headscale/acls_test.go

388 lines
12 KiB
Go
Raw Normal View History

2021-07-03 03:55:32 -06:00
package headscale
import (
"errors"
2021-07-03 03:55:32 -06:00
"gopkg.in/check.v1"
"gorm.io/datatypes"
"inet.af/netaddr"
2021-07-03 03:55:32 -06:00
)
func (s *Suite) TestWrongPath(c *check.C) {
2021-11-15 09:16:04 -07:00
err := app.LoadACLPolicy("asdfg")
2021-07-03 03:55:32 -06:00
c.Assert(err, check.NotNil)
}
func (s *Suite) TestBrokenHuJson(c *check.C) {
2021-11-15 09:16:04 -07:00
err := app.LoadACLPolicy("./tests/acls/broken.hujson")
2021-07-03 03:55:32 -06:00
c.Assert(err, check.NotNil)
}
func (s *Suite) TestInvalidPolicyHuson(c *check.C) {
2021-11-15 09:16:04 -07:00
err := app.LoadACLPolicy("./tests/acls/invalid.hujson")
2021-07-03 03:55:32 -06:00
c.Assert(err, check.NotNil)
2021-11-15 09:33:16 -07:00
c.Assert(err, check.Equals, errEmptyPolicy)
2021-07-03 03:55:32 -06:00
}
2021-07-03 09:31:32 -06:00
func (s *Suite) TestParseHosts(c *check.C) {
2021-11-15 09:16:04 -07:00
var hosts Hosts
err := hosts.UnmarshalJSON(
2021-11-13 01:36:45 -07:00
[]byte(
`{"example-host-1": "100.100.100.100","example-host-2": "100.100.101.100/24"}`,
),
)
2021-11-15 09:16:04 -07:00
c.Assert(hosts, check.NotNil)
2021-07-03 03:55:32 -06:00
c.Assert(err, check.IsNil)
2021-07-03 09:31:32 -06:00
}
func (s *Suite) TestParseInvalidCIDR(c *check.C) {
2021-11-15 09:16:04 -07:00
var hosts Hosts
err := hosts.UnmarshalJSON([]byte(`{"example-host-1": "100.100.100.100/42"}`))
c.Assert(hosts, check.IsNil)
2021-07-03 09:31:32 -06:00
c.Assert(err, check.NotNil)
}
func (s *Suite) TestRuleInvalidGeneration(c *check.C) {
2021-11-15 09:16:04 -07:00
err := app.LoadACLPolicy("./tests/acls/acl_policy_invalid.hujson")
2021-07-03 09:31:32 -06:00
c.Assert(err, check.NotNil)
}
func (s *Suite) TestBasicRule(c *check.C) {
2021-11-15 09:16:04 -07:00
err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_1.hujson")
2021-07-03 09:31:32 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
rules, err := app.generateACLRules()
2021-07-03 09:31:32 -06:00
c.Assert(err, check.IsNil)
2021-07-04 05:01:41 -06:00
c.Assert(rules, check.NotNil)
}
func (s *Suite) TestInvalidAction(c *check.C) {
app.aclPolicy = &ACLPolicy{
ACLs: []ACL{
{Action: "invalidAction", Users: []string{"*"}, Ports: []string{"*:*"}},
},
}
err := app.UpdateACLRules()
c.Assert(errors.Is(err, errInvalidAction), check.Equals, true)
}
func (s *Suite) TestInvalidGroupInGroup(c *check.C) {
// this ACL is wrong because the group in users sections doesn't exist
app.aclPolicy = &ACLPolicy{
Groups: Groups{"group:test": []string{"foo"}, "group:error": []string{"foo", "group:test"}},
ACLs: []ACL{
{Action: "accept", Users: []string{"group:error"}, Ports: []string{"*:*"}},
},
}
err := app.UpdateACLRules()
c.Assert(errors.Is(err, errInvalidGroup), check.Equals, true)
}
func (s *Suite) TestInvalidTagOwners(c *check.C) {
// this ACL is wrong because no tagOwners own the requested tag for the server
app.aclPolicy = &ACLPolicy{
ACLs: []ACL{
{Action: "accept", Users: []string{"tag:foo"}, Ports: []string{"*:*"}},
},
}
err := app.UpdateACLRules()
c.Assert(errors.Is(err, errInvalidTag), check.Equals, true)
}
// this test should validate that we can expand a group in a TagOWner section and
// match properly the IP's of the related hosts. The owner is valid and the tag is also valid.
// the tag is matched in the Users section
func (s *Suite) TestValidExpandTagOwnersInUsers(c *check.C) {
namespace, err := app.CreateNamespace("foo")
c.Assert(err, check.IsNil)
pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil)
c.Assert(err, check.IsNil)
_, err = app.GetMachine("foo", "testmachine")
c.Assert(err, check.NotNil)
b := []byte("{\"OS\":\"centos\",\"Hostname\":\"foo\",\"RequestTags\":[\"tag:test\"]}")
machine := Machine{
ID: 0,
MachineKey: "foo",
NodeKey: "bar",
DiscoKey: "faa",
Name: "testmachine",
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.1")},
NamespaceID: namespace.ID,
Registered: true,
RegisterMethod: RegisterMethodAuthKey,
AuthKeyID: uint(pak.ID),
HostInfo: datatypes.JSON(b),
}
app.db.Save(&machine)
app.aclPolicy = &ACLPolicy{
Groups: Groups{"group:test": []string{"foo", "foobar"}},
TagOwners: TagOwners{"tag:test": []string{"bar", "group:test"}},
ACLs: []ACL{
{Action: "accept", Users: []string{"tag:test"}, Ports: []string{"*:*"}},
},
}
err = app.UpdateACLRules()
c.Assert(err, check.IsNil)
c.Assert(app.aclRules, check.HasLen, 1)
c.Assert(app.aclRules[0].SrcIPs, check.HasLen, 1)
c.Assert(app.aclRules[0].SrcIPs[0], check.Equals, "100.64.0.1")
}
// this test should validate that we can expand a group in a TagOWner section and
// match properly the IP's of the related hosts. The owner is valid and the tag is also valid.
// the tag is matched in the Ports section
func (s *Suite) TestValidExpandTagOwnersInPorts(c *check.C) {
namespace, err := app.CreateNamespace("foo")
c.Assert(err, check.IsNil)
pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil)
c.Assert(err, check.IsNil)
_, err = app.GetMachine("foo", "testmachine")
c.Assert(err, check.NotNil)
b := []byte("{\"OS\":\"centos\",\"Hostname\":\"foo\",\"RequestTags\":[\"tag:test\"]}")
machine := Machine{
ID: 1,
MachineKey: "foo",
NodeKey: "bar",
DiscoKey: "faa",
Name: "testmachine",
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.1")},
NamespaceID: namespace.ID,
Registered: true,
RegisterMethod: RegisterMethodAuthKey,
AuthKeyID: uint(pak.ID),
HostInfo: datatypes.JSON(b),
}
app.db.Save(&machine)
app.aclPolicy = &ACLPolicy{
Groups: Groups{"group:test": []string{"foo", "foobar"}},
TagOwners: TagOwners{"tag:test": []string{"bar", "group:test"}},
ACLs: []ACL{
{Action: "accept", Users: []string{"*"}, Ports: []string{"tag:test:*"}},
},
}
err = app.UpdateACLRules()
c.Assert(err, check.IsNil)
c.Assert(app.aclRules, check.HasLen, 1)
c.Assert(app.aclRules[0].DstPorts, check.HasLen, 1)
c.Assert(app.aclRules[0].DstPorts[0].IP, check.Equals, "100.64.0.1")
}
// need a test with:
// tag on a host that isn't owned by a tag owners. So the namespace
// of the host should be valid
func (s *Suite) TestInvalidTagValidNamespace(c *check.C) {
namespace, err := app.CreateNamespace("foo")
c.Assert(err, check.IsNil)
pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil)
c.Assert(err, check.IsNil)
_, err = app.GetMachine("foo", "testmachine")
c.Assert(err, check.NotNil)
b := []byte("{\"OS\":\"centos\",\"Hostname\":\"foo\",\"RequestTags\":[\"tag:foo\"]}")
machine := Machine{
ID: 1,
MachineKey: "foo",
NodeKey: "bar",
DiscoKey: "faa",
Name: "testmachine",
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.1")},
NamespaceID: namespace.ID,
Registered: true,
RegisterMethod: RegisterMethodAuthKey,
AuthKeyID: uint(pak.ID),
HostInfo: datatypes.JSON(b),
}
app.db.Save(&machine)
app.aclPolicy = &ACLPolicy{
TagOwners: TagOwners{"tag:test": []string{"foo"}},
ACLs: []ACL{
{Action: "accept", Users: []string{"foo"}, Ports: []string{"*:*"}},
},
}
err = app.UpdateACLRules()
c.Assert(err, check.IsNil)
c.Assert(app.aclRules, check.HasLen, 1)
c.Assert(app.aclRules[0].SrcIPs, check.HasLen, 1)
c.Assert(app.aclRules[0].SrcIPs[0], check.Equals, "100.64.0.1")
}
// tag on a host is owned by a tag owner, the tag is valid.
