tlc-claude-code 1.4.7 → 1.4.9

package/server/lib/network/firewall-manager.js

@@ -0,0 +1,252 @@
+/**
+ * Firewall Manager - UFW rules generation and management
+ */
+
+/**
+ * UFW policy constants
+ */
+export const UFW_POLICIES = {
+  ALLOW: 'allow',
+  DENY: 'deny',
+  REJECT: 'reject',
+};
+
+/**
+ * Generate UFW enable command
+ * @param {Object} options - Options
+ * @param {boolean} options.force - Include --force flag
+ * @returns {string} UFW enable command
+ */
+export function generateUfwEnableCommand(options = {}) {
+  const { force = false } = options;
+  if (force) {
+    return 'ufw --force enable';
+  }
+  return 'ufw enable';
+}
+
+/**
+ * Set default policy
+ * @param {Object} options - Options
+ * @param {string} options.direction - 'incoming' or 'outgoing'
+ * @param {string} options.policy - 'allow', 'deny', or 'reject'
+ * @returns {string} UFW default policy command
+ */
+export function setDefaultPolicy(options) {
+  const { direction, policy } = options;
+  return `ufw default ${policy} ${direction}`;
+}
+
+/**
+ * Generate allow rule for port
+ * @param {Object} options - Options
+ * @param {number|string} options.port - Port number, range, or service name
+ * @param {string} options.protocol - Protocol (tcp, udp)
+ * @returns {string} UFW allow rule
+ */
+export function allowPort(options) {
+  const { port, protocol } = options;
+  if (protocol) {
+    return `ufw allow ${port}/${protocol}`;
+  }
+  return `ufw allow ${port}`;
+}
+
+/**
+ * Generate allow rule for IP
+ * @param {Object} options - Options
+ * @param {string} options.ip - IP address or CIDR range
+ * @param {number} options.port - Port number (optional)
+ * @returns {string} UFW allow from IP rule
+ */
+export function allowFromIp(options) {
+  const { ip, port } = options;
+  if (port) {
+    return `ufw allow from ${ip} to any port ${port}`;
+  }
+  return `ufw allow from ${ip}`;
+}
+
+/**
+ * Generate deny rule for port
+ * @param {Object} options - Options
+ * @param {number|string} options.port - Port number
+ * @param {string} options.protocol - Protocol (tcp, udp)
+ * @returns {string} UFW deny rule
+ */
+export function denyPort(options) {
+  const { port, protocol } = options;
+  if (protocol) {
+    return `ufw deny ${port}/${protocol}`;
+  }
+  return `ufw deny ${port}`;
+}
+
+/**
+ * Validate UFW rule syntax
+ * @param {string} rule - UFW rule to validate
+ * @returns {Object} Validation result with valid and error properties
+ */
+export function validateRule(rule) {
+  // Check for port numbers
+  const portMatch = rule.match(/(?:port\s+|allow\s+|deny\s+)(\d+)/);
+  if (portMatch) {
+    const port = parseInt(portMatch[1], 10);
+    if (port < 1 || port > 65535) {
+      return { valid: false, error: 'Invalid port number' };
+    }
+  }
+
+  // Check for IP addresses
+  const ipMatch = rule.match(/from\s+([\d.]+(?:\/\d+)?)/);
+  if (ipMatch) {
+    const ipPart = ipMatch[1];
+    const [ip, cidr] = ipPart.split('/');
+
+    // Validate IP octets
+    const octets = ip.split('.');
+    if (octets.length !== 4) {
+      return { valid: false, error: 'Invalid IP address format' };
+    }
+
+    for (const octet of octets) {
+      const num = parseInt(octet, 10);
+      if (isNaN(num) || num < 0 || num > 255) {
+        return { valid: false, error: 'Invalid IP address' };
+      }
+    }
+
+    // Validate CIDR if present
+    if (cidr !== undefined) {
+      const cidrNum = parseInt(cidr, 10);
+      if (isNaN(cidrNum) || cidrNum < 0 || cidrNum > 32) {
+        return { valid: false, error: 'Invalid CIDR notation' };
+      }
+    }
+  }
+
+  return { valid: true };
+}
+
+/**
+ * Generate complete UFW rules configuration
+ * @param {Object} options - Options
+ * @param {number[]} options.allowPorts - Ports to allow
+ * @param {number} options.sshPort - SSH port
+ * @param {string[]} options.adminIps - Admin IP addresses
+ * @param {boolean} options.rateLimit - Enable rate limiting
+ * @param {string} options.format - Output format ('rules' or 'script')
+ * @returns {string} UFW rules or script
+ */
+export function generateUfwRules(options) {
+  const {
+    allowPorts = [],
+    sshPort = 22,
+    adminIps = [],
+    rateLimit = false,
+    format = 'rules',
+  } = options;
+
+  const lines = [];
+
+  if (format === 'script') {
+    lines.push('#!/bin/bash');
+    lines.push('');
