app/vppn
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

Audit changes.

Browse Source
This commit is contained in:
jdl
2026-06-11 16:46:38 +02:00
parent cd2ec23ccb
commit 82a6d47bc9
17 changed files with 133 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
hub/api/db/sanitize-validate.go
View File

@@ -8,6 +8,7 @@ import (
var (
ErrInvalidIP = errors.New("invalid IP")
ErrInvalidPeerIP = errors.New("invalid peer IP")
ErrNonPrivateIP = errors.New("non-private IP")
ErrInvalidPort = errors.New("invalid port")
ErrInvalidNetName = errors.New("invalid network name")
@@ -67,7 +68,8 @@ func Peer_Sanitize(p *Peer) {
p.Name = strings.TrimSpace(p.Name)
if len(p.Addr4) != 0 {
if addr, ok := netip.AddrFromSlice(p.Addr4); ok {
p.Addr4 = addr.AsSlice()
// Unmap so an IPv4-mapped form is stored canonically as 4 bytes.
p.Addr4 = addr.Unmap().AsSlice()
}
}
if len(p.Addr6) != 0 {
@@ -81,13 +83,18 @@ func Peer_Sanitize(p *Peer) {
}
func Peer_Validate(p *Peer) error {
if p.PeerIP < 1 || p.PeerIP > 254 {
return ErrInvalidPeerIP
}
if len(p.Addr4) > 0 {
if _, ok := netip.AddrFromSlice(p.Addr4); !ok {
// Must be a genuine IPv4 address (reject an IPv6 in the v4 field).
if addr, ok := netip.AddrFromSlice(p.Addr4); !ok || !addr.Is4() {
return ErrInvalidIP
}
}
if len(p.Addr6) > 0 {
if _, ok := netip.AddrFromSlice(p.Addr6); !ok {
// Must be a genuine IPv6 address (reject IPv4 / IPv4-mapped in the v6 field).
if addr, ok := netip.AddrFromSlice(p.Addr6); !ok || !addr.Is6() || addr.Is4In6() {
return ErrInvalidIP
}
}