 +213,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -131,6 +233,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

155
hscontrol/policy/v2/testdata/ssh_results/SSH-D5.hujson vendored
View file

@ -5,21 +5,38 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D5",
"policy_file": "ssh_policies/ssh_d5.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["localpart:*@passkey", "root", "autogroup:nonroot"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey",
"root",
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +45,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -42,8 +68,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -56,8 +92,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -66,8 +112,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -80,8 +135,18 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -90,8 +155,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -100,8 +174,18 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -110,8 +194,18 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -120,8 +214,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -131,6 +234,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

154
hscontrol/policy/v2/testdata/ssh_results/SSH-D6.hujson vendored
View file

@ -5,21 +5,37 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D6",
"policy_file": "ssh_policies/ssh_d6.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["localpart:*@passkey", "autogroup:nonroot"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey",
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +44,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -42,8 +67,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -56,8 +91,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -66,8 +111,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -80,8 +134,18 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -90,8 +154,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -100,8 +173,18 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -110,8 +193,18 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -120,8 +213,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -131,6 +233,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

155
hscontrol/policy/v2/testdata/ssh_results/SSH-D7.hujson vendored
View file

@ -5,21 +5,38 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-D7",
"policy_file": "ssh_policies/ssh_d7.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["localpart:*@passkey", "root", "autogroup:nonroot"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey",
"root",
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +45,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -42,8 +68,18 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -56,8 +92,18 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -66,8 +112,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -80,8 +135,18 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -90,8 +155,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -100,8 +174,18 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -110,8 +194,18 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "*": "=", "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -120,8 +214,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -131,6 +234,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

87
hscontrol/policy/v2/testdata/ssh_results/SSH-D8.hujson vendored
View file

@ -5,16 +5,35 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-D8",
"policy_file": "ssh_policies/ssh_d8.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["localpart:*@passkey"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"localpart:*@passkey"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -23,8 +42,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -37,8 +65,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -51,8 +88,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -61,8 +107,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -72,7 +127,11 @@
}
]
},
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

87
hscontrol/policy/v2/testdata/ssh_results/SSH-D9.hujson vendored
View file

@ -5,21 +5,36 @@
// Expected: SSH rules on 3 of 5 nodes
{
"test_id": "SSH-D9",
"policy_file": "ssh_policies/ssh_d9.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["autogroup:self"],
"users": ["localpart:*@passkey", "root"]
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"localpart:*@passkey",
"root"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +43,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -42,8 +66,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -56,8 +89,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -66,8 +108,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -77,7 +128,11 @@
}
]
},
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

21
hscontrol/policy/v2/testdata/ssh_results/SSH-E3.hujson vendored
View file

@ -5,13 +5,22 @@
// Expected: No SSH rules
{
"test_id": "SSH-E3",
"policy_file": "ssh_policies/ssh_e3.json",
"ssh_section": [],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

21
hscontrol/policy/v2/testdata/ssh_results/SSH-E4.hujson vendored
View file

@ -5,13 +5,22 @@
// Expected: No SSH rules
{
"test_id": "SSH-E4",
"policy_file": "ssh_policies/ssh_e4.json",
"ssh_section": null,
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"tagged-server": { "rules": [] },
"tagged-prod": { "rules": [] }
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": []
},
"tagged-prod": {
"rules": []
}
}
}

54
hscontrol/policy/v2/testdata/ssh_results/SSH-E5.hujson vendored
View file

@ -5,17 +5,44 @@
// Expected: SSH rules on 2 of 5 nodes
{
"test_id": "SSH-E5",
"policy_file": "ssh_policies/ssh_e5.json",
"ssh_section": [{ "action": "accept", "src": ["tag:prod"], "dst": ["tag:server"], "users": ["localpart:*@passkey"] }],
"ssh_section": [
{
"action": "accept",
"src": [
"tag:prod"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.8.15" }, { "nodeIP": "fd7a:115c:a1e0::5b37:80f" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.8.15"
},
{
"nodeIP": "fd7a:115c:a1e0::5b37:80f"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -28,8 +55,17 @@
"tagged-prod": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.8.15" }, { "nodeIP": "fd7a:115c:a1e0::5b37:80f" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.8.15"
},
{
"nodeIP": "fd7a:115c:a1e0::5b37:80f"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,

1
hscontrol/policy/v2/testdata/ssh_results/SSH-E6.hujson vendored
View file

@ -5,7 +5,6 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-E6",
"policy_file": "ssh_policies/ssh_e6.json",
"ssh_section": [
{
"action": "check",

99
hscontrol/policy/v2/testdata/ssh_results/SSH-F1.hujson vendored
View file

@ -7,17 +7,47 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-F1",
"policy_file": "ssh_policies/ssh_f1.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["root"] },
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["autogroup:nonroot"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"root"
]
},
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -30,8 +60,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -44,8 +83,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "root" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -59,14 +107,29 @@
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "*": "=", "root": "" },
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -76,6 +139,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

1
hscontrol/policy/v2/testdata/ssh_results/SSH-F2.hujson vendored
View file

@ -7,7 +7,6 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-F2",
"policy_file": "ssh_policies/ssh_f2.json",
"ssh_section": [
{
"action": "accept",

253
hscontrol/policy/v2/testdata/ssh_results/SSH-F3.hujson vendored
View file

@ -7,17 +7,47 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-F3",
"policy_file": "ssh_policies/ssh_f3.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["localpart:*@passkey"] },
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["root"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey"
]
},
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"root"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -26,8 +56,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -40,8 +79,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -54,8 +102,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -64,8 +121,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -78,48 +144,17 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -129,14 +164,104 @@
},
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -146,6 +271,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

