Audit changes.

hub/api/api.go

@@ -65,12 +65,8 @@ func (a *API) ensurePassword() error {
 	return db.Config_Insert(a.db, conf)
 }
 
-func (a *API) Config_Get() *Config {
-	conf, err := db.Config_Get(a.db, 1)
-	if err != nil {
-		panic(err)
-	}
-	return conf
+func (a *API) Config_Get() (*Config, error) {
+	return db.Config_Get(a.db, 1)
 }
 
 func (a *API) Config_Update(conf *Config) error {
@@ -116,7 +112,10 @@ func (a *API) session_Create() *Session {
 }
 
 func (a *API) Session_SignIn(s *Session, pwd string) error {
-	conf := a.Config_Get()
+	conf, err := a.Config_Get()
+	if err != nil {
+		return err
+	}
 	if err := bcrypt.CompareHashAndPassword(conf.Password, []byte(pwd)); err != nil {
 		return ErrNotAuthorized
 	}

hub/api/db/sanitize-validate.go

@@ -8,6 +8,7 @@ import (
 
 var (
 	ErrInvalidIP       = errors.New("invalid IP")
+	ErrInvalidPeerIP   = errors.New("invalid peer IP")
 	ErrNonPrivateIP    = errors.New("non-private IP")
 	ErrInvalidPort     = errors.New("invalid port")
 	ErrInvalidNetName  = errors.New("invalid network name")
@@ -67,7 +68,8 @@ func Peer_Sanitize(p *Peer) {
 	p.Name = strings.TrimSpace(p.Name)
 	if len(p.Addr4) != 0 {
 		if addr, ok := netip.AddrFromSlice(p.Addr4); ok {
-			p.Addr4 = addr.AsSlice()
+			// Unmap so an IPv4-mapped form is stored canonically as 4 bytes.
+			p.Addr4 = addr.Unmap().AsSlice()
 		}
 	}
 	if len(p.Addr6) != 0 {
@@ -81,13 +83,18 @@ func Peer_Sanitize(p *Peer) {
 }
 
 func Peer_Validate(p *Peer) error {
+	if p.PeerIP < 1 || p.PeerIP > 254 {
+		return ErrInvalidPeerIP
+	}
 	if len(p.Addr4) > 0 {
-		if _, ok := netip.AddrFromSlice(p.Addr4); !ok {
+		// Must be a genuine IPv4 address (reject an IPv6 in the v4 field).
+		if addr, ok := netip.AddrFromSlice(p.Addr4); !ok || !addr.Is4() {
 			return ErrInvalidIP
 		}
 	}
 	if len(p.Addr6) > 0 {
-		if _, ok := netip.AddrFromSlice(p.Addr6); !ok {
+		// Must be a genuine IPv6 address (reject IPv4 / IPv4-mapped in the v6 field).
+		if addr, ok := netip.AddrFromSlice(p.Addr6); !ok || !addr.Is6() || addr.Is4In6() {
 			return ErrInvalidIP
 		}
 	}

hub/api/errors.go

@@ -7,7 +7,6 @@ import (
 
 var (
 	ErrNotAuthorized = errors.New("not authorized")
-	ErrNoIPAvailable = errors.New("no IP address available")
 	ErrInvalidIP     = db.ErrInvalidIP
 	ErrInvalidPort   = db.ErrInvalidPort
 )

hub/api/migrations/2024-11-30-init.sql

@@ -14,12 +14,13 @@ CREATE TABLE peers (
   PeerIP     INTEGER NOT NULL,           -- Final byte of IP.
   Version    INTEGER NOT NULL,           -- Changes when updated.
   APIKey     TEXT    NOT NULL UNIQUE,    -- Peer's secret API key.
-  Name       TEXT    NOT NULL UNIQUE,    -- For humans.
+  Name       TEXT    NOT NULL,           -- For humans.
   Addr4      BLOB    NOT NULL,
   Addr6      BLOB    NOT NULL,
   Port       INTEGER NOT NULL,
   Relay      INTEGER NOT NULL DEFAULT 0, -- Boolean if peer will forward packets.
   WGPubKey   BLOB    NOT NULL,
   SignPubKey BLOB    NOT NULL,
+  UNIQUE(NetworkID, Name),
   PRIMARY KEY(NetworkID, PeerIP)
 ) WITHOUT ROWID;

