nils/nixos-router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Zone-based firewall page, per-sensor temperatures, 15 minute default

Browse Source 
The firewall page now manages zones (assign each LAN or tunnel, add and
remove zones) and rules with zone, address and port on both sides plus the
protocol. router.firewall.zones declares zones without members and rules
take sourcePorts. The temperature chart draws every thermal zone and hwmon
sensor; the overview defaults to 15 minutes, 1h stays an option.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F
This commit is contained in:
nils
2026-10-30 09:26:25 +01:00
co-authored by Claude Sonnet 5.5
parent e2986f1418
commit eda7080d94
14 changed files with 713 additions and 149 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/router-webui/firewall_test.go
+129 -6
View File
@@ -6,6 +6,7 @@ import (
"regexp"
"strings"
"testing"
"time"
)
func TestFirewallRulesRoundTrip(t *testing.T) {
@@ -21,7 +22,7 @@ func TestFirewallRulesRoundTrip(t *testing.T) {
if len(rows) != 0 || len(other) != 1 || !strings.Contains(other[0], "port forward") {
t.Fatalf("rows=%+v other=%v", rows, other)
}
err := s.applyFirewall([]FirewallRule{
err := s.applyFirewall(ZoneForm{}, []FirewallRule{
{From: "main", To: "vpn", Protocol: "any"},
{From: "vpn", To: "main", Protocol: "tcp", Ports: "22, 443 5000-5100", Destination: "192.168.10.0/24"},
{Protocol: "any"}, // the empty add row
@@ -43,13 +44,13 @@ func TestFirewallRulesRoundTrip(t *testing.T) {
}
}
rows[0].Remove, rows[1].Remove = true, true
if err := s.applyFirewall(rows); err != nil {
if err := s.applyFirewall(ZoneForm{}, rows); err != nil {
t.Fatal(err)
}
if rows, other = s.firewallRules(); len(rows) != 0 || len(other) != 1 {
t.Errorf("rows=%+v other=%v", rows, other)
}
if err := s.applyFirewall(nil); err != nil {
if err := s.applyFirewall(ZoneForm{}, nil); err != nil {
t.Fatal(err)
}
if _, ok := s["router"].(map[string]any)["firewall"].(map[string]any)["rules"]; !ok {
@@ -68,7 +69,7 @@ func TestFirewallRulesAreChecked(t *testing.T) {
} {
r := good
mod(&r)
err := mustParse(t).applyFirewall([]FirewallRule{r})
err := mustParse(t).applyFirewall(ZoneForm{}, []FirewallRule{r})
fe, ok := err.(FormErrors)
if !ok || fe["rule[0]."+name] == "" {
t.Errorf("%s: err = %v", name, err)
@@ -76,10 +77,10 @@ func TestFirewallRulesAreChecked(t *testing.T) {
}
r := good
r.Protocol = "any"
if err := mustParse(t).applyFirewall([]FirewallRule{r}); err == nil {
if err := mustParse(t).applyFirewall(ZoneForm{}, []FirewallRule{r}); err == nil {
t.Error("ports without tcp/udp accepted")
}
if err := mustParse(t).applyFirewall([]FirewallRule{good, good}); err == nil {
if err := mustParse(t).applyFirewall(ZoneForm{}, []FirewallRule{good, good}); err == nil {
t.Error("the same rule twice accepted")
}
}
@@ -106,3 +107,125 @@ func TestFirewallPage(t *testing.T) {
t.Fatalf("not saved: %v", s)
}
}
func TestFirewallAddressesAndSourcePorts(t *testing.T) {
s := mustParse(t)
err := s.applyFirewall(ZoneForm{}, []FirewallRule{{From: "vpn", To: "main", Protocol: "udp",
Sources: "198.51.100.0/24, 2001:db8::1", SourcePorts: "53 1024-2048", Destination: "192.168.10.5", Ports: "5353"}})
if err != nil {
t.Fatal(err)
}
rows, _ := s.firewallRules()
want := FirewallRule{From: "vpn", To: "main", Protocol: "udp", Sources: "198.51.100.0/24, 2001:db8::1",
SourcePorts: "53, 1024-2048", Destination: "192.168.10.5", Ports: "5353"}
if len(rows) != 1 || rows[0] != want {
t.Fatalf("rows = %+v", rows)
}
for name, mod := range map[string]func(*FirewallRule){
"sources": func(r *FirewallRule) { r.Sources = "the internet" },
"sourcePorts": func(r *FirewallRule) { r.SourcePorts = "70000" },
"ports": func(r *FirewallRule) { r.Protocol = "icmp" },
} {
r := want
mod(&r)
if fe, ok := mustParse(t).applyFirewall(ZoneForm{}, []FirewallRule{r}).(FormErrors); !ok || fe["rule[0]."+name] == "" {
t.Errorf("%s not refused: %v", name, fe)
}
}
}
func TestZonesAreAssignedAddedAndRemoved(t *testing.T) {
s := mustParse(t)
// A new zone, empty at first.
