policy/v2: overhaul compat test infrastructure
Reworks the ACL/routes/grant/SSH compat harnesses to read testcapture.Capture typed files, per-scenario topologies, strict error wording match, and shared helpers. Surfaces policy-engine drift against Tailscale SaaS. Updates #3157
This commit is contained in:
Kristoffer Dalby
parent
f34dec2754
commit
a7c9721faa
5 changed files with 2335 additions and 712 deletions
|
|
@ -1,27 +1,24 @@
|
|||
// This file is "generated" by Claude.
|
||||
// It contains a data-driven test that reads 237 GRANT-*.json test files
|
||||
// captured from Tailscale SaaS. Each file contains:
|
||||
// - A policy with grants (and optionally ACLs)
|
||||
// - The expected packet_filter_rules for each of 8 test nodes
|
||||
// This file implements a data-driven test runner for grant compatibility
|
||||
// tests. It loads HuJSON golden files from testdata/grant_results/grant-*.hujson
|
||||
// and via-grant-*.hujson, captured from Tailscale SaaS by tscap, and compares
|
||||
// headscale's grants engine output against the captured packet filter rules.
|
||||
//
|
||||
// Each file is a testcapture.Capture containing:
|
||||
// - A full policy with grants (and optionally ACLs)
|
||||
// - The expected packet_filter_rules for each of 8-15 test nodes
|
||||
// - Or an error response for invalid policies
|
||||
//
|
||||
// The test loads each JSON file, applies the policy through headscale's
|
||||
// grants engine, and compares the output against Tailscale's actual behavior.
|
||||
// Tests known to fail due to unimplemented features or known differences are
|
||||
// skipped with a TODO comment explaining the root cause. As headscale's grants
|
||||
// implementation improves, tests should be removed from the skip list.
|
||||
//
|
||||
// Tests that are known to fail due to unimplemented features or known
|
||||
// differences are skipped with a TODO comment explaining the root cause.
|
||||
// As headscale's grants implementation improves, tests should be removed
|
||||
// from the skip list.
|
||||
//
|
||||
// Test data source: testdata/grant_results/GRANT-*.json
|
||||
// Captured from: Tailscale SaaS API + tailscale debug localapi
|
||||
// Test data source: testdata/grant_results/{grant,via-grant}-*.hujson
|
||||
// Source format: github.com/juanfont/headscale/hscontrol/types/testcapture
|
||||
|
||||
package v2
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/netip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
|
@ -30,54 +27,33 @@ import (
|
|||
"github.com/google/go-cmp/cmp/cmpopts"
|
||||
"github.com/juanfont/headscale/hscontrol/policy/policyutil"
|
||||
"github.com/juanfont/headscale/hscontrol/types"
|
||||
"github.com/juanfont/headscale/hscontrol/types/testcapture"
|
||||
"github.com/stretchr/testify/require"
|
||||
"github.com/tailscale/hujson"
|
||||
"gorm.io/gorm"
|
||||
"tailscale.com/tailcfg"
|
||||
)
|
||||
|
||||
// grantTestFile represents the JSON structure of a captured grant test file.
|
||||
type grantTestFile struct {
|
||||
TestID string `json:"test_id"`
|
||||
Error bool `json:"error"`
|
||||
Input struct {
|
||||
FullPolicy json.RawMessage `json:"full_policy"`
|
||||
APIResponseCode int `json:"api_response_code"`
|
||||
APIResponseBody *struct {
|
||||
Message string `json:"message"`
|
||||
} `json:"api_response_body"`
|
||||
} `json:"input"`
|
||||
Topology struct {
|
||||
Nodes map[string]struct {
|
||||
Hostname string `json:"hostname"`
|
||||
Tags []string `json:"tags"`
|
||||
IPv4 string `json:"ipv4"`
|
||||
IPv6 string `json:"ipv6"`
|
||||
} `json:"nodes"`
|
||||
} `json:"topology"`
|
||||
Captures map[string]struct {
|
||||
PacketFilterRules json.RawMessage `json:"packet_filter_rules"`
|
||||
} `json:"captures"`
|
||||
}
|
||||
|
||||
// setupGrantsCompatUsers returns the 3 test users for grants compatibility tests.
|
||||
// Email addresses use @example.com domain, matching the converted Tailscale policy format.
