Drop network map rules with an unrecognized protocol instead of decoding them as all

shared/management/networkmap/decode_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/types"
 )
 
 func TestDecodePolicy(t *testing.T) {
@@ -59,3 +60,53 @@ func TestResourceCompactLegacyWireFormat(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, legacy, encoded)
 }
+
+// A management newer than this client can ship a protocol value this build has
+// no case for. Mapping it to ALL would both widen the rule to every IP protocol
+// and, because an ALL match short-circuits the port comparison, discard the
+// port restriction the rule was written with. The rule must be dropped instead.
+func TestDecodePolicyCompact_UnknownProtocolIsDropped(t *testing.T) {
+	const futureProtocol = proto.RuleProtocol(99)
+
+	pc := &proto.PolicyCompact{
+		Id:       "policy-1",
+		Action:   proto.RuleAction_ACCEPT,
+		Protocol: futureProtocol,
+		PortRanges: []*proto.PortInfo_Range{
+			{Start: 25900, End: 25900},
+		},
+		SourceGroupIds:      []string{"g-src"},
+		DestinationGroupIds: []string{"g-dst"},
+	}
+
+	assert.Nil(t, decodePolicyCompact(pc, pc.Id, nil),
+		"a rule with an unrecognized protocol must not decode into an enforceable rule")
+
+	_, ok := protocolFromProto(futureProtocol)
+	assert.False(t, ok, "an unrecognized protocol must not resolve to a known one")
+}
+
+// Every protocol the encoder can emit must survive a round trip, so the
+// drop-on-unknown rule above cannot quietly start discarding valid policies.
+func TestProtocolFromProto_KnownValuesRoundTrip(t *testing.T) {
+	known := []proto.RuleProtocol{
+		proto.RuleProtocol_ALL,
+		proto.RuleProtocol_TCP,
+		proto.RuleProtocol_UDP,
+		proto.RuleProtocol_ICMP,
+		proto.RuleProtocol_NETBIRD_SSH,
+		proto.RuleProtocol_NETBIRD_VNC,
+	}
+	for _, p := range known {
+		decoded, ok := protocolFromProto(p)
+		require.Truef(t, ok, "protocol %s must decode", p)
+		assert.Equalf(t, p, GetProtoProtocol(string(decoded)), "protocol %s must round trip", p)
+	}
+}
+
+// An action the switch does not recognize must deny, not accept.
+func TestActionFromProto_UnknownDenies(t *testing.T) {
+	assert.Equal(t, types.PolicyTrafficActionAccept, actionFromProto(proto.RuleAction_ACCEPT))
+	assert.Equal(t, types.PolicyTrafficActionDrop, actionFromProto(proto.RuleAction_DROP))
+	assert.Equal(t, types.PolicyTrafficActionDrop, actionFromProto(proto.RuleAction(99)))
+}