Firewall panel advertises service-name rules the backend rejects #10

Merged

Breadway merged 1 commit from fix/bset-8-firewall-hint-port-only into main

2026-09-11 11:01:34 +08:00

Breadway commented

2026-09-09 19:44:01 +08:00

Owner

Summary

The Firewall panel's "Add rule" hint and input placeholder advertised service names (a service name like "OpenSSH", port/proto or service name), but valid_firewall_rule in src/src/commands/firewall.rs is deliberately port-only (argv-safe, kept strict from f7b114f) and rejects anything that is not a port with an optional protocol. Its own test asserts !valid_firewall_rule("OpenSSH"). A user who followed the UI hint and typed OpenSSH got an "invalid firewall rule" error.

This takes option 2 from the issue: make the UI copy honest about the current port-only behaviour rather than loosening the validator (which is a security-sensitive product decision, better handled as its own feature).

Changes

frontend/src/lib/views/Firewall.svelte: hint is now A port, optionally with a protocol. e.g. "22", "8080/tcp", "53/udp". and the placeholder is port/proto, e.g. 8080/tcp.

No backend change. valid_firewall_rule and its tests are unchanged and already match this copy.

Verification

npm run build (frontend) passes
npm run check (svelte-check): 0 errors, 0 warnings
No Rust changed

Closes #9

## Summary The Firewall panel's "Add rule" hint and input placeholder advertised service names (`a service name like "OpenSSH"`, `port/proto or service name`), but `valid_firewall_rule` in `src/src/commands/firewall.rs` is deliberately port-only (argv-safe, kept strict from f7b114f) and rejects anything that is not a port with an optional protocol. Its own test asserts `!valid_firewall_rule("OpenSSH")`. A user who followed the UI hint and typed `OpenSSH` got an "invalid firewall rule" error. This takes option 2 from the issue: make the UI copy honest about the current port-only behaviour rather than loosening the validator (which is a security-sensitive product decision, better handled as its own feature). ## Changes - `frontend/src/lib/views/Firewall.svelte`: hint is now `A port, optionally with a protocol. e.g. "22", "8080/tcp", "53/udp".` and the placeholder is `port/proto, e.g. 8080/tcp`. No backend change. `valid_firewall_rule` and its tests are unchanged and already match this copy. ## Verification - `npm run build` (frontend) passes - `npm run check` (svelte-check): 0 errors, 0 warnings - No Rust changed Closes #9

Breadway added 1 commit

2026-09-09 19:44:01 +08:00

fix(firewall): align add-rule hint with the port-only validator

check / check (push) Successful in 2m32s

Details

fa8bf3525c

The Add rule hint and input placeholder advertised service names like
"OpenSSH", but valid_firewall_rule is deliberately port-only (argv-safe,
kept strict from f7b114f) and rejects them. A user following the hint
got an "invalid firewall rule" error.

Update the hint and placeholder to describe the port/proto forms the
validator actually accepts. No behaviour change; the validator and its
tests are unchanged.

Closes #9

Breadway referenced this pull request

2026-09-09 19:44:09 +08:00

Firewall panel advertises service-name rules the backend rejects #9

Breadway merged commit 0732e3b0c6 into main

2026-09-11 11:01:34 +08:00

Breadway deleted branch fix/bset-8-firewall-hint-port-only

2026-09-11 11:01:34 +08:00

Breadway referenced this pull request

2026-09-11 11:01:43 +08:00

Firewall panel advertises service-name rules the backend rejects #9