julian.kiedaisch/mdg-filius
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(editor): F4.5d the firewall in the device sheet

Browse Source 
Measured first: SheetRun drives FILIUS' firewall dialog down to its table
editor (Swing's own end of an edit). Java's table writes a cell into the
rule before it checks it, so that the firewall holds "abc", a mask of
255.0.255.0 or port 0 while the table shows the old value, and reads a
port that is no number as all ports. Here nothing the check refuses
reaches the rule.

- doc: the three switches, the default action, rules (new as Java's,
  cells by Java's checks: masks of ones then zeros, the directly connected
  marker as a source only, an empty port for all ports; protocol, action,
  moved up or down, removed)
- editor: the firewall as a page of the router's and home router's sheet,
  with Java's explanations; the general tab named so (Java: "network
  interfaces")

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
julian.kiedaisch
2026-10-03 12:27:10 +00:00
co-authored by Claude Opus 5.5
parent c8edb87210
commit 4e062bb347
15 changed files with 1399 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/doc/test/sheet.java.json
+610 -1
View File
@@ -1209,7 +1209,7 @@
}
],
"flows": {
"useMacAsNameThenOff": "26:0A:1B:EE:FE:4B",
"useMacAsNameThenOff": "5E:C4:F7:30:10:4A",
"useIpAsNameThenOff": "PC-A",
"dhcpClientStopsServer": true,
"dhcpClient": true,
@@ -1674,6 +1674,615 @@
false
]
},
"firewall": {
"newRule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"newRuleShown": [
"1",
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
],
"newFirewall": [
false,
0,
false,
true
],
"cells": [
{
"column": 1,
"input": "10.0.0.0",
"rule": {
"srcIP": "10.0.0.0",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"10.0.0.0",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 1,
"input": "abc",
"rule": {
"srcIP": "abc",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": false,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 1,
"input": ".0.0.1",
"rule": {
"srcIP": ".0.0.1",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
".0.0.1",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 1,
"input": "999.999.999.999",
"rule": {
"srcIP": "999.999.999.999",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"999.999.999.999",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 1,
"input": "010.0.0.0",
"rule": {
"srcIP": "010.0.0.0",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"010.0.0.0",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 1,
"input": " ",
"rule": {
"srcIP": " ",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
" ",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 2,
"input": "255.255.0.0",
"rule": {
"srcIP": "",
"srcMask": "255.255.0.0",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"255.255.0.0",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 2,
"input": "255.0.255.0",
"rule": {
"srcIP": "",
"srcMask": "255.0.255.0",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": false,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 2,
"input": "0.0.0.0",
"rule": {
"srcIP": "",
"srcMask": "0.0.0.0",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": false,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 2,
"input": "255.255.255.255",
"rule": {
"srcIP": "",
"srcMask": "255.255.255.255",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"255.255.255.255",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 2,
"input": "0255.255.0.0",
"rule": {
"srcIP": "",
"srcMask": "0255.255.0.0",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"0255.255.0.0",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 3,
"input": "192.168.0.1",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "192.168.0.1",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"192.168.0.1",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 3,
"input": "999.999.999.999",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "999.999.999.999",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": false,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 4,
"input": "255.255.255.0",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "255.255.255.0",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"",
"255.255.255.0",
"TCP",
"",
"verwerfen"
]
},
{
"column": 6,
"input": "80",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": 80,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"",
"",
"TCP",
"80",
"verwerfen"
]
},
{
"column": 6,
"input": "abc",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 6,
"input": "0",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": 0,
"protocol": 6,
"action": 0
},
"valid": false,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 6,
"input": "080",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": 80,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"",
"",
"TCP",
"80",
"verwerfen"
]
},
{
"column": 6,
"input": "",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 6,
