policy/v2: add advertised routes to compat test topologies

Add routable_ips and approved_routes fields to the node topology
definitions in all golden test files. These represent the subnet
routes actually advertised by nodes on the Tailscale SaaS network
during data capture:

  Routes topology (92 files, 6 router nodes):
    big-router:     10.0.0.0/8
    subnet-router:  10.33.0.0/16
    ha-router1:     192.168.1.0/24
    ha-router2:     192.168.1.0/24
    multi-router:   172.16.0.0/24
    exit-node:      0.0.0.0/0, ::/0

  ACL topology (199 files, 1 router node):
    subnet-router:  10.33.0.0/16

  Grants topology (203 files, 1 router node):
    subnet-router:  10.33.0.0/16

The route assignments were deduced from the golden data by analyzing
which router nodes receive FilterRules for which destination CIDRs
across all test files, and cross-referenced with the MTS setup
script (setup_grant_nodes.sh).

Updates #2180
This commit is contained in:
Kristoffer Dalby 2026-03-18 13:40:19 +00:00
parent 927ce418d2
commit 995ed0187c
494 changed files with 76022 additions and 15770 deletions

View file

@ -38,7 +38,13 @@
}
]
},
"grants_section": [{ "src": ["internal"], "dst": ["*"], "ip": ["*"] }],
"grants_section": [
{
"src": ["internal"],
"dst": ["*"],
"ip": ["*"]
}
],
"api_endpoint": "https://api.tailscale.com/api/v2/tailnet/kratail2tid%40passkey/acl",
"api_method": "POST",
"api_response_code": 200
@ -61,7 +67,9 @@
"user_id": 7489538288452506,
"tags": ["tag:router"],
"ipv4": "100.92.142.61",
"ipv6": "fd7a:115c:a1e0::3e37:8e3d"
"ipv6": "fd7a:115c:a1e0::3e37:8e3d",
"routable_ips": ["10.33.0.0/16"],
"approved_routes": ["10.33.0.0/16"]
},
"tagged-client": {
"mts_name": "tagged-client",
@ -126,7 +134,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/exit-node/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -134,8 +153,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -166,8 +197,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -178,7 +215,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -220,7 +261,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/subnet-router/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -228,8 +280,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -260,8 +324,14 @@
"OS": "linux",
"Hostname": "exit-node",
"Services": [
{ "Proto": "peerapi4", "Port": 37000 },
{ "Proto": "peerapi6", "Port": 37000 }
{
"Proto": "peerapi4",
"Port": 37000
},
{
"Proto": "peerapi6",
"Port": 37000
}
]
},
"Created": "2026-02-23T00:13:20.566112173Z",
@ -271,7 +341,11 @@
"ComputedName": "exit-node",
"ComputedNameWithHost": "exit-node"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -300,8 +374,14 @@
"OS": "linux",
"Hostname": "tagged-client",
"Services": [
{ "Proto": "peerapi4", "Port": 41378 },
{ "Proto": "peerapi6", "Port": 41378 }
{
"Proto": "peerapi4",
"Port": 41378
},
{
"Proto": "peerapi6",
"Port": 41378
}
]
},
"Created": "2026-02-23T00:13:11.017324028Z",
@ -311,7 +391,11 @@
"ComputedName": "tagged-client",
"ComputedNameWithHost": "tagged-client"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -340,8 +424,14 @@
"OS": "linux",
"Hostname": "tagged-prod",
"Services": [
{ "Proto": "peerapi4", "Port": 37678 },
{ "Proto": "peerapi6", "Port": 37678 }
{
"Proto": "peerapi4",
"Port": 37678
},
{
"Proto": "peerapi6",
"Port": 37678
}
]
},
"Created": "2026-02-20T14:03:12.89283153Z",
@ -351,7 +441,11 @@
"ComputedName": "tagged-prod",
"ComputedNameWithHost": "tagged-prod"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -380,8 +474,14 @@
"OS": "linux",
"Hostname": "tagged-server",
"Services": [
{ "Proto": "peerapi4", "Port": 46499 },
{ "Proto": "peerapi6", "Port": 46499 }
{
"Proto": "peerapi4",
"Port": 46499
},
{
"Proto": "peerapi6",
"Port": 46499
}
]
},
"Created": "2026-01-23T10:10:26.365653609Z",
@ -391,7 +491,11 @@
"ComputedName": "tagged-server",
"ComputedNameWithHost": "tagged-server"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -421,8 +525,14 @@
"OS": "linux",
"Hostname": "user-kris",
"Services": [
{ "Proto": "peerapi4", "Port": 40159 },
{ "Proto": "peerapi6", "Port": 40159 }
{
"Proto": "peerapi4",
"Port": 40159
},
{
"Proto": "peerapi6",
"Port": 40159
}
]
},
"Created": "2026-02-20T14:09:34.803901523Z",
@ -431,7 +541,11 @@