+  }
+
+  // Default policies
+  lines.push('ufw default deny incoming');
+  lines.push('ufw default allow outgoing');
+
+  // SSH rule
+  if (rateLimit) {
+    lines.push(`ufw limit ${sshPort}`);
+  } else {
+    lines.push(`ufw allow ${sshPort}`);
+  }
+
+  // Allowed ports
+  for (const port of allowPorts) {
+    lines.push(`ufw allow ${port}`);
+  }
+
+  // Admin IPs
+  for (const ip of adminIps) {
+    lines.push(`ufw allow from ${ip}`);
+  }
+
+  return lines.join('\n');
+}
+
+/**
+ * Create a firewall manager instance
+ * @param {Object} options - Initial options
+ * @returns {Object} Firewall manager object
+ */
+export function createFirewallManager(options = {}) {
+  const { sshPort = 22 } = options;
+  const rules = [];
+
+  return {
+    /**
+     * Generate rules using the current configuration
+     */
+    generateRules(opts = {}) {
+      return generateUfwRules({ ...opts, sshPort });
+    },
+
+    /**
+     * Add an allow port rule
+     */
+    allowPort(opts) {
+      const rule = allowPort(opts);
+      rules.push(rule);
+      return rule;
+    },
+
+    /**
+     * Add a deny port rule
+     */
+    denyPort(opts) {
+      const rule = denyPort(opts);
+      rules.push(rule);
+      return rule;
+    },
+
+    /**
+     * Add an allow from IP rule
+     */
+    allowFromIp(opts) {
+      const rule = allowFromIp(opts);
+      rules.push(rule);
+      return rule;
+    },
+
+    /**
+     * Validate a rule
+     */
+    validate(rule) {
+      return validateRule(rule);
+    },
+
+    /**
+     * Get all added rules
+     */
+    getRules() {
+      return [...rules];
+    },
+
+    /**
+     * Generate complete configuration
+     */
+    generateConfig() {
+      const lines = [
+        'ufw default deny incoming',
+        'ufw default allow outgoing',
+        `ufw allow ${sshPort}`,
+        ...rules,
+      ];
+      return lines.join('\n');
+    },
+  };
+}

package/server/lib/network/firewall-manager.test.js

@@ -0,0 +1,254 @@
+/**
+ * Firewall Manager Tests
+ */
+import { describe, it, expect } from 'vitest';
+import {
+  generateUfwRules,
+  generateUfwEnableCommand,
+  setDefaultPolicy,
+  allowPort,
+  allowFromIp,
+  denyPort,
+  validateRule,
+  UFW_POLICIES,
+  createFirewallManager,
+} from './firewall-manager.js';
+
+describe('firewall-manager', () => {
+  describe('UFW_POLICIES', () => {
+    it('defines policy constants', () => {
+      expect(UFW_POLICIES.ALLOW).toBe('allow');
+      expect(UFW_POLICIES.DENY).toBe('deny');
+      expect(UFW_POLICIES.REJECT).toBe('reject');
+    });
+  });
+
+  describe('generateUfwEnableCommand', () => {
+    it('generates enable command', () => {
+      const command = generateUfwEnableCommand();
+
+      expect(command).toContain('ufw');
+      expect(command).toContain('enable');
+    });
+
+    it('includes force flag', () => {
+      const command = generateUfwEnableCommand({ force: true });
+
+      expect(command).toContain('--force');
+    });
+  });
+
+  describe('setDefaultPolicy', () => {
+    it('sets default deny incoming', () => {
+      const command = setDefaultPolicy({
+        direction: 'incoming',
+        policy: 'deny',
+      });
+
+      expect(command).toContain('default deny incoming');
+    });
+
+    it('sets default allow outgoing', () => {
+      const command = setDefaultPolicy({
+        direction: 'outgoing',
+        policy: 'allow',
+      });
+
+      expect(command).toContain('default allow outgoing');
+    });
+  });
+
+  describe('allowPort', () => {
+    it('generates allow rule for port', () => {
+      const rule = allowPort({ port: 443 });
+
+      expect(rule).toContain('allow');
+      expect(rule).toContain('443');
+    });
+
+    it('supports protocol specification', () => {
+      const rule = allowPort({ port: 443, protocol: 'tcp' });
+
+      expect(rule).toContain('443/tcp');
+    });
+
+    it('supports port ranges', () => {
+      const rule = allowPort({ port: '3000:3010' });
+
+      expect(rule).toContain('3000:3010');
+    });
+
+    it('supports named services', () => {
+      const rule = allowPort({ port: 'ssh' });
+
+      expect(rule).toContain('ssh');
+    });
+  });
+
+  describe('allowFromIp', () => {
+    it('generates allow rule for IP', () => {
+      const rule = allowFromIp({
+        ip: '192.168.1.100',
+        port: 22,
