nixos-router/pkgs/router-webui/main_test.go

package main

import (
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

func newTestApp(t *testing.T) (*app, System) {
	t.Helper()
	dir := t.TempDir()
	sys := System{ConfigDir: filepath.Join(dir, "config"), StateDir: dir}
	os.MkdirAll(sys.ConfigDir, 0o700)
	os.WriteFile(sys.settingsPath(), []byte(sample), 0o600)
	h, _ := hashPassword("hunter2hunter2")
	os.WriteFile(sys.passwordPath(), []byte(h), 0o600)
	return newApp(sys), sys
}

func do(h http.Handler, method, path string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
	var req *http.Request
	if form != nil {
		req = httptest.NewRequest(method, path, strings.NewReader(form.Encode()))
		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	} else {
		req = httptest.NewRequest(method, path, nil)
	}
	if cookie != nil {
		req.AddCookie(cookie)
	}
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	return rec
}

func TestLoginAndSave(t *testing.T) {
	a, sys := newTestApp(t)
	h := a.routes()

	if rec := do(h, "GET", "/network", nil, nil); rec.Code != http.StatusSeeOther {
		t.Fatalf("unauthenticated access: %d", rec.Code)
	}
	if rec := do(h, "POST", "/login", url.Values{"password": {"nope"}}, nil); rec.Code != http.StatusUnauthorized {
		t.Fatalf("wrong password: %d", rec.Code)
	}
	// What Firefox and Chrome send for a same-origin form post (seen as 403).
	req := httptest.NewRequest("POST", "https://192.168.1.1/login", strings.NewReader("password=hunter2hunter2"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Origin", "null")
	req.Header.Set("Sec-Fetch-Site", "same-origin")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != http.StatusSeeOther || len(rec.Result().Cookies()) == 0 {
		t.Fatalf("browser login: %d", rec.Code)
	}
	req = httptest.NewRequest("POST", "https://192.168.1.1/login", strings.NewReader("password=hunter2hunter2"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Sec-Fetch-Site", "cross-site")
	rec = httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != http.StatusForbidden {
		t.Fatalf("cross-site login: %d", rec.Code)
	}

	rec = do(h, "POST", "/login", url.Values{"password": {"hunter2hunter2"}}, nil)
	if rec.Code != http.StatusSeeOther || len(rec.Result().Cookies()) == 0 {
		t.Fatalf("login failed: %d", rec.Code)
	}
	cookie := rec.Result().Cookies()[0]

	page := do(h, "GET", "/network", nil, cookie).Body.String()
	m := regexp.MustCompile(`name="csrf" value="([^"]+)"`).FindStringSubmatch(page)
	if m == nil {
		t.Fatalf("no CSRF token in:\n%s", page)
	}
	form := url.Values{
		"hostName": {"gw"}, "wan.interface": {"eth1"}, "wan.type": {"dhcp"},
		"lans": {"1"}, "lan.0.name": {"main"}, "lan.0.interface": {"eth2"},
		"lan.0.address": {"192.168.10.1"}, "lan.0.internet": {"on"}, "lan.0.dhcp": {"on"},
		"lan.0.poolStart": {"192.168.10.100"}, "lan.0.poolEnd": {"192.168.10.120"},
	}
	if rec := do(h, "POST", "/network", form, cookie); rec.Code != http.StatusForbidden {
		t.Fatalf("POST without CSRF token: %d", rec.Code)
	}
	form.Set("csrf", m[1])
	if rec := do(h, "POST", "/network", form, cookie); rec.Code != http.StatusSeeOther {
		t.Fatalf("save: %d\n%s", rec.Code, rec.Body)
	}
	s, _ := loadSettings(sys.settingsPath())
	if str(s, "system", "hostName") != "gw" || str(s, "router", "lans", "main", "dhcp", "pool", "end") != "192.168.10.120" {
		t.Fatalf("not saved: %v", s)
	}
	if str(s, "router", "lans", "main", "dhcp", "reservations", "nas", "address") != "192.168.10.5" {
		t.Fatal("the form dropped the reservation")
	}

	req = httptest.NewRequest("POST", "/advanced", strings.NewReader(url.Values{"csrf": {m[1]}, "settings": {"{}"}}.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Origin", "https://evil.example")
	req.AddCookie(cookie)
	rec = httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	if rec.Code != http.StatusForbidden {
		t.Fatalf("cross-origin POST: %d", rec.Code)
	}
}