"ComputedName": "user-kris",
"ComputedNameWithHost": "user-kris"
},
"UserProfile": { "ID": 4538565228176803, "LoginName": "kristoffer@dalby.cc", "DisplayName": "kristoffer" },
"UserProfile": {
"ID": 4538565228176803,
"LoginName": "kristoffer@dalby.cc",
"DisplayName": "kristoffer"
},
"CapMap": null
}
},
@ -461,8 +575,14 @@
"OS": "linux",
"Hostname": "user-mon",
"Services": [
{ "Proto": "peerapi4", "Port": 33201 },
{ "Proto": "peerapi6", "Port": 33201 }
{
"Proto": "peerapi4",
"Port": 33201
},
{
"Proto": "peerapi6",
"Port": 33201
}
]
},
"Created": "2026-02-20T14:09:00.203639664Z",
@ -505,8 +625,14 @@
"OS": "linux",
"Hostname": "user1",
"Services": [
{ "Proto": "peerapi4", "Port": 46708 },
{ "Proto": "peerapi6", "Port": 46708 }
{
"Proto": "peerapi4",
"Port": 46708
},
{
"Proto": "peerapi6",
"Port": 46708
}
]
},
"Created": "2026-01-23T10:04:13.531671894Z",
@ -515,7 +641,11 @@
"ComputedName": "user1",
"ComputedNameWithHost": "user1"
},
"UserProfile": { "ID": 4156223528223174, "LoginName": "kratail2tid@passkey", "DisplayName": "kratail2tid" },
"UserProfile": {
"ID": 4156223528223174,
"LoginName": "kratail2tid@passkey",
"DisplayName": "kratail2tid"
},
"CapMap": null
}
}
@ -527,7 +657,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-client/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -535,8 +676,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -572,8 +725,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -584,7 +743,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -621,7 +784,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-prod/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -629,8 +803,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -666,8 +852,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -678,7 +870,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -715,7 +911,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/tagged-server/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -723,8 +930,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -760,8 +979,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -772,7 +997,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -809,7 +1038,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-kris/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -817,8 +1057,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -854,8 +1106,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -866,7 +1124,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -903,7 +1165,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user-mon/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -911,8 +1184,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -948,8 +1233,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -960,7 +1251,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},
@ -997,7 +1292,18 @@
"packet_filter_matches": "/home/kradalby/go/bin/tailscale --socket=/home/kradalby/.config/multi-tailscale-dev/user1/tailscaled.sock debug localapi POST debug-packet-filter-matches"
},
"packet_filter_rules": [
{ "SrcIPs": ["10.0.0.0/8"], "DstPorts": [{ "IP": "*", "Ports": { "First": 0, "Last": 65535 } }] }
{
"SrcIPs": ["10.0.0.0/8"],
"DstPorts": [
{
"IP": "*",
"Ports": {
"First": 0,
"Last": 65535
}
}
]
}
],
"packet_filter_matches": [
{
@ -1005,8 +1311,20 @@
"Srcs": ["10.0.0.0/8"],
"SrcCaps": null,
"Dsts": [
{ "Net": "0.0.0.0/0", "Ports": { "First": 0, "Last": 65535 } },
{ "Net": "::/0", "Ports": { "First": 0, "Last": 65535 } }
{
"Net": "0.0.0.0/0",
"Ports": {
"First": 0,
"Last": 65535
}
},
{
"Net": "::/0",
"Ports": {
"First": 0,
"Last": 65535
}
}
],
"Caps": []
}
@ -1042,8 +1360,14 @@
"OS": "linux",
"Hostname": "subnet-router",
"Services": [
{ "Proto": "peerapi4", "Port": 63250 },
{ "Proto": "peerapi6", "Port": 63250 }
{
"Proto": "peerapi4",
"Port": 63250
},
{
"Proto": "peerapi6",
"Port": 63250
}
]
},
"Created": "2026-02-23T00:13:15.731478784Z",
@ -1054,7 +1378,11 @@
"ComputedName": "subnet-router",
"ComputedNameWithHost": "subnet-router"
},
"UserProfile": { "ID": 1260082990019555, "LoginName": "tagged-devices", "DisplayName": "Tagged Devices" },
"UserProfile": {
"ID": 1260082990019555,
"LoginName": "tagged-devices",
"DisplayName": "Tagged Devices"
},
"CapMap": null
}
},