6c59d3e601
Add 39 test fixtures captured from Tailscale SaaS API responses to validate SSH policy compilation parity. Each JSON file contains the SSH policy section and expected compiled SSHRule arrays for 5 test nodes (3 user-owned, 2 tagged). Test series: SSH-A (basic), SSH-B (specific sources), SSH-C (destination combos), SSH-D (localpart), SSH-E (edge cases), SSH-F (multi-rule), SSH-G (acceptEnv). The data-driven TestSSHDataCompat harness uses cmp.Diff with principal order tolerance but strict rule ordering (first-match-wins semantics require exact order). Updates #3049
240 lines
6.8 KiB
JSON
240 lines
6.8 KiB
JSON
{
|
|
"test_id": "SSH-E6",
|
|
"policy_file": "ssh_policies/ssh_e6.json",
|
|
"ssh_section": [
|
|
{
|
|
"action": "check",
|
|
"src": [
|
|
"autogroup:member"
|
|
],
|
|
"dst": [
|
|
"tag:server"
|
|
],
|
|
"users": [
|
|
"localpart:*@passkey"
|
|
],
|
|
"checkPeriod": "1h"
|
|
}
|
|
],
|
|
"nodes": {
|
|
"user1": {
|
|
"rules": [
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.90.199.68"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"root": ""
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
},
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.90.199.68"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"kratail2tid": "kratail2tid"
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"user-kris": {
|
|
"rules": [
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.110.121.96"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::1737:7960"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"root": ""
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"user-mon": {
|
|
"rules": [
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.103.90.82"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"root": ""
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
},
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.103.90.82"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"monitorpasskeykradalby": "monitorpasskeykradalby"
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"tagged-server": {
|
|
"rules": [
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.90.199.68"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"root": ""
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
},
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.90.199.68"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::2d01:c747"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"kratail2tid": "kratail2tid"
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
},
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.110.121.96"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::1737:7960"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"root": ""
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
},
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.103.90.82"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"root": ""
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
},
|
|
{
|
|
"principals": [
|
|
{
|
|
"nodeIP": "100.103.90.82"
|
|
},
|
|
{
|
|
"nodeIP": "fd7a:115c:a1e0::9e37:5a52"
|
|
}
|
|
],
|
|
"sshUsers": {
|
|
"monitorpasskeykradalby": "monitorpasskeykradalby"
|
|
},
|
|
"action": {
|
|
"holdAndDelegate": "unused-server-url/machine/ssh/action/from/$SRC_NODE_ID/to/$DST_NODE_ID?ssh_user=$SSH_USER&local_user=$LOCAL_USER",
|
|
"allowAgentForwarding": true,
|
|
"allowLocalPortForwarding": true,
|
|
"allowRemotePortForwarding": true,
|
|
"sessionDuration": 3600000000000
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"tagged-prod": {
|
|
"rules": []
|
|
}
|
|
}
|
|
}
|