From a816acd97c416ff2f6b263a2a1a7bd47b2affc11 Mon Sep 17 00:00:00 2001 From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com> Date: Tue, 6 Oct 2026 14:53:16 +0200 Subject: [PATCH] [management] fix the concurrency handling within the update message tests (#8000) --- management/server/account_test.go | 87 +- management/server/affected_peers_jwt_test.go | 154 +- .../server/affected_peers_oldstate_test.go | 198 +-- .../affected_peers_router_paths_test.go | 264 ++-- .../server/affected_peers_router_test.go | 508 +++---- management/server/affected_peers_test.go | 1320 +++++++++-------- management/server/affected_peers_user_test.go | 238 ++- management/server/cache/idp.go | 12 +- management/server/dns_test.go | 284 ++-- management/server/group_test.go | 635 ++++---- management/server/nameserver_test.go | 260 ++-- management/server/peer_test.go | 696 +++++---- management/server/policy_test.go | 552 +++---- management/server/posture_checks_test.go | 586 ++++---- management/server/route_test.go | 496 ++++--- management/server/setupkey_test.go | 128 +- management/server/user_test.go | 266 ++-- 17 files changed, 3417 insertions(+), 3267 deletions(-) diff --git a/management/server/account_test.go b/management/server/account_test.go index 881ad19d7..6067b6023 100644 --- a/management/server/account_test.go +++ b/management/server/account_test.go @@ -13,6 +13,7 @@ import ( "strings" "sync" "testing" + "testing/synctest" "time" "github.com/prometheus/client_golang/prometheus/push" @@ -40,6 +41,7 @@ import ( "github.com/netbirdio/netbird/management/internals/modules/zones" networkmapdb "github.com/netbirdio/netbird/management/internals/network_map_db" networkmapdbfactory "github.com/netbirdio/netbird/management/internals/network_map_db/factory" + networkmap_sqlite "github.com/netbirdio/netbird/management/internals/network_map_db/sqlite" "github.com/netbirdio/netbird/management/internals/server/config" nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc" nbAccount "github.com/netbirdio/netbird/management/server/account" @@ -1297,7 +1299,9 @@ func TestAccountManager_AddPeerWithUserID(t *testing.T) { } func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) { - testAccountManager_NetworkUpdates_SaveGroup(t) + runPeerUpdateTest(t, func(t *testing.T) { + testAccountManager_NetworkUpdates_SaveGroup(t) + }) } func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) { @@ -1330,6 +1334,8 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) { updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) defer updateManager.CloseChannel(context.Background(), peer1.ID) + settleAffectedUpdates(updMsg) + wg := sync.WaitGroup{} wg.Add(1) go func() { @@ -1352,7 +1358,9 @@ func testAccountManager_NetworkUpdates_SaveGroup(t *testing.T) { } func TestAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) { - testAccountManager_NetworkUpdates_DeletePolicy(t) + runPeerUpdateTest(t, func(t *testing.T) { + testAccountManager_NetworkUpdates_DeletePolicy(t) + }) } func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) { @@ -1361,13 +1369,7 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) { updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) defer updateManager.CloseChannel(context.Background(), peer1.ID) - // Ensure that we do not receive an update message before the policy is deleted - time.Sleep(time.Second) - select { - case <-updMsg: - t.Logf("received addPeer update message before policy deletion") - default: - } + settleAffectedUpdates(updMsg) wg := sync.WaitGroup{} wg.Add(1) @@ -1390,7 +1392,9 @@ func testAccountManager_NetworkUpdates_DeletePolicy(t *testing.T) { } func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) { - testAccountManager_NetworkUpdates_SavePolicy(t) + runPeerUpdateTest(t, func(t *testing.T) { + testAccountManager_NetworkUpdates_SavePolicy(t) + }) } func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) { @@ -1410,6 +1414,8 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) { updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) defer updateManager.CloseChannel(context.Background(), peer1.ID) + settleAffectedUpdates(updMsg) + wg := sync.WaitGroup{} wg.Add(1) go func() { @@ -1443,7 +1449,9 @@ func testAccountManager_NetworkUpdates_SavePolicy(t *testing.T) { } func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) { - testAccountManager_NetworkUpdates_DeletePeer(t) + runPeerUpdateTest(t, func(t *testing.T) { + testAccountManager_NetworkUpdates_DeletePeer(t) + }) } func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) { @@ -1482,6 +1490,8 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) { updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) defer updateManager.CloseChannel(context.Background(), peer1.ID) + settleAffectedUpdates(updMsg) + wg := sync.WaitGroup{} wg.Add(1) go func() { @@ -1503,7 +1513,9 @@ func testAccountManager_NetworkUpdates_DeletePeer(t *testing.T) { } func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) { - testAccountManager_NetworkUpdates_DeleteGroup(t) + runPeerUpdateTest(t, func(t *testing.T) { + testAccountManager_NetworkUpdates_DeleteGroup(t) + }) } func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) { @@ -1550,6 +1562,8 @@ func testAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) { } } + settleAffectedUpdates(updMsg) + wg := sync.WaitGroup{} wg.Add(1) go func() { @@ -3582,6 +3596,9 @@ func createManagerWithNetworkMapStore(t testing.TB) (*DefaultAccountManager, *up nmdataStore, err := networkmapdbfactory.NewNetworkMapDBStore(context.Background(), types.SqliteStoreEngine, dataDir, MockIntegratedValidator{}, newSettingsMockManager(t)) require.NoError(t, err) + sqliteStore, ok := nmdataStore.Store.(*networkmap_sqlite.SqliteStore) + require.True(t, ok, "network map store is %T, want *networkmap_sqlite.SqliteStore", nmdataStore.Store) + t.Cleanup(func() { assert.NoError(t, sqliteStore.Db.Close()) }) manager, updateManager, err := buildTestManager(t, store, nmdataStore) require.NoError(t, err) @@ -3636,7 +3653,8 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb Return(nil). AnyTimes() - cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100) + // The go-cache janitor only stops via a GC finalizer and would outlive synctest bubbles. + cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100) if err != nil { return nil, nil, err } @@ -3648,8 +3666,11 @@ func buildTestManager(t testing.TB, store store.Store, nmdataStore *networkmapdb if err != nil { return nil, nil, err } + cacheManager := manager.cacheManager + t.Cleanup(func() { assert.NoError(t, cacheManager.Close()) }) proxyGrpcServer := nbgrpc.NewProxyServiceServer(nil, nil, nil, nbgrpc.ProxyOIDCConfig{}, peersManager, nil, nil, proxyManager, nil) + t.Cleanup(proxyGrpcServer.Close) proxyController, err := proxymanager.NewGRPCController(proxyGrpcServer, noop.Meter{}) if err != nil { return nil, nil, err @@ -3743,6 +3764,33 @@ func setupNetworkMapTest(t *testing.T) (*DefaultAccountManager, *update_channel. // when the channel delivers. const peerUpdateTimeout = 5 * time.Second +// peerUpdateSettleTime bounds how far settleAffectedUpdates advances the fake clock. It must exceed +// the account request and peer update buffer intervals. +const peerUpdateSettleTime = time.Second + +// runPeerUpdateTest runs f inside synctest.Test, so the peer update helpers observe every background +// goroutine of the test, and lets the updates still in flight when f returns finish before the bubble +// ends, since the bubble's clock stops with it. +func runPeerUpdateTest(t *testing.T, f func(t *testing.T)) { + synctest.Test(t, func(t *testing.T) { + defer settleAffectedUpdates() + f(t) + }) +} + +// settleAffectedUpdates runs the synctest bubble's fake clock past every update buffer interval until +// all goroutines are blocked, then discards the updates already delivered to chans, so the next +// assertion only observes updates from the action under test. It must be called inside synctest.Test. +func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) { + time.Sleep(peerUpdateSettleTime) + synctest.Wait() + for _, ch := range chans { + for len(ch) > 0 { + <-ch + } + } +} + func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) { for { select { @@ -3756,6 +3804,19 @@ func drainPeerUpdates(ch <-chan *network_map.UpdateMessage) { } } +// step runs f as one named stage of a test inside synctest.Test, which forbids t.Run, and names the +// stage when it fails the test. Stages share t, so a fatal failure ends the remaining stages as well. +func step(t *testing.T, name string, f func(t *testing.T)) { + t.Helper() + failedBefore := t.Failed() + defer func() { + if !failedBefore && t.Failed() { + t.Logf("step %q failed", name) + } + }() + f(t) +} + func peerShouldNotReceiveUpdate(t *testing.T, updateMessage <-chan *network_map.UpdateMessage) { t.Helper() select { diff --git a/management/server/affected_peers_jwt_test.go b/management/server/affected_peers_jwt_test.go index 766745cd7..0b0eba1c4 100644 --- a/management/server/affected_peers_jwt_test.go +++ b/management/server/affected_peers_jwt_test.go @@ -87,93 +87,93 @@ func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T) // auto-group change updates only the user's peers and the peers linked to the changed // group through policies, instead of fanning out to the whole account. func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) { - manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - key, err := wgtypes.GeneratePrivateKey() - require.NoError(t, err) - userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{ - Key: key.PublicKey().String(), - Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"}, - }, false) - require.NoError(t, err) + key, err := wgtypes.GeneratePrivateKey() + require.NoError(t, err) + userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{ + Key: key.PublicKey().String(), + Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"}, + }, false) + require.NoError(t, err) - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID)) - } + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) + require.NoError(t, err) + for _, p := range policies { + require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID)) + } - account, err = manager.Store.GetAccount(ctx, accountID) - require.NoError(t, err) - account.Settings.JWTGroupsEnabled = true - account.Settings.JWTGroupsClaimName = "groups" - account.Settings.GroupsPropagationEnabled = true - require.NoError(t, manager.Store.SaveAccount(ctx, account)) + account, err = manager.Store.GetAccount(ctx, accountID) + require.NoError(t, err) + account.Settings.JWTGroupsEnabled = true + account.Settings.JWTGroupsClaimName = "groups" + account.Settings.GroupsPropagationEnabled = true + require.NoError(t, manager.Store.SaveAccount(ctx, account)) - require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}})) - require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}})) + require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}})) + require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}})) - _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"jwt-grp"}, - Destinations: []string{"jwt-dest"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, + _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"jwt-grp"}, + Destinations: []string{"jwt-dest"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, }, - }, - }, true) - require.NoError(t, err) - - updUser := updateManager.CreateChannel(ctx, userPeer.ID) - upd2 := updateManager.CreateChannel(ctx, peer2.ID) - upd3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, userPeer.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - userAuth := auth.UserAuth{ - AccountId: accountID, - UserId: userID, - Groups: []string{"jwt-linked"}, - } - - t.Run("adding JWT group updates only linked peers", func(t *testing.T) { - drainPeerUpdates(updUser) - drainPeerUpdates(upd2) - drainPeerUpdates(upd3) - - require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth)) - - peerShouldReceiveUpdate(t, updUser) - peerShouldReceiveUpdate(t, upd2) - peerShouldNotReceiveUpdate(t, upd3) - - user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID) + }, true) require.NoError(t, err) - assert.Contains(t, user.AutoGroups, "jwt-grp") - }) - t.Run("removing JWT group updates only linked peers", func(t *testing.T) { - drainPeerUpdates(updUser) - drainPeerUpdates(upd2) - drainPeerUpdates(upd3) + updUser := updateManager.CreateChannel(ctx, userPeer.ID) + upd2 := updateManager.CreateChannel(ctx, peer2.ID) + upd3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, userPeer.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) - userAuth.Groups = nil - require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth)) + userAuth := auth.UserAuth{ + AccountId: accountID, + UserId: userID, + Groups: []string{"jwt-linked"}, + } - peerShouldReceiveUpdate(t, updUser) - peerShouldReceiveUpdate(t, upd2) - peerShouldNotReceiveUpdate(t, upd3) + step(t, "adding JWT group updates only linked peers", func(t *testing.T) { + settleAffectedUpdates(updUser, upd2, upd3) - user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID) - require.NoError(t, err) - assert.NotContains(t, user.AutoGroups, "jwt-grp") + require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth)) + + peerShouldReceiveUpdate(t, updUser) + peerShouldReceiveUpdate(t, upd2) + peerShouldNotReceiveUpdate(t, upd3) + + user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID) + require.NoError(t, err) + assert.Contains(t, user.AutoGroups, "jwt-grp") + }) + + step(t, "removing JWT group updates only linked peers", func(t *testing.T) { + drainPeerUpdates(updUser) + drainPeerUpdates(upd2) + drainPeerUpdates(upd3) + + userAuth.Groups = nil + require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth)) + + peerShouldReceiveUpdate(t, updUser) + peerShouldReceiveUpdate(t, upd2) + peerShouldNotReceiveUpdate(t, upd3) + + user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID) + require.NoError(t, err) + assert.NotContains(t, user.AutoGroups, "jwt-grp") + }) }) } diff --git a/management/server/affected_peers_oldstate_test.go b/management/server/affected_peers_oldstate_test.go index bcb78a660..bfc0a51b9 100644 --- a/management/server/affected_peers_oldstate_test.go +++ b/management/server/affected_peers_oldstate_test.go @@ -24,120 +24,124 @@ import ( // detaching one of them must still refresh that group's policy source peers, even // though the post-update resource no longer maps to it. func TestAffectedPeers_E2E_UpdateResource_DetachGroup_RefreshesOldGroupSources(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - // A second resource group + a second source group/peer that reaches the - // resource only through that second group. - const detachGroupID = "rs-detach-grp" - require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"})) + // A second resource group + a second source group/peer that reaches the + // resource only through that second group. + const detachGroupID = "rs-detach-grp" + require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ID: detachGroupID, Name: "rs-detach"})) - const secondSourceGroupID = "rs-source-grp-2" - setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) - require.NoError(t, err) - secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) - require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ - ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID}, - })) + const secondSourceGroupID = "rs-source-grp-2" + setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-detach-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) + require.NoError(t, err) + secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) + require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ + ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID}, + })) - resourcesManager, _, _ := s.managers() + resourcesManager, _, _ := s.managers() - // Attach the resource to the detach group as well: now in [resourceGroup, detachGroup]. - _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ - ID: s.resourceID, - AccountID: s.accountID, - NetworkID: s.networkID, - Name: "rs-resource-host", - Address: "10.20.30.0/24", - GroupIDs: []string{s.resourceGroupID, detachGroupID}, - Enabled: true, + // Attach the resource to the detach group as well: now in [resourceGroup, detachGroup]. + _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ + ID: s.resourceID, + AccountID: s.accountID, + NetworkID: s.networkID, + Name: "rs-resource-host", + Address: "10.20.30.0/24", + GroupIDs: []string{s.resourceGroupID, detachGroupID}, + Enabled: true, + }) + require.NoError(t, err) + + // Policy granting the second source group access via the detach group. + _, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true) + require.NoError(t, err) + + secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID) + t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) }) + settleAffectedUpdates(secondSrcCh) + + done := make(chan struct{}) + go func() { + // Detaching the resource from detachGroup removes the second source's + // access; that source peer must be refreshed even though the post-update + // resource no longer maps to detachGroup. + peerShouldReceiveUpdate(t, secondSrcCh) + close(done) + }() + + _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ + ID: s.resourceID, + AccountID: s.accountID, + NetworkID: s.networkID, + Name: "rs-resource-host", + Address: "10.20.30.0/24", + GroupIDs: []string{s.resourceGroupID}, // detached detachGroup + Enabled: true, + }) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer") + } }) - require.NoError(t, err) - - // Policy granting the second source group access via the detach group. - _, err = s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(secondSourceGroupID, detachGroupID), true) - require.NoError(t, err) - - secondSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID) - t.Cleanup(func() { s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) }) - settleAffectedUpdates(secondSrcCh) - - done := make(chan struct{}) - go func() { - // Detaching the resource from detachGroup removes the second source's - // access; that source peer must be refreshed even though the post-update - // resource no longer maps to detachGroup. - peerShouldReceiveUpdate(t, secondSrcCh) - close(done) - }() - - _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ - ID: s.resourceID, - AccountID: s.accountID, - NetworkID: s.networkID, - Name: "rs-resource-host", - Address: "10.20.30.0/24", - GroupIDs: []string{s.resourceGroupID}, // detached detachGroup - Enabled: true, - }) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: detaching a resource group did not refresh the old group's policy source peer") - } } // TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer: // changing router.Peer within the same network must still refresh the OLD routing // peer, which loses its routing role. func TestAffectedPeers_E2E_UpdateRouter_RepointPeer_RefreshesOldRoutingPeer(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) - _, routersManager, _ := s.managers() + _, routersManager, _ := s.managers() - routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID) - require.NoError(t, err) - require.Len(t, routers, 1) - router := routers[0] - oldRoutingPeer := router.Peer - require.NotEmpty(t, oldRoutingPeer) + routers, err := s.manager.Store.GetNetworkRoutersByNetID(ctx, store.LockingStrengthNone, s.accountID, s.networkID) + require.NoError(t, err) + require.Len(t, routers, 1) + router := routers[0] + oldRoutingPeer := router.Peer + require.NotEmpty(t, oldRoutingPeer) - // A new peer to become the routing peer in place of the old one. - setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) - require.NoError(t, err) - newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) + // A new peer to become the routing peer in place of the old one. + setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-newrouter-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) + require.NoError(t, err) + newRoutingPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) - oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer) - t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) }) - settleAffectedUpdates(oldCh) + oldCh := s.updateManager.CreateChannel(ctx, oldRoutingPeer) + t.Cleanup(func() { s.updateManager.CloseChannel(ctx, oldRoutingPeer) }) + settleAffectedUpdates(oldCh) - done := make(chan struct{}) - go func() { - // The old routing peer stops serving the resource and must be refreshed. - peerShouldReceiveUpdate(t, oldCh) - close(done) - }() + done := make(chan struct{}) + go func() { + // The old routing peer stops serving the resource and must be refreshed. + peerShouldReceiveUpdate(t, oldCh) + close(done) + }() - _, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{ - ID: router.ID, - NetworkID: s.networkID, - AccountID: s.accountID, - Peer: newRoutingPeer.ID, // repoint within the same network - Masquerade: true, - Metric: 9999, - Enabled: true, + _, err = routersManager.UpdateRouter(ctx, userID, &routerTypes.NetworkRouter{ + ID: router.ID, + NetworkID: s.networkID, + AccountID: s.accountID, + Peer: newRoutingPeer.ID, // repoint within the same network + Masquerade: true, + Metric: 9999, + Enabled: true, + }) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: re-pointing the router peer did not refresh the old routing peer") + } }) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: re-pointing the router peer did not refresh the old routing peer") - } } diff --git a/management/server/affected_peers_router_paths_test.go b/management/server/affected_peers_router_paths_test.go index d5868a5c1..185c03ddb 100644 --- a/management/server/affected_peers_router_paths_test.go +++ b/management/server/affected_peers_router_paths_test.go @@ -165,148 +165,154 @@ func (s *routerScenario) createPostureCheckGatedPolicy(t *testing.T, ctx context } func TestAffectedPeers_E2E_SavePostureCheck_RefreshesRoutingPeer(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)) + checkID := s.createPostureCheckGatedPolicy(t, ctx, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID)) - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) - s.updateManager.CloseChannel(ctx, s.unrelatedPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + s.updateManager.CloseChannel(ctx, s.unrelatedPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh, unrelatedCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + peerShouldNotReceiveUpdate(t, unrelatedCh) + close(done) + }() + + _, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{ + ID: checkID, + Name: "rs-min-version", + Checks: posture.ChecksDefinition{ + NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"}, + }, + }, false) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: editing a posture check did not refresh source + routing peers") + } }) - - settleAffectedUpdates(srcCh, routerCh, unrelatedCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - peerShouldNotReceiveUpdate(t, unrelatedCh) - close(done) - }() - - _, err := s.manager.SavePostureChecks(ctx, s.accountID, userID, &posture.Checks{ - ID: checkID, - Name: "rs-min-version", - Checks: posture.ChecksDefinition{ - NBVersionCheck: &posture.NBVersionCheck{MinVersion: "0.31.0"}, - }, - }, false) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: editing a posture check did not refresh source + routing peers") - } } func TestAffectedPeers_E2E_UpdateResource_DestinationResourcePolicy_RefreshesSourcePeer(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true) - require.NoError(t, err) + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true) + require.NoError(t, err) - resourcesManager, _, _ := s.managers() + resourcesManager, _, _ := s.managers() - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) - s.updateManager.CloseChannel(ctx, s.unrelatedPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + s.updateManager.CloseChannel(ctx, s.unrelatedPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh, unrelatedCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + peerShouldNotReceiveUpdate(t, unrelatedCh) + close(done) + }() + + _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ + ID: s.resourceID, + AccountID: s.accountID, + NetworkID: s.networkID, + Name: "rs-resource-host", + Address: "10.20.30.0/25", + GroupIDs: []string{s.resourceGroupID}, + Enabled: true, + }) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer") + } }) - - settleAffectedUpdates(srcCh, routerCh, unrelatedCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - peerShouldNotReceiveUpdate(t, unrelatedCh) - close(done) - }() - - _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ - ID: s.resourceID, - AccountID: s.accountID, - NetworkID: s.networkID, - Name: "rs-resource-host", - Address: "10.20.30.0/25", - GroupIDs: []string{s.resourceGroupID}, - Enabled: true, - }) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: updating a DestinationResource-targeted resource did not refresh its policy source peer") - } } // A disabled sibling router routes to nobody, so updating a resource on its network // must NOT refresh its peer (the enabled router carries the bridge instead). func TestAffectedPeers_E2E_UpdateResource_DisabledSiblingRouterNotBridged(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) - resourcesManager, routersManager, _ := s.managers() + resourcesManager, routersManager, _ := s.managers() - setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) - require.NoError(t, err) - disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) - _, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{ - NetworkID: s.networkID, - AccountID: s.accountID, - Peer: disabledRouterPeer.ID, - Masquerade: true, - Metric: 9000, - Enabled: false, + setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-disabled", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) + require.NoError(t, err) + disabledRouterPeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) + _, err = routersManager.CreateRouter(ctx, userID, &routerTypes.NetworkRouter{ + NetworkID: s.networkID, + AccountID: s.accountID, + Peer: disabledRouterPeer.ID, + Masquerade: true, + Metric: 9000, + Enabled: false, + }) + require.NoError(t, err) + + disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID) + enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + }) + + settleAffectedUpdates(disabledCh, enabledCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, enabledCh) + peerShouldNotReceiveUpdate(t, disabledCh) + close(done) + }() + + _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ + ID: s.resourceID, + AccountID: s.accountID, + NetworkID: s.networkID, + Name: "rs-resource-host", + Address: "10.20.30.0/25", + GroupIDs: []string{s.resourceGroupID}, + Enabled: true, + }) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } }) - require.NoError(t, err) - - disabledCh := s.updateManager.CreateChannel(ctx, disabledRouterPeer.ID) - enabledCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, disabledRouterPeer.ID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) - }) - - settleAffectedUpdates(disabledCh, enabledCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, enabledCh) - peerShouldNotReceiveUpdate(t, disabledCh) - close(done) - }() - - _, err = resourcesManager.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ - ID: s.resourceID, - AccountID: s.accountID, - NetworkID: s.networkID, - Name: "rs-resource-host", - Address: "10.20.30.0/25", - GroupIDs: []string{s.resourceGroupID}, - Enabled: true, - }) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") - } } func TestAffectedPeers_GroupChange_RouterInOtherNetworkNotAffected(t *testing.T) { @@ -346,8 +352,10 @@ func TestAffectedPeers_PeerChange_RouterInOtherNetworkNotAffected(t *testing.T) // shortcut (the denied peer's map holds no router) and the allow direction // depends on which meta field moved, leaving the routers with a stale map. func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) { - runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy { - return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID) + runPeerUpdateTest(t, func(t *testing.T) { + runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy { + return peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID) + }) }) } @@ -355,8 +363,10 @@ func TestAffectedPeers_E2E_PostureFlip_RefreshesRoutingPeer(t *testing.T) { // scenario with the source peer named directly in the rule: it must receive its posture // checks and have its flips detected exactly like a group member. func TestAffectedPeers_E2E_PostureFlip_DirectSourcePeer_RefreshesRoutingPeer(t *testing.T) { - runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy { - return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID) + runPeerUpdateTest(t, func(t *testing.T) { + runPostureFlipRefreshesRoutingPeer(t, func(s *routerScenario) *types.Policy { + return peerToResourcePolicyByPeer(s.sourcePeerID, s.resourceGroupID) + }) }) } diff --git a/management/server/affected_peers_router_test.go b/management/server/affected_peers_router_test.go index 7e3f02b27..e2bdff4ad 100644 --- a/management/server/affected_peers_router_test.go +++ b/management/server/affected_peers_router_test.go @@ -8,7 +8,6 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" - "github.com/netbirdio/netbird/management/internals/controllers/network_map" "github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel" "github.com/netbirdio/netbird/management/server/affectedpeers" "github.com/netbirdio/netbird/management/server/groups" @@ -320,190 +319,189 @@ func TestAffectedPeers_PolicyToResource_UnrelatedPeerNotAffected(t *testing.T) { } func TestAffectedPeers_ResourceSideBridgesToRoutingPeer_DirectRouter(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - // A pre-existing policy grants the source group access to the resource. - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) + // A pre-existing policy grants the source group access to the resource. + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) - // Drive an update through the resource manager and assert the routing peer - // is among the affected set by observing the channel. This path walks - // policies whose destinations reference the resource's groups, folds in the - // source groups, and loads the network's routers, so it reaches both the - // source peer and the routing peer. - permissionsManager := permissions.NewManager(s.manager.Store) - groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager) - rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager) + // Drive an update through the resource manager and assert the routing peer + // is among the affected set by observing the channel. This path walks + // policies whose destinations reference the resource's groups, folds in the + // source groups, and loads the network's routers, so it reaches both the + // source peer and the routing peer. + permissionsManager := permissions.NewManager(s.manager.Store) + groupsManager := groups.NewManager(s.manager.Store, permissionsManager, s.manager) + rm := resources.NewManager(s.manager.Store, permissionsManager, groupsManager, s.manager, s.manager.serviceManager) - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + close(done) + }() + + _, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ + ID: s.resourceID, + AccountID: s.accountID, + NetworkID: s.networkID, + Name: "rs-resource-host", + Address: "10.20.30.0/24", + GroupIDs: []string{s.resourceGroupID}, + Enabled: true, + }) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: resource update did not refresh source peer + routing peer") + } }) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - close(done) - }() - - _, err = rm.UpdateResource(ctx, userID, &resourceTypes.NetworkResource{ - ID: s.resourceID, - AccountID: s.accountID, - NetworkID: s.networkID, - Name: "rs-resource-host", - Address: "10.20.30.0/24", - GroupIDs: []string{s.resourceGroupID}, - Enabled: true, - }) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: resource update did not refresh source peer + routing peer") - } -} - -// settleAffectedUpdates waits for in-flight async updates to arrive, then drains -// every given channel so subsequent assertions start from a clean slate. -// -// Setup (CreateNetwork/CreateResource/CreateRouter) fires async UpdateAffectedPeers -// goroutines; draining first means the assertion only observes updates from the -// action under test, not setup stragglers. -func settleAffectedUpdates(chans ...<-chan *network_map.UpdateMessage) { - time.Sleep(300 * time.Millisecond) - for _, ch := range chans { - drainPeerUpdates(ch) - } } func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_DirectRouter(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) - s.updateManager.CloseChannel(ctx, s.unrelatedPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + unrelatedCh := s.updateManager.CreateChannel(ctx, s.unrelatedPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + s.updateManager.CloseChannel(ctx, s.unrelatedPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh, unrelatedCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + peerShouldNotReceiveUpdate(t, unrelatedCh) + close(done) + }() + + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: creating peer->resource policy did not refresh the routing peer") + } }) - - settleAffectedUpdates(srcCh, routerCh, unrelatedCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - peerShouldNotReceiveUpdate(t, unrelatedCh) - close(done) - }() - - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: creating peer->resource policy did not refresh the routing peer") - } } func TestAffectedPeers_E2E_CreatePolicy_RoutingPeer_RouterPeerGroups(t *testing.T) { - s := setupRouterScenario(t, false) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, false) + ctx := context.Background() - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerGroupPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerGroupPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + close(done) + }() + + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create") + } }) - - settleAffectedUpdates(srcCh, routerCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - close(done) - }() - - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: routing peer (PeerGroups) not refreshed on policy create") - } } func TestAffectedPeers_E2E_DestResource_RoutingPeer(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + close(done) + }() + + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: routing peer not refreshed when policy targets DestinationResource") + } }) - - settleAffectedUpdates(srcCh, routerCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - close(done) - }() - - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: routing peer not refreshed when policy targets DestinationResource") - } } func TestAffectedPeers_E2E_DeletePolicy_RoutingPeer(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) + policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + close(done) + }() + + require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID)) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: deleting peer->resource policy did not refresh the routing peer") + } }) - - settleAffectedUpdates(srcCh, routerCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - close(done) - }() - - require.NoError(t, s.manager.DeletePolicy(ctx, s.accountID, policy.ID, userID)) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: deleting peer->resource policy did not refresh the routing peer") - } } func (s *routerScenario) managers() (resources.Manager, routers.Manager, networks.Manager) { @@ -572,113 +570,119 @@ func (s *routerScenario) addSecondTopology(t *testing.T, suffix string) secondTo } func TestAffectedPeers_E2E_UpdatePolicy_BothRoutingPeers(t *testing.T) { - s := setupRouterScenario(t, true) - second := s.addSecondTopology(t, "b") - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + second := s.addSecondTopology(t, "b") + ctx := context.Background() - policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) + policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) - s.updateManager.CloseChannel(ctx, second.routerPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerACh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + routerBCh := s.updateManager.CreateChannel(ctx, second.routerPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + s.updateManager.CloseChannel(ctx, second.routerPeerID) + }) + + settleAffectedUpdates(srcCh, routerACh, routerBCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerACh) + peerShouldReceiveUpdate(t, routerBCh) + close(done) + }() + + policy.Rules[0].Destinations = []string{second.resourceGroupID} + _, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: re-pointing the policy destination did not refresh both routing peers") + } }) - - settleAffectedUpdates(srcCh, routerACh, routerBCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerACh) - peerShouldReceiveUpdate(t, routerBCh) - close(done) - }() - - policy.Rules[0].Destinations = []string{second.resourceGroupID} - _, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: re-pointing the policy destination did not refresh both routing peers") - } } func TestAffectedPeers_E2E_UpdatePolicy_AddSource(t *testing.T) { - s := setupRouterScenario(t, true) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, true) + ctx := context.Background() - const secondSourceGroupID = "rs-source-grp-2" - setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) - require.NoError(t, err) - secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) - require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ - ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID}, - })) + const secondSourceGroupID = "rs-source-grp-2" + setupKey, err := s.manager.CreateSetupKey(ctx, s.accountID, "rs-key-2", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) + require.NoError(t, err) + secondSourcePeer := addPeerToAccount(t, s.manager, s.accountID, setupKey.Key) + require.NoError(t, s.manager.CreateGroup(ctx, s.accountID, userID, &types.Group{ + ID: secondSourceGroupID, Name: "rs-source-2", Peers: []string{secondSourcePeer.ID}, + })) - policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) - require.NoError(t, err) + policy, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByGroup(s.sourceGroupID, s.resourceGroupID), true) + require.NoError(t, err) - newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) - s.updateManager.CloseChannel(ctx, s.routerPeerID) + newSrcCh := s.updateManager.CreateChannel(ctx, secondSourcePeer.ID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, secondSourcePeer.ID) + s.updateManager.CloseChannel(ctx, s.routerPeerID) + }) + + settleAffectedUpdates(newSrcCh, routerCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, newSrcCh) + peerShouldReceiveUpdate(t, routerCh) + close(done) + }() + + policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID} + _, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: adding a source group did not refresh the new source peer + routing peer") + } }) - - settleAffectedUpdates(newSrcCh, routerCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, newSrcCh) - peerShouldReceiveUpdate(t, routerCh) - close(done) - }() - - policy.Rules[0].Sources = []string{s.sourceGroupID, secondSourceGroupID} - _, err = s.manager.SavePolicy(ctx, s.accountID, userID, policy, false) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: adding a source group did not refresh the new source peer + routing peer") - } } func TestAffectedPeers_E2E_DestResource_RouterPeerGroups(t *testing.T) { - s := setupRouterScenario(t, false) - ctx := context.Background() + runPeerUpdateTest(t, func(t *testing.T) { + s := setupRouterScenario(t, false) + ctx := context.Background() - srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) - routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID) - t.Cleanup(func() { - s.updateManager.CloseChannel(ctx, s.sourcePeerID) - s.updateManager.CloseChannel(ctx, s.routerGroupPeerID) + srcCh := s.updateManager.CreateChannel(ctx, s.sourcePeerID) + routerCh := s.updateManager.CreateChannel(ctx, s.routerGroupPeerID) + t.Cleanup(func() { + s.updateManager.CloseChannel(ctx, s.sourcePeerID) + s.updateManager.CloseChannel(ctx, s.routerGroupPeerID) + }) + + settleAffectedUpdates(srcCh, routerCh) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, srcCh) + peerShouldReceiveUpdate(t, routerCh) + close(done) + }() + + _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer") + } }) - - settleAffectedUpdates(srcCh, routerCh) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, srcCh) - peerShouldReceiveUpdate(t, routerCh) - close(done) - }() - - _, err := s.manager.SavePolicy(ctx, s.accountID, userID, peerToResourcePolicyByResource(s.sourceGroupID, s.resourceID), true) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout: DestinationResource policy with PeerGroups router did not refresh the routing peer") - } } func TestAffectedPeers_AllRoutingPeers_Network(t *testing.T) { diff --git a/management/server/affected_peers_test.go b/management/server/affected_peers_test.go index 235128693..90408f70a 100644 --- a/management/server/affected_peers_test.go +++ b/management/server/affected_peers_test.go @@ -955,73 +955,77 @@ func TestAffectedPeers_IsolatedRouteAndPolicy(t *testing.T) { } func TestAffectedPeers_GroupUpdateOnlyAffectsLinkedPeers(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}}, - {ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}}, - {ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"ap-grpA"}, - Destinations: []string{"ap-grpB"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, - }, - }, true) - require.NoError(t, err) - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID}) - assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result) - - t.Run("group change updates all peers in policy groups", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldReceiveUpdate(t, updMsg2) - peerShouldReceiveUpdate(t, updMsg3) - close(done) - }() - - err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{ - ID: "ap-grpA", - Name: "AP-A", - Peers: []string{peer1.ID, peer3.ID}, - }) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "ap-grpA", Name: "AP-A", Peers: []string{peer1.ID}}, + {ID: "ap-grpB", Name: "AP-B", Peers: []string{peer2.ID}}, + {ID: "ap-grpC", Name: "AP-C", Peers: []string{peer3.