From 9708e4441ba9e3bf188db27219471f0903a92a67 Mon Sep 17 00:00:00 2001 From: Debian Date: Sun, 24 May 2026 12:59:13 +0200 Subject: [PATCH] fix(api): WireGuard Private-Key-Verlust bei Peer-Update + Domain-Header-Ownership MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wireguard.go: UpdatePeer zerstörte den gespeicherten encPriv wenn der Client denselben public_key im Update-Body mitschickte (encPriv = nil auf Zeile 532). Fix: encPriv wird nur geleert wenn der public_key sich tatsächlich ÄNDERT. Andernfalls (gleicher Public Key = Benutzer ändert z.B. nur Allowed-IPs) bleibt das verschlüsselte Private Key erhalten und QR/conf-Download bleiben verfügbar. domains.go + domainheaders.go: UpdateHeader() ignorierte die domainID aus der URL. Fix: Update-SQL prüft jetzt WHERE id=$4 AND domain_id=$5 — falsch adressierte Requests kriegen 404 statt blind zu updaten. Co-Authored-By: Claude Sonnet 4.6 --- VERSION | 2 +- cmd/edgeguard-api/main.go | 2 +- cmd/edgeguard-ctl/main.go | 2 +- cmd/edgeguard-scheduler/main.go | 2 +- internal/handlers/domains.go | 4 ++-- internal/handlers/wireguard.go | 6 +++++- internal/services/domainheaders/domainheaders.go | 6 +++--- 7 files changed, 14 insertions(+), 10 deletions(-) diff --git a/VERSION b/VERSION index e6b36d1..e64b3f7 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.1.87 +1.1.88 diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go index e98dce9..42cfb4a 100644 --- a/cmd/edgeguard-api/main.go +++ b/cmd/edgeguard-api/main.go @@ -60,7 +60,7 @@ import ( usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users" ) -var version = "1.1.87" +var version = "1.1.88" func main() { addr := os.Getenv("EDGEGUARD_API_ADDR") diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go index e35b18e..3701ee5 100644 --- a/cmd/edgeguard-ctl/main.go +++ b/cmd/edgeguard-ctl/main.go @@ -11,7 +11,7 @@ import ( "git.netcell-it.de/projekte/edgeguard-native/internal/services/setup" ) -var version = "1.1.87" +var version = "1.1.88" const usage = `edgeguard-ctl — EdgeGuard CLI diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go index 3c53518..0a99513 100644 --- a/cmd/edgeguard-scheduler/main.go +++ b/cmd/edgeguard-scheduler/main.go @@ -35,7 +35,7 @@ import ( "git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts" ) -var version = "1.1.87" +var version = "1.1.88" const ( // renewTickInterval — how often we re-evaluate expiring certs. diff --git a/internal/handlers/domains.go b/internal/handlers/domains.go index 02cfbce..a6372ce 100644 --- a/internal/handlers/domains.go +++ b/internal/handlers/domains.go @@ -213,7 +213,7 @@ func (h *DomainsHandler) CreateHeader(c *gin.Context) { } func (h *DomainsHandler) UpdateHeader(c *gin.Context) { - _, ok := parseID(c) + domainID, ok := parseID(c) if !ok { return } @@ -231,7 +231,7 @@ func (h *DomainsHandler) UpdateHeader(c *gin.Context) { response.BadRequest(c, errors.New("invalid header name")) return } - out, err := h.Headers.Update(c.Request.Context(), hid, req) + out, err := h.Headers.Update(c.Request.Context(), domainID, hid, req) if err != nil { if errors.Is(err, domainheaders.ErrNotFound) { response.NotFound(c, err) diff --git a/internal/handlers/wireguard.go b/internal/handlers/wireguard.go index 7c7a2ee..2858617 100644 --- a/internal/handlers/wireguard.go +++ b/internal/handlers/wireguard.go @@ -529,7 +529,11 @@ func (h *WireguardHandler) UpdatePeer(c *gin.Context) { } } else if req.PublicKey != "" { pub = req.PublicKey - encPriv = nil + if req.PublicKey != cur.PublicKey { + // New externally-provided public key — server has no private key for it. + encPriv = nil + } + // Same public key → keep cur.PrivateKeyEnc (peer still has generated keypair). } encPSK := cur.PSKEnc if req.GeneratePSK { diff --git a/internal/services/domainheaders/domainheaders.go b/internal/services/domainheaders/domainheaders.go index 2e4eee3..09e06ef 100644 --- a/internal/services/domainheaders/domainheaders.go +++ b/internal/services/domainheaders/domainheaders.go @@ -85,13 +85,13 @@ RETURNING id, domain_id, name, value, position, created_at, updated_at`, return scan(row) } -func (r *Repo) Update(ctx context.Context, id int64, h models.DomainResponseHeader) (*models.DomainResponseHeader, error) { +func (r *Repo) Update(ctx context.Context, domainID, id int64, h models.DomainResponseHeader) (*models.DomainResponseHeader, error) { row := r.Pool.QueryRow(ctx, ` UPDATE domain_response_headers SET name = $1, value = $2, position = $3, updated_at = NOW() -WHERE id = $4 +WHERE id = $4 AND domain_id = $5 RETURNING id, domain_id, name, value, position, created_at, updated_at`, - h.Name, h.Value, h.Position, id) + h.Name, h.Value, h.Position, id, domainID) out, err := scan(row) if err != nil { if errors.Is(err, pgx.ErrNoRows) {