mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-13 10:19:07 +02:00
mlsmayconandClaude Fable 5.1
5502ea08ac
The PR grew past its purpose. What it needs to do is refuse to bootstrap an agent network endpoint onto a cluster that cannot serve it, which is the private capability check on the picked cluster. Everything that accreted around it — canonicalising proxy addresses at connect, refusing another account's cluster or a host another account pinned, withdrawing a claim lost to a concurrent one, folding casing on migrated settings rows — is security work in its own right and moves to follow-up PRs, where each can be reviewed against its own threat rather than as a rider on this one. This restores main's version of every file outside that purpose and reduces the validation to: a cluster the account can see must have a live embedded proxy, and a cluster management holds no row for stays pinnable (address-first). The e2e test and the fixture seeds are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sa3DsBDP3VciAi4PPG17L6
30 lines
754 B
Go
30 lines
754 B
Go
package grpc
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestIsProxyAddressValid(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
addr string
|
|
valid bool
|
|
}{
|
|
{name: "valid domain", addr: "eu.proxy.netbird.io", valid: true},
|
|
{name: "valid subdomain", addr: "byop.proxy.example.com", valid: true},
|
|
{name: "valid IPv4", addr: "10.0.0.1", valid: true},
|
|
{name: "valid IPv4 public", addr: "203.0.113.10", valid: true},
|
|
{name: "valid IPv6", addr: "::1", valid: true},
|
|
{name: "valid IPv6 full", addr: "2001:db8::1", valid: true},
|
|
{name: "empty string", addr: "", valid: false},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert.Equal(t, tt.valid, isProxyAddressValid(tt.addr))
|
|
})
|
|
}
|
|
}
|