M8: Mehrere LAN-Interfaces + Netzwerk-Isolation (Firewall-Regeln pro Netzwerk)

lanConfig wird zu lanConfigs: [LanDhcpConfig] (analog zum VLAN-Listen- Muster) — mehrere physische Interfaces mit je eigenem DHCP-Server. Neues isolated-Feld auf LanDhcpConfig/VlanEntry: FirewallConfig erzeugt daraus paarweise Forward-Drop-Regeln zwischen jedem isolierten Netzwerk und allen anderen konfigurierten Netzwerken (Pair-Dedup bei gegenseitiger Isolation). Behebt nebenbei, dass VlanStepView bisher Isolation im Hilfetext behauptete, ohne dass eine Regel das durchsetzte. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YYoWFMLHACvzzRC8u4iKF9
2026-09-13 19:57:15 +02:00
parent c1e6ec73b5
commit 5c8b5fd9d2
8 changed files with 189 additions and 39 deletions
@@ -36,4 +36,49 @@ final class FirewallConfigTests: XCTestCase {
        XCTAssertEqual(dropRule.arguments["in-interface"], "ether1")
        XCTAssertEqual(dropRule.arguments["action"], "drop")
    }
+
+    func testIsolatedNetworkGetsBidirectionalDropRulesAgainstOtherNetworks() {
+        let config = FirewallConfig(
+            wanInterface: "ether1",
+            networks: [
+                FirewallConfig.NetworkSegment(interfaceName: "bridge", isolated: true),
+                FirewallConfig.NetworkSegment(interfaceName: "vlan20", isolated: false)
+            ]
+        )
+        let commands = config.buildCommands()
+        let isolationCommands = commands.dropFirst(8)
+
+        XCTAssertEqual(isolationCommands.count, 2)
+        XCTAssertTrue(isolationCommands.allSatisfy { $0.arguments["chain"] == "forward" && $0.arguments["action"] == "drop" })
+
+        let directions = Set(isolationCommands.map { "\($0.arguments["in-interface"]!)->\($0.arguments["out-interface"]!)" })
+        XCTAssertEqual(directions, ["bridge->vlan20", "vlan20->bridge"])
+
+        XCTAssertEqual(isolationCommands.map { $0.arguments["place-before"] }, ["7", "8"])
+    }
+
+    func testMutuallyIsolatedNetworksProduceOnlyOnePairOfRules() {
+        let config = FirewallConfig(
+            wanInterface: "ether1",
+            networks: [
+                FirewallConfig.NetworkSegment(interfaceName: "bridge", isolated: true),
+                FirewallConfig.NetworkSegment(interfaceName: "vlan20", isolated: true)
+            ]
+        )
+        let isolationCommands = config.buildCommands().dropFirst(8)
+
+        XCTAssertEqual(isolationCommands.count, 2)
+    }
+
+    func testNonIsolatedNetworksProduceNoIsolationRules() {
+        let config = FirewallConfig(
+            wanInterface: "ether1",
+            networks: [
+                FirewallConfig.NetworkSegment(interfaceName: "bridge", isolated: false),
+                FirewallConfig.NetworkSegment(interfaceName: "vlan20", isolated: false)
+            ]
+        )
+
+        XCTAssertEqual(config.buildCommands().count, 8)
+    }
 }