nilsandClaude Opus 5.5
753459f5d7
router-webui (Go, standard library only) edits settings.json: host name, WAN (DHCP or PPPoE), LANs with DHCP, and the raw JSON for the rest; keys the forms do not know are kept. It applies and confirms by starting router-apply.service and router-confirm.service, which a switch never restarts, and shows the build log and the rollback countdown. HTTPS with a self-signed certificate, a PBKDF2 password hash, CSRF tokens and an Origin check; reachable from management LANs only (new router.managementPorts). router-apply records the settings it built and router-confirm keeps them as settings.confirmed.json (new rollback.onConfirm hook), so the UI can tell unapplied changes and discard them. checks.apply now also logs in from a LAN client, discards the change left by the rollback, edits the DHCP pool, applies and confirms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
93 lines
3.1 KiB
Go
93 lines
3.1 KiB
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"regexp"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func newTestApp(t *testing.T) (*app, System) {
|
|
t.Helper()
|
|
dir := t.TempDir()
|
|
sys := System{ConfigDir: filepath.Join(dir, "config"), StateDir: dir}
|
|
os.MkdirAll(sys.ConfigDir, 0o700)
|
|
os.WriteFile(sys.settingsPath(), []byte(sample), 0o600)
|
|
h, _ := hashPassword("hunter2hunter2")
|
|
os.WriteFile(sys.passwordPath(), []byte(h), 0o600)
|
|
return newApp(sys), sys
|
|
}
|
|
|
|
func do(h http.Handler, method, path string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
|
|
var req *http.Request
|
|
if form != nil {
|
|
req = httptest.NewRequest(method, path, strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
} else {
|
|
req = httptest.NewRequest(method, path, nil)
|
|
}
|
|
if cookie != nil {
|
|
req.AddCookie(cookie)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func TestLoginAndSave(t *testing.T) {
|
|
a, sys := newTestApp(t)
|
|
h := a.routes()
|
|
|
|
if rec := do(h, "GET", "/network", nil, nil); rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("unauthenticated access: %d", rec.Code)
|
|
}
|
|
if rec := do(h, "POST", "/login", url.Values{"password": {"nope"}}, nil); rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("wrong password: %d", rec.Code)
|
|
}
|
|
rec := do(h, "POST", "/login", url.Values{"password": {"hunter2hunter2"}}, nil)
|
|
if rec.Code != http.StatusSeeOther || len(rec.Result().Cookies()) == 0 {
|
|
t.Fatalf("login failed: %d", rec.Code)
|
|
}
|
|
cookie := rec.Result().Cookies()[0]
|
|
|
|
page := do(h, "GET", "/network", nil, cookie).Body.String()
|
|
m := regexp.MustCompile(`name="csrf" value="([^"]+)"`).FindStringSubmatch(page)
|
|
if m == nil {
|
|
t.Fatalf("no CSRF token in:\n%s", page)
|
|
}
|
|
form := url.Values{
|
|
"hostName": {"gw"}, "wan.interface": {"eth1"}, "wan.type": {"dhcp"},
|
|
"lans": {"1"}, "lan.0.name": {"main"}, "lan.0.interface": {"eth2"},
|
|
"lan.0.address": {"192.168.10.1"}, "lan.0.internet": {"on"}, "lan.0.dhcp": {"on"},
|
|
"lan.0.poolStart": {"192.168.10.100"}, "lan.0.poolEnd": {"192.168.10.120"},
|
|
}
|
|
if rec := do(h, "POST", "/network", form, cookie); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("POST without CSRF token: %d", rec.Code)
|
|
}
|
|
form.Set("csrf", m[1])
|
|
if rec := do(h, "POST", "/network", form, cookie); rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("save: %d\n%s", rec.Code, rec.Body)
|
|
}
|
|
s, _ := loadSettings(sys.settingsPath())
|
|
if str(s, "system", "hostName") != "gw" || str(s, "router", "lans", "main", "dhcp", "pool", "end") != "192.168.10.120" {
|
|
t.Fatalf("not saved: %v", s)
|
|
}
|
|
if str(s, "router", "lans", "main", "dhcp", "reservations", "nas", "address") != "192.168.10.5" {
|
|
t.Fatal("the form dropped the reservation")
|
|
}
|
|
|
|
req := httptest.NewRequest("POST", "/advanced", strings.NewReader(url.Values{"csrf": {m[1]}, "settings": {"{}"}}.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.Header.Set("Origin", "https://evil.example")
|
|
req.AddCookie(cookie)
|
|
rec = httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("cross-origin POST: %d", rec.Code)
|
|
}
|
|
}
|