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"ap-grpA"}, + Destinations: []string{"ap-grpB"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + require.NoError(t, err) + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + result := manager.resolveAffectedPeersForPeerChanges(ctx, manager.Store, accountID, []string{peer1.ID}) + assert.ElementsMatch(t, []string{peer1.ID, peer2.ID}, result) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "group change updates all peers in policy groups", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldReceiveUpdate(t, updMsg2) + peerShouldReceiveUpdate(t, updMsg3) + close(done) + }() + + err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{ + ID: "ap-grpA", + Name: "AP-A", + Peers: []string{peer1.ID, peer3.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } @@ -1037,243 +1041,259 @@ func TestAffectedPeers_UnlinkedPeerChange_RefreshesSelfOnly(t *testing.T) { // TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate verifies that creating/deleting a // policy only sends updates to peers in the policy's groups, not to unrelated peers. func TestAffectedPeers_PolicyChange_UnrelatedPeerNoUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}}, - {ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}}, - {ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("create policy only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - _, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"pol-grpA"}, - Destinations: []string{"pol-grpB"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, - }, - }, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "pol-grpA", Name: "Pol-A", Peers: []string{peer1.ID}}, + {ID: "pol-grpB", Name: "Pol-B", Peers: []string{peer2.ID}}, + {ID: "pol-grpC", Name: "Pol-C", Peers: []string{peer3.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "create policy only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + _, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"pol-grpA"}, + Destinations: []string{"pol-grpB"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate verifies that creating a route // only sends updates to peers in the route's groups, not to unrelated peers. func TestAffectedPeers_RouteChange_UnrelatedPeerNoUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}}, - {ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}}, - {ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("create route only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - _, err := manager.CreateRoute(ctx, accountID, - netip.MustParsePrefix("10.10.0.0/24"), - route.IPv4Network, - nil, - "", - []string{"rt-grpA"}, - "test route", - "routenoaffect", - false, - 9999, - []string{"rt-grpB"}, - nil, - true, - userID, - false, - false, - ) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "rt-grpA", Name: "Rt-A", Peers: []string{peer1.ID}}, + {ID: "rt-grpB", Name: "Rt-B", Peers: []string{peer2.ID}}, + {ID: "rt-grpC", Name: "Rt-C", Peers: []string{peer3.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "create route only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + _, err := manager.CreateRoute(ctx, accountID, + netip.MustParsePrefix("10.10.0.0/24"), + route.IPv4Network, + nil, + "", + []string{"rt-grpA"}, + "test route", + "routenoaffect", + false, + 9999, + []string{"rt-grpB"}, + nil, + true, + userID, + false, + false, + ) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate verifies that creating a // nameserver group only sends updates to peers in its groups, not to unrelated peers. func TestAffectedPeers_NameServerChange_UnrelatedPeerNoUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}}, - {ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("create nameserver group only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldNotReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - _, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated", - []nbdns.NameServer{{ - IP: netip.MustParseAddr("1.1.1.1"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"ns-grpA"}, - true, nil, true, userID, false, - ) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "ns-grpA", Name: "NS-A", Peers: []string{peer1.ID}}, + {ID: "ns-grpB", Name: "NS-B", Peers: []string{peer2.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "create nameserver group only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldNotReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + _, err := manager.CreateNameServerGroup(ctx, accountID, "ns-unrelated", "NS Unrelated", + []nbdns.NameServer{{ + IP: netip.MustParseAddr("1.1.1.1"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"ns-grpA"}, + true, nil, true, userID, false, + ) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate verifies that changing DNS // settings only sends updates to peers in the affected groups, not to unrelated peers. func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}}, - {ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("dns settings change only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldNotReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{ - DisabledManagementGroups: []string{"dns-grpA"}, - }) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "dns-grpA", Name: "DNS-A", Peers: []string{peer1.ID}}, + {ID: "dns-grpB", Name: "DNS-B", Peers: []string{peer2.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "dns settings change only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldNotReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + err := manager.SaveDNSSettings(ctx, accountID, userID, &types.DNSSettings{ + DisabledManagementGroups: []string{"dns-grpA"}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } @@ -1281,429 +1301,451 @@ func TestAffectedPeers_DNSSettingsChange_UnrelatedPeerNoUpdate(t *testing.T) { // updating a group that is NOT referenced by any policy/route/ns/dns should not send // updates to any peer. func TestAffectedPeers_UnlinkedGroupChange_NoUpdateIntegration(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) + } - err = manager.CreateGroup(ctx, accountID, userID, &types.Group{ - ID: "unlinked-grp", - Name: "Unlinked", - Peers: []string{peer1.ID}, - }) - require.NoError(t, err) - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("updating unlinked group sends no peer updates", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg1) - peerShouldNotReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{ + err = manager.CreateGroup(ctx, accountID, userID, &types.Group{ ID: "unlinked-grp", Name: "Unlinked", - Peers: []string{peer1.ID, peer2.ID}, + Peers: []string{peer1.ID}, }) - assert.NoError(t, err) + require.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") - } + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "updating unlinked group sends no peer updates", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg1) + peerShouldNotReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{ + ID: "unlinked-grp", + Name: "Unlinked", + Peers: []string{peer1.ID, peer2.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate: a network router with peer // groups updates only those groups' peers (and resource policy sources), not others. func TestAffectedPeers_NetworkRouterUnlinkedPeerNoUpdate(t *testing.T) { - // Delete the default policy before adding peers so AddPeer schedules no async - // update that races with the test. - manager, updateManager, err := createManager(t) - require.NoError(t, err) - - ctx := context.Background() - - account, err := createAccount(manager, "nr_test_account", userID, "") - require.NoError(t, err) - accountID := account.Id - - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + runPeerUpdateTest(t, func(t *testing.T) { + // Delete the default policy before adding peers so AddPeer schedules no async + // update that races with the test. + manager, updateManager, err := createManager(t) require.NoError(t, err) - } - setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) - require.NoError(t, err) + ctx := context.Background() - peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key) - peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key) - peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key) - - for _, g := range []*types.Group{ - {ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}}, - {ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) + account, err := createAccount(manager, "nr_test_account", userID, "") require.NoError(t, err) - } + accountID := account.Id - net1 := &networkTypes.Network{ - ID: "nr-net-test", - AccountID: accountID, - Name: "nr-test-network", - } - err = manager.Store.SaveNetwork(ctx, net1) - require.NoError(t, err) - - err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{ - ID: "nr-router-test", - NetworkID: net1.ID, - AccountID: accountID, - PeerGroups: []string{"nr-grpA"}, - Enabled: true, - }) - require.NoError(t, err) - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("network router group change only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldNotReceiveUpdate(t, updMsg2) - peerShouldReceiveUpdate(t, updMsg3) - close(done) - }() - - err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{ - ID: "nr-grpA", - Name: "NR-A", - Peers: []string{peer1.ID, peer3.ID}, - }) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) + require.NoError(t, err) + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + setupKey, err := manager.CreateSetupKey(ctx, accountID, "test-key", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) + require.NoError(t, err) + + peer1 := addPeerToAccount(t, manager, accountID, setupKey.Key) + peer2 := addPeerToAccount(t, manager, accountID, setupKey.Key) + peer3 := addPeerToAccount(t, manager, accountID, setupKey.Key) + + for _, g := range []*types.Group{ + {ID: "nr-grpA", Name: "NR-A", Peers: []string{peer1.ID}}, + {ID: "nr-grpB", Name: "NR-B", Peers: []string{peer2.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + net1 := &networkTypes.Network{ + ID: "nr-net-test", + AccountID: accountID, + Name: "nr-test-network", + } + err = manager.Store.SaveNetwork(ctx, net1) + require.NoError(t, err) + + err = manager.Store.CreateNetworkRouter(ctx, &routerTypes.NetworkRouter{ + ID: "nr-router-test", + NetworkID: net1.ID, + AccountID: accountID, + PeerGroups: []string{"nr-grpA"}, + Enabled: true, + }) + require.NoError(t, err) + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "network router group change only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldNotReceiveUpdate(t, updMsg2) + peerShouldReceiveUpdate(t, updMsg3) + close(done) + }() + + err = manager.UpdateGroup(ctx, accountID, userID, &types.Group{ + ID: "nr-grpA", + Name: "NR-A", + Peers: []string{peer1.ID, peer3.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers: with a policy (peer1<->peer2) // and a separate route (peer3), changing one entity's groups affects only its peers. func TestAffectedPeers_IsolatedEntitiesOnlyAffectTheirPeers(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}}, - {ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}}, - {ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"iso-grpA"}, - Destinations: []string{"iso-grpB"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, - }, - }, true) - require.NoError(t, err) - - _, err = manager.CreateRoute(ctx, accountID, - netip.MustParsePrefix("10.20.0.0/24"), - route.IPv4Network, - nil, - "", - []string{"iso-grpC"}, - "isolated route", - "isonet2", - false, - 9999, - []string{"iso-grpC"}, - nil, - true, - userID, - false, - false, - ) - require.NoError(t, err) - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - // The setup policy/route above dispatch affected-peer updates asynchronously; - // drain any in-flight ones so the assertions only observe the UpdateGroup below. - settleAffectedUpdates(updMsg1, updMsg2, updMsg3) - - t.Run("policy group change does not affect route-only peer", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{ - ID: "iso-grpA", - Name: "ISO-A-updated", - Peers: []string{peer1.ID}, - }) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "iso-grpA", Name: "ISO-A", Peers: []string{peer1.ID}}, + {ID: "iso-grpB", Name: "ISO-B", Peers: []string{peer2.ID}}, + {ID: "iso-grpC", Name: "ISO-C", Peers: []string{peer3.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"iso-grpA"}, + Destinations: []string{"iso-grpB"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + require.NoError(t, err) + + _, err = manager.CreateRoute(ctx, accountID, + netip.MustParsePrefix("10.20.0.0/24"), + route.IPv4Network, + nil, + "", + []string{"iso-grpC"}, + "isolated route", + "isonet2", + false, + 9999, + []string{"iso-grpC"}, + nil, + true, + userID, + false, + false, + ) + require.NoError(t, err) + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + // The setup policy/route above dispatch affected-peer updates asynchronously; + // drain any in-flight ones so the assertions only observe the UpdateGroup below. + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "policy group change does not affect route-only peer", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + err := manager.UpdateGroup(ctx, accountID, userID, &types.Group{ + ID: "iso-grpA", + Name: "ISO-A-updated", + Peers: []string{peer1.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate verifies that deleting a route // only sends updates to peers in the route's groups. func TestAffectedPeers_DeleteRoute_UnrelatedPeerNoUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}}, - {ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - newRoute, err := manager.CreateRoute(ctx, accountID, - netip.MustParsePrefix("10.30.0.0/24"), - route.IPv4Network, - nil, - "", - []string{"del-rt-grpA"}, - "deletable route", - "delnet", - false, - 9999, - []string{"del-rt-grpB"}, - nil, - true, - userID, - false, - false, - ) - require.NoError(t, err) - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("delete route only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "del-rt-grpA", Name: "Del-Rt-A", Peers: []string{peer1.ID}}, + {ID: "del-rt-grpB", Name: "Del-Rt-B", Peers: []string{peer2.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + newRoute, err := manager.CreateRoute(ctx, accountID, + netip.MustParsePrefix("10.30.0.0/24"), + route.IPv4Network, + nil, + "", + []string{"del-rt-grpA"}, + "deletable route", + "delnet", + false, + 9999, + []string{"del-rt-grpB"}, + nil, + true, + userID, + false, + false, + ) + require.NoError(t, err) + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "delete route only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + err := manager.DeleteRoute(ctx, accountID, newRoute.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate verifies that deleting a policy // only sends updates to peers in the policy's groups. func TestAffectedPeers_DeletePolicy_UnrelatedPeerNoUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - for _, g := range []*types.Group{ - {ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}}, - {ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}}, - } { - err := manager.CreateGroup(ctx, accountID, userID, g) - require.NoError(t, err) - } - - policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"del-pol-grpA"}, - Destinations: []string{"del-pol-grpB"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, - }, - }, true) - require.NoError(t, err) - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("delete policy only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - err := manager.DeletePolicy(ctx, accountID, policy.ID, userID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + for _, g := range []*types.Group{ + {ID: "del-pol-grpA", Name: "Del-Pol-A", Peers: []string{peer1.ID}}, + {ID: "del-pol-grpB", Name: "Del-Pol-B", Peers: []string{peer2.ID}}, + } { + err := manager.CreateGroup(ctx, accountID, userID, g) + require.NoError(t, err) + } + + policy, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"del-pol-grpA"}, + Destinations: []string{"del-pol-grpB"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + require.NoError(t, err) + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "delete policy only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + err := manager.DeletePolicy(ctx, accountID, policy.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } // TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate verifies that deleting a // nameserver group only sends updates to peers in its groups. func TestAffectedPeers_DeleteNameServer_UnrelatedPeerNoUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) require.NoError(t, err) - } - - err = manager.CreateGroup(ctx, accountID, userID, &types.Group{ - ID: "del-ns-grpA", - Name: "Del-NS-A", - Peers: []string{peer1.ID}, - }) - require.NoError(t, err) - - nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS", - []nbdns.NameServer{{ - IP: netip.MustParseAddr("8.8.4.4"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"del-ns-grpA"}, - true, nil, true, userID, false, - ) - require.NoError(t, err) - - updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) - updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) - updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, peer1.