Merge remote-tracking branch 'origin/main' into security/ssrf-pki-hardening

# Conflicts:
#	Meshtastic/Helpers/MapDataManager.swift
#	MeshtasticTests/MapDataManagerTests.swift

Author: garthvh

Meshtastic/Helpers/LocalNotificationManager.swift

@@ -9,10 +9,17 @@ import OSLog
 class LocalNotificationManager {
 
     var notifications = [Notification]()
+	private let removeDeliveredNotifications: ([String]) -> Void
 	let thumbsUpAction = UNNotificationAction(identifier: "messageNotification.thumbsUpAction", title: "👍 \(Tapbacks.thumbsUp.description)", options: [])
 	let thumbsDownAction = UNNotificationAction(identifier: "messageNotification.thumbsDownAction", title: "👎  \(Tapbacks.thumbsDown.description)", options: [])
 	let replyInputAction =  UNTextInputNotificationAction(identifier: "messageNotification.replyInputAction", title: "Reply".localized, options: [])
 
+	init(removeDeliveredNotifications: @escaping ([String]) -> Void = { identifiers in
+		UNUserNotificationCenter.current().removeDeliveredNotifications(withIdentifiers: identifiers)
+	}) {
+		self.removeDeliveredNotifications = removeDeliveredNotifications
+	}
+
     // Step 1 Request Permissions for notifications
     private func requestAuthorization() async {
         do {
@@ -124,6 +131,12 @@ class LocalNotificationManager {
 	func cancelNotificationsForMessageIds(_ messageIds: [Int64]) {
 		let messageIDSet = Set(messageIds)
 		guard !messageIDSet.isEmpty else { return }
+		let deliveredNotificationIdentifiers = messageIds.map { "notification.id.\($0)" }
+
+		// Pending requests have not surfaced to the user yet; delivered notifications may
+		// still be visible on the Lock Screen or in Notification Center. Remove both when
+		// their messages have been read in the app.
+		removeDeliveredNotifications(deliveredNotificationIdentifiers)
 
 		UNUserNotificationCenter.current().getPendingNotificationRequests { notifications in
 			let identifiers = notifications.compactMap { notification -> String? in

Meshtastic/Helpers/MapDataManager.swift

@@ -102,94 +102,6 @@ class MapDataManager: ObservableObject {
 		return metadata
 	}
 