|
||||
// Users get norse-god names; nodes get original-151 pokémon names — matching
|
||||
// the anonymized identifiers tscap writes into the capture files
|
||||
// (see github.com/kradalby/tscap/anonymize).
|
||||
func setupGrantsCompatUsers() types.Users {
|
||||
return types.Users{
|
||||
{Model: gorm.Model{ID: 1}, Name: "kratail2tid", Email: "kratail2tid@example.com"},
|
||||
{Model: gorm.Model{ID: 2}, Name: "kristoffer", Email: "kristoffer@example.com"},
|
||||
{Model: gorm.Model{ID: 3}, Name: "monitorpasskeykradalby", Email: "monitorpasskeykradalby@example.com"},
|
||||
{Model: gorm.Model{ID: 1}, Name: "odin", Email: "odin@example.com"},
|
||||
{Model: gorm.Model{ID: 2}, Name: "thor", Email: "thor@example.org"},
|
||||
{Model: gorm.Model{ID: 3}, Name: "freya", Email: "freya@example.com"},
|
||||
}
|
||||
}
|
||||
|
||||
// setupGrantsCompatNodes returns the 8 test nodes for grants compatibility tests.
|
||||
// setupGrantsCompatNodes returns the 15 test nodes for grants compatibility tests.
|
||||
// The node configuration matches the Tailscale test environment:
|
||||
// - 3 user-owned nodes (user1, user-kris, user-mon)
|
||||
// - 5 tagged nodes (tagged-server, tagged-prod, tagged-client, subnet-router, exit-node)
|
||||
// - 3 user-owned nodes (bulbasaur, ivysaur, venusaur)
|
||||
// - 12 tagged nodes (beedrill, kakuna, weedle, squirtle, charmander,
|
||||
// pidgey, pidgeotto, rattata, raticate, spearow, fearow, blastoise)
|
||||
func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
||||
nodeUser1 := &types.Node{
|
||||
nodeBulbasaur := &types.Node{
|
||||
ID: 1,
|
||||
GivenName: "user1",
|
||||
GivenName: "bulbasaur",
|
||||
User: &users[0],
|
||||
UserID: &users[0].ID,
|
||||
IPv4: ptrAddr("100.90.199.68"),
|
||||
|
|
@ -85,9 +61,9 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeUserKris := &types.Node{
|
||||
nodeIvysaur := &types.Node{
|
||||
ID: 2,
|
||||
GivenName: "user-kris",
|
||||
GivenName: "ivysaur",
|
||||
User: &users[1],
|
||||
UserID: &users[1].ID,
|
||||
IPv4: ptrAddr("100.110.121.96"),
|
||||
|
|
@ -95,9 +71,9 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeUserMon := &types.Node{
|
||||
nodeVenusaur := &types.Node{
|
||||
ID: 3,
|
||||
GivenName: "user-mon",
|
||||
GivenName: "venusaur",
|
||||
User: &users[2],
|
||||
UserID: &users[2].ID,
|
||||
IPv4: ptrAddr("100.103.90.82"),
|
||||
|
|
@ -105,36 +81,36 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeTaggedServer := &types.Node{
|
||||
nodeBeedrill := &types.Node{
|
||||
ID: 4,
|
||||
GivenName: "tagged-server",
|
||||
GivenName: "beedrill",
|
||||
IPv4: ptrAddr("100.108.74.26"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::b901:4a87"),
|
||||
Tags: []string{"tag:server"},
|
||||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeTaggedProd := &types.Node{
|
||||
nodeKakuna := &types.Node{
|
||||
ID: 5,
|
||||
GivenName: "tagged-prod",
|
||||
GivenName: "kakuna",
|
||||
IPv4: ptrAddr("100.103.8.15"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::5b37:80f"),
|
||||
Tags: []string{"tag:prod"},
|
||||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeTaggedClient := &types.Node{
|
||||
nodeWeedle := &types.Node{
|
||||
ID: 6,
|
||||
GivenName: "tagged-client",
|
||||
GivenName: "weedle",
|
||||
IPv4: ptrAddr("100.83.200.69"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::c537:c845"),
|
||||
Tags: []string{"tag:client"},
|
||||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeSubnetRouter := &types.Node{
