fix: architecture audit — security, atomicity, broken endpoints, test coverage

Sprint 1 — Security & correctness: - Restore all 10 commented-out is_local_request() checks (vault, containers, images, volumes) - Fix XFF spoofing: only trust the LAST X-Forwarded-For entry (Caddy's append), not all - Require prefix length in wireguard.address (was accepting bare IPs like 10.0.0.1) - Validate service_access list in add_peer (valid: calendar/files/mail/webdav) - Fix dhcp/reservations POST/DELETE: unpack mac/ip/hostname from body (was passing dict as positional arg) - Fix network/test POST: remove spurious data arg (test_connectivity takes no args) - Fix remove_peer: clear iptables rules and regenerate DNS ACLs on deletion (was leaving stale rules) - Fix CoreDNS reload: SIGHUP → SIGUSR1 (SIGHUP kills the process; SIGUSR1 triggers reload plugin) - Remove local.{domain} block from Corefile template (local.zone doesn't exist, caused log spam) - Fix routing_manager._remove_nat_rule: targeted -D instead of flushing entire POSTROUTING chain Sprint 2 — State consistency: - Atomic config writes in config_manager, ip_utils, firewall_manager, network_manager (write to .tmp → fsync → os.replace, prevents truncated files on kill) - backup_config: now also backs up Caddyfile, Corefile, .env, DNS zone files - restore_config: restores all of the above so config stays consistent after restore Sprint 3 — Dead code / documentation: - Remove CellManager instantiation from app startup (was never called, double-instantiated all managers) - Document routing_manager scope (targets host, not cell-wireguard; methods not called by any active route) Sprint 4 — Test infrastructure: - Add tests/conftest.py with shared tmp_dir, tmp_config_dir, tmp_data_dir, flask_client fixtures - Add tests/test_config_validation.py: 400 paths for ip_range, port, wireguard.address validation - Add tests/test_ip_utils_caddyfile.py: 14 tests for write_caddyfile (was completely untested) - Expand test_app_misc.py: 7 new is_local_request tests covering XFF spoofing and cell-network IPs - Add --cov-fail-under=70 to make test-coverage - Add pre-commit hook that runs pytest before every commit 414 tests pass (was 372). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-24 03:27:52 -04:00
parent 55bec04603
commit d5018c2b34
13 changed files with 801 additions and 633 deletions
@@ -0,0 +1,174 @@
+"""
+Tests for PUT /api/config input validation (400 paths).
+These are the highest-risk untested paths: the only server-side guard against
+bad subnet/port values entering persistent config.
+"""
+import json
+import sys
+import os
+import unittest
+from unittest.mock import patch, MagicMock
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'api'))
+
+
+def _make_client():
+    from app import app
+    app.config['TESTING'] = True
+    return app.test_client()
+
+
+def _put(client, payload):
+    return client.put(
+        '/api/config',
+        data=json.dumps(payload),
+        content_type='application/json',
+    )
+
+
+# ---------------------------------------------------------------------------
+# ip_range validation
+# ---------------------------------------------------------------------------
+
+class TestIpRangeValidation(unittest.TestCase):
+
+    def setUp(self):
+        self.client = _make_client()
+
+    def test_non_rfc1918_returns_400(self):
+        r = _put(self.client, {'ip_range': '1.2.3.0/24'})
+        self.assertEqual(r.status_code, 400)
+        body = json.loads(r.data)
+        self.assertIn('error', body)
+        self.assertIn('RFC-1918', body['error'])
+
+    def test_172_0_subnet_returns_400(self):
+        # 172.0.0.0/24 is NOT in 172.16.0.0/12 — was the bug on the dev machine
+        r = _put(self.client, {'ip_range': '172.0.0.0/24'})
+        self.assertEqual(r.status_code, 400)
+
+    def test_172_15_subnet_returns_400(self):
+        # One prefix below the 172.16.0.0/12 boundary
+        r = _put(self.client, {'ip_range': '172.15.0.0/24'})
+        self.assertEqual(r.status_code, 400)
+
+    def test_172_32_subnet_returns_400(self):
+        # One prefix above the 172.31.255.255 boundary
+        r = _put(self.client, {'ip_range': '172.32.0.0/24'})
+        self.assertEqual(r.status_code, 400)
+
+    def test_public_ip_returns_400(self):