if err := s.applyFirewall(ZoneForm{New: "guests, iot"}, nil); err != nil {
t.Fatal(err)
}
if got := strings.Join(s.zones(), ","); got != "guests,iot,main,vpn" {
t.Fatalf("zones = %s", got)
}
// Two interfaces into one zone; the tunnel's old zone disappears, the
// LAN's keeps its name by default.
members := s.zoneMembers()
if len(members) != 2 || members[0].Kind != "lan" || members[1].Device != "wg-vpn" {
t.Fatalf("members = %+v", members)
}
members[1].Zone = "guests"
if err := s.applyFirewall(ZoneForm{Members: members}, nil); err != nil {
t.Fatal(err)
}
if str(s, "router", "wireguard", "vpn", "zone") != "guests" || str(s, "router", "lans", "main", "zone") != "" {
t.Errorf("zones not assigned: %s", mustMarshal(t, s))
}
if got := strings.Join(s.declaredZones(), ","); got != "iot" {
t.Errorf("declared = %s (guests has a member now)", got)
}
// Back to the default name drops the key; an empty zone can be removed.
members[1].Zone = "vpn"
if err := s.applyFirewall(ZoneForm{Members: members, Remove: []string{"iot"}}, nil); err != nil {
t.Fatal(err)
}
if _, ok := s["router"].(map[string]any)["wireguard"].(map[string]any)["vpn"].(map[string]any)["zone"]; ok {
t.Error("the default zone is written out")
}
if len(s.declaredZones()) != 0 {
t.Errorf("declared = %v", s.declaredZones())
}
if _, ok := s["router"].(map[string]any)["firewall"]; ok {
t.Error("an empty firewall section is left behind")
}
}
func TestZoneChangesAreChecked(t *testing.T) {
for name, zf := range map[string]func(*Settings) ZoneForm{
"newzone": func(*Settings) ZoneForm { return ZoneForm{New: "Not Ok"} },
"newzone ": func(*Settings) ZoneForm { return ZoneForm{New: "wan"} },
"member[0]": func(s *Settings) ZoneForm { m := s.zoneMembers(); m[0].Zone = "wan"; return ZoneForm{Members: m} },
} {
s := mustParse(t)
fe, ok := s.applyFirewall(zf(&s), nil).(FormErrors)
if !ok || fe[strings.TrimSpace(name)] == "" {
t.Errorf("%s accepted: %v", name, fe)
}
}
// A zone with members stays; a rule left without its zone is refused.
s := mustParse(t)
if err := s.applyFirewall(ZoneForm{}, []FirewallRule{{From: "main", To: "vpn", Protocol: "any"}}); err != nil {
t.Fatal(err)
}
m := s.zoneMembers()
m[1].Zone = "other"
fe, ok := s.applyFirewall(ZoneForm{Members: m}, []FirewallRule{{From: "main", To: "vpn", Protocol: "any"}}).(FormErrors)
if !ok || fe["rule[0].to"] == "" {
t.Errorf("rule to a vanished zone accepted: %v", fe)
}
fe, ok = mustParse(t).applyFirewall(ZoneForm{Remove: []string{"main"}, Members: mustParse(t).zoneMembers()}, nil).(FormErrors)
if ok && len(fe) > 0 {
t.Errorf("removing a zone that is not declared is not an error: %v", fe)
}
}
func TestDefaultRangeIs15Minutes(t *testing.T) {
if findRange("").Name != "15m" || findRange("1h").Name != "1h" || findRange("bogus").Name != "15m" {
t.Fatal("ranges", ranges)
}
a, _ := newTestApp(t)
now := time.Now()
a.metrics.store.Add("sys:cpu", now, 50)
c15 := a.chart("t", "%", findRange("15m"), now, []seriesSpec{{"sys:cpu", "cpu", 1}})
c1h := a.chart("t", "%", findRange("1h"), now, []seriesSpec{{"sys:cpu", "cpu", 1}})
if c15.Empty || c1h.Empty || len(c15.Cols) != chartCols {
t.Fatalf("charts: %+v", c15)
}
// The ends of the axis are 15 and 60 minutes apart.
span := func(c Chart) time.Duration {
a, _ := time.ParseInLocation("15:04", c.XTicks[0].Label, time.Local)
b, _ := time.ParseInLocation("15:04", c.XTicks[4].Label, time.Local)
return (b.Sub(a) + 24*time.Hour) % (24 * time.Hour)
}
if got := span(c15); got < 14*time.Minute || got > 16*time.Minute {
t.Errorf("15m axis spans %v", got)
}
if got := span(c1h); got < 59*time.Minute || got > 61*time.Minute {
t.Errorf("1h axis spans %v", got)
}
}