hub/cookie.go

@@ -2,7 +2,6 @@ package hub
 
 import (
 	"net/http"
-	"time"
 )
 
 func (a *App) getCookie(r *http.Request, name string) string {
@@ -26,9 +25,12 @@ func (a *App) setCookie(w http.ResponseWriter, name, value string) {
 
 func (a *App) deleteCookie(w http.ResponseWriter, name string) {
 	http.SetCookie(w, &http.Cookie{
-		Name:    name,
-		Value:   "",
-		Path:    "/",
-		Expires: time.Unix(0, 0),
+		Name:     name,
+		Value:    "",
+		Path:     "/",
+		Secure:   !a.insecure,
+		SameSite: http.SameSiteStrictMode,
+		HttpOnly: true,
+		MaxAge:   -1, // delete now
 	})
 }

hub/handlers.go

@@ -260,13 +260,17 @@ func (a *App) _adminPasswordEdit(s *api.Session, w http.ResponseWriter, r *http.
 
 func (a *App) _adminPasswordSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
 	var (
-		conf    = a.api.Config_Get()
 		curPwd  string
 		newPwd  string
 		newPwd2 string
 	)
 
-	err := webutil.NewFormScanner(r.Form).
+	conf, err := a.api.Config_Get()
+	if err != nil {
+		return err
+	}
+
+	err = webutil.NewFormScanner(r.Form).
 		Scan("CurrentPassword", &curPwd).
 		Scan("NewPassword", &newPwd).
 		Scan("NewPassword2", &newPwd2).
@@ -337,7 +341,7 @@ func (a *App) _peerInit(peer *api.Peer, w http.ResponseWriter, r *http.Request)
 		LocalDomain: net.LocalDomain,
 	}
 
-	resp.NetworkState.Peers, err = a.peersArray(net.NetworkID)
+	resp.NetworkState.Peers, err = a.peersList(net.NetworkID)
 	if err != nil {
 		return err
 	}
@@ -346,22 +350,24 @@ func (a *App) _peerInit(peer *api.Peer, w http.ResponseWriter, r *http.Request)
 }
 
 func (a *App) _peerFetchState(peer *api.Peer, w http.ResponseWriter, r *http.Request) error {
-	peers, err := a.peersArray(peer.NetworkID)
+	peers, err := a.peersList(peer.NetworkID)
 	if err != nil {
 		return err
 	}
 	return a.sendJSON(w, m.NetworkState{Peers: peers})
 }
 
-func (a *App) peersArray(networkID int64) (peers [256]*m.Peer, err error) {
+func (a *App) peersList(networkID int64) (peers []m.Peer, err error) {
 	l, err := a.api.Peer_List(networkID)
 	if err != nil {
-		return peers, err
+		return nil, err
 	}
 
+	peers = make([]m.Peer, 0, len(l))
+
 	for _, p := range l {
 		if len(p.WGPubKey) != 0 {
-			peers[p.PeerIP] = &m.Peer{
+			peers = append(peers, m.Peer{
 				PeerIP:     p.PeerIP,
 				Version:    p.Version,
 				Name:       p.Name,
@@ -371,9 +377,9 @@ func (a *App) peersArray(networkID int64) (peers [256]*m.Peer, err error) {
 				Relay:      p.Relay,
 				WGPubKey:   p.WGPubKey,
 				SignPubKey: p.SignPubKey,
-			}
+			})
 		}
 	}
 
-	return
+	return peers, nil
 }