From 10919312697164d8a90ba10861f01a8cd87f7287 Mon Sep 17 00:00:00 2001 From: Denozordec Date: Thu, 23 Jul 2026 20:51:12 +0700 Subject: [PATCH] fix(api): update firewall filter comments and test assertions - Modified comments in the `mikrotik-install.rsc` script to clarify the naming convention for filter rules, ensuring consistency with `policy.rsc`. - Updated the test assertions in `install-links.test.ts` to reflect the new comment names in the firewall filter rules, enhancing test accuracy. These changes improve the clarity and reliability of the firewall configuration and associated tests. --- apps/api/src/agent-scripts/mikrotik-install.rsc | 10 +++++----- apps/api/src/services/install-links.test.ts | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/apps/api/src/agent-scripts/mikrotik-install.rsc b/apps/api/src/agent-scripts/mikrotik-install.rsc index 038aed5..a3733d8 100644 --- a/apps/api/src/agent-scripts/mikrotik-install.rsc +++ b/apps/api/src/agent-scripts/mikrotik-install.rsc @@ -51,13 +51,13 @@ /system script add name=evofw-env policy=read,write,policy,test source=(" :global EvofwCpUrl \"" . $EvofwCpUrl . "\"; :global EvofwToken \"" . $EvofwToken . "\" ") } -# Filter rules (idempotent by comment) +# Filter rules (idempotent by comment) — names must match policy.rsc (mikrotik-rsc.ts) :do { /ip firewall filter remove [find comment~"^evofw-"] } on-error={} -/ip firewall filter add chain=input action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-input disabled=no -/ip firewall filter add chain=forward action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-forward disabled=no -/ip firewall filter add chain=forward action=accept src-address-list=EVOFW_ALLOW comment=evofw-wl-accept-forward disabled=yes -/ip firewall filter add chain=forward action=drop comment=evofw-wl-drop-forward disabled=yes +/ip firewall filter add chain=input action=drop src-address-list=EVOFW_DENY comment=evofw-deny-drop-input disabled=no +/ip firewall filter add chain=forward action=drop src-address-list=EVOFW_DENY comment=evofw-deny-drop-forward disabled=no +/ip firewall filter add chain=forward action=accept src-address-list=EVOFW_ALLOW comment=evofw-allow-accept-forward disabled=no +/ip firewall filter add chain=forward action=drop comment=evofw-default-drop-forward disabled=yes # Sync: fetch policy.rsc → import address-lists + toggle mode :do { /system script remove [find name="evofw-sync"] } on-error={} diff --git a/apps/api/src/services/install-links.test.ts b/apps/api/src/services/install-links.test.ts index 5071423..7b0aa46 100644 --- a/apps/api/src/services/install-links.test.ts +++ b/apps/api/src/services/install-links.test.ts @@ -140,7 +140,7 @@ describe('install-links', () => { expect(byId.headers['content-type']).toContain('text/plain') expect(byId.body).toContain(':global EvofwCpUrl "https://fw.example.com"') expect(byId.body).toContain(`:global EvofwInstallLinkId "${body.id}"`) - expect(byId.body).toContain('evofw-bl-drop-input') + expect(byId.body).toContain('evofw-deny-drop-input') expect(byId.body).toContain('/v1/agent/policy.rsc') })