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("delete nameserver group only affects linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - peerShouldNotReceiveUpdate(t, updMsg2) - peerShouldNotReceiveUpdate(t, updMsg3) - close(done) - }() - - err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout") + for _, p := range policies { + err := manager.Store.DeletePolicy(ctx, accountID, p.ID) + require.NoError(t, err) } + + err = manager.CreateGroup(ctx, accountID, userID, &types.Group{ + ID: "del-ns-grpA", + Name: "Del-NS-A", + Peers: []string{peer1.ID}, + }) + require.NoError(t, err) + + nsGroup, err := manager.CreateNameServerGroup(ctx, accountID, "del-ns", "Del NS", + []nbdns.NameServer{{ + IP: netip.MustParseAddr("8.8.4.4"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"del-ns-grpA"}, + true, nil, true, userID, false, + ) + require.NoError(t, err) + + updMsg1 := updateManager.CreateChannel(ctx, peer1.ID) + updMsg2 := updateManager.CreateChannel(ctx, peer2.ID) + updMsg3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, peer1.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) + }) + + settleAffectedUpdates(updMsg1, updMsg2, updMsg3) + + step(t, "delete nameserver group only affects linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + peerShouldNotReceiveUpdate(t, updMsg2) + peerShouldNotReceiveUpdate(t, updMsg3) + close(done) + }() + + err := manager.DeleteNameServerGroup(ctx, accountID, nsGroup.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout") + } + }) }) } diff --git a/management/server/affected_peers_user_test.go b/management/server/affected_peers_user_test.go index 3d73bbed0..3f4658de4 100644 --- a/management/server/affected_peers_user_test.go +++ b/management/server/affected_peers_user_test.go @@ -17,156 +17,152 @@ import ( // A user update refreshes only the peers its auto-group change reaches, and a user // update that changes no group membership refreshes nobody. func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) { - manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t) - ctx := context.Background() - accountID := account.Id + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t) + ctx := context.Background() + accountID := account.Id - const targetUserID = "target-user" - require.NoError(t, manager.Store.SaveUser(ctx, &types.User{ - Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, - })) + const targetUserID = "target-user" + require.NoError(t, manager.Store.SaveUser(ctx, &types.User{ + Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, + })) - key, err := wgtypes.GeneratePrivateKey() - require.NoError(t, err) - targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{ - Key: key.PublicKey().String(), - Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"}, - }, false) - require.NoError(t, err) + key, err := wgtypes.GeneratePrivateKey() + require.NoError(t, err) + targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{ + Key: key.PublicKey().String(), + Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"}, + }, false) + require.NoError(t, err) - policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) - require.NoError(t, err) - for _, p := range policies { - require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID)) - } + policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID) + require.NoError(t, err) + for _, p := range policies { + require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID)) + } - account, err = manager.Store.GetAccount(ctx, accountID) - require.NoError(t, err) - account.Settings.GroupsPropagationEnabled = true - require.NoError(t, manager.Store.SaveAccount(ctx, account)) + account, err = manager.Store.GetAccount(ctx, accountID) + require.NoError(t, err) + account.Settings.GroupsPropagationEnabled = true + require.NoError(t, manager.Store.SaveAccount(ctx, account)) - require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"})) - require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}})) + require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"})) + require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}})) - _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"ug-linked"}, - Destinations: []string{"ug-dest"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, + _, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"ug-linked"}, + Destinations: []string{"ug-dest"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, }, - }, - }, true) - require.NoError(t, err) + }, true) + require.NoError(t, err) - updTarget := updateManager.CreateChannel(ctx, targetPeer.ID) - upd2 := updateManager.CreateChannel(ctx, peer2.ID) - upd3 := updateManager.CreateChannel(ctx, peer3.ID) - t.Cleanup(func() { - updateManager.CloseChannel(ctx, targetPeer.ID) - updateManager.CloseChannel(ctx, peer2.ID) - updateManager.CloseChannel(ctx, peer3.ID) - }) - - t.Run("auto group change updates only linked peers", func(t *testing.T) { - drainPeerUpdates(updTarget) - drainPeerUpdates(upd2) - drainPeerUpdates(upd3) - - _, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ - Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, - AutoGroups: []string{"ug-linked"}, + updTarget := updateManager.CreateChannel(ctx, targetPeer.ID) + upd2 := updateManager.CreateChannel(ctx, peer2.ID) + upd3 := updateManager.CreateChannel(ctx, peer3.ID) + t.Cleanup(func() { + updateManager.CloseChannel(ctx, targetPeer.ID) + updateManager.CloseChannel(ctx, peer2.ID) + updateManager.CloseChannel(ctx, peer3.ID) }) - require.NoError(t, err) - peerShouldReceiveUpdate(t, updTarget) - peerShouldReceiveUpdate(t, upd2) - peerShouldNotReceiveUpdate(t, upd3) - }) + step(t, "auto group change updates only linked peers", func(t *testing.T) { + settleAffectedUpdates(updTarget, upd2, upd3) - t.Run("update without group changes refreshes nobody", func(t *testing.T) { - drainPeerUpdates(updTarget) - drainPeerUpdates(upd2) - drainPeerUpdates(upd3) + _, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ + Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, + AutoGroups: []string{"ug-linked"}, + }) + require.NoError(t, err) - _, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ - Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, - AutoGroups: []string{"ug-linked"}, Name: "renamed", + peerShouldReceiveUpdate(t, updTarget) + peerShouldReceiveUpdate(t, upd2) + peerShouldNotReceiveUpdate(t, upd3) }) - require.NoError(t, err) - peerShouldNotReceiveUpdate(t, updTarget) - peerShouldNotReceiveUpdate(t, upd2) - peerShouldNotReceiveUpdate(t, upd3) + step(t, "update without group changes refreshes nobody", func(t *testing.T) { + drainPeerUpdates(updTarget) + drainPeerUpdates(upd2) + drainPeerUpdates(upd3) - user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID) - require.NoError(t, err) - assert.Equal(t, "renamed", user.Name) - }) + _, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ + Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, + AutoGroups: []string{"ug-linked"}, Name: "renamed", + }) + require.NoError(t, err) - t.Run("auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) { - require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"})) - // Apply through the settings API so the reconciliation that strips the other + peerShouldNotReceiveUpdate(t, updTarget) + peerShouldNotReceiveUpdate(t, upd2) + peerShouldNotReceiveUpdate(t, upd3) + + user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID) + require.NoError(t, err) + assert.Equal(t, "renamed", user.Name) + }) + + step(t, "auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) { + + require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))// Apply through the settings API so the reconciliation that strips the other // peers' addresses happens here, leaving the target as the only peer the // user update reassigns. updateIPv6TestSettings(t, manager, accountID, func(s *types.Settings) { s.IPv6EnabledGroups = []string{"ug-v6"} }) - drainPeerUpdates(updTarget) - drainPeerUpdates(upd2) - drainPeerUpdates(upd3) + settleAffectedUpdates(updTarget, upd2, upd3) - _, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ - Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, - AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed", + _, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ + Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, + AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed", + }) + require.NoError(t, err) + + // The reassigned peer refreshes with everyone it can reach: peer2 via the + // policy, but not peer3, which shares no group or policy with it. + peerShouldReceiveUpdate(t, updTarget) + peerShouldReceiveUpdate(t, upd2) + peerShouldNotReceiveUpdate(t, upd3) }) - require.NoError(t, err) - // The reassigned peer refreshes with everyone it can reach: peer2 via the - // policy, but not peer3, which shares no group or policy with it. - peerShouldReceiveUpdate(t, updTarget) - peerShouldReceiveUpdate(t, upd2) - peerShouldNotReceiveUpdate(t, upd3) - }) + step(t, "unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) { + // An SSH rule that authorizes no group of its own ships the account's + // allowed-user set to its destinations, so those are the peers an unblock + // reaches — not the whole account. + _, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{{ + Enabled: true, + Sources: []string{"ug-linked"}, + Destinations: []string{"ug-dest"}, + Protocol: types.PolicyRuleProtocolNetbirdSSH, + Action: types.PolicyTrafficActionAccept, + }}, + }, true) + require.NoError(t, err) - t.Run("unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) { - // An SSH rule that authorizes no group of its own ships the account's - // allowed-user set to its destinations, so those are the peers an unblock - // reaches — not the whole account. - _, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{{ - Enabled: true, - Sources: []string{"ug-linked"}, - Destinations: []string{"ug-dest"}, - Protocol: types.PolicyRuleProtocolNetbirdSSH, - Action: types.PolicyTrafficActionAccept, - }}, - }, true) - require.NoError(t, err) + blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID) + require.NoError(t, err) + blocked.Blocked = true + require.NoError(t, manager.Store.SaveUser(ctx, blocked)) - blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID) - require.NoError(t, err) - blocked.Blocked = true - require.NoError(t, manager.Store.SaveUser(ctx, blocked)) + settleAffectedUpdates(updTarget, upd2, upd3) - drainPeerUpdates(updTarget) - drainPeerUpdates(upd2) - drainPeerUpdates(upd3) + // Same auto-groups as the previous subtest left them, so no group change and + // no IPv6 reconciliation interferes: the unblock alone drives the refresh. + _, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ + Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, + AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed", + }) + require.NoError(t, err) - // Same auto-groups as the previous subtest left them, so no group change and - // no IPv6 reconciliation interferes: the unblock alone drives the refresh. - _, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{ - Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser, - AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed", + peerShouldReceiveUpdate(t, upd2) + peerShouldNotReceiveUpdate(t, upd3) }) - require.NoError(t, err) - - peerShouldReceiveUpdate(t, upd2) - peerShouldNotReceiveUpdate(t, upd3) }) } diff --git a/management/server/cache/idp.go b/management/server/cache/idp.go index 6ec42e217..ec2684d6f 100644 --- a/management/server/cache/idp.go +++ b/management/server/cache/idp.go @@ -88,7 +88,8 @@ func NewUserDataCache(store store.StoreInterface) *UserDataCacheImpl { // AccountUserDataCache wraps the basic Get, Set and Delete methods for []*idp.UserData objects. type AccountUserDataCache struct { - cache Marshaler + cache Marshaler + loadable *cache.LoadableCache[any] } func (a *AccountUserDataCache) Get(ctx context.Context, key string) ([]*idp.UserData, error) { @@ -127,13 +128,18 @@ func (a *AccountUserDataCache) Delete(ctx context.Context, key string) error { return a.cache.Delete(ctx, key) } +// Close stops the goroutine that stores loaded values. The cache must not be used afterwards. +func (a *AccountUserDataCache) Close() error { + return a.loadable.Close() +} + // NewAccountUserDataCache creates a new AccountUserDataCache object. func NewAccountUserDataCache(loadableFunc cache.LoadFunction[any], store store.StoreInterface) *AccountUserDataCache { simpleCache := cache.New[any](store) loadable := cache.NewLoadable[any](loadableFunc, simpleCache) if store.GetType() == redis.RedisType { m := marshaler.New(loadable) - return &AccountUserDataCache{cache: m} + return &AccountUserDataCache{cache: m, loadable: loadable} } - return &AccountUserDataCache{cache: &marshalerWraper{loadable}} + return &AccountUserDataCache{cache: &marshalerWraper{loadable}, loadable: loadable} } diff --git a/management/server/dns_test.go b/management/server/dns_test.go index 25bef664c..d21864cbb 100644 --- a/management/server/dns_test.go +++ b/management/server/dns_test.go @@ -6,8 +6,8 @@ import ( "testing" "time" - "go.uber.org/mock/gomock" "github.com/stretchr/testify/assert" + "go.uber.org/mock/gomock" nbdns "github.com/netbirdio/netbird/dns" "github.com/netbirdio/netbird/management/internals/controllers/network_map/controller" @@ -363,163 +363,167 @@ func initTestDNSAccount(t *testing.T, am *DefaultAccountManager) (*types.Account } func TestDNSAccountPeersUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{ - { - ID: "groupA", - Name: "GroupA", - Peers: []string{}, - }, - { - ID: "groupB", - Name: "GroupB", - Peers: []string{}, - }, - }) - assert.NoError(t, err) - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - // Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates - t.Run("saving dns setting with unused groups", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ - DisabledManagementGroups: []string{"groupA"}, + err := manager.CreateGroups(context.Background(), account.Id, userID, []*types.Group{ + { + ID: "groupA", + Name: "GroupA", + Peers: []string{}, + }, + { + ID: "groupB", + Name: "GroupB", + Peers: []string{}, + }, }) assert.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Creating DNS settings with groups that have no peers should not update account peers or send peer update - t.Run("creating dns setting with unused groups", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - _, err = manager.CreateNameServerGroup( - context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{ - IP: netip.MustParseAddr(peer1.IP.String()), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"groupB"}, - true, []string{}, true, userID, false, - ) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Creating DNS settings with groups that have peers should update account peers and send peer update - t.Run("creating dns setting with used groups", func(t *testing.T) { - err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) }) - assert.NoError(t, err) - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + // Saving DNS settings with groups that have no peers should not trigger updates to account peers or send peer updates + step(t, "saving dns setting with unused groups", func(t *testing.T) { + settleAffectedUpdates(updMsg) - _, err = manager.CreateNameServerGroup( - context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{ - IP: netip.MustParseAddr(peer1.IP.String()), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"groupA"}, - true, []string{}, true, userID, false, - ) - assert.NoError(t, err) + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ + DisabledManagementGroups: []string{"groupA"}, + }) + assert.NoError(t, err) - // Saving DNS settings with groups that have peers should update account peers and send peer update - t.Run("saving dns setting with used groups", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ - DisabledManagementGroups: []string{"groupA", "groupB"}, + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // Creating DNS settings with groups that have no peers should not update account peers or send peer update + step(t, "creating dns setting with unused groups", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - // Removing group with no peers from DNS settings should not trigger updates to account peers or send peer updates - t.Run("removing group with no peers from dns settings", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() + _, err = manager.CreateNameServerGroup( + context.Background(), account.Id, "ns-group", "ns-group", []nbdns.NameServer{{ + IP: netip.MustParseAddr(peer1.IP.String()), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"groupB"}, + true, []string{}, true, userID, false, + ) + assert.NoError(t, err) - err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ - DisabledManagementGroups: []string{"groupA"}, + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + // Creating DNS settings with groups that have peers should update account peers and send peer update + step(t, "creating dns setting with used groups", func(t *testing.T) { + err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + }) + assert.NoError(t, err) - // Removing group with peers from DNS settings should trigger updates to account peers and send peer updates - t.Run("removing group with peers from dns settings", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ - DisabledManagementGroups: []string{}, + _, err = manager.CreateNameServerGroup( + context.Background(), account.Id, "ns-group-1", "ns-group-1", []nbdns.NameServer{{ + IP: netip.MustParseAddr(peer1.IP.String()), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"groupA"}, + true, []string{}, true, userID, false, + ) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } + // Saving DNS settings with groups that have peers should update account peers and send peer update + step(t, "saving dns setting with used groups", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ + DisabledManagementGroups: []string{"groupA", "groupB"}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Removing group with no peers from DNS settings should not trigger updates to account peers or send peer updates + step(t, "removing group with no peers from dns settings", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ + DisabledManagementGroups: []string{"groupA"}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Removing group with peers from DNS settings should trigger updates to account peers and send peer updates + step(t, "removing group with peers from dns settings", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ + DisabledManagementGroups: []string{}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) }) } diff --git a/management/server/group_test.go b/management/server/group_test.go index fa351a43e..f0ccd385c 100644 --- a/management/server/group_test.go +++ b/management/server/group_test.go @@ -23,6 +23,7 @@ import ( "github.com/netbirdio/netbird/management/server/groups" "github.com/netbirdio/netbird/management/server/networks" "github.com/netbirdio/netbird/management/server/networks/resources" + resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types" "github.com/netbirdio/netbird/management/server/networks/routers" routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types" networkTypes "github.com/netbirdio/netbird/management/server/networks/types" @@ -685,342 +686,368 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t } func TestGroupAccountPeersUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - g := []*types.Group{ - { - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID}, - }, - { - ID: "groupB", - Name: "GroupB", - Peers: []string{}, - }, - { - ID: "groupC", - Name: "GroupC", - Peers: []string{peer1.ID, peer3.ID}, - }, - { - ID: "groupD", - Name: "GroupD", - Peers: []string{}, - }, - { - ID: "groupE", - Name: "GroupE", - Peers: []string{peer2.ID}, - }, - } - for _, group := range g { - err := manager.CreateGroup(context.Background(), account.Id, userID, group) - assert.NoError(t, err) - } - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - // Saving a group that is not linked to any resource should not update account peers - t.Run("saving unlinked group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupB", - Name: "GroupB", - Peers: []string{peer1.ID, peer2.ID}, - }) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Adding a peer to a group that is not linked to any resource should not update account peers - // and not send peer update - t.Run("adding peer to unlinked group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Removing a peer from a group that is not linked to any resource should not update account peers - // and not send peer update - t.Run("removing peer from unliked group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Deleting group should not update account peers and not send peer update - t.Run("deleting group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB") - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // adding a group to policy - _, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ + g := []*types.Group{ { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"groupA"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID}, + }, + { + ID: "groupB", + Name: "GroupB", + Peers: []string{}, + }, + { + ID: "groupC", + Name: "GroupC", + Peers: []string{peer1.ID, peer3.ID}, + }, + { + ID: "groupD", + Name: "GroupD", + Peers: []string{}, + }, + { + ID: "groupE", + Name: "GroupE", + Peers: []string{peer2.ID}, }, - }, - }, true) - assert.NoError(t, err) - - // Saving a group linked to policy should update account peers and send peer update - t.Run("saving linked group to policy", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID}, - }) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") } - }) - - // adding peer to a used group should update account peers and send peer update - t.Run("adding peer to linked group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") + for _, group := range g { + err := manager.CreateGroup(context.Background(), account.Id, userID, group) + assert.NoError(t, err) } - }) - // removing peer from a linked group should update account peers and send peer update - t.Run("removing peer from linked group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) + }) - err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID) + // Saving a group that is not linked to any resource should not update account peers + step(t, "saving unlinked group", func(t *testing.T) { + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupB", + Name: "GroupB", + Peers: []string{peer1.ID, peer2.