-	/// Downloads an `http`/`https` GeoJSON overlay from `urlString` and imports it through the same
-	/// pipeline as `processUploadedFile`. Lets an overlay be fetched and installed without the
-	/// file-picker UI — e.g. from the `importGeoJSON` deep link (see `Router.swift`).
-	///
-	/// Because the deep-link caller is untrusted, this rejects any non-`http(s)` scheme and blocks
-	/// loopback / link-local / private / reserved hosts (SSRF hardening). Local `file://`
-	/// imports go through `processUploadedFile` directly, not this path.
-	func importFromRemote(urlString: String, configuration injectedConfiguration: URLSessionConfiguration? = nil) async throws -> MapDataMetadata {
-		guard let url = URL(string: urlString) else {
-			throw MapDataError.invalidDestination
-		}
-
-		// This entry point is reachable from the `importGeoJSON` deep link with an
-		// attacker-controlled URL. Only allow `http(s)` — reject everything else (closing the previous
-		// `file://` fallthrough that let a deep link reach the local-file read pipeline).
-		guard url.scheme == "http" || url.scheme == "https" else {
-			throw MapDataError.disallowedHost
-		}
-
-		// Block SSRF to loopback / link-local / private / reserved hosts. Resolve
-		// the host and reject if any resolved address falls in a non-routable / internal range, so an
-		// attacker deep link cannot probe localhost services, LAN admin pages, or cloud metadata
-		// (169.254.169.254) from the victim's network position.
-		guard let host = url.host, !host.isEmpty else {
-			throw MapDataError.disallowedHost
-		}
-		guard !Self.isDisallowedHost(host) else {
-			throw MapDataError.disallowedHost
-		}
-
-		// The up-front host check above can be defeated by two SSRF tricks that both re-enter DNS/URL
-		// handling *after* validation: (1) an HTTP redirect to an internal host, and (2) DNS rebinding
-		// (a short-TTL record that answers with a public IP at validation time and an internal IP when
-		// `URLSession` re-resolves at connect time). The session is always backed by `SSRFGuardDelegate`:
-		// redirect re-validation is the reliable control; the connected-peer check is opportunistic (see
-		// below). Tests inject only a `URLSessionConfiguration` (e.g. a `URLProtocol` stub), so a caller
-		// can never supply a session that bypasses the guard.
-		let guardDelegate = SSRFGuardDelegate()
-		let session = URLSession(
-			configuration: injectedConfiguration ?? .ephemeral,
-			delegate: guardDelegate,
-			delegateQueue: nil
-		)
-		defer { session.finishTasksAndInvalidate() }
-
-		// Stream the body instead of buffering it whole. `data(from:)` would materialise the entire
-		// (possibly attacker-sized or endless) response in memory before the size guard could run, so we
-		// read the async byte stream and abort the moment the running total exceeds `maxFileSize`.
-		let (byteStream, response) = try await session.bytes(from: url)
-
-		// Cheap early reject when the server honestly declares an oversized body.
-		if response.expectedContentLength > maxFileSize {
-			throw MapDataError.fileTooLarge
-		}
-		if let httpResponse = response as? HTTPURLResponse, !(200..<300).contains(httpResponse.statusCode) {
-			throw MapDataError.invalidContent
-		}
-
-		var data = Data()
-		if response.expectedContentLength > 0 {
-			data.reserveCapacity(Int(min(response.expectedContentLength, maxFileSize)))
-		}
-		for try await byte in byteStream {
-			data.append(byte)
-			if data.count > maxFileSize {
-				throw MapDataError.fileTooLarge
-			}
-		}
-
-		// Opportunistic DNS-rebinding catch: transaction metrics are collected once the body finishes, so
-		// by the time the stream is drained the guard has seen the real peer address. If the connection
-		// landed on an internal peer, discard the response so its content is never imported/rendered —
-		// redirect re-validation remains the reliable control (`URLSession` exposes no pre-connect IP hook).
-		if guardDelegate.connectedToDisallowedPeer {
-			throw MapDataError.disallowedHost
-		}
-
-		let suggestedName = url.pathExtension.lowercased() == "geojson" || url.pathExtension.lowercased() == "json"
-			? url.lastPathComponent
-			: "coverage.geojson"
-		let tempURL = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString).appendingPathComponent(suggestedName)
-		try FileManager.default.createDirectory(at: tempURL.deletingLastPathComponent(), withIntermediateDirectories: true)
-		try data.write(to: tempURL)
-		defer { try? FileManager.default.removeItem(at: tempURL) }
-
-		return try await processUploadedFile(from: tempURL)
-	}
-
 	/// Imports an in-memory GeoJSON string (e.g. the coverage `FeatureCollection` handed back by
 	/// the Site Planner's native bridge) through the same pipeline as `processUploadedFile`, so it
 	/// reuses the exact validation + render + styling path with no round-trip to the share sheet.
@@ -512,192 +424,6 @@ class MapDataManager: ObservableObject {
 	}
 }
 