|
||||
nodeSquirtle := &types.Node{
|
||||
ID: 7,
|
||||
GivenName: "subnet-router",
|
||||
GivenName: "squirtle",
|
||||
IPv4: ptrAddr("100.92.142.61"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::3e37:8e3d"),
|
||||
Tags: []string{"tag:router"},
|
||||
|
|
@ -144,9 +120,9 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
ApprovedRoutes: []netip.Prefix{netip.MustParsePrefix("10.33.0.0/16")},
|
||||
}
|
||||
|
||||
nodeExitNode := &types.Node{
|
||||
nodeCharmander := &types.Node{
|
||||
ID: 8,
|
||||
GivenName: "exit-node",
|
||||
GivenName: "charmander",
|
||||
IPv4: ptrAddr("100.85.66.106"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::7c37:426a"),
|
||||
Tags: []string{"tag:exit"},
|
||||
|
|
@ -164,9 +140,9 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
|
||||
// --- New nodes for expanded via grant topology ---
|
||||
|
||||
nodeExitA := &types.Node{
|
||||
nodePidgey := &types.Node{
|
||||
ID: 9,
|
||||
GivenName: "exit-a",
|
||||
GivenName: "pidgey",
|
||||
IPv4: ptrAddr("100.124.195.93"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::7837:c35d"),
|
||||
Tags: []string{"tag:exit-a"},
|
||||
|
|
@ -182,9 +158,9 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
},
|
||||
}
|
||||
|
||||
nodeExitB := &types.Node{
|
||||
nodePidgeotto := &types.Node{
|
||||
ID: 10,
|
||||
GivenName: "exit-b",
|
||||
GivenName: "pidgeotto",
|
||||
IPv4: ptrAddr("100.116.18.24"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::ff37:1218"),
|
||||
Tags: []string{"tag:exit-b"},
|
||||
|
|
@ -200,27 +176,27 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
},
|
||||
}
|
||||
|
||||
nodeGroupA := &types.Node{
|
||||
nodeRattata := &types.Node{
|
||||
ID: 11,
|
||||
GivenName: "group-a-client",
|
||||
GivenName: "rattata",
|
||||
IPv4: ptrAddr("100.107.162.14"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::a237:a20e"),
|
||||
Tags: []string{"tag:group-a"},
|
||||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeGroupB := &types.Node{
|
||||
nodeRaticate := &types.Node{
|
||||
ID: 12,
|
||||
GivenName: "group-b-client",
|
||||
GivenName: "raticate",
|
||||
IPv4: ptrAddr("100.77.135.18"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::4b37:8712"),
|
||||
Tags: []string{"tag:group-b"},
|
||||
Hostinfo: &tailcfg.Hostinfo{},
|
||||
}
|
||||
|
||||
nodeRouterA := &types.Node{
|
||||
nodeSpearow := &types.Node{
|
||||
ID: 13,
|
||||
GivenName: "router-a",
|
||||
GivenName: "spearow",
|
||||
IPv4: ptrAddr("100.109.43.124"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::a537:2b7c"),
|
||||
Tags: []string{"tag:router-a"},
|
||||
|
|
@ -230,9 +206,9 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
ApprovedRoutes: []netip.Prefix{netip.MustParsePrefix("10.44.0.0/16")},
|
||||
}
|
||||
|
||||
nodeRouterB := &types.Node{
|
||||
nodeFearow := &types.Node{
|
||||
ID: 14,
|
||||
GivenName: "router-b",
|
||||
GivenName: "fearow",
|
||||
IPv4: ptrAddr("100.65.172.123"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::5a37:ac7c"),
|
||||
Tags: []string{"tag:router-b"},
|
||||
|
|
@ -242,9 +218,9 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
ApprovedRoutes: []netip.Prefix{netip.MustParsePrefix("10.55.0.0/16")},
|
||||
}
|
||||
|
||||
nodeMultiExitRouter := &types.Node{
|
||||
nodeBlastoise := &types.Node{
|
||||
ID: 15,
|
||||
GivenName: "multi-exit-router",
|
||||
GivenName: "blastoise",
|
||||
IPv4: ptrAddr("100.105.127.107"),
|
||||