+      });
+
+      expect(rule).toContain('from 192.168.1.100');
+      expect(rule).toContain('22');
+    });
+
+    it('supports CIDR notation', () => {
+      const rule = allowFromIp({
+        ip: '10.0.0.0/8',
+        port: 22,
+      });
+
+      expect(rule).toContain('from 10.0.0.0/8');
+    });
+
+    it('supports any destination', () => {
+      const rule = allowFromIp({
+        ip: '192.168.1.100',
+      });
+
+      expect(rule).toContain('from 192.168.1.100');
+    });
+  });
+
+  describe('denyPort', () => {
+    it('generates deny rule for port', () => {
+      const rule = denyPort({ port: 23 });
+
+      expect(rule).toContain('deny');
+      expect(rule).toContain('23');
+    });
+
+    it('supports protocol specification', () => {
+      const rule = denyPort({ port: 23, protocol: 'tcp' });
+
+      expect(rule).toContain('23/tcp');
+    });
+  });
+
+  describe('validateRule', () => {
+    it('validates correct rule syntax', () => {
+      const result = validateRule('ufw allow 443/tcp');
+
+      expect(result.valid).toBe(true);
+    });
+
+    it('rejects invalid port numbers', () => {
+      const result = validateRule('ufw allow 99999');
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('port');
+    });
+
+    it('rejects invalid IP addresses', () => {
+      const result = validateRule('ufw allow from 999.999.999.999');
+
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('IP');
+    });
+
+    it('validates CIDR notation', () => {
+      const validResult = validateRule('ufw allow from 10.0.0.0/8');
+      expect(validResult.valid).toBe(true);
+
+      const invalidResult = validateRule('ufw allow from 10.0.0.0/33');
+      expect(invalidResult.valid).toBe(false);
+    });
+  });
+
+  describe('generateUfwRules', () => {
+    it('generates complete UFW configuration', () => {
+      const rules = generateUfwRules({
+        allowPorts: [80, 443],
+        sshPort: 22,
+      });
+
+      expect(rules).toContain('default deny incoming');
+      expect(rules).toContain('default allow outgoing');
+      expect(rules).toContain('allow 80');
+      expect(rules).toContain('allow 443');
+      expect(rules).toContain('allow 22');
+    });
+
+    it('supports custom SSH port', () => {
+      const rules = generateUfwRules({
+        allowPorts: [80, 443],
+        sshPort: 2222,
+      });
+
+      expect(rules).toContain('allow 2222');
+      expect(rules).not.toContain('allow 22/tcp');
+    });
+
+    it('includes IP allowlist for admin', () => {
+      const rules = generateUfwRules({
+        allowPorts: [80, 443],
+        sshPort: 22,
+        adminIps: ['192.168.1.100', '10.0.0.50'],
+      });
+
+      expect(rules).toContain('from 192.168.1.100');
+      expect(rules).toContain('from 10.0.0.50');
+    });
+
+    it('supports rate limiting', () => {
+      const rules = generateUfwRules({
+        allowPorts: [80, 443],
+        sshPort: 22,
+        rateLimit: true,
+      });
+
+      expect(rules).toContain('limit');
+    });
+
+    it('generates script format', () => {
+      const rules = generateUfwRules({
+        allowPorts: [80, 443],
+        sshPort: 22,
+        format: 'script',
+      });
+
+      expect(rules).toContain('#!/bin/bash');
+      expect(rules).toContain('ufw');
+    });
+  });
+
+  describe('createFirewallManager', () => {
+    it('creates manager with methods', () => {
+      const manager = createFirewallManager();
+
+      expect(manager.generateRules).toBeDefined();
+      expect(manager.allowPort).toBeDefined();
+      expect(manager.denyPort).toBeDefined();
+      expect(manager.allowFromIp).toBeDefined();
+      expect(manager.validate).toBeDefined();
+    });
+
+    it('tracks added rules', () => {
+      const manager = createFirewallManager();
+
+      manager.allowPort({ port: 80 });
+      manager.allowPort({ port: 443 });
+
+      const rules = manager.getRules();
+      expect(rules.length).toBe(2);
+    });
+
+    it('generates complete config', () => {
+      const manager = createFirewallManager({
+        sshPort: 22,
+      });
+
+      manager.allowPort({ port: 80 });
+      manager.allowPort({ port: 443 });
+
+      const config = manager.generateConfig();
+      expect(config).toContain('80');
+      expect(config).toContain('443');
+      expect(config).toContain('22');
+    });
+  });
+});