-// MARK: - SSRF host validation
-
-extension MapDataManager {
-
-	/// Returns `true` if `host` is an internal / non-routable destination that must not be fetched from
-	/// an attacker-supplied deep link. Resolves the host and rejects if it is `localhost`, an mDNS
-	/// `.local` name, or resolves to any loopback / link-local / private / reserved IP range.
-	static func isDisallowedHost(_ host: String) -> Bool {
-		let lowered = host.lowercased()
-		// Reject bare-name internal hosts outright (localhost + mDNS `.local`).
-		if lowered == "localhost" || lowered.hasSuffix(".local") {
-			return true
-		}
-
-		// A URL host may be an IPv6 literal wrapped in brackets — strip them before resolving.
-		let bareHost = lowered.hasPrefix("[") && lowered.hasSuffix("]")
-			? String(lowered.dropFirst().dropLast())
-			: lowered
-
-		// Resolve the host (handles both literal IPs and DNS names, closing the hostname→private-IP gap).
-		var hints = addrinfo(
-			ai_flags: 0,
-			ai_family: AF_UNSPEC,
-			ai_socktype: SOCK_STREAM,
-			ai_protocol: 0,
-			ai_addrlen: 0,
-			ai_canonname: nil,
-			ai_addr: nil,
-			ai_next: nil
-		)
-		var result: UnsafeMutablePointer<addrinfo>?
-		guard getaddrinfo(bareHost, nil, &hints, &result) == 0, let first = result else {
-			// Resolution failed — fail closed and treat as disallowed.
-			return true
-		}
-		defer { freeaddrinfo(result) }
-
-		var addr: UnsafeMutablePointer<addrinfo>? = first
-		while let current = addr {
-			if let sockaddr = current.pointee.ai_addr {
-				if current.pointee.ai_family == AF_INET {
-					let ipv4 = sockaddr.withMemoryRebound(to: sockaddr_in.self, capacity: 1) {
-						UInt32(bigEndian: $0.pointee.sin_addr.s_addr)
-					}
-					if isDisallowedIPv4(ipv4) { return true }
-				} else if current.pointee.ai_family == AF_INET6 {
-					var bytes = [UInt8](repeating: 0, count: 16)
-					sockaddr.withMemoryRebound(to: sockaddr_in6.self, capacity: 1) {
-						withUnsafeBytes(of: $0.pointee.sin6_addr) { raw in
-							for i in 0..<16 { bytes[i] = raw[i] }
-						}
-					}
-					if isDisallowedIPv6(bytes) { return true }
-				}
-			}
-			addr = current.pointee.ai_next
-		}
-		return false
-	}
-
-	/// `ip` is a host-order IPv4 address. Blocks loopback, private (RFC 1918), link-local,
-	/// CGNAT, "this host", benchmarking, and other reserved ranges.
-	private static func isDisallowedIPv4(_ ip: UInt32) -> Bool {
-		func octets(_ a: UInt8, _ b: UInt8, _ c: UInt8, _ d: UInt8) -> UInt32 {
-			(UInt32(a) << 24) | (UInt32(b) << 16) | (UInt32(c) << 8) | UInt32(d)
-		}
-		func inRange(_ base: UInt32, _ prefix: Int) -> Bool {
-			let mask: UInt32 = prefix == 0 ? 0 : ~UInt32(0) << (32 - prefix)
-			return (ip & mask) == (base & mask)
-		}
-		return inRange(octets(0, 0, 0, 0), 8)        // 0.0.0.0/8  "this host"
-			|| inRange(octets(10, 0, 0, 0), 8)       // 10.0.0.0/8 private
-			|| inRange(octets(100, 64, 0, 0), 10)    // 100.64.0.0/10 CGNAT
-			|| inRange(octets(127, 0, 0, 0), 8)      // 127.0.0.0/8 loopback
-			|| inRange(octets(169, 254, 0, 0), 16)   // 169.254.0.0/16 link-local (inc. 169.254.169.254)
-			|| inRange(octets(172, 16, 0, 0), 12)    // 172.16.0.0/12 private
-			|| inRange(octets(192, 0, 0, 0), 24)     // 192.0.0.0/24 IETF protocol assignments
-			|| inRange(octets(192, 0, 2, 0), 24)     // 192.0.2.0/24 TEST-NET-1 (RFC 5737)
-			|| inRange(octets(192, 168, 0, 0), 16)   // 192.168.0.0/16 private
-			|| inRange(octets(198, 18, 0, 0), 15)    // 198.18.0.0/15 benchmarking
-			|| inRange(octets(198, 51, 100, 0), 24)  // 198.51.100.0/24 TEST-NET-2 (RFC 5737)
-			|| inRange(octets(203, 0, 113, 0), 24)   // 203.0.113.0/24 TEST-NET-3 (RFC 5737)
-			|| inRange(octets(224, 0, 0, 0), 4)      // 224.0.0.0/4 multicast
-			|| inRange(octets(240, 0, 0, 0), 4)      // 240.0.0.0/4 reserved
-			|| inRange(octets(255, 255, 255, 255), 32) // 255.255.255.255/32 limited broadcast
-	}
-
-	/// `bytes` is a 16-byte IPv6 address. Blocks loopback (`::1`), unspecified (`::`), link-local
-	/// (`fe80::/10`), unique-local (`fc00::/7`), deprecated site-local (`fec0::/10`), multicast
-	/// (`ff00::/8`), and IPv4-mapped addresses in a blocked v4 range.
-	private static func isDisallowedIPv6(_ bytes: [UInt8]) -> Bool {
-		guard bytes.count == 16 else { return true }
-		// Loopback ::1