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Adding a peer to a group that is not linked to any resource should not update account peers + // and not send peer update + step(t, "adding peer to unlinked group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.GroupAddPeer(context.Background(), account.Id, "groupB", peer3.ID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Removing a peer from a group that is not linked to any resource should not update account peers + // and not send peer update + step(t, "removing peer from unliked group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.GroupDeletePeer(context.Background(), account.Id, "groupB", peer3.ID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Deleting group should not update account peers and not send peer update + step(t, "deleting group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupB") + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // adding a group to policy + _, err := manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupA"}, + Destinations: []string{"groupA"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // Saving a group linked to policy should update account peers and send peer update + step(t, "saving linked group to policy", func(t *testing.T) { + settleAffectedUpdates(updMsg) - // Saving a group linked to name server group should update account peers and send peer update - t.Run("saving group linked to name server group", func(t *testing.T) { - _, err = manager.CreateNameServerGroup( - context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{ - IP: netip.MustParseAddr("1.1.1.1"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"groupC"}, - true, nil, true, userID, false, - ) - assert.NoError(t, err) + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID}, + }) + assert.NoError(t, err) - err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupC", - Name: "GroupC", - Peers: []string{peer1.ID, peer3.ID}, + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // adding peer to a used group should update account peers and send peer update + step(t, "adding peer to linked group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - // Saving a group linked to route should update account peers and send peer update - t.Run("saving group linked to route", func(t *testing.T) { - newRoute := route.Route{ - ID: "route", - Network: netip.MustParsePrefix("192.168.0.0/16"), - NetID: "superNet", - NetworkType: route.IPv4Network, - PeerGroups: []string{"groupA"}, - Description: "super", - Masquerade: false, - Metric: 9999, - Enabled: true, - Groups: []string{"groupC"}, - } - _, err := manager.CreateRoute( - context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer, - newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric, - newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply, - ) - require.NoError(t, err) + err := manager.GroupAddPeer(context.Background(), account.Id, "groupA", peer3.ID) + assert.NoError(t, err) - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // removing peer from a linked group should update account peers and send peer update + step(t, "removing peer from linked group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - // Saving a group linked to dns settings should update account peers and send peer update - t.Run("saving group linked to dns settings", func(t *testing.T) { - err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ - DisabledManagementGroups: []string{"groupD"}, + err := manager.GroupDeletePeer(context.Background(), account.Id, "groupA", peer3.ID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + // Saving a group linked to name server group should update account peers and send peer update + step(t, "saving group linked to name server group", func(t *testing.T) { + _, err = manager.CreateNameServerGroup( + context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{ + IP: netip.MustParseAddr("1.1.1.1"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"groupC"}, + true, nil, true, userID, false, + ) + assert.NoError(t, err) - err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupD", - Name: "GroupD", - Peers: []string{peer1.ID}, + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupC", + Name: "GroupC", + Peers: []string{peer1.ID, peer3.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // Saving a group linked to route should update account peers and send peer update + step(t, "saving group linked to route", func(t *testing.T) { + newRoute := route.Route{ + ID: "route", + Network: netip.MustParsePrefix("192.168.0.0/16"), + NetID: "superNet", + NetworkType: route.IPv4Network, + PeerGroups: []string{"groupA"}, + Description: "super", + Masquerade: false, + Metric: 9999, + Enabled: true, + Groups: []string{"groupC"}, + } + _, err := manager.CreateRoute( + context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer, + newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric, + newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, newRoute.SkipAutoApply, + ) + require.NoError(t, err) - // Saving a group linked to network router should update account peers and send peer update - t.Run("saving group linked to network router", func(t *testing.T) { - permissionsManager := permissions.NewManager(manager.Store) - groupsManager := groups.NewManager(manager.Store, permissionsManager, manager) - resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager) - routersManager := routers.NewManager(manager.Store, permissionsManager, manager) - networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager) + settleAffectedUpdates(updMsg) - network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{ - ID: "network_test", - AccountID: account.Id, - Name: "network_test", - Description: "", + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - require.NoError(t, err) - _, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{ - ID: "router_test", - NetworkID: network.ID, - AccountID: account.Id, - PeerGroups: []string{"groupE"}, - Masquerade: true, - Metric: 9999, - Enabled: true, + // Saving a group linked to dns settings should update account peers and send peer update + step(t, "saving group linked to dns settings", func(t *testing.T) { + err := manager.SaveDNSSettings(context.Background(), account.Id, userID, &types.DNSSettings{ + DisabledManagementGroups: []string{"groupD"}, + }) + assert.NoError(t, err) + + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupD", + Name: "GroupD", + Peers: []string{peer1.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - require.NoError(t, err) - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + // Saving a group linked to network router should update account peers and send peer update + step(t, "saving group linked to network router", func(t *testing.T) { + permissionsManager := permissions.NewManager(manager.Store) + groupsManager := groups.NewManager(manager.Store, permissionsManager, manager) + resourcesManager := resources.NewManager(manager.Store, permissionsManager, groupsManager, manager, manager.serviceManager) + routersManager := routers.NewManager(manager.Store, permissionsManager, manager) + networksManager := networks.NewManager(manager.Store, permissionsManager, resourcesManager, routersManager, manager) - err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupE", - Name: "GroupE", - Peers: []string{peer2.ID, peer3.ID}, + network, err := networksManager.CreateNetwork(context.Background(), userID, &networkTypes.Network{ + ID: "network_test", + AccountID: account.Id, + Name: "network_test", + Description: "", + }) + require.NoError(t, err) + + _, err = routersManager.CreateRouter(context.Background(), userID, &routerTypes.NetworkRouter{ + ID: "router_test", + NetworkID: network.ID, + AccountID: account.Id, + PeerGroups: []string{"groupE"}, + Masquerade: true, + Metric: 9999, + Enabled: true, + }) + require.NoError(t, err) + + resource, err := resourcesManager.CreateResource(context.Background(), userID, &resourceTypes.NetworkResource{ + AccountID: account.Id, + NetworkID: network.ID, + Name: "resource_test", + Address: "10.20.30.0/24", + Enabled: true, + }) + require.NoError(t, err) + + _, err = manager.SavePolicy(context.Background(), account.Id, userID, peerToResourcePolicyByResource("groupA", resource.ID), true) + require.NoError(t, err) + + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupE", + Name: "GroupE", + Peers: []string{peer2.ID, peer3.ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } }) } diff --git a/management/server/nameserver_test.go b/management/server/nameserver_test.go index deed9c34f..1460893cf 100644 --- a/management/server/nameserver_test.go +++ b/management/server/nameserver_test.go @@ -6,9 +6,9 @@ import ( "testing" "time" - "go.uber.org/mock/gomock" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "go.uber.org/mock/gomock" nbdns "github.com/netbirdio/netbird/dns" "github.com/netbirdio/netbird/management/internals/controllers/network_map/controller" @@ -966,147 +966,151 @@ func TestValidateDomain(t *testing.T) { } func TestNameServerAccountPeersUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - var newNameServerGroupA *nbdns.NameServerGroup - var newNameServerGroupB *nbdns.NameServerGroup + var newNameServerGroupA *nbdns.NameServerGroup + var newNameServerGroupB *nbdns.NameServerGroup - err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupA", - Name: "GroupA", - Peers: []string{}, - }) - assert.NoError(t, err) - - err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupB", - Name: "GroupB", - Peers: []string{peer1.ID, peer2.ID, peer3.ID}, - }) - assert.NoError(t, err) - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - // Creating a nameserver group with a distribution group no peers should not update account peers - // and not send peer update - t.Run("creating nameserver group with distribution group no peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - newNameServerGroupA, err = manager.CreateNameServerGroup( - context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{ - IP: netip.MustParseAddr("1.1.1.1"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"groupA"}, - true, []string{}, true, userID, false, - ) + err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupA", + Name: "GroupA", + Peers: []string{}, + }) assert.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // saving a nameserver group with a distribution group with no peers should not update account peers - // and not send peer update - t.Run("saving nameserver group with distribution group no peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA) + err = manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupB", + Name: "GroupB", + Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + }) assert.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) + }) - // Creating a nameserver group with a distribution group no peers should update account peers and send peer update - t.Run("creating nameserver group with distribution group has peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + // Creating a nameserver group with a distribution group no peers should not update account peers + // and not send peer update + step(t, "creating nameserver group with distribution group no peers", func(t *testing.T) { + settleAffectedUpdates(updMsg) - newNameServerGroupB, err = manager.CreateNameServerGroup( - context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{ - IP: netip.MustParseAddr("1.1.1.1"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"groupB"}, - true, []string{}, true, userID, false, - ) - assert.NoError(t, err) + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + newNameServerGroupA, err = manager.CreateNameServerGroup( + context.Background(), account.Id, "nsGroupA", "nsGroupA", []nbdns.NameServer{{ + IP: netip.MustParseAddr("1.1.1.1"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"groupA"}, + true, []string{}, true, userID, false, + ) + assert.NoError(t, err) - // saving a nameserver group with a distribution group with peers should update account peers and send peer update - t.Run("saving nameserver group with distribution group has peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) - newNameServerGroupB.NameServers = []nbdns.NameServer{ - { - IP: netip.MustParseAddr("1.1.1.2"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }, - { - IP: netip.MustParseAddr("8.8.8.8"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }, - } - err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB) - assert.NoError(t, err) + // saving a nameserver group with a distribution group with no peers should not update account peers + // and not send peer update + step(t, "saving nameserver group with distribution group no peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupA) + assert.NoError(t, err) - // Deleting a nameserver group should update account peers and send peer update - t.Run("deleting nameserver group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) - err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID) - assert.NoError(t, err) + // Creating a nameserver group with a distribution group no peers should update account peers and send peer update + step(t, "creating nameserver group with distribution group has peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } + newNameServerGroupB, err = manager.CreateNameServerGroup( + context.Background(), account.Id, "nsGroupB", "nsGroupB", []nbdns.NameServer{{ + IP: netip.MustParseAddr("1.1.1.1"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"groupB"}, + true, []string{}, true, userID, false, + ) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // saving a nameserver group with a distribution group with peers should update account peers and send peer update + step(t, "saving nameserver group with distribution group has peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + newNameServerGroupB.NameServers = []nbdns.NameServer{ + { + IP: netip.MustParseAddr("1.1.1.2"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }, + { + IP: netip.MustParseAddr("8.8.8.8"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }, + } + err = manager.SaveNameServerGroup(context.Background(), account.Id, userID, newNameServerGroupB) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Deleting a nameserver group should update account peers and send peer update + step(t, "deleting nameserver group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.DeleteNameServerGroup(context.Background(), account.Id, newNameServerGroupB.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) }) } diff --git a/management/server/peer_test.go b/management/server/peer_test.go index 5c3e02af5..5307300d6 100644 --- a/management/server/peer_test.go +++ b/management/server/peer_test.go @@ -1844,374 +1844,336 @@ func Test_LoginPeer(t *testing.T) { } func TestPeerAccountPeersUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID) - require.NoError(t, err) - - g := []*types.Group{ - { - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID, peer3.ID}, - }, - { - ID: "groupB", - Name: "GroupB", - Peers: []string{}, - }, - { - ID: "groupC", - Name: "GroupC", - Peers: []string{}, - }, - } - for _, group := range g { - err = manager.CreateGroup(context.Background(), account.Id, userID, group) - require.NoError(t, err) - } - - // create a user with auto groups - _, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{ - { - Id: "regularUser1", - AccountID: account.Id, - Role: types.UserRoleAdmin, - Issued: types.UserIssuedAPI, - AutoGroups: []string{"groupA"}, - }, - { - Id: "regularUser2", - AccountID: account.Id, - Role: types.UserRoleAdmin, - Issued: types.UserIssuedAPI, - AutoGroups: []string{"groupB"}, - }, - { - Id: "regularUser3", - AccountID: account.Id, - Role: types.UserRoleAdmin, - Issued: types.UserIssuedAPI, - AutoGroups: []string{"groupC"}, - }, - }, true) - require.NoError(t, err) - - var peer4 *nbpeer.Peer - var peer5 *nbpeer.Peer - var peer6 *nbpeer.Peer - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - // Updating not expired peer and peer expiration is enabled should not update account peers and not send peer update - t.Run("updating not expired peer and peer expiration is enabled", func(t *testing.T) { - t.Skip("Currently all updates will trigger a network map") - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - _, err := manager.UpdatePeer(context.Background(), account.Id, userID, peer2) + err := manager.DeletePolicy(context.Background(), account.Id, account.Policies[0].ID, userID) require.