2b7f15abaa
A grant of the form `{src: alice, dst: autogroup:internet, via:
tag:exit1}` was loading without error but stripping every exit node
from alice's view: `tailscale exit-node list` returned "no exit nodes
found".
Two sites skipped autogroup:internet at the compile / steering layer:
compileViaForNode's *AutoGroup arm produced no FilterRule for the
via-tagged exit node, and ViaRoutesForPeer's *AutoGroup arm produced
no Include/Exclude. With pm.needsPerNodeFilter true, the exit node's
matchers were empty, BuildPeerMap could not link source to exit, and
RoutesForPeer's ReduceRoutes stripped 0.0.0.0/0 and ::/0 from
AllowedIPs.
The skip belongs at the wire-format layer (ReduceFilterRules), not at
the compile layer that also feeds internal matchers. Lift
autogroup:internet handling into both *AutoGroup arms with the same
shape used for *Prefix destinations: emit a TheInternet rule on
via-tagged exit advertisers; surface peer.ExitRoutes() in Include
when the peer carries the via tag, Exclude otherwise.
ReduceFilterRules continues to keep the rule on exit-route
advertisers' wire output and strip it elsewhere, preserving SaaS
PacketFilter encoding.
Also drop compileViaForNode's early len(SubnetRoutes)==0 return:
SubnetRoutes excludes exit routes, so the early return pre-empted the
autogroup:internet branch on nodes that only advertise exit routes.
Existing tests pinning the buggy behaviour (TestViaRoutesForPeer
subtests, TestCompileViaGrant case) flipped to the new contract.
Fixes #3233
107 lines
3.5 KiB
Go
107 lines
3.5 KiB
Go
// A via grant scoping autogroup:internet to a tag must surface only
|
|
// the matching exit node to the source — not strip every exit node
|
|
// from the source's view.
|
|
//
|
|
// Spec: https://tailscale.com/docs/features/access-control/grants/grants-via#route-users-through-exit-nodes-based-on-location
|
|
package v2
|
|
|
|
import (
|
|
"net/netip"
|
|
"slices"
|
|
"testing"
|
|
|
|
"github.com/juanfont/headscale/hscontrol/types"
|
|
"github.com/stretchr/testify/require"
|
|
"gorm.io/gorm"
|
|
"tailscale.com/net/tsaddr"
|
|
"tailscale.com/tailcfg"
|
|
)
|
|
|
|
// TestIssue3233ViaInternetExitVisibility loads a policy where alice's
|
|
// only access to autogroup:internet is via tag:exit1. Alice sees her
|
|
// tag:exit1 exit node as a peer with 0.0.0.0/0 + ::/0 in AllowedIPs,
|
|
// and does not see bob's tag:exit2 exit node.
|
|
func TestIssue3233ViaInternetExitVisibility(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
users := types.Users{
|
|
{Model: gorm.Model{ID: 1}, Name: "alice", Email: "alice@headscale.net"},
|
|
{Model: gorm.Model{ID: 2}, Name: "bob", Email: "bob@headscale.net"},
|
|
}
|
|
|
|
exitRoutes := []netip.Prefix{tsaddr.AllIPv4(), tsaddr.AllIPv6()}
|
|
|
|
aliceLaptop := node("alice-laptop", "100.64.0.10", "fd7a:115c:a1e0::a", users[0])
|
|
aliceLaptop.ID = 1
|
|
|
|
aliceExit := node("alice-exit", "100.64.0.11", "fd7a:115c:a1e0::b", users[0])
|
|
aliceExit.ID = 2
|
|
aliceExit.Tags = []string{"tag:exit1"}
|
|
aliceExit.Hostinfo = &tailcfg.Hostinfo{RoutableIPs: exitRoutes}
|
|
aliceExit.ApprovedRoutes = exitRoutes
|
|
|
|
bobExit := node("bob-exit", "100.64.0.21", "fd7a:115c:a1e0::15", users[1])
|
|
bobExit.ID = 3
|
|
bobExit.Tags = []string{"tag:exit2"}
|
|
bobExit.Hostinfo = &tailcfg.Hostinfo{RoutableIPs: exitRoutes}
|
|
bobExit.ApprovedRoutes = exitRoutes
|
|
|
|
nodes := types.Nodes{aliceLaptop, aliceExit, bobExit}
|
|
|
|
policy := `{
|
|
"tagOwners": {
|
|
"tag:exit1": ["alice@headscale.net"],
|
|
"tag:exit2": ["bob@headscale.net"]
|
|
},
|
|
"grants": [
|
|
{
|
|
"src": ["alice@headscale.net"],
|
|
"dst": ["autogroup:internet"],
|
|
"via": ["tag:exit1"],
|
|
"ip": ["*"]
|
|
}
|
|
]
|
|
}`
|
|
|
|
pm, err := NewPolicyManager([]byte(policy), users, nodes.ViewSlice())
|
|
require.NoError(t, err)
|
|
|
|
t.Run("BuildPeerMap_includes_via_tagged_exit", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
peerMap := pm.BuildPeerMap(nodes.ViewSlice())
|
|
|
|
require.True(t,
|
|
slices.ContainsFunc(peerMap[aliceLaptop.ID], func(n types.NodeView) bool {
|
|
return n.ID() == aliceExit.ID
|
|
}),
|
|
"alice must see her tag:exit1 exit node as a peer")
|
|
|
|
require.False(t,
|
|
slices.ContainsFunc(peerMap[aliceLaptop.ID], func(n types.NodeView) bool {
|
|
return n.ID() == bobExit.ID
|
|
}),
|
|
"alice must not see bob's tag:exit2 exit node — via grant scopes to tag:exit1")
|
|
})
|
|
|
|
t.Run("ViaRoutesForPeer_includes_exit_for_matching_tag", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
result := pm.ViaRoutesForPeer(aliceLaptop.View(), aliceExit.View())
|
|
require.Contains(t, result.Include, tsaddr.AllIPv4(),
|
|
"alice viewing tag:exit1 exit must Include 0.0.0.0/0 — drives AllowedIPs in state.RoutesForPeer")
|
|
require.Contains(t, result.Include, tsaddr.AllIPv6(),
|
|
"alice viewing tag:exit1 exit must Include ::/0 — drives AllowedIPs in state.RoutesForPeer")
|
|
})
|
|
|
|
t.Run("ViaRoutesForPeer_excludes_exit_for_other_tag", func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
result := pm.ViaRoutesForPeer(aliceLaptop.View(), bobExit.View())
|
|
require.Contains(t, result.Exclude, tsaddr.AllIPv4(),
|
|
"alice viewing tag:exit2 exit must Exclude 0.0.0.0/0 — strips it from AllowedIPs")
|
|
require.Contains(t, result.Exclude, tsaddr.AllIPv6(),
|
|
"alice viewing tag:exit2 exit must Exclude ::/0 — strips it from AllowedIPs")
|
|
})
|
|
}
|