-		if bytes[0..<15].allSatisfy({ $0 == 0 }) && bytes[15] == 1 { return true }
-		// Unspecified ::
-		if bytes.allSatisfy({ $0 == 0 }) { return true }
-		// Link-local fe80::/10
-		if bytes[0] == 0xfe && (bytes[1] & 0xc0) == 0x80 { return true }
-		// Unique-local fc00::/7
-		if (bytes[0] & 0xfe) == 0xfc { return true }
-		// Deprecated site-local fec0::/10 (RFC 3879)
-		if bytes[0] == 0xfe && (bytes[1] & 0xc0) == 0xc0 { return true }
-		// Multicast ff00::/8
-		if bytes[0] == 0xff { return true }
-		// IPv4-mapped ::ffff:a.b.c.d — re-check the embedded v4 address.
-		if bytes[0..<10].allSatisfy({ $0 == 0 }) && bytes[10] == 0xff && bytes[11] == 0xff {
-			let ipv4 = (UInt32(bytes[12]) << 24) | (UInt32(bytes[13]) << 16) | (UInt32(bytes[14]) << 8) | UInt32(bytes[15])
-			return isDisallowedIPv4(ipv4)
-		}
-		// NAT64 well-known prefix 64:ff9b::/96 — the last 4 bytes embed the real IPv4 target, so on a
-		// NAT64 network `64:ff9b::a9fe:a9fe` would otherwise reach 169.254.169.254. Re-check the embed.
-		if bytes[0] == 0x00 && bytes[1] == 0x64 && bytes[2] == 0xff && bytes[3] == 0x9b
-			&& bytes[4..<12].allSatisfy({ $0 == 0 }) {
-			let ipv4 = (UInt32(bytes[12]) << 24) | (UInt32(bytes[13]) << 16) | (UInt32(bytes[14]) << 8) | UInt32(bytes[15])
-			return isDisallowedIPv4(ipv4)
-		}
-		return false
-	}
-}
-
-// MARK: - SSRF-guarded URLSession delegate
-
-/// `URLSession` delegate that hardens `MapDataManager.importFromRemote` against the two SSRF tricks
-/// the up-front hostname check can't catch on its own:
-///
-/// - **HTTP redirects** — `willPerformHTTPRedirection` re-runs `MapDataManager.isDisallowedHost` on
-///   every hop and refuses to follow a redirect to an internal host, so a public allow-listed URL
-///   can't `302` the request onto `169.254.169.254`, `localhost`, or a LAN address. This is the
-///   primary, reliable control.
-/// - **DNS rebinding** — `URLSession` re-resolves DNS itself at connect time, so a short-TTL record
-///   can pass validation with a public IP yet connect to an internal one. `didFinishCollecting`
-///   reads the real peer address from the transaction metrics and flags it; the caller then discards
-///   the response. This is best-effort defense-in-depth (metrics-based, so it prevents the fetched
-///   content from being imported rather than blocking the initial GET, which `URLSession` gives no
-///   pre-connect hook to stop).
-// Internal (not private) so `SSRFGuardDelegateTests` can drive the redirect re-validation directly.
-final class SSRFGuardDelegate: NSObject, URLSessionTaskDelegate, @unchecked Sendable {
-	private let lock = NSLock()
-	private var disallowedPeer = false
-
-	/// `true` once any transaction in the task connected to an internal / non-routable peer.
-	var connectedToDisallowedPeer: Bool {
-		lock.lock(); defer { lock.unlock() }
-		return disallowedPeer
-	}
-
-	private func flagDisallowedPeer() {
-		lock.lock(); defer { lock.unlock() }
-		disallowedPeer = true
-	}
-
-	func urlSession(
-		_ session: URLSession,
-		task: URLSessionTask,
-		willPerformHTTPRedirection response: HTTPURLResponse,
-		newRequest request: URLRequest,
-		completionHandler: @escaping (URLRequest?) -> Void
-	) {
-		guard let host = request.url?.host, !host.isEmpty, !MapDataManager.isDisallowedHost(host) else {
-			// Disallowed or unparseable redirect target — do not follow it. Passing `nil` returns the
-			// redirect response itself, which the caller treats as a non-2xx failure.
-			completionHandler(nil)
-			return
-		}
-		completionHandler(request)
-	}
-
-	func urlSession(
-		_ session: URLSession,
-		task: URLSessionTask,
-		didFinishCollecting metrics: URLSessionTaskMetrics
-	) {
-		for transaction in metrics.transactionMetrics {
-			// When the connection is proxied (e.g. iCloud Private Relay), `remoteAddress` is the proxy's IP,
-			// not the origin's — checking it would give a false internal / rebinding verdict, so skip it.
-			if transaction.isProxyConnection { continue }
-			guard let peer = transaction.remoteAddress, !peer.isEmpty else { continue }
-			// `remoteAddress` is a literal IP; `isDisallowedHost` resolves literals locally (no network).
-			if MapDataManager.isDisallowedHost(peer) {
-				flagDisallowedPeer()
-				return
-			}
-		}
-	}
-}
-
 // MARK: - Supporting Types
 
