fix: validate agent-supplied AllowedIPs in coordinator (#26144) (#26292) · coder/coder@fa933af
@@ -120,7 +120,7 @@ func TestPGCoordinatorSingle_AgentInvalidIP(t *testing.T) {
120120121121// The agent connection should be closed immediately after sending an invalid addr
122122agent.AssertEventuallyResponsesClosed(
123- agpl.AuthorizationError{Wrapped: agpl.InvalidNodeAddressError{Addr: prefix.Addr().String()}}.Error())
123+ agpl.AuthorizationError{Wrapped: xerrors.Errorf("Addresses: %w", agpl.InvalidNodeAddressError{Addr: prefix.Addr().String()})}.Error())
124124assertEventuallyLost(ctx, t, store, agent.ID)
125125}
126126@@ -146,7 +146,37 @@ func TestPGCoordinatorSingle_AgentInvalidIPBits(t *testing.T) {
146146147147// The agent connection should be closed immediately after sending an invalid addr
148148agent.AssertEventuallyResponsesClosed(
149- agpl.AuthorizationError{Wrapped: agpl.InvalidAddressBitsError{Bits: 64}}.Error())
149+ agpl.AuthorizationError{Wrapped: xerrors.Errorf("Addresses: %w", agpl.InvalidAddressBitsError{Bits: 64})}.Error())
150+assertEventuallyLost(ctx, t, store, agent.ID)
151+}
152+153+func TestPGCoordinatorSingle_AgentInvalidAllowedIP(t *testing.T) {
154+t.Parallel()
155+156+store, ps := dbtestutil.NewDB(t)
157+ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
158+defer cancel()
159+logger := testutil.Logger(t)
160+coordinator, err := tailnet.NewPGCoord(ctx, logger, ps, store)
161+require.NoError(t, err)
162+defer coordinator.Close()
163+164+agent := agpltest.NewAgent(ctx, t, coordinator, "agent")
165+defer agent.Close(ctx)
166+// A valid self-address paired with an AllowedIP belonging to a different
167+// (victim) agent must be rejected.
168+victim := agpl.TailscaleServicePrefix.PrefixFromUUID(uuid.New())
169+agent.UpdateNode(&proto.Node{
170+Addresses: []string{
171+agpl.TailscaleServicePrefix.PrefixFromUUID(agent.ID).String(),
172+ },
173+AllowedIps: []string{victim.String()},
174+PreferredDerp: 10,
175+ })
176+177+// The agent connection should be closed after sending an invalid AllowedIP.
178+agent.AssertEventuallyResponsesClosed(
179+ agpl.AuthorizationError{Wrapped: xerrors.Errorf("AllowedIps: %w", agpl.InvalidNodeAddressError{Addr: victim.Addr().String()})}.Error())
150180assertEventuallyLost(ctx, t, store, agent.ID)
151181}
152182