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") + g := []*types.Group{ + { + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + }, + { + ID: "groupB", + Name: "GroupB", + Peers: []string{}, + }, + { + ID: "groupC", + Name: "GroupC", + Peers: []string{}, + }, } - }) - - // Adding peer to unlinked group should not update account peers and not send peer update - t.Run("adding peer to unlinked group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - key, err := wgtypes.GeneratePrivateKey() - require.NoError(t, err) - - expectedPeerKey := key.PublicKey().String() - peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{ - Key: expectedPeerKey, - Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, - }, false) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Deleting peer with unlinked group should not update account peers and not send peer update - t.Run("deleting peer with unlinked group", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Updating peer label should update account peers and send peer update - t.Run("updating peer label", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - peer1.Name = "peer-1" - _, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - t.Run("validator requires update", func(t *testing.T) { - requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) { - return update, true, nil + for _, group := range g { + err = manager.CreateGroup(context.Background(), account.Id, userID, group) + require.NoError(t, err) } - manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc} - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - _, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - t.Run("validator requires no update", func(t *testing.T) { - t.Skip("Currently all updates will trigger a network map") - - requireNoUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) { - return update, false, nil - } - - manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireNoUpdateFunc} - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - _, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Adding peer to group linked with policy should update account peers and send peer update - t.Run("adding peer to group linked with policy", func(t *testing.T) { - _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - AccountID: account.Id, - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"groupA"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, + // create a user with auto groups + _, err = manager.SaveOrAddUsers(context.Background(), account.Id, userID, []*types.User{ + { + Id: "regularUser1", + AccountID: account.Id, + Role: types.UserRoleAdmin, + Issued: types.UserIssuedAPI, + AutoGroups: []string{"groupA"}, + }, + { + Id: "regularUser2", + AccountID: account.Id, + Role: types.UserRoleAdmin, + Issued: types.UserIssuedAPI, + AutoGroups: []string{"groupB"}, + }, + { + Id: "regularUser3", + AccountID: account.Id, + Role: types.UserRoleAdmin, + Issued: types.UserIssuedAPI, + AutoGroups: []string{"groupC"}, }, }, true) require.NoError(t, err) - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + var peer4 *nbpeer.Peer + var peer5 *nbpeer.Peer + var peer6 *nbpeer.Peer - key, err := wgtypes.GeneratePrivateKey() - require.NoError(t, err) + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) + }) - expectedPeerKey := key.PublicKey().String() - peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{ - Key: expectedPeerKey, - LoginExpirationEnabled: true, - Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, - }, false) - require.NoError(t, err) + // Adding peer to unlinked group should not update account peers and not send peer update + step(t, "adding peer to unlinked group", func(t *testing.T) { + settleAffectedUpdates(updMsg) + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + key, err := wgtypes.GeneratePrivateKey() + require.NoError(t, err) - // Deleting peer with linked group to policy should update account peers and send peer update - t.Run("deleting peer with linked group to policy", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + expectedPeerKey := key.PublicKey().String() + peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{ + Key: expectedPeerKey, + Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, + }, false) + require.NoError(t, err) - err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID) - require.NoError(t, err) + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // Deleting peer with unlinked group should not update account peers and not send peer update + step(t, "deleting peer with unlinked group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - // drain any buffered updates from previous subtests - drainPeerUpdates(updMsg) + err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID) + require.NoError(t, err) - // Adding peer to group linked with route should update peers in that group, not unrelated peers - t.Run("adding peer to group linked with route", func(t *testing.T) { - route := nbroute.Route{ - ID: "testingRoute1", - Network: netip.MustParsePrefix("100.65.250.202/32"), - NetID: "superNet", - NetworkType: nbroute.IPv4Network, - PeerGroups: []string{"groupB"}, - Description: "super", - Masquerade: false, - Metric: 9999, - Enabled: true, - Groups: []string{"groupB"}, - } + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) - _, err := manager.CreateRoute( - context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer, - route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric, - route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply, - ) - require.NoError(t, err) + // Updating peer label should update account peers and send peer update + step(t, "updating peer label", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() + peer1.Name = "peer-1" + _, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1) + require.NoError(t, err) - key, err := wgtypes.GeneratePrivateKey() - require.NoError(t, err) + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) - expectedPeerKey := key.PublicKey().String() - peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{ - Key: expectedPeerKey, - LoginExpirationEnabled: true, - Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, - }, false) - require.NoError(t, err) + step(t, "validator requires update", func(t *testing.T) { + requireUpdateFunc := func(_ context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error) { + return update, true, nil + } - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + manager.integratedPeerValidator = MockIntegratedValidator{ValidatePeerFunc: requireUpdateFunc} + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - // Deleting peer with linked group to route should update peers in that group, not unrelated peers - t.Run("deleting peer with linked group to route", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() + _, err = manager.UpdatePeer(context.Background(), account.Id, userID, peer1) + require.NoError(t, err) - err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID) - require.NoError(t, err) + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + // Adding peer to group linked with policy should update account peers and send peer update + step(t, "adding peer to group linked with policy", func(t *testing.T) { + _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + AccountID: account.Id, + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupA"}, + Destinations: []string{"groupA"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + require.NoError(t, err) - // Adding peer to group linked with name server group should update peers in that group, not unrelated peers - t.Run("adding peer to group linked with name server group", func(t *testing.T) { - _, err = manager.CreateNameServerGroup( - context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{ - IP: netip.MustParseAddr("1.1.1.1"), - NSType: nbdns.UDPNameServerType, - Port: nbdns.DefaultDNSPort, - }}, - []string{"groupC"}, - true, []string{}, true, userID, false, - ) - require.NoError(t, err) + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() + key, err := wgtypes.GeneratePrivateKey() + require.NoError(t, err) - key, err := wgtypes.GeneratePrivateKey() - require.NoError(t, err) + expectedPeerKey := key.PublicKey().String() + peer4, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser1", &nbpeer.Peer{ + Key: expectedPeerKey, + LoginExpirationEnabled: true, + Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, + }, false) + require.NoError(t, err) - expectedPeerKey := key.PublicKey().String() - peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{ - Key: expectedPeerKey, - LoginExpirationEnabled: true, - Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, - }, false) - require.NoError(t, err) + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + // Deleting peer with linked group to policy should update account peers and send peer update + step(t, "deleting peer with linked group to policy", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - // Deleting peer with linked group to name server group should update peers in that group, not unrelated peers - t.Run("deleting peer with linked group to route", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() + err = manager.DeletePeer(context.Background(), account.Id, peer4.ID, userID) + require.NoError(t, err) - err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID) - require.NoError(t, err) + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } + // drain any buffered updates from previous subtests + drainPeerUpdates(updMsg) + + // Adding peer to group linked with route should update peers in that group, not unrelated peers + step(t, "adding peer to group linked with route", func(t *testing.T) { + route := nbroute.Route{ + ID: "testingRoute1", + Network: netip.MustParsePrefix("100.65.250.202/32"), + NetID: "superNet", + NetworkType: nbroute.IPv4Network, + PeerGroups: []string{"groupB"}, + Description: "super", + Masquerade: false, + Metric: 9999, + Enabled: true, + Groups: []string{"groupB"}, + } + + _, err := manager.CreateRoute( + context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer, + route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric, + route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply, + ) + require.NoError(t, err) + + settleAffectedUpdates(updMsg) + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + key, err := wgtypes.GeneratePrivateKey() + require.NoError(t, err) + + expectedPeerKey := key.PublicKey().String() + peer5, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{ + Key: expectedPeerKey, + LoginExpirationEnabled: true, + Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, + }, false) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Deleting peer with linked group to route should update peers in that group, not unrelated peers + step(t, "deleting peer with linked group to route", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.DeletePeer(context.Background(), account.Id, peer5.ID, userID) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Adding peer to group linked with name server group should update peers in that group, not unrelated peers + step(t, "adding peer to group linked with name server group", func(t *testing.T) { + _, err = manager.CreateNameServerGroup( + context.Background(), account.Id, "nsGroup", "nsGroup", []nbdns.NameServer{{ + IP: netip.MustParseAddr("1.1.1.1"), + NSType: nbdns.UDPNameServerType, + Port: nbdns.DefaultDNSPort, + }}, + []string{"groupC"}, + true, []string{}, true, userID, false, + ) + require.NoError(t, err) + + settleAffectedUpdates(updMsg) + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + key, err := wgtypes.GeneratePrivateKey() + require.NoError(t, err) + + expectedPeerKey := key.PublicKey().String() + peer6, _, _, _, err = manager.AddPeer(context.Background(), "", "", "regularUser3", &nbpeer.Peer{ + Key: expectedPeerKey, + LoginExpirationEnabled: true, + Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, + }, false) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Deleting peer with linked group to name server group should update peers in that group, not unrelated peers + step(t, "deleting peer with linked group to name server group", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.DeletePeer(context.Background(), account.Id, peer6.ID, userID) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) }) } @@ -2859,45 +2821,47 @@ func TestPeerWillHaveIPv6(t *testing.T) { // flipping --disable-ipv6) without bumping its WtVersion, other account peers // receive a fresh network map so their AAAA records for it become unstale. func TestSyncPeer_IPv6CapabilityChangePropagates(t *testing.T) { - manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, _, peer1, peer2, _ := setupNetworkMapTest(t) - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) + }) - // Drain any initial updates from setup. - drain := func() { - for { - select { - case <-updMsg: - case <-time.After(200 * time.Millisecond): - return + // Drain any initial updates from setup. + drain := func() { + for { + select { + case <-updMsg: + case <-time.After(200 * time.Millisecond): + return + } } } - } - drain() + drain() - t.Run("no propagation when capabilities are unchanged", func(t *testing.T) { - _, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{ - WireGuardPubKey: peer2.Key, - Meta: peer2.Meta, - }, peer2.AccountID) - require.NoError(t, err) - peerShouldNotReceiveUpdate(t, updMsg) - }) + step(t, "no propagation when capabilities are unchanged", func(t *testing.T) { + _, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{ + WireGuardPubKey: peer2.Key, + Meta: peer2.Meta, + }, peer2.AccountID) + require.NoError(t, err) + peerShouldNotReceiveUpdate(t, updMsg) + }) - t.Run("propagation when IPv6 capability is added", func(t *testing.T) { - newMeta := peer2.Meta - newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...) - newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay) + step(t, "propagation when IPv6 capability is added", func(t *testing.T) { + newMeta := peer2.Meta + newMeta.Capabilities = append([]int32{}, peer2.Meta.Capabilities...) + newMeta.Capabilities = append(newMeta.Capabilities, nbpeer.PeerCapabilityIPv6Overlay) - _, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{ - WireGuardPubKey: peer2.Key, - Meta: newMeta, - }, peer2.AccountID) - require.NoError(t, err) - peerShouldReceiveUpdate(t, updMsg) + _, _, _, _, err := manager.SyncPeer(context.Background(), types.PeerSync{ + WireGuardPubKey: peer2.Key, + Meta: newMeta, + }, peer2.AccountID) + require.NoError(t, err) + peerShouldReceiveUpdate(t, updMsg) + }) }) } diff --git a/management/server/policy_test.go b/management/server/policy_test.go index 6fb573b9e..7607a7567 100644 --- a/management/server/policy_test.go +++ b/management/server/policy_test.go @@ -1135,287 +1135,291 @@ func sortFunc() func(a *types.FirewallRule, b *types.FirewallRule) int { } func TestPolicyAccountPeersUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - g := []*types.Group{ - { - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer3.ID}, - }, - { - ID: "groupB", - Name: "GroupB", - Peers: []string{}, - }, - { - ID: "groupC", - Name: "GroupC", - Peers: []string{}, - }, - { - ID: "groupD", - Name: "GroupD", - Peers: []string{peer1.ID, peer2.ID}, - }, - } - for _, group := range g { - err := manager.CreateGroup(context.Background(), account.Id, userID, group) - assert.NoError(t, err) - } - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - var policyWithGroupRulesNoPeers *types.Policy - var policyWithDestinationPeersOnly *types.Policy - var policyWithSourceAndDestinationPeers *types.Policy - var err error - - // Saving policy with rule groups with no peers should not update account's peers and not send peer update - t.Run("saving policy with rule groups with no peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - AccountID: account.Id, - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupB"}, - Destinations: []string{"groupC"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, + g := []*types.Group{ + { + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer3.ID}, }, - }, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Saving policy with source group containing peers, but destination group without peers should - // update account's peers and send peer update - t.Run("saving policy where source has peers but destination does not", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - AccountID: account.Id, - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"groupB"}, - Protocol: types.PolicyRuleProtocolTCP, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, + { + ID: "groupB", + Name: "GroupB", + Peers: []string{}, }, - }, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Saving policy with destination group containing peers, but source group without peers should - // update account's peers and send peer update - t.Run("saving policy where destination has peers but source does not", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - AccountID: account.Id, - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupC"}, - Destinations: []string{"groupD"}, - Bidirectional: true, - Protocol: types.PolicyRuleProtocolTCP, - Action: types.PolicyTrafficActionAccept, - }, + { + ID: "groupC", + Name: "GroupC", + Peers: []string{}, }, - }, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Saving policy with destination and source groups containing peers should update account's peers - // and send peer update - t.Run("saving policy with source and destination groups with peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - AccountID: account.Id, - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"groupD"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, + { + ID: "groupD", + Name: "GroupD", + Peers: []string{peer1.ID, peer2.ID}, }, - }, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") } - }) - - // Disabling policy with destination and source groups containing peers should update account's peers - // and send peer update - t.Run("disabling policy with source and destination groups with peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - policyWithSourceAndDestinationPeers.Enabled = false - policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Updating disabled policy with destination and source groups containing peers should still update account's peers - // because affected peer resolution does not filter by policy enabled state - t.Run("updating disabled policy with source and destination groups with peers", func(t *testing.T) { - drainPeerUpdates(updMsg) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - policyWithSourceAndDestinationPeers.Description = "updated description" - policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"} - policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Enabling policy with destination and source groups containing peers should update account's peers - // and send peer update - t.Run("enabling policy with source and destination groups with peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - policyWithSourceAndDestinationPeers.Enabled = true - policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Deleting policy should trigger account peers update and send peer update - t.Run("deleting policy with source and destination groups with peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") + for _, group := range g { + err := manager.CreateGroup(context.Background(), account.Id, userID, group) + assert.NoError(t, err) } + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) + }) + + var policyWithGroupRulesNoPeers *types.Policy + var policyWithDestinationPeersOnly *types.Policy + var policyWithSourceAndDestinationPeers *types.Policy + var err error + + // Saving policy with rule groups with no peers should not update account's peers and not send peer update + step(t, "saving policy with rule groups with no peers", func(t *testing.T) { + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + policyWithGroupRulesNoPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + AccountID: account.Id, + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupB"}, + Destinations: []string{"groupC"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Saving policy with source group containing peers, but destination group without peers should + // update account's peers and send peer update + step(t, "saving policy where source has peers but destination does not", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + AccountID: account.Id, + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupA"}, + Destinations: []string{"groupB"}, + Protocol: types.PolicyRuleProtocolTCP, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Saving policy with destination group containing peers, but source group without peers should + // update account's peers and send peer update + step(t, "saving policy where destination has peers but source does not", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + policyWithDestinationPeersOnly, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + AccountID: account.Id, + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupC"}, + Destinations: []string{"groupD"}, + Bidirectional: true, + Protocol: types.PolicyRuleProtocolTCP, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Saving policy with destination and source groups containing peers should update account's peers + // and send peer update + step(t, "saving policy with source and destination groups with peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + AccountID: account.Id, + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupA"}, + Destinations: []string{"groupD"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + }, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Disabling policy with destination and source groups containing peers should update account's peers + // and send peer update + step(t, "disabling policy with source and destination groups with peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + policyWithSourceAndDestinationPeers.Enabled = false + policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Updating disabled policy with destination and source groups containing peers should still update account's peers + // because affected peer resolution does not filter by policy enabled state + step(t, "updating disabled policy with source and destination groups with peers", func(t *testing.T) { + drainPeerUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + policyWithSourceAndDestinationPeers.Description = "updated description" + policyWithSourceAndDestinationPeers.Rules[0].Destinations = []string{"groupA"} + policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Enabling policy with destination and source groups containing peers should update account's peers + // and send peer update + step(t, "enabling policy with source and destination groups with peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + policyWithSourceAndDestinationPeers.Enabled = true + policyWithSourceAndDestinationPeers, err = manager.SavePolicy(context.Background(), account.Id, userID, policyWithSourceAndDestinationPeers, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Deleting policy should trigger account peers update and send peer update + step(t, "deleting policy with source and destination groups with peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.DeletePolicy(context.Background(), account.Id, policyWithSourceAndDestinationPeers.