rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

19
scripts/router-ui-check.py
View file

@ -174,3 +174,22 @@ assert got[0] == {"ts": "2026-08-15 12:00:55", "down": 508.9, "up": 70.7,
"ping": 18.8, "server": "Preston"}, got[0]
print("\nall checks passed", file=sys.stderr)
# A save must not inject nft syntax, introduce ambiguous forwards, or move
# management ports to another machine while appearing to keep them open.
for extra in [
{"name": 'bad" rule', "port": "9999", "protocol": "tcp"},
{"name": "bad destination", "port": "9999", "protocol": "tcp", "dest": "10.0.0.5; accept"},
{"name": "outside LAN", "port": "9999", "protocol": "tcp", "dest": "192.168.1.2"},
{"name": "broadcast", "port": "9999", "protocol": "tcp", "dest": "10.0.0.255"},
{"name": "overlap", "port": "25600-25610", "protocol": "udp"},
{"name": "SSH", "port": "9999", "protocol": "udp"},
{"name": "ambiguous", "port": "9999", "ports": "10000-10001", "protocol": "udp"},
]:
refuses(r.check_forwards, mk() + [extra])
for name in ("SSH", "HTTPS"):
entries = mk()
next(f for f in entries if f["name"] == name)["dest"] = "10.0.0.2"
refuses(r.check_forwards, entries)
r.check_forwards(mk() + [{"name": "different protocol", "port": "443", "protocol": "udp", "dest": "10.0.0.2"}])
print("Forward failure-path checks passed")