Stefano Bertelli
06b5a3dc12
Tests (198 unit + 70 e2e = 268 total): - Add test_api_deps.py: Bearer token auth, get_current_api_user, require_admin - Add test_wireguard_extended.py: ensure_interface, set_private_key, set_listen_port - Add test_firewall_extended.py: _nft/_nft_batch errors, jump rules, policies - Add test_mfa_login.py: MFA redirect, TOTP verify, invalid code, cancel - Add test_magic_link_page.py: page render, submit, empty email, back to login - Add test_admin_devices.py: list, filter, create, edit, delete, config dialog - Add test_admin_rules.py: list, create, edit, delete (all DB-verified) - Add test_admin_settings.py: defaults, security, OIDC/SAML providers - Add test_saml_login.py: button visible, redirect, metadata, full login flow Bug fixes: - Fix SAML callback to use /auth/complete bridge (same fix as OIDC) - Fix missing get_settings import in admin settings page - Add SAML provider buttons to login page - Make SAML strict mode configurable per-provider Infrastructure: - Add mock SimpleSAMLphp IdP to compose.yml with SP config - Add mock-saml service to CI workflows (release + dev)
206 lines
No EOL
7.1 KiB
Python
206 lines
No EOL
7.1 KiB
Python
"""Extended firewall tests — _nft/_nft_batch error handling, add_device_jump_rule edge cases, policies."""
|
|
|
|
from unittest.mock import AsyncMock, patch
|
|
|
|
import pytest
|
|
|
|
from wiregui.services.firewall import (
|
|
_nft,
|
|
_nft_batch,
|
|
add_device_jump_rule,
|
|
setup_base_tables,
|
|
setup_masquerade,
|
|
apply_peer_to_peer_policy,
|
|
apply_lan_to_peers_policy,
|
|
get_ruleset,
|
|
)
|
|
|
|
|
|
# ========== _nft error handling ==========
|
|
|
|
|
|
@patch("asyncio.create_subprocess_exec")
|
|
async def test_nft_raises_on_failure(mock_exec):
|
|
"""_nft raises RuntimeError on non-zero exit code."""
|
|
mock_proc = AsyncMock()
|
|
mock_proc.communicate.return_value = (b"", b"nft: error message")
|
|
mock_proc.returncode = 1
|
|
mock_exec.return_value = mock_proc
|
|
|
|
with pytest.raises(RuntimeError, match="nft.*failed"):
|
|
await _nft("list ruleset")
|
|
|
|
|
|
@patch("asyncio.create_subprocess_exec")
|
|
async def test_nft_returns_stdout_on_success(mock_exec):
|
|
"""_nft returns stdout on success."""
|
|
mock_proc = AsyncMock()
|
|
mock_proc.communicate.return_value = (b"table inet wiregui {}", b"")
|
|
mock_proc.returncode = 0
|
|
mock_exec.return_value = mock_proc
|
|
|
|
result = await _nft("list ruleset")
|
|
assert "wiregui" in result
|
|
|
|
|
|
# ========== _nft_batch error handling ==========
|
|
|
|
|
|
@patch("asyncio.create_subprocess_exec")
|
|
async def test_nft_batch_raises_on_failure(mock_exec):
|
|
"""_nft_batch raises RuntimeError on non-zero exit code."""
|
|
mock_proc = AsyncMock()
|
|
mock_proc.communicate.return_value = (b"", b"Error: syntax error")
|
|
mock_proc.returncode = 1
|
|
mock_exec.return_value = mock_proc
|
|
|
|
with pytest.raises(RuntimeError, match="nft batch failed"):
|
|
await _nft_batch(["add table inet wiregui"])
|
|
|
|
|
|
@patch("asyncio.create_subprocess_exec")
|
|
async def test_nft_batch_sends_commands_via_stdin(mock_exec):
|
|
"""_nft_batch sends all commands via stdin to nft -f -."""
|
|
mock_proc = AsyncMock()
|
|
mock_proc.communicate.return_value = (b"", b"")
|
|
mock_proc.returncode = 0
|
|
mock_exec.return_value = mock_proc
|
|
|
|
cmds = ["add table inet wiregui", "add chain inet wiregui test"]
|
|
await _nft_batch(cmds)
|
|
|
|
mock_exec.assert_awaited_once()
|
|
# Verify nft -f - was called
|
|
call_args = mock_exec.call_args[0]
|
|
assert call_args == ("nft", "-f", "-")
|
|
# Verify stdin data
|
|
stdin_data = mock_proc.communicate.call_args[0][0]
|
|
assert b"add table inet wiregui" in stdin_data
|
|
assert b"add chain inet wiregui test" in stdin_data
|
|
|
|
|
|
# ========== add_device_jump_rule edge cases ==========
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_add_device_jump_rule_ipv4_only(mock_batch):
|
|
"""Only IPv4 — generates single IPv4 jump rule."""
