projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(api): WireGuard Private-Key-Verlust bei Peer-Update + Domain-Header-Ownership

Browse Source 
wireguard.go: UpdatePeer zerstörte den gespeicherten encPriv wenn der Client
denselben public_key im Update-Body mitschickte (encPriv = nil auf Zeile 532).
Fix: encPriv wird nur geleert wenn der public_key sich tatsächlich ÄNDERT.
Andernfalls (gleicher Public Key = Benutzer ändert z.B. nur Allowed-IPs)
bleibt das verschlüsselte Private Key erhalten und QR/conf-Download
bleiben verfügbar.

domains.go + domainheaders.go: UpdateHeader() ignorierte die domainID aus der
URL. Fix: Update-SQL prüft jetzt WHERE id=$4 AND domain_id=$5 — falsch
adressierte Requests kriegen 404 statt blind zu updaten.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-24 12:59:13 +02:00
parent 1aaca2c056
commit 9708e4441b
7 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
VERSION
View File

@@ -1 +1 @@
1.1.87
1.1.88

2
cmd/edgeguard-api/main.go
View File

@@ -60,7 +60,7 @@ import (
usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
)
var version = "1.1.87"
var version = "1.1.88"
func main() {
addr := os.Getenv("EDGEGUARD_API_ADDR")

2
cmd/edgeguard-ctl/main.go
View File

@@ -11,7 +11,7 @@ import (
"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
)
var version = "1.1.87"
var version = "1.1.88"
const usage = `edgeguard-ctl — EdgeGuard CLI

2
cmd/edgeguard-scheduler/main.go
View File

@@ -35,7 +35,7 @@ import (
"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
)
var version = "1.1.87"
var version = "1.1.88"
const (
// renewTickInterval — how often we re-evaluate expiring certs.

4
internal/handlers/domains.go
View File

@@ -213,7 +213,7 @@ func (h *DomainsHandler) CreateHeader(c *gin.Context) {
}
func (h *DomainsHandler) UpdateHeader(c *gin.Context) {
_, ok := parseID(c)
domainID, ok := parseID(c)
if !ok {
return
}
@@ -231,7 +231,7 @@ func (h *DomainsHandler) UpdateHeader(c *gin.Context) {
response.BadRequest(c, errors.New("invalid header name"))
return
}
out, err := h.Headers.Update(c.Request.Context(), hid, req)
out, err := h.Headers.Update(c.Request.Context(), domainID, hid, req)
if err != nil {
if errors.Is(err, domainheaders.ErrNotFound) {
response.NotFound(c, err)

6
internal/handlers/wireguard.go
View File

@@ -529,7 +529,11 @@ func (h *WireguardHandler) UpdatePeer(c *gin.Context) {
}
} else if req.PublicKey != "" {
pub = req.PublicKey
encPriv = nil
if req.PublicKey != cur.PublicKey {
// New externally-provided public key — server has no private key for it.
encPriv = nil
}
// Same public key → keep cur.PrivateKeyEnc (peer still has generated keypair).
}
encPSK := cur.PSKEnc
if req.GeneratePSK {

6
internal/services/domainheaders/domainheaders.go
View File

@@ -85,13 +85,13 @@ RETURNING id, domain_id, name, value, position, created_at, updated_at`,
return scan(row)
}
func (r *Repo) Update(ctx context.Context, id int64, h models.DomainResponseHeader) (*models.DomainResponseHeader, error) {
func (r *Repo) Update(ctx context.Context, domainID, id int64, h models.DomainResponseHeader) (*models.DomainResponseHeader, error) {
row := r.Pool.QueryRow(ctx, `
UPDATE domain_response_headers SET
name = $1, value = $2, position = $3, updated_at = NOW()
WHERE id = $4
WHERE id = $4 AND domain_id = $5
RETURNING id, domain_id, name, value, position, created_at, updated_at`,
h.Name, h.Value, h.Position, id)
h.Name, h.Value, h.Position, id, domainID)
out, err := scan(row)
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {