sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-23 23:29:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Accept an explicit empty allow_match as the default and cover the CIDR short-circuit against a country blocklist

Browse Source
This commit is contained in:
Viktor Liu
2026-09-23 10:23:13 +02:00
parent 9847cbfef5
commit 1a04b3784b
3 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/internal/restrict/restrict_test.go
+7
View File
@@ -284,6 +284,13 @@ func TestFilter_Check_AllowMatchAny(t *testing.T) {
config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
addr: "1.1.1.1", geo: &unavailableGeo{}, want: DenyGeoUnavailable,
},
{
// The CIDR short-circuit must not skip the country blocklist: with geo
// down the address cannot be cleared against it, so it fails closed.
name: "CIDR match still needs geo for a country blocklist",
config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, BlockedCountries: []string{"CN"}},
addr: "203.0.113.7", geo: &unavailableGeo{}, want: DenyGeoUnavailable,
},
{
name: "block gate wins over allowed CIDR (blocked country)",
config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"0.0.0.0/0"}, BlockedCountries: []string{"CN"}},