 /// Metadata for uploaded map data files
@@ -744,7 +470,6 @@ enum MapDataError: Error, LocalizedError {
 	case invalidDestination
 	case fileNotFound
 	case saveFailed
-	case disallowedHost
 
 	var errorDescription: String? {
 		switch self {
@@ -764,8 +489,6 @@ enum MapDataError: Error, LocalizedError {
 			return "File not found."
 		case .saveFailed:
 			return "Failed to save file."
-		case .disallowedHost:
-			return String(localized: "This URL is not allowed.")
 		}
 	}
 }

Meshtastic/Router/Router.swift

@@ -134,8 +134,6 @@ class Router: ObservableObject {
 			routeNodes(components)
 		} else if components.path == "/map" {
 			routeMap(components)
-		} else if components.path == "/importGeoJSON" {
-			routeImportGeoJSON(components)
 		} else if components.path.hasPrefix("/settings") {
 			routeSettings(components)
 		} else {
@@ -235,31 +233,10 @@ class Router: ObservableObject {
 		}
 	}
 
-	/// Downloads (http/https) or reads (file) a GeoJSON map overlay from the `url` query param and
-	/// imports it via `MapDataManager`, reusing the same pipeline as the in-app file picker. Lets a
-	/// coverage map be imported hands-free, e.g. `xcrun simctl openurl <udid> "meshtastic:///importGeoJSON?url=<encoded-url>"`.
-	private func routeImportGeoJSON(_ components: URLComponents) {
-		guard let urlString = components.queryItems?.first(where: { $0.name == "url" })?.value else {
-			Logger.services.warning("🛣 [App] importGeoJSON route missing required 'url' query param.")
-			return
-		}
-
-		selectedTab = .map
-
-		Task {
-			do {
-				let metadata = try await MapDataManager.shared.importFromRemote(urlString: urlString)
-				Logger.services.info("🗺️ [App] Imported '\(metadata.originalName, privacy: .public)' (\(metadata.overlayCount, privacy: .public) overlays) via importGeoJSON deep link.")
-			} catch {
-				Logger.services.error("🗺️ [App] importGeoJSON deep link failed: \(error.localizedDescription, privacy: .public)")
-			}
-		}
-	}
-
 	/// Imports a GeoJSON map overlay handed to the app as a file URL — e.g. via "Open in Meshtastic"
 	/// from the Share Sheet, the Files app, or a drag-and-drop — reusing the same pipeline as the
-	/// in-app file picker and the `importGeoJSON` deep link. Called from `onOpenURL` for file URLs,
-	/// which is a distinct path from `route(url:)` (that only handles `meshtastic://` scheme URLs).
+	/// in-app file picker. Called from `onOpenURL` for file URLs, which is a distinct path from
+	/// `route(url:)` (that only handles `meshtastic://` scheme URLs).
 	func importMapFile(url: URL) {
 		selectedTab = .map