peerman 0.2.7

DN42 peer manager with WireGuard, BIRD, and cluster support
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

use crate::error::AppError;

/// Allowed BIRD commands (Looking Glass is read-only).
const ALLOWED_PREFIXES: &[&str] = &[
    "show protocols",
    "show status",
    "show route",
    "show interfaces",
    "show neighbors",
    "show symbols",
];

/// Validate a BIRD command against the allowlist.
pub fn validate_bird_command(command: &str) -> Result<&str, AppError> {
    let trimmed = command.trim();
    if trimmed.is_empty() {
        return Err(AppError::Validation("BIRD command cannot be empty".into()));
    }
    let lower = trimmed.to_lowercase();
    for prefix in ALLOWED_PREFIXES {
        if lower.starts_with(prefix) {
            return Ok(trimmed);
        }
    }
    Err(AppError::Validation(format!(
        "BIRD command not allowed: '{}'. Allowed: {}",
        trimmed,
        ALLOWED_PREFIXES.join(", ")
    )))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_allowed_commands() {
        assert!(validate_bird_command("show protocols").is_ok());
        assert!(validate_bird_command("show protocols all").is_ok());
        assert!(validate_bird_command("show status").is_ok());
        assert!(validate_bird_command("show route for 172.20.0.0/14").is_ok());
        assert!(validate_bird_command("show interfaces").is_ok());
        assert!(validate_bird_command("show neighbors").is_ok());
        assert!(validate_bird_command("show symbols").is_ok());
    }

    #[test]
    fn test_blocked_commands() {
        assert!(validate_bird_command("configure").is_err());
        assert!(validate_bird_command("configure soft").is_err());
        assert!(validate_bird_command("debug all").is_err());
        assert!(validate_bird_command("eval $var").is_err());
        assert!(validate_bird_command("").is_err());
    }

    #[test]
    fn test_case_insensitive() {
        assert!(validate_bird_command("SHOW PROTOCOLS").is_ok());
        assert!(validate_bird_command("Show Status").is_ok());
    }
}