fix: full security audit remediation — P0/P1/P2/P3 fixes + 1020 passing tests
P0 — Broken functionality: - Fix 12+ endpoints with wrong manager method signatures (email/calendar/file/routing) - Fix email_manager.delete_email_user() missing domain arg - Fix cell-link DNS forwarding wiped on every peer change (generate_corefile now accepts cell_links param; add/remove_cell_dns_forward no longer clobber the file) - Fix Flask SECRET_KEY regenerating on every restart (persisted to DATA_DIR) - Fix _next_peer_ip exhaustion returning 500 instead of 409 - Fix ConfigManager Caddyfile path (/app/config-caddy/) - Fix UI double-add and wrong-key peer bugs in Peers.jsx / WireGuard.jsx - Remove hardcoded credentials from Dashboard.jsx P1 — Security: - CSRF token validation on all POST/PUT/DELETE/PATCH to /api/* (double-submit pattern) - enforce_auth: 503 only when users file readable but empty; never bypass on IOError - WireGuard add_cell_peer: validate pubkey, name, endpoint against strict regexes - DNS add_cell_dns_forward: validate IP and domain; reject injection chars - DNS zone write: realpath containment + record content validation - iptables comment /32 suffix prevents substring match deleting wrong peer rules - is_local_request() trusts only loopback + 172.16.0.0/12 (Docker bridge) - POST /api/containers: volume allow-list prevents arbitrary host mounts - file_manager: bcrypt ($2b→$2y) for WebDAV; realpath containment in delete_user - email/calendar: stop persisting plaintext passwords in user records - routing_manager: validate IPs, networks, and interface names - peer_registry: write peers.json at mode 0o600 - vault_manager: Fernet key file at mode 0o600 - CORS: lock down to explicit origin list - domain/cell_name validation: reject newline, brace, semicolon injection chars P2 — Architecture: - Peer add: rollback registry entry if firewall rules fail post-add - restart_service(): base class now calls _restart_container(); email and calendar managers call cell-mail / cell-radicale respectively - email/calendar managers sync user list (no passwords) to cell_config.json - Pending-restart flag cleared only after helper subprocess exits with code 0 - docker-compose.yml: add config-caddy volume to API container P3 — Tests (854 → 1020): - Fill test_email_endpoints.py, test_calendar_endpoints.py, test_network_endpoints.py, test_routing_endpoints.py - New: test_peer_management_update.py, test_peer_management_edge_cases.py, test_input_validation.py, test_enforce_auth_configured.py, test_cell_link_dns.py, test_logs_endpoints.py, test_cells_endpoints.py, test_is_local_request_per_endpoint.py, test_caddy_routing.py - E2E conftest: skip WireGuard suite when wg-quick absent - Update existing tests to match fixed signatures and comment formats Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,182 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Edge-case tests for peer management endpoints in api/app.py.
|
||||
|
||||
Key scenarios:
|
||||
- POST /api/peers with subnet exhaustion (_next_peer_ip raises ValueError) → 409
|
||||
- POST /api/peers/<name>/clear-reinstall: success (200)
|
||||
- POST /api/peers/<name>/clear-reinstall: unknown peer raises → 500
|
||||
- POST /api/ip-update: missing 'peer' field → 400
|
||||
- POST /api/ip-update: missing 'ip' field → 400
|
||||
- POST /api/ip-update: unknown peer → 404
|
||||
- POST /api/ip-update: success → 200
|
||||
"""
|
||||
|
||||
import sys
|
||||
import json
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
from unittest.mock import patch, MagicMock
|
||||
|
||||
api_dir = Path(__file__).parent.parent / 'api'
|
||||
sys.path.insert(0, str(api_dir))
|
||||
|
||||
from app import app
|
||||
|
||||
|
||||
class TestAddPeerSubnetExhaustion(unittest.TestCase):
|
||||
"""POST /api/peers with no free IPs left must return 409, not 500."""
