Stefano Bertelli
0546b44507
Complete Python/NiceGUI rewrite of the Wirezone (Elixir/Phoenix) VPN management platform. All 10 implementation phases delivered. Core stack: - NiceGUI reactive UI with SQLModel ORM on PostgreSQL (asyncpg) - Alembic migrations, Valkey/Redis cache, pydantic-settings config - WireGuard management via subprocess (wg/ip/nft CLIs) - 164 tests passing, 35% code coverage Features: - User/device/rule CRUD with admin and unprivileged roles - Full device config form with per-device WG overrides - WireGuard client config generation with QR codes - REST API (v0) with Bearer token auth for all resources - TOTP MFA with QR registration and challenge flow - OIDC SSO with authlib (provider registry, auto-create users) - Magic link passwordless sign-in via email - SAML SP-initiated SSO with IdP metadata parsing - WebAuthn/FIDO2 security key registration - nftables firewall with per-user chains and masquerade - Background tasks: WG stats polling, VPN session expiry, OIDC token refresh, WAN connectivity checks - Startup reconciliation (DB ↔ WireGuard state sync) - In-memory notification system with header badge - Admin UI: users, devices, rules, settings (3 tabs), diagnostics - Loguru logging with optional timestamped file output Deployment: - Multi-stage Dockerfile (python:3.13-slim) - Docker Compose prod stack (bridge networking, NET_ADMIN, nftables) - Forgejo CI: tests → semantic versioning → Docker registry push - Health endpoint at /api/health
40 lines
1.3 KiB
Python
40 lines
1.3 KiB
Python
"""Tests for firewall service — rule expression building and chain naming."""
|
|
|
|
from wiregui.services.firewall import _build_rule_expr, _user_chain_name
|
|
|
|
|
|
def test_user_chain_name():
|
|
uid = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
|
|
name = _user_chain_name(uid)
|
|
assert name == "user_a1b2c3d4e5f6"
|
|
assert len(name) <= 30
|
|
|
|
|
|
def test_user_chain_name_deterministic():
|
|
uid = "12345678-1234-1234-1234-123456789abc"
|
|
assert _user_chain_name(uid) == _user_chain_name(uid)
|
|
|
|
|
|
def test_build_rule_expr_ipv4_accept():
|
|
expr = _build_rule_expr("10.0.0.0/8", "accept")
|
|
assert expr == "ip daddr 10.0.0.0/8 accept"
|
|
|
|
|
|
def test_build_rule_expr_ipv6_drop():
|
|
expr = _build_rule_expr("fd00::/64", "drop")
|
|
assert expr == "ip6 daddr fd00::/64 drop"
|
|
|
|
|
|
def test_build_rule_expr_with_port():
|
|
expr = _build_rule_expr("192.168.0.0/16", "accept", port_type="tcp", port_range="80-443")
|
|
assert expr == "ip daddr 192.168.0.0/16 tcp dport 80-443 accept"
|
|
|
|
|
|
def test_build_rule_expr_single_port():
|
|
expr = _build_rule_expr("10.0.0.1/32", "drop", port_type="udp", port_range="53")
|
|
assert expr == "ip daddr 10.0.0.1/32 udp dport 53 drop"
|
|
|
|
|
|
def test_build_rule_expr_no_port():
|
|
expr = _build_rule_expr("0.0.0.0/0", "accept", port_type=None, port_range=None)
|
|
assert expr == "ip daddr 0.0.0.0/0 accept"
|