"input": "65536",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": 65536,
"protocol": 6,
"action": 0
},
"valid": false,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"verwerfen"
]
},
{
"column": 5,
"input": "UDP",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 17,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"",
"",
"UDP",
"",
"verwerfen"
]
},
{
"column": 5,
"input": "*",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": -1,
"action": 0
},
"valid": true,
"shown": [
"",
"",
"",
"",
"*",
"",
"verwerfen"
]
},
{
"column": 7,
"input": "#0",
"rule": {
"srcIP": "",
"srcMask": "",
"destIP": "",
"destMask": "",
"port": -1,
"protocol": 6,
"action": 1
},
"valid": true,
"shown": [
"",
"",
"",
"",
"TCP",
"",
"akzeptieren"
]
}
],
"moves": [
[
"up",
1,
false,
[
"1.1.1.1",
"2.2.2.2",
"3.3.3.3"
]
],
[
"up",
3,
true,
[
"1.1.1.1",
"3.3.3.3",
"2.2.2.2"
]
],
[
"down",
3,
false,
[
"1.1.1.1",
"3.3.3.3",
"2.2.2.2"
]
],
[
"down",
1,
true,
[
"3.3.3.3",
"1.1.1.1",
"2.2.2.2"
]
],
[
"delete",
2,
null,
[
"3.3.3.3",
"2.2.2.2"
]
]
]
},
"edits": {
"invalidCell": {
"manual": [
packages/doc/test/sheet.test.ts
+168
View File
@@ -31,6 +31,14 @@ import {
setSwitchRetention,
setSwitchSsid,
addRoute,
addFirewallRule,
moveFirewallRule,
removeFirewallRule,
setFirewallDefaultPolicy,
setFirewallFlag,
setFirewallRuleCell,
setFirewallRuleChoice,
type FirewallRuleColumn,
addDhcpStaticAssignment,
addPortForwarding,
removeDhcpStaticAssignment,
@@ -90,8 +98,24 @@ const java = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)
readonly addable: readonly boolean[];
};
readonly forwarding: { readonly rows: readonly (readonly [string, string, string, string])[]; readonly valid: readonly boolean[] };
readonly firewall: {
readonly newRule: JavaFirewallRule;
readonly newFirewall: readonly [boolean, number, boolean, boolean];
readonly cells: readonly { readonly column: number; readonly input: string; readonly rule: JavaFirewallRule; readonly valid: boolean }[];
readonly moves: readonly (readonly [string, number, boolean | null, readonly string[]])[];
};
};
interface JavaFirewallRule {
readonly srcIP: string;
readonly srcMask: string;
readonly destIP: string;
readonly destMask: string;
readonly port: number;
readonly protocol: number;
readonly action: number;
}
const RULES: Readonly<Record<string, FieldRule>> = {
'host name': 'name',
'host ip': 'ipAddress',
@@ -921,3 +945,147 @@ describe("a home router's port forwarding", () => {
expect(reopened.portForwardingRowsByNodeId.get(again)).toEqual([JAVA_ROWS()[0]]);
});
});
describe("a router's firewall", () => {
const JAVA_PROTOCOLS: Readonly<Record<number, string>> = { [-1]: 'all', 1: 'icmp', 6: 'tcp', 17: 'udp' };
const COLUMNS: Readonly<Record<number, FirewallRuleColumn>> = { 1: 'sourceIPAddress', 2: 'sourceSubnetMask', 3: 'destinationIPAddress', 4: 'destinationSubnetMask', 6: 'port' };
const ruleOfJava = (rule: JavaFirewallRule) => ({
sourceIPAddress: rule.srcIP,
sourceSubnetMask: rule.srcMask,
destinationIPAddress: rule.destIP,
destinationSubnetMask: rule.destMask,
port: rule.port,
protocol: JAVA_PROTOCOLS[rule.protocol],
action: rule.action === 1 ? 'accept' : 'drop',
});
function firewalled() {
const doc = new Y.Doc();
const id = add(doc, 'router');
const rules = () => router(doc, id).firewall.rules;
return { doc, id, rules };
}
it("starts as Java's, and makes a new rule as Java's does", () => {
const { doc, id, rules } = firewalled();
const [isActive, policy, dropIcmp, filterSyn] = java.firewall.newFirewall;
expect(router(doc, id).firewall).toEqual({ isActive, defaultPolicy: policy === 1 ? 'accept' : 'drop', dropIcmp, filterSynSegmentsOnly: filterSyn, rules: [] });
expect(addFirewallRule(doc, id, 'me')).toBe(0);
expect(rules()).toEqual([ruleOfJava(java.firewall.newRule)]);
expect(addFirewallRule(doc, 'nobody', 'me')).toBeUndefined();
});
it("takes a cell by Java's checks, never a value they refuse (Java's table keeps it in the rule)", () => {
// Java: what its rule holds after the cell is taken, and whether the rule then passes its own check.
expect(java.firewall.cells.filter((each) => each.column in COLUMNS).map((each) => [each.column, each.input, ruleOfJava(each.rule)[COLUMNS[each.column]!], each.valid])).toEqual([
[1, '10.0.0.0', '10.0.0.0', true],
[1, 'abc', 'abc', false],
[1, '.0.0.1', '.0.0.1', true],
[1, '999.999.999.999', '999.999.999.999', true],
[1, '010.0.0.0', '010.0.0.0', true],
[1, ' ', ' ', true],
[2, '255.255.0.0', '255.255.0.0', true],
[2, '255.0.255.0', '255.0.255.0', false],
[2, '0.0.0.0', '0.0.0.0', false],
[2, '255.255.255.255', '255.255.255.255', true],
[2, '0255.255.0.0', '0255.255.0.0', true],
[3, '192.168.0.1', '192.168.0.1', true],
[3, '999.999.999.999', '999.999.999.999', false],
[4, '255.255.255.0', '255.255.255.0', true],
[6, '80', 80, true],
[6, 'abc', -1, true],
[6, '0', 0, false],
[6, '080', 80, true],
[6, '', -1, true],
[6, '65536', 65_536, false],
]);
// Here: what the rule takes, or that it takes nothing. Not adopted: ".0.0.1" (no address), "abc" as all ports, "080" (musterPort).