IPv6: ptrAddr("fd7a:115c:a1e0::9537:7f6b"),
|
||||
Tags: []string{"tag:exit", "tag:router"},
|
||||
|
|
@ -263,21 +239,21 @@ func setupGrantsCompatNodes(users types.Users) types.Nodes {
|
|||
}
|
||||
|
||||
return types.Nodes{
|
||||
nodeUser1,
|
||||
nodeUserKris,
|
||||
nodeUserMon,
|
||||
nodeTaggedServer,
|
||||
nodeTaggedProd,
|
||||
nodeTaggedClient,
|
||||
nodeSubnetRouter,
|
||||
nodeExitNode,
|
||||
nodeExitA,
|
||||
nodeExitB,
|
||||
nodeGroupA,
|
||||
nodeGroupB,
|
||||
nodeRouterA,
|
||||
nodeRouterB,
|
||||
nodeMultiExitRouter,
|
||||
nodeBulbasaur,
|
||||
nodeIvysaur,
|
||||
nodeVenusaur,
|
||||
nodeBeedrill,
|
||||
nodeKakuna,
|
||||
nodeWeedle,
|
||||
nodeSquirtle,
|
||||
nodeCharmander,
|
||||
nodePidgey,
|
||||
nodePidgeotto,
|
||||
nodeRattata,
|
||||
nodeRaticate,
|
||||
nodeSpearow,
|
||||
nodeFearow,
|
||||
nodeBlastoise,
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -292,41 +268,87 @@ func findGrantsNode(nodes types.Nodes, name string) *types.Node {
|
|||
return nil
|
||||
}
|
||||
|
||||
// convertPolicyUserEmails converts Tailscale SaaS user email formats to
|
||||
// headscale-compatible @example.com format in the raw policy JSON.
|
||||
//
|
||||
// Tailscale uses provider-specific email formats:
|
||||
// - kratail2tid@passkey (passkey auth)
|
||||
// - kristoffer@dalby.cc (email auth)
|
||||
// - monitorpasskeykradalby@passkey (passkey auth)
|
||||
//
|
||||
// Headscale resolves users by Email field, so we convert all to @example.com.
|
||||
func convertPolicyUserEmails(policyJSON []byte) []byte {
|
||||
s := string(policyJSON)
|
||||
s = strings.ReplaceAll(s, "kratail2tid@passkey", "kratail2tid@example.com")
|
||||
s = strings.ReplaceAll(s, "kristoffer@dalby.cc", "kristoffer@example.com")
|
||||
s = strings.ReplaceAll(s, "monitorpasskeykradalby@passkey", "monitorpasskeykradalby@example.com")
|
||||
// buildGrantsNodesFromCapture constructs types.Nodes from a capture's
|
||||
// topology section. Each scenario in tscap uses clean-slate mode, so
|
||||
// node IPs differ between scenarios; this builds the node set with
|
||||
// the IPs that were actually present during that capture.
|
||||
func buildGrantsNodesFromCapture(
|
||||
users types.Users,
|
||||
tf *testcapture.Capture,
|
||||
) types.Nodes {
|
||||
nodes := make(types.Nodes, 0, len(tf.Topology.Nodes))
|
||||
autoID := 1
|
||||
|
||||
return []byte(s)
|
||||
for _, nodeDef := range tf.Topology.Nodes {
|
||||
node := &types.Node{
|
||||
ID: types.NodeID(autoID), //nolint:gosec
|
||||
GivenName: nodeDef.Hostname,
|
||||
IPv4: ptrAddr(nodeDef.IPv4),
|
||||
IPv6: ptrAddr(nodeDef.IPv6),
|
||||
Tags: nodeDef.Tags,
|
||||
}
|
||||
autoID++
|
||||
|
||||
hostinfo := &tailcfg.Hostinfo{}
|
||||
|
||||
if len(nodeDef.RoutableIPs) > 0 {
|
||||
routableIPs := make([]netip.Prefix, 0, len(nodeDef.RoutableIPs))
|
||||
for _, r := range nodeDef.RoutableIPs {
|
||||
routableIPs = append(routableIPs, netip.MustParsePrefix(r))
|
||||
}
|
||||
|
||||
hostinfo.RoutableIPs = routableIPs
|
||||
}
|
||||
|
||||
node.Hostinfo = hostinfo
|
||||
|
||||
if len(nodeDef.ApprovedRoutes) > 0 {
|
||||
approved := make([]netip.Prefix, 0, len(nodeDef.ApprovedRoutes))
|
||||
for _, r := range nodeDef.ApprovedRoutes {
|
||||
approved = append(approved, netip.MustParsePrefix(r))
|
||||
}
|
||||
|
||||
node.ApprovedRoutes = approved
|
||||
} else {
|
||||
node.ApprovedRoutes = []netip.Prefix{}
|
||||
}
|
||||
|
||||
// Assign user — untagged nodes look up by User field.