|
|
await add_device_jump_rule("user-id-1", "10.0.0.5", None)
|
|
mock_batch.assert_awaited_once()
|
|
cmds = mock_batch.call_args[0][0]
|
|
assert len(cmds) == 1
|
|
assert "ip saddr 10.0.0.5" in cmds[0]
|
|
assert "jump" in cmds[0]
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_add_device_jump_rule_ipv6_only(mock_batch):
|
|
"""Only IPv6 — generates single IPv6 jump rule."""
|
|
await add_device_jump_rule("user-id-2", None, "fd00::5")
|
|
mock_batch.assert_awaited_once()
|
|
cmds = mock_batch.call_args[0][0]
|
|
assert len(cmds) == 1
|
|
assert "ip6 saddr fd00::5" in cmds[0]
|
|
assert "jump" in cmds[0]
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_add_device_jump_rule_no_ips(mock_batch):
|
|
"""Neither IPv4 nor IPv6 — no nft commands issued."""
|
|
await add_device_jump_rule("user-id-3", None, None)
|
|
mock_batch.assert_not_awaited()
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_add_device_jump_rule_both_ips(mock_batch):
|
|
"""Both IPv4 and IPv6 — generates two jump rules."""
|
|
await add_device_jump_rule("user-id-4", "10.0.0.7", "fd00::7")
|
|
mock_batch.assert_awaited_once()
|
|
cmds = mock_batch.call_args[0][0]
|
|
assert len(cmds) == 2
|
|
assert any("ip saddr 10.0.0.7" in c for c in cmds)
|
|
assert any("ip6 saddr fd00::7" in c for c in cmds)
|
|
|
|
|
|
# ========== setup_base_tables — already exists ==========
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_setup_base_tables_already_exists(mock_batch):
|
|
"""If table already exists (File exists error), don't raise."""
|
|
mock_batch.side_effect = RuntimeError("File exists")
|
|
await setup_base_tables() # should not raise
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_setup_base_tables_other_error_raises(mock_batch):
|
|
"""Other nft errors should propagate."""
|
|
mock_batch.side_effect = RuntimeError("Permission denied")
|
|
with pytest.raises(RuntimeError, match="Permission denied"):
|
|
await setup_base_tables()
|
|
|
|
|
|
# ========== setup_masquerade — error handling ==========
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_setup_masquerade_error_swallowed(mock_batch):
|
|
"""Masquerade errors are logged but not raised."""
|
|
mock_batch.side_effect = RuntimeError("nft error")
|
|
await setup_masquerade(iface="wg0") # should not raise
|
|
|
|
|
|
# ========== policy functions — command verification ==========
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_peer_to_peer_enabled(mock_batch):
|
|
"""Enabling peer-to-peer generates accept rules."""
|
|
await apply_peer_to_peer_policy(True)
|
|
cmds = mock_batch.call_args[0][0]
|
|
assert any("accept" in c for c in cmds)
|
|
assert any("peer_to_peer" in c for c in cmds)
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_peer_to_peer_disabled(mock_batch):
|
|
"""Disabling peer-to-peer generates drop rules."""
|
|
await apply_peer_to_peer_policy(False)
|
|
cmds = mock_batch.call_args[0][0]
|
|
assert any("drop" in c for c in cmds)
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_lan_to_peers_enabled(mock_batch):
|
|
"""Enabling LAN-to-peers generates accept rules."""
|
|
await apply_lan_to_peers_policy(True)
|
|
cmds = mock_batch.call_args[0][0]
|
|
assert any("accept" in c for c in cmds)
|
|
assert any("lan_to_peers" in c for c in cmds)
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft_batch", new_callable=AsyncMock)
|
|
async def test_lan_to_peers_disabled(mock_batch):
|
|
"""Disabling LAN-to-peers generates drop rules."""
|
|
await apply_lan_to_peers_policy(False)
|
|
cmds = mock_batch.call_args[0][0]
|
|
assert any("drop" in c for c in cmds)
|
|
|
|
|
|
# ========== get_ruleset — error handling ==========
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft", new_callable=AsyncMock)
|
|
async def test_get_ruleset_returns_output(mock_nft):
|
|
"""get_ruleset returns nft list ruleset output."""
|
|
mock_nft.return_value = "table inet wiregui { ... }"
|
|
result = await get_ruleset()
|
|
assert "wiregui" in result
|
|
|
|
|
|
@patch("wiregui.services.firewall._nft", new_callable=AsyncMock)
|
|
async def test_get_ruleset_returns_fallback_on_error(mock_nft):
|
|
"""get_ruleset returns friendly message when nft not available."""
|
|
mock_nft.side_effect = RuntimeError("nft not found")
|
|
result = await get_ruleset()
|
|
assert "not available" in result |