const ours = java.firewall.cells
.filter((each) => each.column in COLUMNS)
.map((each) => {
const { doc, id, rules } = firewalled();
addFirewallRule(doc, id, 'me');
const result = setFirewallRuleCell(doc, id, 0, COLUMNS[each.column]!, each.input, 'me');
return 'invalid' in result ? 'refused' : rules()[0]![COLUMNS[each.column]!];
});
expect(ours).toEqual([
'10.0.0.0',
'refused',
'refused',
'999.999.999.999',
'10.0.0.0',
'',
'255.255.0.0',
'refused',
'refused',
'255.255.255.255',
'255.255.0.0',
'192.168.0.1',
'refused',
'255.255.255.0',
80,
'refused',
'refused',
'refused',
-1,
'refused',
]);
});
it("chooses a rule's protocol and action as Java's lists do", () => {
const choices = java.firewall.cells.filter((each) => !(each.column in COLUMNS)).map((each) => ruleOfJava(each.rule));
expect(choices.map((each) => [each.protocol, each.action])).toEqual([
['udp', 'drop'],
['all', 'drop'],
['tcp', 'accept'],
]);
const { doc, id, rules } = firewalled();
addFirewallRule(doc, id, 'me');
setFirewallRuleChoice(doc, id, 0, { protocol: 'udp' }, 'me');
setFirewallRuleChoice(doc, id, 0, { action: 'accept' }, 'me');
expect(rules()[0]).toMatchObject({ protocol: 'udp', action: 'accept' });
setFirewallRuleChoice(doc, id, 5, { protocol: 'all' }, 'me');
expect(rules()).toHaveLength(1);
});
it("moves and removes rules as Java's buttons do, the first going no higher and the last no lower", () => {
const { doc, id, rules } = firewalled();
for (const source of ['1.1.1.1', '2.2.2.2', '3.3.3.3']) setFirewallRuleCell(doc, id, addFirewallRule(doc, id, 'me')!, 'sourceIPAddress', source, 'me');
// Java's buttons pass the row's number (1 for the first); here its place.
const ours = java.firewall.moves.map(([step, number]) => {
const answer = step === 'delete' ? (removeFirewallRule(doc, id, number - 1, 'me'), null) : moveFirewallRule(doc, id, number - 1, step === 'up' ? -1 : 1, 'me');
return [step, number, answer, rules().map((rule) => rule.sourceIPAddress)];
});
expect(ours).toEqual(java.firewall.moves);
expect(moveFirewallRule(doc, id, 7, 1, 'me')).toBe(false);
removeFirewallRule(doc, id, 7, 'me');
expect(rules()).toHaveLength(2);
});
it('switches its flags and its default, and keeps all through a saved file', () => {
const { doc, id } = firewalled();
const homeId = add(doc, 'gateway');
for (const device of [id, homeId]) {
setFirewallFlag(doc, device, 'isActive', true, 'me');
setFirewallFlag(doc, device, 'dropIcmp', true, 'me');
setFirewallFlag(doc, device, 'filterSynSegmentsOnly', false, 'me');
setFirewallDefaultPolicy(doc, device, 'accept', 'me');
addFirewallRule(doc, device, 'me');
setFirewallRuleCell(doc, device, 0, 'destinationIPAddress', '10.0.0.0', 'me');
setFirewallRuleCell(doc, device, 0, 'destinationSubnetMask', '255.0.0.0', 'me');
setFirewallRuleCell(doc, device, 0, 'port', '80', 'me');
}
expect(home(doc, homeId).firewall).toMatchObject({ isActive: true, dropIcmp: true, filterSynSegmentsOnly: false, defaultPolicy: 'accept' });
let counter = 0;
const reopened = openProjectArchive(saveProjectArchive(readProject(doc)).archive, () => `60000000-0000-0000-0000-${(++counter).toString(16).padStart(12, '0')}`);
for (const node of reopened.graph.nodes) {
expect(reopened.firewallConfigurationsByNodeId.get(node.id)).toMatchObject({
isActive: true,
dropIcmp: true,
filterSynSegmentsOnly: false,
defaultPolicy: 'accept',
rules: [{ sourceIPAddress: '', destinationIPAddress: '10.0.0.0', destinationSubnetMask: '255.0.0.0', port: 80, protocol: 'tcp', action: 'drop' }],
});
}
});
});