mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-23 22:09:09 +02:00
Maycon Santos
8397bed4af
An integrated validator can approve or revoke peers outside a login or sync, for example during a periodic EDR sync. Only revocations of SSO peers reached anyone; a newly approved peer kept its empty map, and its peers did not see it, until an unrelated update or a reconnect. Add SetPeerValidationChangeListener to the IntegratedValidator interface. The account manager registers a handler that resolves the affected peers and calls OnPeersUpdated, the same path a login-time approval takes. The OSS validator and the mock implement it as a no-op.
60 lines
2.2 KiB
Go
60 lines
2.2 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/mock/gomock"
|
|
|
|
"github.com/netbirdio/netbird/management/internals/controllers/network_map"
|
|
"github.com/netbirdio/netbird/management/server/types"
|
|
)
|
|
|
|
// A peer that the background validator approves must get its own map and appear in the
|
|
// maps of the peers a policy connects it to, without waiting for a login or sync.
|
|
func TestOnPeerValidationChanged_UpdatesChangedPeerAndItsPeers(t *testing.T) {
|
|
_, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
|
|
ctx := context.Background()
|
|
|
|
err := s.CreatePolicy(ctx, &types.Policy{
|
|
ID: "policy-validation-change",
|
|
AccountID: accountID,
|
|
Enabled: true,
|
|
Rules: []*types.PolicyRule{{
|
|
ID: "rule-validation-change",
|
|
PolicyID: "policy-validation-change",
|
|
Enabled: true,
|
|
Sources: []string{groupIDs[0]},
|
|
Destinations: []string{groupIDs[1]},
|
|
Bidirectional: true,
|
|
Action: types.PolicyTrafficActionAccept,
|
|
}},
|
|
})
|
|
require.NoError(t, err)
|
|
|
|
var changed, affected []string
|
|
controller := network_map.NewMockController(gomock.NewController(t))
|
|
controller.EXPECT().OnPeersUpdated(gomock.Any(), accountID, gomock.Any(), gomock.Any()).
|
|
DoAndReturn(func(_ context.Context, _ string, peerIDs, affectedPeerIDs []string) error {
|
|
changed, affected = peerIDs, affectedPeerIDs
|
|
return nil
|
|
})
|
|
// A separate manager over the same store: the setup's manager still has peer update
|
|
// goroutines in flight that read its controller.
|
|
manager := &DefaultAccountManager{Store: s, networkMapController: controller}
|
|
|
|
manager.onPeerValidationChanged(ctx, accountID, []string{peerIDs[0]})
|
|
|
|
assert.Equal(t, []string{peerIDs[0]}, changed, "changed peers should be passed through")
|
|
assert.ElementsMatch(t, []string{peerIDs[0], peerIDs[1]}, affected, "the changed peer and its policy peer should be updated")
|
|
}
|
|
|
|
func TestOnPeerValidationChanged_NoPeersNoUpdate(t *testing.T) {
|
|
// Any call on the mock fails the test.
|
|
manager := &DefaultAccountManager{networkMapController: network_map.NewMockController(gomock.NewController(t))}
|
|
|
|
manager.onPeerValidationChanged(context.Background(), "account", nil)
|
|
}
|