+        r = _put(self.client, {'ip_range': '8.8.0.0/16'})
+        self.assertEqual(r.status_code, 400)
+
+    def test_172_16_exact_boundary_accepted(self):
+        # 172.16.0.0/12 is the exact lower boundary — must be valid
+        r = _put(self.client, {'ip_range': '172.16.0.0/12'})
+        # 200 or 202 — just not 400
+        self.assertNotEqual(r.status_code, 400)
+
+    def test_10_network_accepted(self):
+        r = _put(self.client, {'ip_range': '10.0.0.0/8'})
+        self.assertNotEqual(r.status_code, 400)
+
+    def test_192_168_network_accepted(self):
+        r = _put(self.client, {'ip_range': '192.168.0.0/16'})
+        self.assertNotEqual(r.status_code, 400)
+
+    def test_invalid_cidr_syntax_returns_400(self):
+        r = _put(self.client, {'ip_range': 'not-a-cidr'})
+        self.assertEqual(r.status_code, 400)
+
+
+# ---------------------------------------------------------------------------
+# Port range validation
+# ---------------------------------------------------------------------------
+
+class TestPortValidation(unittest.TestCase):
+
+    def setUp(self):
+        self.client = _make_client()
+
+    def test_dns_port_zero_returns_400(self):
+        r = _put(self.client, {'network': {'dns_port': 0}})
+        self.assertEqual(r.status_code, 400)
+        body = json.loads(r.data)
+        self.assertIn('dns_port', body.get('error', ''))
+
+    def test_dns_port_65536_returns_400(self):
+        r = _put(self.client, {'network': {'dns_port': 65536}})
+        self.assertEqual(r.status_code, 400)
+
+    def test_wireguard_port_zero_returns_400(self):
+        r = _put(self.client, {'wireguard': {'port': 0}})
+        self.assertEqual(r.status_code, 400)
+
+    def test_wireguard_port_65536_returns_400(self):
+        r = _put(self.client, {'wireguard': {'port': 65536}})
+        self.assertEqual(r.status_code, 400)
+
+    def test_wireguard_port_1_accepted(self):
+        r = _put(self.client, {'wireguard': {'port': 1}})
+        self.assertNotEqual(r.status_code, 400)
+
+    def test_wireguard_port_65535_accepted(self):
+        r = _put(self.client, {'wireguard': {'port': 65535}})
+        self.assertNotEqual(r.status_code, 400)
+
+    def test_email_smtp_port_zero_returns_400(self):
+        r = _put(self.client, {'email': {'smtp_port': 0}})
+        self.assertEqual(r.status_code, 400)
+
+    def test_calendar_port_negative_returns_400(self):
+        r = _put(self.client, {'calendar': {'port': -1}})
+        self.assertEqual(r.status_code, 400)
+
+
+# ---------------------------------------------------------------------------
+# WireGuard address validation
+# ---------------------------------------------------------------------------
+
+class TestWireguardAddressValidation(unittest.TestCase):
+
+    def setUp(self):
+        self.client = _make_client()
+
+    def test_bad_wg_address_returns_400(self):
+        r = _put(self.client, {'wireguard': {'address': 'not-an-ip'}})
+        self.assertEqual(r.status_code, 400)
+        body = json.loads(r.data)
+        self.assertIn('wireguard.address', body.get('error', ''))
+
+    def test_ip_without_prefix_returns_400(self):
+        r = _put(self.client, {'wireguard': {'address': '10.0.0.1'}})
+        self.assertEqual(r.status_code, 400)
+
+    def test_valid_wg_address_accepted(self):
+        r = _put(self.client, {'wireguard': {'address': '10.0.0.1/24'}})
+        self.assertNotEqual(r.status_code, 400)
+
+
+# ---------------------------------------------------------------------------
+# Body validation
+# ---------------------------------------------------------------------------
+
+class TestBodyValidation(unittest.TestCase):
+
+    def setUp(self):
+        self.client = _make_client()
+
+    def test_no_body_returns_400(self):
+        r = self.client.put('/api/config', content_type='application/json')
+        self.assertEqual(r.status_code, 400)
+
+    def test_empty_body_returns_400(self):
+        r = self.client.put('/api/config', data='', content_type='application/json')
+        self.assertEqual(r.status_code, 400)
+
+    def test_valid_cell_name_change_returns_200(self):
+        r = _put(self.client, {'cell_name': 'testcell'})
+        self.assertEqual(r.status_code, 200)
+
+
+if __name__ == '__main__':
+    unittest.main()