|
||||
if len(nodeDef.Tags) == 0 && nodeDef.User != "" {
|
||||
for i := range users {
|
||||
if users[i].Name == nodeDef.User {
|
||||
node.User = &users[i]
|
||||
node.UserID = &users[i].ID
|
||||
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
nodes = append(nodes, node)
|
||||
}
|
||||
|
||||
return nodes
|
||||
}
|
||||
|
||||
// loadGrantTestFile loads and parses a single grant test JSON file.
|
||||
func loadGrantTestFile(t *testing.T, path string) grantTestFile {
|
||||
// convertPolicyUserEmails used to map SaaS-side emails to @example.com.
|
||||
// tscap now anonymizes the policy JSON at write time (kratail2tid -> odin,
|
||||
// kristoffer -> thor, monitorpasskeykradalby -> freya), so the captured
|
||||
// FullPolicy is already in its final form and this is a passthrough that
|
||||
// just adapts the captured string value to the []byte that the policy
|
||||
// parser expects.
|
||||
func convertPolicyUserEmails(policyJSON string) []byte {
|
||||
return []byte(policyJSON)
|
||||
}
|
||||
|
||||
// loadGrantTestFile loads and parses a single grant capture HuJSON file.
|
||||
func loadGrantTestFile(t *testing.T, path string) *testcapture.Capture {
|
||||
t.Helper()
|
||||
|
||||
content, err := os.ReadFile(path)
|
||||
c, err := testcapture.Read(path)
|
||||
require.NoError(t, err, "failed to read test file %s", path)
|
||||
|
||||
ast, err := hujson.Parse(content)
|
||||
require.NoError(t, err, "failed to parse HuJSON in %s", path)
|
||||
ast.Standardize()
|
||||
|
||||
var tf grantTestFile
|
||||
|
||||
err = json.Unmarshal(ast.Pack(), &tf)
|
||||
require.NoError(t, err, "failed to unmarshal test file %s", path)
|
||||
|
||||
return tf
|
||||
return c
|
||||
}
|
||||
|
||||
// Skip categories document WHY tests are expected to differ from Tailscale SaaS.
|
||||
|
|
@ -341,8 +363,8 @@ var grantSkipReasons = map[string]string{
|
|||
// Tailscale SaaS policies can use user:*@passkey as a wildcard matching
|
||||
// all passkey-authenticated users. headscale does not support passkey
|
||||
// authentication and has no equivalent for this wildcard pattern.
|
||||
"GRANT-K20": "USER_PASSKEY_WILDCARD: src=user:*@passkey not supported in headscale",
|
||||
"GRANT-K21": "USER_PASSKEY_WILDCARD: dst=user:*@passkey not supported in headscale",
|
||||
"grant-k20": "USER_PASSKEY_WILDCARD: src=user:*@passkey not supported in headscale",
|
||||
"grant-k21": "USER_PASSKEY_WILDCARD: dst=user:*@passkey not supported in headscale",
|
||||
}
|
||||
|
||||
// TestGrantsCompat is a data-driven test that loads all GRANT-*.json
|
||||
|
|
@ -354,22 +376,21 @@ var grantSkipReasons = map[string]string{
|
|||
// - For success cases: expected packet_filter_rules per node
|
||||
// - For error cases: expected error message
|
||||
//
|
||||
// The test converts Tailscale user email formats (@passkey, @dalby.cc) to
|
||||
// headscale format (@example.com) and runs the policy through unmarshalPolicy,
|
||||
// The test converts Tailscale user email formats to headscale format
|
||||
// (@example.com, @example.org) and runs the policy through unmarshalPolicy,
|
||||
// validate, compileFilterRulesForNode, and ReduceFilterRules.
|
||||
//
|
||||
// 2 tests are skipped for user:*@passkey wildcard (not supported in headscale).