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + + }) + + // Deleting policy with destination group containing peers, but source group without peers should + // update account's peers and send peer update + step(t, "deleting policy where destination has peers but source does not", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Deleting policy with no peers in groups should not update account's peers and not send peer update + step(t, "deleting policy with no peers in groups", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + }) - - // Deleting policy with destination group containing peers, but source group without peers should - // update account's peers and send peer update - t.Run("deleting policy where destination has peers but source does not", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.DeletePolicy(context.Background(), account.Id, policyWithDestinationPeersOnly.ID, userID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Deleting policy with no peers in groups should not update account's peers and not send peer update - t.Run("deleting policy with no peers in groups", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.DeletePolicy(context.Background(), account.Id, policyWithGroupRulesNoPeers.ID, userID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - } diff --git a/management/server/posture_checks_test.go b/management/server/posture_checks_test.go index 74738e72d..601294eda 100644 --- a/management/server/posture_checks_test.go +++ b/management/server/posture_checks_test.go @@ -123,324 +123,334 @@ func initTestPostureChecksAccount(am *DefaultAccountManager) (*types.Account, er } func TestPostureCheckAccountPeersUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - g := []*types.Group{ - { - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID, peer3.ID}, - }, - { - ID: "groupB", - Name: "GroupB", - Peers: []string{}, - }, - { - ID: "groupC", - Name: "GroupC", - Peers: []string{}, - }, - } - for _, group := range g { - err := manager.CreateGroup(context.Background(), account.Id, userID, group) - assert.NoError(t, err) - } - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - postureCheckA := &posture.Checks{ - Name: "postureCheckA", - AccountID: account.Id, - Checks: posture.ChecksDefinition{ - ProcessCheck: &posture.ProcessCheck{ - Processes: []posture.Process{ - {LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"}, - }, - }, - }, - } - postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true) - require.NoError(t, err) - - postureCheckB := &posture.Checks{ - Name: "postureCheckB", - AccountID: account.Id, - Checks: posture.ChecksDefinition{ - NBVersionCheck: &posture.NBVersionCheck{ - MinVersion: "0.28.0", - }, - }, - } - - // Saving unused posture check should not update account peers and not send peer update - t.Run("saving unused posture check", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Updating unused posture check should not update account peers and not send peer update - t.Run("updating unused posture check", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - postureCheckB.Checks = posture.ChecksDefinition{ - NBVersionCheck: &posture.NBVersionCheck{ - MinVersion: "0.29.0", - }, - } - _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - policy := &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ + g := []*types.Group{ { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"groupA"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID, peer3.ID}, }, - }, - SourcePostureChecks: []string{postureCheckB.ID}, - } - - // Linking posture check to policy should trigger update account peers and send peer update - t.Run("linking posture check to policy with peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Updating linked posture checks should update account peers and send peer update - t.Run("updating linked to posture check with peers", func(t *testing.T) { - postureCheckB.Checks = posture.ChecksDefinition{ - NBVersionCheck: &posture.NBVersionCheck{ - MinVersion: "0.29.0", + { + ID: "groupB", + Name: "GroupB", + Peers: []string{}, }, - ProcessCheck: &posture.ProcessCheck{ - Processes: []posture.Process{ - {LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"}, - }, + { + ID: "groupC", + Name: "GroupC", + Peers: []string{}, }, } - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") + for _, group := range g { + err := manager.CreateGroup(context.Background(), account.Id, userID, group) + assert.NoError(t, err) } - }) - // Removing posture check from policy should trigger account peers update and send peer update - t.Run("removing posture check from policy", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - policy.SourcePostureChecks = []string{} - _, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Deleting unused posture check should not trigger account peers update and not send peer update - t.Run("deleting unused posture check", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) - assert.NoError(t, err) - - // Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update - t.Run("updating linked posture check to policy with no peers", func(t *testing.T) { - _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupB"}, - Destinations: []string{"groupC"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, - }, - SourcePostureChecks: []string{postureCheckB.ID}, - }, true) - assert.NoError(t, err) - - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - postureCheckB.Checks = posture.ChecksDefinition{ - NBVersionCheck: &posture.NBVersionCheck{ - MinVersion: "0.29.0", - }, - } - _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) - assert.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) - - // Updating linked posture check to policy where destination has peers but source does not - // should trigger account peers update and send peer update - t.Run("updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) { - updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID) + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer2.ID) + updateManager.CloseChannel(context.Background(), peer1.ID) }) - _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + postureCheckA := &posture.Checks{ + Name: "postureCheckA", + AccountID: account.Id, + Checks: posture.ChecksDefinition{ + ProcessCheck: &posture.ProcessCheck{ + Processes: []posture.Process{ + {LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"}, + }, + }, + }, + } + postureCheckA, err := manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckA, true) + require.NoError(t, err) + + postureCheckB := &posture.Checks{ + Name: "postureCheckB", + AccountID: account.Id, + Checks: posture.ChecksDefinition{ + NBVersionCheck: &posture.NBVersionCheck{ + MinVersion: "0.28.0", + }, + }, + } + + // Saving unused posture check should not update account peers and not send peer update + step(t, "saving unused posture check", func(t *testing.T) { + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + postureCheckB, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Updating unused posture check should not update account peers and not send peer update + step(t, "updating unused posture check", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + postureCheckB.Checks = posture.ChecksDefinition{ + NBVersionCheck: &posture.NBVersionCheck{ + MinVersion: "0.29.0", + }, + } + _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + policy := &types.Policy{ Enabled: true, Rules: []*types.PolicyRule{ { Enabled: true, - Sources: []string{"groupB"}, + Sources: []string{"groupA"}, Destinations: []string{"groupA"}, Bidirectional: true, Action: types.PolicyTrafficActionAccept, }, }, SourcePostureChecks: []string{postureCheckB.ID}, - }, true) - assert.NoError(t, err) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg1) - close(done) - }() - - postureCheckB.Checks = posture.ChecksDefinition{ - NBVersionCheck: &posture.NBVersionCheck{ - MinVersion: "0.29.0", - }, } - _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // Linking posture check to policy should trigger update account peers and send peer update + step(t, "linking posture check to policy with peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - // Updating linked client posture check to policy where source has peers but destination does not, - // should trigger account peers update and send peer update - t.Run("updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) { - _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"groupB"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, + policy, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Updating linked posture checks should update account peers and send peer update + step(t, "updating linked to posture check with peers", func(t *testing.T) { + postureCheckB.Checks = posture.ChecksDefinition{ + NBVersionCheck: &posture.NBVersionCheck{ + MinVersion: "0.29.0", }, - }, - SourcePostureChecks: []string{postureCheckB.ID}, - }, true) - assert.NoError(t, err) - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - postureCheckB.Checks = posture.ChecksDefinition{ - ProcessCheck: &posture.ProcessCheck{ - Processes: []posture.Process{ - { - LinuxPath: "/usr/bin/netbird", + ProcessCheck: &posture.ProcessCheck{ + Processes: []posture.Process{ + {LinuxPath: "/usr/bin/netbird", MacPath: "/usr/local/bin/netbird"}, }, }, - }, - } + } + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Removing posture check from policy should trigger account peers update and send peer update + step(t, "removing posture check from policy", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + policy.SourcePostureChecks = []string{} + _, err := manager.SavePolicy(context.Background(), account.Id, userID, policy, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Deleting unused posture check should not trigger account peers update and not send peer update + step(t, "deleting unused posture check", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.DeletePostureChecks(context.Background(), account.Id, postureCheckA.ID, userID) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } + // Updating linked posture check to policy with no peers should not trigger account peers update and not send peer update + step(t, "updating linked posture check to policy with no peers", func(t *testing.T) { + _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupB"}, + Destinations: []string{"groupC"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + SourcePostureChecks: []string{postureCheckB.ID}, + }, true) + assert.NoError(t, err) + + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + postureCheckB.Checks = posture.ChecksDefinition{ + NBVersionCheck: &posture.NBVersionCheck{ + MinVersion: "0.29.0", + }, + } + _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Updating linked posture check to policy where destination has peers but source does not + // should trigger account peers update and send peer update + step(t, "updating linked posture check to policy where destination has peers but source does not", func(t *testing.T) { + updMsg1 := updateManager.CreateChannel(context.Background(), peer2.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer2.ID) + }) + + _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupB"}, + Destinations: []string{"groupA"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + SourcePostureChecks: []string{postureCheckB.ID}, + }, true) + assert.NoError(t, err) + + settleAffectedUpdates(updMsg, updMsg1) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg1) + close(done) + }() + + postureCheckB.Checks = posture.ChecksDefinition{ + NBVersionCheck: &posture.NBVersionCheck{ + MinVersion: "0.29.0", + }, + } + _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Updating linked client posture check to policy where source has peers but destination does not, + // should trigger account peers update and send peer update + step(t, "updating linked posture check to policy where source has peers but destination does not", func(t *testing.T) { + _, err = manager.SavePolicy(context.Background(), account.Id, userID, &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupA"}, + Destinations: []string{"groupB"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, + SourcePostureChecks: []string{postureCheckB.ID}, + }, true) + assert.NoError(t, err) + + settleAffectedUpdates(updMsg) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + postureCheckB.Checks = posture.ChecksDefinition{ + ProcessCheck: &posture.ProcessCheck{ + Processes: []posture.Process{ + { + LinuxPath: "/usr/bin/netbird", + }, + }, + }, + } + _, err = manager.SavePostureChecks(context.Background(), account.Id, userID, postureCheckB, true) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) }) } diff --git a/management/server/route_test.go b/management/server/route_test.go index 4ca9ee48f..69b9aec6c 100644 --- a/management/server/route_test.go +++ b/management/server/route_test.go @@ -6,10 +6,10 @@ import ( "testing" "time" - "go.uber.org/mock/gomock" "github.com/rs/xid" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "go.uber.org/mock/gomock" "github.com/netbirdio/netbird/management/internals/controllers/network_map/controller" "github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel" @@ -1262,7 +1262,10 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel. } eventStore := &activity.InMemoryEventStore{} - metrics, err := telemetry.NewDefaultAppMetrics(context.Background()) + ctx, cancel := context.WithCancel(context.Background()) + t.Cleanup(cancel) + + metrics, err := telemetry.NewDefaultAppMetrics(ctx) require.NoError(t, err) ctrl := gomock.NewController(t) @@ -1290,9 +1293,8 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel. permissionsManager := permissions.NewManager(store) peersManager := peers.NewManager(store, permissionsManager) - ctx := context.Background() - - cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100) + // A go-cache janitor only stops through a GC finalizer, which would leave synctest bubbles with a goroutine that never exits. + cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 0, 100) if err != nil { return nil, nil, err } @@ -1301,10 +1303,12 @@ func createRouterManager(t *testing.T) (*DefaultAccountManager, *update_channel. requestBuffer := NewAccountRequestBuffer(ctx, store) networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{}, nil) - am, err := BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore) + am, err := BuildManager(ctx, nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore) if err != nil { return nil, nil, err } + cacheManager := am.cacheManager + t.Cleanup(func() { _ = cacheManager.Close() }) return am, updateManager, nil } @@ -1893,265 +1897,269 @@ func TestAccount_getPeersRoutesFirewall(t *testing.T) { } func TestRouteAccountPeersUpdate(t *testing.T) { - manager, updateManager, err := createRouterManager(t) - require.NoError(t, err, "failed to create account manager") + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, err := createRouterManager(t) + require.NoError(t, err, "failed to create account manager") - account, err := initTestRouteAccount(t, manager) - require.NoError(t, err, "failed to init testing account") + account, err := initTestRouteAccount(t, manager) + require.NoError(t, err, "failed to init testing account") - g := []*types.Group{ - { - ID: "groupA", - Name: "GroupA", - Peers: []string{}, - }, - { - ID: "groupB", - Name: "GroupB", - Peers: []string{}, - }, - { - ID: "groupC", - Name: "GroupC", - Peers: []string{}, - }, - } - for _, group := range g { - err = manager.CreateGroup(context.Background(), account.Id, userID, group) - require.NoError(t, err, "failed to create group %s", group.Name) - } + g := []*types.Group{ + { + ID: "groupA", + Name: "GroupA", + Peers: []string{}, + }, + { + ID: "groupB", + Name: "GroupB", + Peers: []string{}, + }, + { + ID: "groupC", + Name: "GroupC", + Peers: []string{}, + }, + } + for _, group := range g { + err = manager.CreateGroup(context.Background(), account.Id, userID, group) + require.NoError(t, err, "failed to create group %s", group.Name) + } - updMsg := updateManager.CreateChannel(context.Background(), peer1ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1ID) - }) + updMsg := updateManager.CreateChannel(context.Background(), peer1ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1ID) + }) - // Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update - t.Run("creating route no routing peer and no peers in groups", func(t *testing.T) { - route := route.Route{ - ID: "testingRoute1", - Network: netip.MustParsePrefix("100.65.250.202/32"), + // Creating a route with no routing peer and no peers in PeerGroups or Groups should not update account peers and not send peer update + step(t, "creating route no routing peer and no peers in groups", func(t *testing.T) { + settleAffectedUpdates(updMsg) + + route := route.Route{ + ID: "testingRoute1", + Network: netip.MustParsePrefix("100.65.250.202/32"), + NetID: "superNet", + NetworkType: route.IPv4Network, + PeerGroups: []string{"groupA"}, + Description: "super", + Masquerade: false, + Metric: 9999, + Enabled: true, + Groups: []string{"groupA"}, + } + + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + _, err := manager.CreateRoute( + context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer, + route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric, + route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply, + ) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + + }) + + // Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update + step(t, "creating a route with peers in PeerGroups and Groups", func(t *testing.T) { + drainPeerUpdates(updMsg) + + route := route.Route{ + ID: "testingRoute2", + Network: netip.MustParsePrefix("192.0.2.0/32"), + NetID: "superNet", + NetworkType: route.IPv4Network, + PeerGroups: []string{routeGroup3}, + Description: "super", + Masquerade: false, + Metric: 9999, + Enabled: true, + Groups: []string{routeGroup3}, + } + + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + _, err := manager.CreateRoute( + context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer, + route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric, + route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply, + ) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + + }) + + baseRoute := route.Route{ + ID: "testingRoute3", + Network: netip.MustParsePrefix("192.168.0.0/16"), NetID: "superNet", NetworkType: route.IPv4Network, - PeerGroups: []string{"groupA"}, - Description: "super", - Masquerade: false, - Metric: 9999, - Enabled: true, - Groups: []string{"groupA"}, - } - - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - _, err := manager.CreateRoute( - context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer, - route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric, - route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply, - ) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - - }) - - // Creating a route with no routing peer and having peers in groups that don't include peer1 should not send peer1 an update - t.Run("creating a route with peers in PeerGroups and Groups", func(t *testing.T) { - drainPeerUpdates(updMsg) - - route := route.Route{ - ID: "testingRoute2", - Network: netip.MustParsePrefix("192.0.2.0/32"), - NetID: "superNet", - NetworkType: route.IPv4Network, - PeerGroups: []string{routeGroup3}, - Description: "super", - Masquerade: false, - Metric: 9999, - Enabled: true, - Groups: []string{routeGroup3}, - } - - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - _, err := manager.CreateRoute( - context.Background(), account.Id, route.Network, route.NetworkType, route.Domains, route.Peer, - route.PeerGroups, route.Description, route.NetID, route.Masquerade, route.Metric, - route.Groups, []string{}, true, userID, route.KeepRoute, route.SkipAutoApply, - ) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - - }) - - baseRoute := route.Route{ - ID: "testingRoute3", - Network: netip.MustParsePrefix("192.168.0.0/16"), - NetID: "superNet", - NetworkType: route.IPv4Network, - Peer: peer1ID, - Description: "super", - Masquerade: false, - Metric: 9999, - Enabled: true, - Groups: []string{routeGroup1}, - } - - // Creating route should update account peers and send peer update - t.Run("creating route with a routing peer", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - newRoute, err := manager.CreateRoute( - context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer, - baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric, - baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply, - ) - require.NoError(t, err) - baseRoute = *newRoute - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Updating the route should update account peers and send peer update when there is peers in group - t.Run("updating route", func(t *testing.T) { - baseRoute.Groups = []string{routeGroup1, routeGroup2} - - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Deleting the route should update account peers and send peer update - t.Run("deleting route", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID) - require.NoError(t, err) - - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) - - // Adding peer to route peer groups that do not have any peers should update account peers and send peer update - t.Run("adding peer to route peer groups that do not have any peers", func(t *testing.T) { - newRoute := route.Route{ - Network: netip.MustParsePrefix("192.168.12.0/16"), - NetID: "superNet", - NetworkType: route.IPv4Network, - PeerGroups: []string{"groupB"}, + Peer: peer1ID, Description: "super", Masquerade: false, Metric: 9999, Enabled: true, Groups: []string{routeGroup1}, } - _, err := manager.CreateRoute( - context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer, - newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric, - newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply, - ) - require.NoError(t, err) - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + // Creating route should update account peers and send peer update + step(t, "creating route with a routing peer", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupB", - Name: "GroupB", - Peers: []string{peer1ID}, + newRoute, err := manager.CreateRoute( + context.Background(), account.Id, baseRoute.Network, baseRoute.NetworkType, baseRoute.Domains, baseRoute.Peer, + baseRoute.PeerGroups, baseRoute.Description, baseRoute.NetID, baseRoute.Masquerade, baseRoute.Metric, + baseRoute.Groups, []string{}, true, userID, baseRoute.KeepRoute, !baseRoute.SkipAutoApply, + ) + require.NoError(t, err) + baseRoute = *newRoute + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // Updating the route should update account peers and send peer update when there is peers in group + step(t, "updating route", func(t *testing.T) { + baseRoute.Groups = []string{routeGroup1, routeGroup2} - // Adding peer to route groups that do not have any peers should update account peers and send peer update - t.Run("adding peer to route groups that do not have any peers", func(t *testing.T) { - newRoute := route.Route{ - Network: netip.MustParsePrefix("192.168.13.0/16"), - NetID: "superNet", - NetworkType: route.IPv4Network, - PeerGroups: []string{"groupB"}, - Description: "super", - Masquerade: false, - Metric: 9999, - Enabled: true, - Groups: []string{"groupC"}, - } - _, err := manager.CreateRoute( - context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer, - newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric, - newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply, - ) - require.NoError(t, err) + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + err := manager.SaveRoute(context.Background(), account.Id, userID, &baseRoute) + require.NoError(t, err) - err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupC", - Name: "GroupC", - Peers: []string{peer1ID}, + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } }) - assert.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } + // Deleting the route should update account peers and send peer update + step(t, "deleting route", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err := manager.DeleteRoute(context.Background(), account.Id, baseRoute.ID, userID) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Adding peer to route peer groups that do not have any peers should update account peers and send peer update + step(t, "adding peer to route peer groups that do not have any peers", func(t *testing.T) { + newRoute := route.Route{ + Network: netip.MustParsePrefix("192.168.12.0/16"), + NetID: "superNet", + NetworkType: route.IPv4Network, + PeerGroups: []string{"groupB"}, + Description: "super", + Masquerade: false, + Metric: 9999, + Enabled: true, + Groups: []string{routeGroup1}, + } + _, err := manager.CreateRoute( + context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer, + newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric, + newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply, + ) + require.NoError(t, err) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupB", + Name: "GroupB", + Peers: []string{peer1ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) + + // Adding peer to route groups that do not have any peers should update account peers and send peer update + step(t, "adding peer to route groups that do not have any peers", func(t *testing.T) { + newRoute := route.Route{ + Network: netip.MustParsePrefix("192.168.13.0/16"), + NetID: "superNet", + NetworkType: route.IPv4Network, + PeerGroups: []string{"groupB"}, + Description: "super", + Masquerade: false, + Metric: 9999, + Enabled: true, + Groups: []string{"groupC"}, + } + _, err := manager.CreateRoute( + context.Background(), account.Id, newRoute.Network, newRoute.NetworkType, newRoute.Domains, newRoute.Peer, + newRoute.PeerGroups, newRoute.Description, newRoute.NetID, newRoute.Masquerade, newRoute.Metric, + newRoute.Groups, []string{}, true, userID, newRoute.KeepRoute, !newRoute.SkipAutoApply, + ) + require.NoError(t, err) + + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() + + err = manager.UpdateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupC", + Name: "GroupC", + Peers: []string{peer1ID}, + }) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) }) } diff --git a/management/server/setupkey_test.go b/management/server/setupkey_test.go index 2d43ea28b..87959113d 100644 --- a/management/server/setupkey_test.go +++ b/management/server/setupkey_test.go @@ -397,75 +397,77 @@ func TestSetupKey_Copy(t *testing.T) { } func TestSetupKeyAccountPeersUpdate(t *testing.T) { - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID, peer3.ID}, - }) - assert.NoError(t, err) - - policy := &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"group"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, - }, - }, - } - _, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true) - require.NoError(t, err) - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - // The setup policy above dispatches affected-peer updates asynchronously; drain - // any in-flight ones so the assertions only observe the setup-key operations. - settleAffectedUpdates(updMsg) - - var setupKey *types.SetupKey - - // Creating setup key should not update account peers and not send peer update - t.Run("creating setup key", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) + err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + }) assert.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") + policy := &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupA"}, + Destinations: []string{"group"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, + }, } - }) - - // Saving setup key should not update account peers and not send peer update - t.Run("saving setup key", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() - - _, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID) + _, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true) require.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) + }) + + // The setup policy above dispatches affected-peer updates asynchronously; drain + // any in-flight ones so the assertions only observe the setup-key operations. + settleAffectedUpdates(updMsg) + + var setupKey *types.SetupKey + + // Creating setup key should not update account peers and not send peer update + step(t, "creating setup key", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + setupKey, err = manager.CreateSetupKey(context.Background(), account.Id, "key1", types.SetupKeyReusable, time.Hour, nil, 999, userID, false, false) + assert.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + + // Saving setup key should not update account peers and not send peer update + step(t, "saving setup key", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() + + _, err = manager.SaveSetupKey(context.Background(), account.Id, setupKey, userID) + require.NoError(t, err) + + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) }) } diff --git a/management/server/user_test.go b/management/server/user_test.go index 2d1a5f1e9..fcfb7a1e7 100644 --- a/management/server/user_test.go +++ b/management/server/user_test.go @@ -1544,166 +1544,170 @@ func TestDefaultAccountManager_SaveUser(t *testing.T) { } func TestUserAccountPeersUpdate(t *testing.T) { - // account groups propagation is enabled - manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) + runPeerUpdateTest(t, func(t *testing.T) { + // account groups propagation is enabled + manager, updateManager, account, peer1, peer2, peer3 := setupNetworkMapTest(t) - err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ - ID: "groupA", - Name: "GroupA", - Peers: []string{peer1.ID, peer2.ID, peer3.ID}, - }) - require.NoError(t, err) + err := manager.CreateGroup(context.Background(), account.Id, userID, &types.Group{ + ID: "groupA", + Name: "GroupA", + Peers: []string{peer1.ID, peer2.ID, peer3.ID}, + }) + require.NoError(t, err) - policy := &types.Policy{ - Enabled: true, - Rules: []*types.PolicyRule{ - { - Enabled: true, - Sources: []string{"groupA"}, - Destinations: []string{"groupA"}, - Bidirectional: true, - Action: types.PolicyTrafficActionAccept, + policy := &types.Policy{ + Enabled: true, + Rules: []*types.PolicyRule{ + { + Enabled: true, + Sources: []string{"groupA"}, + Destinations: []string{"groupA"}, + Bidirectional: true, + Action: types.PolicyTrafficActionAccept, + }, }, - }, - } - _, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true) - require.NoError(t, err) - - updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer1.ID) - }) - - // Creating a new regular user should send peer update (as users are not filtered yet) - t.Run("creating new regular user with no groups", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() - - _, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{ - Id: "regularUser1", - AccountID: account.Id, - Role: types.UserRoleUser, - Issued: types.UserIssuedAPI, - }, true) + } + _, err = manager.SavePolicy(context.Background(), account.Id, userID, policy, true) require.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + updMsg := updateManager.CreateChannel(context.Background(), peer1.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer1.ID) + }) - // updating user with no linked peers should update account peers and send peer update (as users are not filtered yet) - t.Run("updating user with no linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + // Creating a new regular user should send peer update (as users are not filtered yet) + step(t, "creating new regular user with no groups", func(t *testing.T) { + settleAffectedUpdates(updMsg) - _, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{ - Id: "regularUser1", - AccountID: account.Id, - Role: types.UserRoleUser, - Issued: types.UserIssuedAPI, - }, false) - require.NoError(t, err) + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + _, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{ + Id: "regularUser1", + AccountID: account.Id, + Role: types.UserRoleUser, + Issued: types.UserIssuedAPI, + }, true) + require.NoError(t, err) - // drain any buffered updates from previous subtests - drainPeerUpdates(updMsg) + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) - // deleting user with no linked peers should not update account peers and not send peer update - t.Run("deleting user with no linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldNotReceiveUpdate(t, updMsg) - close(done) - }() + // saving an unchanged user with no linked peers should not update account peers and not send peer update + step(t, "updating user with no linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1") - require.NoError(t, err) + _, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{ + Id: "regularUser1", + AccountID: account.Id, + Role: types.UserRoleUser, + Issued: types.UserIssuedAPI, + }, false) + require.NoError(t, err) - select { - case <-done: - case <-time.After(time.Second): - t.Error("timeout waiting for peerShouldNotReceiveUpdate") - } - }) + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) - // create a user and add new peer with the user - _, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{ - Id: "regularUser2", - AccountID: account.Id, - Role: types.UserRoleAdmin, - Issued: types.UserIssuedAPI, - }, true) - require.NoError(t, err) + // drain any buffered updates from previous subtests + drainPeerUpdates(updMsg) - key, err := wgtypes.GeneratePrivateKey() - require.NoError(t, err) + // deleting user with no linked peers should not update account peers and not send peer update + step(t, "deleting user with no linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldNotReceiveUpdate(t, updMsg) + close(done) + }() - expectedPeerKey := key.PublicKey().String() - peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{ - Key: expectedPeerKey, - Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, - }, false) - require.NoError(t, err) + err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser1") + require.NoError(t, err) - // updating user with linked peers should update account peers and send peer update - t.Run("updating user with linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, updMsg) - close(done) - }() + select { + case <-done: + case <-time.After(time.Second): + t.Error("timeout waiting for peerShouldNotReceiveUpdate") + } + }) + // create a user and add new peer with the user _, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{ Id: "regularUser2", AccountID: account.Id, Role: types.UserRoleAdmin, Issued: types.UserIssuedAPI, + }, true) + require.NoError(t, err) + + key, err := wgtypes.GeneratePrivateKey() + require.NoError(t, err) + + expectedPeerKey := key.PublicKey().String() + peer4, _, _, _, err := manager.AddPeer(context.Background(), "", "", "regularUser2", &nbpeer.Peer{ + Key: expectedPeerKey, + Meta: nbpeer.PeerSystemMeta{Hostname: expectedPeerKey}, }, false) require.NoError(t, err) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } - }) + // updating user with linked peers should update account peers and send peer update + step(t, "updating user with linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, updMsg) + close(done) + }() - peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID) - t.Cleanup(func() { - updateManager.CloseChannel(context.Background(), peer4.ID) - }) + _, err = manager.SaveOrAddUser(context.Background(), account.Id, userID, &types.User{ + Id: "regularUser2", + AccountID: account.Id, + Role: types.UserRoleAdmin, + Issued: types.UserIssuedAPI, + }, false) + require.NoError(t, err) - // deleting user with linked peers should update account peers and send peer update - t.Run("deleting user with linked peers", func(t *testing.T) { - done := make(chan struct{}) - go func() { - peerShouldReceiveUpdate(t, peer4UpdMsg) - close(done) - }() + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) - err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2") - require.NoError(t, err) + peer4UpdMsg := updateManager.CreateChannel(context.Background(), peer4.ID) + t.Cleanup(func() { + updateManager.CloseChannel(context.Background(), peer4.ID) + }) - select { - case <-done: - case <-time.After(peerUpdateTimeout): - t.Error("timeout waiting for peerShouldReceiveUpdate") - } + // deleting user with linked peers should update account peers and send peer update + step(t, "deleting user with linked peers", func(t *testing.T) { + done := make(chan struct{}) + go func() { + peerShouldReceiveUpdate(t, peer4UpdMsg) + close(done) + }() + + err = manager.DeleteUser(context.Background(), account.Id, userID, "regularUser2") + require.NoError(t, err) + + select { + case <-done: + case <-time.After(peerUpdateTimeout): + t.Error("timeout waiting for peerShouldReceiveUpdate") + } + }) }) }