Updates

2026-09-20 07:27:29 +01:00
parent dc2cd66b25
commit 8ec44ee0a7
70 changed files with 2657 additions and 128 deletions
@@ -0,0 +1,134 @@
+import { describe, expect, test } from "bun:test";
+import buildHostIptablesScripts from "./build-host-iptables-scripts";
+
+const base = {
+    host_id: 0,
+    interface_name: "wgui0",
+    target_interface: "eth0",
+};
+
+describe("buildHostIptablesScripts", () => {
+    test("deny by default with no clients", () => {
+        const res = buildHostIptablesScripts({
+            ...base,
+            clients: [],
+        });
+
+        expect(res.success).toBe(true);
+        expect(res.post_up).toContain("iptables -N WGUI0FWD");
+        expect(res.post_up).toContain("iptables -A WGUI0FWD -j DROP");
+        expect(res.post_up).toContain("iptables -A WGUI0IN -j DROP");
+        expect(res.post_up).not.toContain("WGUI0FWD -s");
+        expect(res.post_down).toContain("iptables -X WGUI0FWD");
+        expect(res.post_down).toContain("iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE");
+    });
+
+    test("all access accepts the client on forward and input", () => {
+        const res = buildHostIptablesScripts({
+            ...base,
+            clients: [
+                {
+                    id: 1,
+                    wg_ip_address: "10.0.0.2",
+                    rules: [{ rule_type: "all" }],
+                },
+            ],
+        });
+
+        expect(res.success).toBe(true);
+        expect(res.post_up).toContain(
+            "iptables -A WGUI0FWD -s 10.0.0.2/32 -j ACCEPT",
+        );
+        expect(res.post_up).toContain(
+            "iptables -A WGUI0IN -s 10.0.0.2/32 -j ACCEPT",
+        );
+    });
+
+    test("destination IP and ports", () => {
+        const res = buildHostIptablesScripts({
+            ...base,
+            clients: [
+                {
+                    id: 2,
+                    wg_ip_address: "10.0.0.3",
+                    rules: [
+                        {
+                            rule_type: "destination",
+                            destination: "192.168.1.10",
+                            ports: "80,443",
+                            protocol: "tcp",
+                        },
+                    ],
+                },
+            ],
+        });
+
+        expect(res.success).toBe(true);
+        expect(res.post_up).toContain(
+            "iptables -A WGUI0FWD -s 10.0.0.3/32 -d 192.168.1.10/32 -p tcp -m multiport --dports 80,443 -j ACCEPT",
+        );
+        expect(res.post_up).toContain(
+            "iptables -A WGUI0IN -s 10.0.0.3/32 -d 192.168.1.10/32 -p tcp -m multiport --dports 80,443 -j ACCEPT",
+        );
+    });
+
+    test("protocol any with ports emits tcp and udp", () => {
+        const res = buildHostIptablesScripts({
+            ...base,
+            clients: [
+                {
+                    id: 3,
+                    wg_ip_address: "10.0.0.4",
+                    rules: [
+                        {
+                            rule_type: "destination",
+                            ports: "53",
+                            protocol: "any",
+                        },
+                    ],
+                },
+            ],
+        });
+
+        expect(res.success).toBe(true);
+        expect(res.post_up).toContain(
+            "iptables -A WGUI0FWD -s 10.0.0.4/32 -p tcp --dport 53 -j ACCEPT",
+        );
+        expect(res.post_up).toContain(
+            "iptables -A WGUI0FWD -s 10.0.0.4/32 -p udp --dport 53 -j ACCEPT",
+        );
+    });
+
+    test("rejects invalid destination", () => {
+        const res = buildHostIptablesScripts({
+            ...base,
+            clients: [
+                {
+                    id: 4,
+                    wg_ip_address: "10.0.0.5",
+                    rules: [
+                        {
+                            rule_type: "destination",
+                            destination: "not-an-ip",
+                        },
+                    ],
+                },
+            ],
+        });
+
+        expect(res.success).toBe(false);
+    });
+
+    test("cleans up legacy allow-all rules", () => {
+        const res = buildHostIptablesScripts({
+            ...base,
+        });
+
+        expect(res.post_up).toContain(
+            "iptables -D FORWARD -i wgui0 -j ACCEPT 2>/dev/null || true",
+        );
+        expect(res.post_down).toContain(
+            "iptables -D FORWARD -i wgui0 -j ACCEPT 2>/dev/null || true",
+        );
+    });
+});