Validate VLAN ID path parameter (#7329)

* Validate VLAN ID path parameter

Creating a VLAN with a non-numeric ID (e.g. /vlan/abc) raised a
ValueError from int() and surfaced as a 500 error. VLAN IDs outside the
valid 802.1Q range were also passed on to NetworkManager unchecked.

Validate the VLAN ID as an integer in 1..4094, so clients get a 400 with
a clear message.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Allow VLAN ID 0 for 802.1p priority tagging

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mrueg

supervisor/api/network.py

@@ -249,6 +249,9 @@ def _require_psk_for_wpa_psk(
     }
 )
 
+# VLAN ID 0 is deliberately allowed for 802.1p priority tagging, 4095 is reserved
+VALIDATE_VLAN_ID = vol.All(vol.Coerce(int), vol.Range(min=0, max=4094))
+
 
 def ip4config_struct(config: IpConfig, setting: IpSetting) -> dict[str, Any]:
     """Return a dict with information about IPv4 configuration."""
@@ -692,9 +695,13 @@ async def scan_accesspoints(self, request: web.Request) -> dict[str, Any]:
     async def create_vlan(self, request: web.Request) -> None:
         """Create a new vlan."""
         interface = self._get_interface(request.match_info[ATTR_INTERFACE])
-        vlan = int(request.match_info.get(ATTR_VLAN, -1))
-        if vlan < 0:
-            raise APIError(f"Invalid vlan specified: {vlan}")
+        vlan_id = request.match_info[ATTR_VLAN]
+        try:
+            vlan: int = VALIDATE_VLAN_ID(vlan_id)
+        except vol.Invalid as err:
+            raise APIError(
+                f"Invalid VLAN ID {vlan_id}, must be between 0 and 4094"
+            ) from err
 
         # Only ethernet is supported
         if interface.type != InterfaceType.ETHERNET:

tests/api/test_network.py

@@ -412,16 +412,24 @@ async def test_api_network_reload(
     assert network_manager_service.CheckConnectivity.calls == [()]
 
 
+@pytest.mark.parametrize(
+    "vlan",
+    [
+        pytest.param(1, id="vlan"),
+        pytest.param(0, id="priority-tagging"),
+    ],
+)
 async def test_api_network_vlan(
     api_client: TestClient,
     coresys: CoreSys,
     network_manager_services: dict[str, DBusServiceMock | dict[str, DBusServiceMock]],
+    vlan: int,
 ):
     """Test creating a vlan."""
     settings_service: SettingsService = network_manager_services["network_settings"]
     settings_service.AddConnection.calls.clear()
     resp = await api_client.post(
-        f"/network/interface/{TEST_INTERFACE_ETH_NAME}/vlan/1",
+        f"/network/interface/{TEST_INTERFACE_ETH_NAME}/vlan/{vlan}",
         json={"ipv4": {"method": "auto"}, "llmnr": "off"},
     )
     result = await resp.json()
@@ -431,7 +439,7 @@ async def test_api_network_vlan(
     connection = settings_service.AddConnection.calls[0][0]
     assert "uuid" in connection["connection"]
     assert connection["connection"] == {
-        "id": Variant("s", "Supervisor eth0.1"),
+        "id": Variant("s", f"Supervisor eth0.{vlan}"),
         "type": Variant("s", "vlan"),
         "mdns": Variant("i", -1),  # Default mode
         "llmnr": Variant("i", 0),
@@ -441,7 +449,7 @@ async def test_api_network_vlan(
     assert connection["ipv4"] == {"method": Variant("s", "auto")}
     assert connection["ipv6"] == {"method": Variant("s", "auto")}
     assert connection["vlan"] == {
-        "id": Variant("u", 1),
+        "id": Variant("u", vlan),
         "flags": Variant("u", 1),
         "parent": Variant("s", "0c23631e-2118-355c-bbb0-8943229cb0d6"),
     }
@@ -457,6 +465,33 @@ async def test_api_network_vlan(
     assert len(settings_service.AddConnection.calls) == 1
 
 
+@pytest.mark.parametrize(
+    "vlan",
+    [
+        pytest.param("abc", id="not-a-number"),
+        pytest.param("1.5", id="float"),
+        pytest.param("4095", id="reserved-4095"),
+        pytest.param("-1", id="negative"),
+    ],
+)
+async def test_api_network_vlan_invalid_id(
+    api_client: TestClient,
+    network_manager_services: dict[str, DBusServiceMock | dict[str, DBusServiceMock]],
+    vlan: str,
+):
+    """Test creating a vlan with an invalid id returns a client error."""
+    settings_service: SettingsService = network_manager_services["network_settings"]
+    settings_service.AddConnection.calls.clear()
+    resp = await api_client.post(
+        f"/network/interface/{TEST_INTERFACE_ETH_NAME}/vlan/{vlan}",
+        json={"ipv4": {"method": "auto"}},
+    )
+    assert resp.status == 400
+    body = await resp.json()
+    assert body["message"] == f"Invalid VLAN ID {vlan}, must be between 0 and 4094"
+    assert settings_service.AddConnection.calls == []
+
+
 @pytest.mark.parametrize(
     ("method", "url"),
     [