254
hscontrol/policy/v2/testdata/ssh_results/SSH-F4.hujson vendored
View file

@ -7,17 +7,47 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-F4",
"policy_file": "ssh_policies/ssh_f4.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["localpart:*@passkey"] },
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["autogroup:nonroot"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey"
]
},
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"autogroup:nonroot"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -26,8 +56,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -40,8 +79,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -54,8 +102,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -64,8 +121,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -78,48 +144,17 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -129,14 +164,105 @@
},
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": { "*": "=", "root": "" },
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
}
},
{
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"*": "=",
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -146,6 +272,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

226
hscontrol/policy/v2/testdata/ssh_results/SSH-F5.hujson vendored
View file

@ -7,17 +7,47 @@
// Expected: SSH rules on 4 of 5 nodes
{
"test_id": "SSH-F5",
"policy_file": "ssh_policies/ssh_f5.json",
"ssh_section": [
{ "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self"], "users": ["localpart:*@passkey"] },
{ "action": "accept", "src": ["autogroup:member"], "dst": ["tag:server"], "users": ["localpart:*@passkey"] }
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"autogroup:self"
],
"users": [
"localpart:*@passkey"
]
},
{
"action": "accept",
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"localpart:*@passkey"
]
}
],
"nodes": {
"user1": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -26,8 +56,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -36,8 +75,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -46,8 +94,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -60,8 +117,17 @@
"user-kris": {
"rules": [
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -70,8 +136,17 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -84,8 +159,17 @@
"user-mon": {
"rules": [
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -94,8 +178,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -104,8 +197,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -114,8 +216,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -128,8 +239,17 @@
"tagged-server": {
"rules": [
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -138,8 +258,17 @@
}
},
{
"principals": [{ "nodeIP": "100.90.199.68" }, { "nodeIP": "fd7a:115c:a1e0::2d01:c747" }],
"sshUsers": { "kratail2tid": "kratail2tid" },
"principals": [
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
}
],
"sshUsers": {
"kratail2tid": "kratail2tid"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -148,8 +277,17 @@
}
},
{
"principals": [{ "nodeIP": "100.110.121.96" }, { "nodeIP": "fd7a:115c:a1e0::1737:7960" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -158,8 +296,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "root": "" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"root": ""
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -168,8 +315,17 @@
}
},
{
"principals": [{ "nodeIP": "100.103.90.82" }, { "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }],
"sshUsers": { "monitorpasskeykradalby": "monitorpasskeykradalby" },
"principals": [
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": {
"monitorpasskeykradalby": "monitorpasskeykradalby"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
@ -179,6 +335,8 @@
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

67
hscontrol/policy/v2/testdata/ssh_results/SSH-G1.hujson vendored
View file

@ -5,42 +5,75 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-G1",
"policy_file": "ssh_policies/ssh_g1.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["root"],
"acceptEnv": ["GIT_EDITOR", "TERM"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"root"
],
"acceptEnv": [
"GIT_EDITOR",
"TERM"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
},
"acceptEnv": ["GIT_EDITOR", "TERM"]
"acceptEnv": [
"GIT_EDITOR",
"TERM"
]
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}

67
hscontrol/policy/v2/testdata/ssh_results/SSH-G2.hujson vendored
View file

@ -5,42 +5,75 @@
// Expected: SSH rules on 1 of 5 nodes
{
"test_id": "SSH-G2",
"policy_file": "ssh_policies/ssh_g2.json",
"ssh_section": [
{
"action": "accept",
"src": ["autogroup:member"],
"dst": ["tag:server"],
"users": ["root"],
"acceptEnv": ["GIT_*", "CUSTOM_VAR_?"]
"src": [
"autogroup:member"
],
"dst": [
"tag:server"
],
"users": [
"root"
],
"acceptEnv": [
"GIT_*",
"CUSTOM_VAR_?"
]
}
],
"nodes": {
"user1": { "rules": [] },
"user-kris": { "rules": [] },
"user-mon": { "rules": [] },
"user1": {
"rules": []
},
"user-kris": {
"rules": []
},
"user-mon": {
"rules": []
},
"tagged-server": {
"rules": [
{
"principals": [
{ "nodeIP": "100.103.90.82" },
{ "nodeIP": "100.110.121.96" },
{ "nodeIP": "100.90.199.68" },
{ "nodeIP": "fd7a:115c:a1e0::1737:7960" },
{ "nodeIP": "fd7a:115c:a1e0::2d01:c747" },
{ "nodeIP": "fd7a:115c:a1e0::9e37:5a52" }
{
"nodeIP": "100.103.90.82"
},
{
"nodeIP": "100.110.121.96"
},
{
"nodeIP": "100.90.199.68"
},
{
"nodeIP": "fd7a:115c:a1e0::1737:7960"
},
{
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
},
{
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
}
],
"sshUsers": { "root": "root" },
"sshUsers": {
"root": "root"
},
"action": {
"accept": true,
"allowAgentForwarding": true,
"allowLocalPortForwarding": true,
"allowRemotePortForwarding": true
},
"acceptEnv": ["GIT_*", "CUSTOM_VAR_?"]
"acceptEnv": [
"GIT_*",
"CUSTOM_VAR_?"
]
}
]
},
"tagged-prod": { "rules": [] }
"tagged-prod": {
"rules": []
}
}
}