From 4cc8588afb874c31fc549d19102aadcf0e42a658 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 13 Oct 2026 13:20:50 +0200 Subject: [PATCH] Test that a global IPv6 subnet is public and never counts as the local network (issue 154, ADR 0340) The review asked for the IPv6 side of the rule that local-network cannot open a port to the internet. --- internal/catalogue/localnetwork_test.go | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/internal/catalogue/localnetwork_test.go b/internal/catalogue/localnetwork_test.go index bbb773c5..4a0cd6f9 100644 --- a/internal/catalogue/localnetwork_test.go +++ b/internal/catalogue/localnetwork_test.go @@ -175,3 +175,21 @@ func TestAnAdoptedNodeOpensTheLocalNetworkPortToTheMeshOnly(t *testing.T) { t.Fatalf("openings %v", out) } } + +// A global unicast IPv6 subnet on a link facing outside is public, and never counts: the IPv6 side of the +// rule that `local-network` cannot open a port to the internet (ADR 0340 ยง2). +func TestAGlobalIPv6SubnetIsPublicAndNeverCounts(t *testing.T) { + got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: "2001:db8:1234::7/48"}}, []string{"eth0"}, "wg-mesh") + if len(got) != 1 { + t.Fatalf("judged %+v", got) + } + if got[0].Counts { + t.Fatalf("the global IPv6 subnet %s counts as a local network", got[0].Network) + } + if got[0].Network != "2001:db8:1234::/48" || !strings.Contains(got[0].Why, "public, never counted") { + t.Fatalf("judged %s with why %q, want it named public and never counted", got[0].Network, got[0].Why) + } + if n := CountedLocalNetworks(got); len(n) != 0 { + t.Fatalf("counted %v", n) + } +}