mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-13 18:29:07 +02:00
riccardom
682b2de549
With the update-settings kill switch on, `netbird up --enable-rosenpass` connected and said almost nothing: SetConfig refused the change, the CLI downgraded that to a warning, and Login carries no rosenpass field to apply, so the flag was silently dropped. The setting stayed disabled, which is the point of the switch, but the caller was never told their request had been ignored. The refusal now travels as codes.FailedPrecondition instead of codes.Unavailable, and the CLI fails on it. Unavailable means "the daemon cannot serve this call", which is why the CLI downgraded it and why client/ui/services reads it as an unreachable daemon — both wrong for a daemon that answered and refused. FailedPrecondition also matches what the MDM gate already returns for a managed field, so both refusals are now one class of error, and it is added to the login backoff's early-exit codes so a refused login stops instead of retrying for 30s. This does not put the container back in the deadlock: with the value-aware gate, a client restating its own configuration is not refused at all, so nothing reaches this path unless a real change was asked for.
58 lines
1.6 KiB
Go
58 lines
1.6 KiB
Go
package cmd
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
"google.golang.org/grpc/codes"
|
|
gstatus "google.golang.org/grpc/status"
|
|
)
|
|
|
|
// A refused settings update has to fail `netbird up`, or a caller that asked
|
|
// for a setting the daemon will not apply connects as if it had been applied.
|
|
// The daemon being unable to serve the call is the case that stays a warning.
|
|
func TestRefusedSettingsUpdate(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
err error
|
|
wantRefused bool
|
|
}{
|
|
{
|
|
name: "the kill switch refused the change",
|
|
err: gstatus.Errorf(codes.FailedPrecondition, "update settings are disabled, you cannot use this feature without update settings enabled"),
|
|
wantRefused: true,
|
|
},
|
|
{
|
|
name: "an MDM policy manages the field",
|
|
err: gstatus.Errorf(codes.FailedPrecondition, "fields managed by MDM policy: managementURL"),
|
|
wantRefused: true,
|
|
},
|
|
{
|
|
name: "the daemon cannot serve the call",
|
|
err: gstatus.Errorf(codes.Unavailable, "connection refused"),
|
|
wantRefused: false,
|
|
},
|
|
{
|
|
name: "any other RPC failure",
|
|
err: gstatus.Errorf(codes.Internal, "boom"),
|
|
wantRefused: false,
|
|
},
|
|
{
|
|
name: "not a status error at all",
|
|
err: errors.New("boom"),
|
|
wantRefused: false,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
reason, refused := refusedSettingsUpdate(tt.err)
|
|
require.Equal(t, tt.wantRefused, refused)
|
|
if tt.wantRefused {
|
|
require.Equal(t, gstatus.Convert(tt.err).Message(), reason, "the daemon's reason must reach the caller")
|
|
}
|
|
})
|
|
}
|
|
}
|