// an ACL rule is matching the tag to a namespace. It should not be valid since the
// host should be tied to the tag now.
func (s *Suite) TestValidTagInvalidNamespace(c *check.C) {
namespace, err := app.CreateNamespace("foo")
c.Assert(err, check.IsNil)
pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil)
c.Assert(err, check.IsNil)
_, err = app.GetMachine("foo", "webserver")
c.Assert(err, check.NotNil)
b := []byte("{\"OS\":\"centos\",\"Hostname\":\"webserver\",\"RequestTags\":[\"tag:webapp\"]}")
machine := Machine{
ID: 1,
MachineKey: "foo",
NodeKey: "bar",
DiscoKey: "faa",
Name: "webserver",
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.1")},
NamespaceID: namespace.ID,
Registered: true,
RegisterMethod: RegisterMethodAuthKey,
AuthKeyID: uint(pak.ID),
HostInfo: datatypes.JSON(b),
}
app.db.Save(&machine)
_, err = app.GetMachine("foo", "user")
b = []byte("{\"OS\":\"debian\",\"Hostname\":\"user\"}")
c.Assert(err, check.NotNil)
machine = Machine{
ID: 2,
MachineKey: "foo2",
NodeKey: "bar2",
DiscoKey: "faab",
Name: "user",
IPAddresses: MachineAddresses{netaddr.MustParseIP("100.64.0.2")},
NamespaceID: namespace.ID,
Registered: true,
RegisterMethod: RegisterMethodAuthKey,
AuthKeyID: uint(pak.ID),
HostInfo: datatypes.JSON(b),
}
app.db.Save(&machine)
app.aclPolicy = &ACLPolicy{
TagOwners: TagOwners{"tag:webapp": []string{"foo"}},
ACLs: []ACL{
{Action: "accept", Users: []string{"foo"}, Ports: []string{"tag:webapp:80,443"}},
},
}
err = app.UpdateACLRules()
c.Assert(err, check.IsNil)
c.Logf("Rules: %v", app.aclRules)
c.Assert(app.aclRules, check.HasLen, 1)
c.Assert(app.aclRules[0].SrcIPs, check.HasLen, 0)
}
2021-07-04 05:01:41 -06:00
func (s *Suite) TestPortRange(c *check.C) {
2021-11-15 09:16:04 -07:00
err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_range.hujson")
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
rules, err := app.generateACLRules()
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
c.Assert(rules, check.NotNil)
c.Assert(rules, check.HasLen, 1)
2022-01-16 06:16:59 -07:00
c.Assert(rules[0].DstPorts, check.HasLen, 1)
c.Assert(rules[0].DstPorts[0].Ports.First, check.Equals, uint16(5400))
c.Assert(rules[0].DstPorts[0].Ports.Last, check.Equals, uint16(5500))
2021-07-04 05:01:41 -06:00
}
func (s *Suite) TestPortWildcard(c *check.C) {
2021-11-15 09:16:04 -07:00
err := app.LoadACLPolicy("./tests/acls/acl_policy_basic_wildcards.hujson")
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
rules, err := app.generateACLRules()
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
c.Assert(rules, check.NotNil)
c.Assert(rules, check.HasLen, 1)
2022-01-16 06:16:59 -07:00
c.Assert(rules[0].DstPorts, check.HasLen, 1)
c.Assert(rules[0].DstPorts[0].Ports.First, check.Equals, uint16(0))
c.Assert(rules[0].DstPorts[0].Ports.Last, check.Equals, uint16(65535))
c.Assert(rules[0].SrcIPs, check.HasLen, 1)
c.Assert(rules[0].SrcIPs[0], check.Equals, "*")
2021-07-04 05:01:41 -06:00
}
func (s *Suite) TestPortNamespace(c *check.C) {
2021-11-15 09:16:04 -07:00
namespace, err := app.CreateNamespace("testnamespace")
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil)
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
