DebTik/internal/api/firewall_validation_test.go

package api

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestFirewallRejectsUnsupportedAndIncompleteRequests(t *testing.T) {
	s := &Server{} // Validation must complete without invoking any manager or tool.
	for _, tc := range []struct {
		handler http.HandlerFunc
		body    string
		status  int
	}{
		{s.handleSaveFilterRule, `{"chain":"input","action":"tarpit"}`, 422},
		{s.handleSaveFilterRule, `{"chain":"input","action":"drop","tls_host":"*.example.com"}`, 422},
		{s.handleSaveNATRule, `{"chain":"srcnat","action":"same"}`, 422},
		{s.handleSaveMangleRule, `{"chain":"output","action":"sniff-pc"}`, 422},
		{s.handleSaveFilterRule, `{"chain":"input","action":"accept","typo":true}`, 400},
		{s.handleKillConnection, `{}`, 422},
		{s.handleKillConnection, `{"protocol":"tcp","src":"192.0.2.1","dst":"198.51.100.1"}`, 422},
	} {
		r := httptest.NewRequest("POST", "/", strings.NewReader(tc.body))
		w := httptest.NewRecorder()
		tc.handler(w, r)
		if w.Code != tc.status {
			t.Fatalf("%s returned %d: %s", tc.body, w.Code, w.Body.String())
		}
	}
}
func TestFirewallRoutePatterns(t *testing.T) {
	s := &Server{mux: http.NewServeMux(), fsHandler: http.NotFoundHandler()}
	s.registerRoutes()
	w := httptest.NewRecorder()
	s.mux.ServeHTTP(w, httptest.NewRequest("GET", "/api/firewall/capabilities", nil))
	if w.Code != 200 {
		t.Fatal(w.Code)
	}
}