|
||||
func TestGrantsCompat(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
files, err := filepath.Glob(filepath.Join("testdata", "grant_results", "GRANT-*.hujson"))
|
||||
files, err := filepath.Glob(filepath.Join("testdata", "grant_results", "*-*.hujson"))
|
||||
require.NoError(t, err, "failed to glob test files")
|
||||
require.NotEmpty(t, files, "no GRANT-*.hujson test files found in testdata/grant_results/")
|
||||
require.NotEmpty(t, files, "no grant test files found in testdata/grant_results/")
|
||||
|
||||
t.Logf("Loaded %d grant test files", len(files))
|
||||
|
||||
users := setupGrantsCompatUsers()
|
||||
allNodes := setupGrantsCompatNodes(users)
|
||||
|
||||
for _, file := range files {
|
||||
tf := loadGrantTestFile(t, file)
|
||||
|
|
@ -383,17 +404,13 @@ func TestGrantsCompat(t *testing.T) {
|
|||
return
|
||||
}
|
||||
|
||||
// Determine which node set to use based on the test's topology.
|
||||
// Tests captured with the expanded 15-node topology (V26+) have
|
||||
// nodes like exit-a, group-a-client, etc. Tests from the original
|
||||
// 8-node topology should only use the first 8 nodes to avoid
|
||||
// resolving extra IPs from nodes that weren't present during capture.
|
||||
nodes := allNodes
|
||||
if _, hasNewNodes := tf.Captures["exit-a"]; !hasNewNodes {
|
||||
nodes = allNodes[:8]
|
||||
}
|
||||
// Build nodes per-scenario from this file's topology.
|
||||
// tscap uses clean-slate mode, so each scenario has
|
||||
// different node IPs.
|
||||
nodes := buildGrantsNodesFromCapture(users, tf)
|
||||
|
||||
// Convert Tailscale user emails to headscale @example.com format
|
||||
// Use the captured full policy verbatim (anonymization
|
||||
// in tscap already rewrote SaaS emails).
|
||||
policyJSON := convertPolicyUserEmails(tf.Input.FullPolicy)
|
||||
|
||||
if tf.Input.APIResponseCode == 400 || tf.Error {
|
||||
|
|
@ -407,7 +424,7 @@ func TestGrantsCompat(t *testing.T) {
|
|||
}
|
||||
|
||||
// testGrantError verifies that an invalid policy produces the expected error.
|
||||
func testGrantError(t *testing.T, policyJSON []byte, tf grantTestFile) {
|
||||
func testGrantError(t *testing.T, policyJSON []byte, tf *testcapture.Capture) {
|
||||
t.Helper()
|
||||
|
||||
wantMsg := ""
|
||||
|
|
@ -439,91 +456,28 @@ func testGrantError(t *testing.T, policyJSON []byte, tf grantTestFile) {
|
|||
tf.TestID, wantMsg)
|
||||
}
|
||||
|
||||
// grantErrorMessageMap maps Tailscale error messages to their headscale equivalents
|
||||
// where the wording differs but the meaning is the same.
|
||||
var grantErrorMessageMap = map[string]string{
|
||||
// Tailscale says "ip and app can not both be empty",
|
||||
// headscale says "grants must specify either 'ip' or 'app' field"
|
||||
"ip and app can not both be empty": "grants must specify either",
|
||||
// Tailscale says "via can only be a tag",
|
||||
// headscale rejects at unmarshal time via Tag.UnmarshalJSON: "tag must start with 'tag:'"
|
||||
"via can only be a tag": "tag must start with",
|
||||
}
|
||||
|
||||
// assertGrantErrorContains checks that an error message contains the expected
|
||||
// Tailscale error message (or its headscale equivalent).
|
||||
// assertGrantErrorContains requires that headscale's error contains
|
||||
// the Tailscale SaaS error message verbatim. Divergence means an
|
||||
// emitter needs to be aligned, not papered over with a translation
|
||||
// table.
|
||||
func assertGrantErrorContains(t *testing.T, err error, wantMsg string, testID string) {
|
||||
t.Helper()
|
||||
|
||||
errStr := err.Error()
|
||||
|
||||
// First try direct substring match
|
||||
if strings.Contains(errStr, wantMsg) {
|
||||
return
|
||||
}
|
||||
|
||||
// Try mapped equivalent
|
||||
if mapped, ok := grantErrorMessageMap[wantMsg]; ok {
|
||||
if strings.Contains(errStr, mapped) {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Try matching key parts of the error message
|
||||
// Extract the most distinctive part of the Tailscale message
|
||||
keyParts := extractErrorKeyParts(wantMsg)
|
||||
for _, part := range keyParts {
|
||||
if strings.Contains(errStr, part) {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
t.Errorf("%s: error message mismatch\n tailscale wants: %q\n headscale got: %q",
|
||||
testID, wantMsg, errStr)
|
||||
}
|
||||
|
||||
// extractErrorKeyParts extracts distinctive substrings from an error message
|
||||
// that should appear in any equivalent error message.