_, err = app.GetMachine("testnamespace", "testmachine")
2021-07-04 05:01:41 -06:00
c.Assert(err, check.NotNil)
2022-01-16 06:16:59 -07:00
ips, _ := app.getAvailableIPs()
2021-11-15 09:16:04 -07:00
machine := Machine{
2021-07-04 05:01:41 -06:00
ID: 0,
MachineKey: "foo",
NodeKey: "bar",
DiscoKey: "faa",
Name: "testmachine",
2021-11-15 09:16:04 -07:00
NamespaceID: namespace.ID,
2021-07-04 05:01:41 -06:00
Registered: true,
2021-11-18 01:49:55 -07:00
RegisterMethod: RegisterMethodAuthKey,
2022-01-16 06:16:59 -07:00
IPAddresses: ips,
2021-07-04 05:01:41 -06:00
AuthKeyID: uint(pak.ID),
}
2021-11-15 09:16:04 -07:00
app.db.Save(&machine)
2021-07-04 05:01:41 -06:00
2021-11-15 09:16:04 -07:00
err = app.LoadACLPolicy(
"./tests/acls/acl_policy_basic_namespace_as_user.hujson",
)
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
rules, err := app.generateACLRules()
2021-07-04 05:01:41 -06:00
c.Assert(err, check.IsNil)
c.Assert(rules, check.NotNil)
c.Assert(rules, check.HasLen, 1)
2022-01-16 06:16:59 -07:00
c.Assert(rules[0].DstPorts, check.HasLen, 1)
c.Assert(rules[0].DstPorts[0].Ports.First, check.Equals, uint16(0))
c.Assert(rules[0].DstPorts[0].Ports.Last, check.Equals, uint16(65535))
c.Assert(rules[0].SrcIPs, check.HasLen, 1)
c.Assert(rules[0].SrcIPs[0], check.Not(check.Equals), "not an ip")
c.Assert(len(ips), check.Equals, 1)
c.Assert(rules[0].SrcIPs[0], check.Equals, ips[0].String())
2021-07-03 03:55:32 -06:00
}
2021-07-04 05:23:31 -06:00
func (s *Suite) TestPortGroup(c *check.C) {
2021-11-15 09:16:04 -07:00
namespace, err := app.CreateNamespace("testnamespace")
2021-07-04 05:23:31 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
pak, err := app.CreatePreAuthKey(namespace.Name, false, false, nil)
2021-07-04 05:23:31 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
_, err = app.GetMachine("testnamespace", "testmachine")
2021-07-04 05:23:31 -06:00
c.Assert(err, check.NotNil)
2022-01-16 06:16:59 -07:00
ips, _ := app.getAvailableIPs()
2021-11-15 09:16:04 -07:00
machine := Machine{
2021-07-04 05:23:31 -06:00
ID: 0,
MachineKey: "foo",
NodeKey: "bar",
DiscoKey: "faa",
Name: "testmachine",
2021-11-15 09:16:04 -07:00
NamespaceID: namespace.ID,
2021-07-04 05:23:31 -06:00
Registered: true,
2021-11-18 01:49:55 -07:00
RegisterMethod: RegisterMethodAuthKey,
2022-01-16 06:16:59 -07:00
IPAddresses: ips,
2021-07-04 05:23:31 -06:00
AuthKeyID: uint(pak.ID),
}
2021-11-15 09:16:04 -07:00
app.db.Save(&machine)
2021-11-15 09:16:04 -07:00
err = app.LoadACLPolicy("./tests/acls/acl_policy_basic_groups.hujson")
2021-07-04 05:23:31 -06:00
c.Assert(err, check.IsNil)
2021-11-15 09:16:04 -07:00
rules, err := app.generateACLRules()
2021-07-04 05:23:31 -06:00
c.Assert(err, check.IsNil)
c.Assert(rules, check.NotNil)
c.Assert(rules, check.HasLen, 1)
2022-01-16 06:16:59 -07:00
c.Assert(rules[0].DstPorts, check.HasLen, 1)
c.Assert(rules[0].DstPorts[0].Ports.First, check.Equals, uint16(0))
c.Assert(rules[0].DstPorts[0].Ports.Last, check.Equals, uint16(65535))
c.Assert(rules[0].SrcIPs, check.HasLen, 1)
c.Assert(rules[0].SrcIPs[0], check.Not(check.Equals), "not an ip")
c.Assert(len(ips), check.Equals, 1)
c.Assert(rules[0].SrcIPs[0], check.Equals, ips[0].String())
2021-07-04 05:23:31 -06:00
}