|
||||
|
||||
def setUp(self):
|
||||
app.config['TESTING'] = True
|
||||
self.client = app.test_client()
|
||||
|
||||
@patch('app._next_peer_ip')
|
||||
@patch('app.auth_manager')
|
||||
def test_add_peer_returns_409_when_subnet_exhausted(self, mock_auth, mock_next_ip):
|
||||
mock_auth.create_user.return_value = True
|
||||
mock_next_ip.side_effect = ValueError('No free IPs left in 10.0.0.0/24')
|
||||
|
||||
r = self.client.post(
|
||||
'/api/peers',
|
||||
data=json.dumps({
|
||||
'name': 'newpeer',
|
||||
'public_key': 'PUBKEY==',
|
||||
'password': 'verysecret123',
|
||||
}),
|
||||
content_type='application/json',
|
||||
)
|
||||
self.assertEqual(r.status_code, 409)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('error', data)
|
||||
|
||||
@patch('app._next_peer_ip')
|
||||
@patch('app.auth_manager')
|
||||
def test_add_peer_409_error_message_mentions_ip(self, mock_auth, mock_next_ip):
|
||||
mock_auth.create_user.return_value = True
|
||||
mock_next_ip.side_effect = ValueError('No free IPs left in 10.0.0.0/24')
|
||||
|
||||
r = self.client.post(
|
||||
'/api/peers',
|
||||
data=json.dumps({
|
||||
'name': 'newpeer',
|
||||
'public_key': 'PUBKEY==',
|
||||
'password': 'verysecret123',
|
||||
}),
|
||||
content_type='application/json',
|
||||
)
|
||||
self.assertEqual(r.status_code, 409)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('No free IPs', data['error'])
|
||||
|
||||
|
||||
class TestClearReinstallFlag(unittest.TestCase):
|
||||
"""POST /api/peers/<name>/clear-reinstall"""
|
||||
|
||||
def setUp(self):
|
||||
app.config['TESTING'] = True
|
||||
self.client = app.test_client()
|
||||
|
||||
@patch('app.peer_registry')
|
||||
def test_clear_reinstall_returns_200_on_success(self, mock_reg):
|
||||
mock_reg.clear_reinstall_flag.return_value = True
|
||||
r = self.client.post('/api/peers/alice/clear-reinstall')
|
||||
self.assertEqual(r.status_code, 200)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('message', data)
|
||||
|
||||
@patch('app.peer_registry')
|
||||
def test_clear_reinstall_calls_registry_with_peer_name(self, mock_reg):
|
||||
mock_reg.clear_reinstall_flag.return_value = True
|
||||
self.client.post('/api/peers/bob/clear-reinstall')
|
||||
mock_reg.clear_reinstall_flag.assert_called_once_with('bob')
|
||||
|
||||
@patch('app.peer_registry')
|
||||
def test_clear_reinstall_returns_500_when_exception_raised(self, mock_reg):
|
||||
mock_reg.clear_reinstall_flag.side_effect = Exception('peer not found')
|
||||
r = self.client.post('/api/peers/ghost/clear-reinstall')
|
||||
self.assertEqual(r.status_code, 500)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('error', data)
|
||||
|
||||
|
||||
class TestIpUpdate(unittest.TestCase):
|
||||
"""POST /api/ip-update"""
|
||||
|
||||
def setUp(self):
|
||||
app.config['TESTING'] = True
|
||||
self.client = app.test_client()
|
||||
|
||||
@patch('app.routing_manager')
|
||||
@patch('app.peer_registry')
|
||||
def test_ip_update_returns_200_on_success(self, mock_reg, mock_rm):
|
||||
mock_reg.update_peer_ip.return_value = True
|
||||
mock_rm.update_peer_ip.return_value = None
|
||||
|
||||
r = self.client.post(
|
||||
'/api/ip-update',
|
||||
data=json.dumps({'peer': 'alice', 'ip': '10.0.0.99'}),
|
||||
content_type='application/json',
|
||||
)
|
||||
self.assertEqual(r.status_code, 200)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('message', data)
|
||||
|
||||
@patch('app.peer_registry')
|
||||
def test_ip_update_returns_400_when_peer_field_missing(self, mock_reg):
|
||||
r = self.client.post(
|
||||
'/api/ip-update',
|
||||
data=json.dumps({'ip': '10.0.0.99'}),
|
||||
content_type='application/json',
|
||||
)
|
||||
self.assertEqual(r.status_code, 400)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('error', data)
|
||||
mock_reg.update_peer_ip.assert_not_called()
|
||||
|
||||
@patch('app.peer_registry')
|
||||
def test_ip_update_returns_400_when_ip_field_missing(self, mock_reg):
|
||||
r = self.client.post(
|
||||
'/api/ip-update',
|
||||
data=json.dumps({'peer': 'alice'}),
|
||||
content_type='application/json',
|
||||
)
|
||||
self.assertEqual(r.status_code, 400)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('error', data)
|
||||
mock_reg.update_peer_ip.assert_not_called()
|
||||
|
||||
@patch('app.peer_registry')
|
||||
def test_ip_update_returns_400_when_no_body(self, mock_reg):
|
||||
r = self.client.post('/api/ip-update')
|
||||
self.assertEqual(r.status_code, 400)
|
||||
self.assertIn('error', json.loads(r.data))
|
||||
|
||||
@patch('app.peer_registry')
|
||||
def test_ip_update_returns_404_when_peer_not_found(self, mock_reg):
|
||||
mock_reg.update_peer_ip.return_value = False
|
||||
r = self.client.post(
|
||||
'/api/ip-update',
|
||||
data=json.dumps({'peer': 'ghost', 'ip': '10.0.0.50'}),
|
||||
content_type='application/json',
|
||||
)
|
||||
self.assertEqual(r.status_code, 404)
|
||||
data = json.loads(r.data)
|
||||
self.assertIn('error', data)
|
||||
|
||||
@patch('app.routing_manager')
|
||||
@patch('app.peer_registry')
|
||||
def test_ip_update_calls_registry_with_correct_args(self, mock_reg, mock_rm):
|
||||
mock_reg.update_peer_ip.return_value = True
|
||||
mock_rm.update_peer_ip.return_value = None
|
||||
|
||||
self.client.post(
|
||||
'/api/ip-update',
|
||||
data=json.dumps({'peer': 'alice', 'ip': '10.0.0.5'}),
|
||||
content_type='application/json',
|
||||
)
|
||||
mock_reg.update_peer_ip.assert_called_once_with('alice', '10.0.0.5')
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
Reference in New Issue
Block a user