|
||||
func extractErrorKeyParts(msg string) []string {
|
||||
var parts []string
|
||||
|
||||
// Common patterns to extract
|
||||
if strings.Contains(msg, "tag:") {
|
||||
// Extract tag references like tag:nonexistent
|
||||
for word := range strings.FieldsSeq(msg) {
|
||||
word = strings.Trim(word, `"'`)
|
||||
if strings.HasPrefix(word, "tag:") {
|
||||
parts = append(parts, word)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if strings.Contains(msg, "autogroup:") {
|
||||
for word := range strings.FieldsSeq(msg) {
|
||||
word = strings.Trim(word, `"'`)
|
||||
if strings.HasPrefix(word, "autogroup:") {
|
||||
parts = append(parts, word)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if strings.Contains(msg, "capability name") {
|
||||
parts = append(parts, "capability")
|
||||
}
|
||||
|
||||
if strings.Contains(msg, "port range") {
|
||||
parts = append(parts, "port")
|
||||
}
|
||||
|
||||
return parts
|
||||
}
|
||||
|
||||
// testGrantSuccess verifies that a valid policy produces the expected
|
||||
// packet filter rules for each node.
|
||||
func testGrantSuccess(
|
||||
t *testing.T,
|
||||
policyJSON []byte,
|
||||
tf grantTestFile,
|
||||
tf *testcapture.Capture,
|
||||
users types.Users,
|
||||
nodes types.Nodes,
|
||||
) {
|
||||
|
|
@ -537,37 +491,9 @@ func testGrantSuccess(
|
|||
|
||||
for nodeName, capture := range tf.Captures {
|
||||
t.Run(nodeName, func(t *testing.T) {
|
||||
// Check if this node was offline during capture.
|
||||
// tagged-prod was frequently offline (132 of 188 success tests).
|
||||
// When offline, packet_filter_rules is null and topology shows
|
||||
// hostname="unknown" with empty tags.
|
||||
captureIsNull := len(capture.PacketFilterRules) == 0 ||
|
||||
string(capture.PacketFilterRules) == "null"
|
||||
|
||||
if captureIsNull {
|
||||
topoNode, exists := tf.Topology.Nodes[nodeName]
|
||||
if exists && (topoNode.Hostname == "unknown" || topoNode.Hostname == "") {
|
||||
t.Skipf(
|
||||
"node %s was offline during Tailscale capture (hostname=%q)",
|
||||
nodeName,
|
||||
topoNode.Hostname,
|
||||
)
|
||||
|
||||
return
|
||||
}
|
||||
// Node was online but has null/empty rules — means Tailscale
|
||||
// produced no rules. headscale should also produce no rules.
|
||||
}
|
||||
|
||||
node := findGrantsNode(nodes, nodeName)
|
||||
if node == nil {
|
||||
t.Skipf(
|
||||
"node %s not found in test setup (may be a test-specific node)",
|
||||
nodeName,
|
||||
)
|
||||
|
||||
return
|
||||
}
|
||||
require.NotNilf(t, node,
|
||||
"golden node %s not found in test setup", nodeName)
|
||||
|
||||
// Compile headscale filter rules for this node
|
||||
gotRules, err := pol.compileFilterRulesForNode(
|
||||
|
|
@ -585,21 +511,7 @@ func testGrantSuccess(
|
|||
|
||||
gotRules = policyutil.ReduceFilterRules(node.View(), gotRules)
|
||||
|
||||
// Unmarshal Tailscale expected rules from JSON capture
|
||||
var wantRules []tailcfg.FilterRule
|
||||
if !captureIsNull {
|
||||
err = json.Unmarshal(
|
||||
[]byte(capture.PacketFilterRules),
|
||||
&wantRules,
|
||||
)
|
||||
require.NoError(
|
||||
t,
|
||||
err,
|
||||
"%s/%s: failed to unmarshal expected rules from JSON",
|
||||
tf.TestID,
|
||||
nodeName,
|
||||
)
|
||||
}
|
||||
wantRules := capture.PacketFilterRules
|
||||
|
||||
// Compare headscale output against Tailscale expected output.
|
||||
// The diff labels show (-tailscale +headscale) to make clear
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue