security: audit fixes and threat model update

Author: vhscom

bridge.go

@@ -45,9 +45,15 @@ func newBridge() http.Handler {
 			return
 		}
 
-		c, err := websocket.Accept(w, r, &websocket.AcceptOptions{
-			InsecureSkipVerify: true,
-		})
+		opts := &websocket.AcceptOptions{}
+		if cfg.WSAllowedOrigins != "" {
+			for _, o := range strings.Split(cfg.WSAllowedOrigins, ",") {
+				if o = strings.TrimSpace(o); o != "" {
+					opts.OriginPatterns = append(opts.OriginPatterns, o)
+				}
+			}
+		}
+		c, err := websocket.Accept(w, r, opts)
 		if err != nil {
 			return
 		}

docs/flows.md

@@ -50,7 +50,7 @@ sequenceDiagram
   H-->>U: 201 {success: true}
 ```
 
-**Source:** [`auth.go:11-51`](../auth.go) | [`crypto.go:29-43`](../crypto.go) | [`respond.go:50-64`](../respond.go)
+**Source:** [`auth.go:11-51`](../auth.go) | [`crypto.go:29-43`](../crypto.go) | [`respond.go:18-26`](../respond.go)
 
 ---
 
@@ -112,7 +112,7 @@ sequenceDiagram
   SS->>SS: enforceSessionLimit() — max 3 per user
   SS-->>H: sessionId
 
-  H->>H: signToken(access) + signToken(refresh, gen=0)
+  H->>H: signToken(access) + signRefreshToken(refresh, gen=0)
   Note over H: Access: {uid, sid, typ:"access", exp:+15min}<br/>Refresh: {uid, sid, typ:"refresh", gen:0, exp:+7d}<br/>Signed with separate secrets (HS256)
 
   H->>U: Set-Cookie: access_token (HttpOnly, Secure, SameSite=Strict)

docs/threat-model.md

@@ -308,7 +308,7 @@ func (m *model) closeTail() {
 		m.tailKeepaliveStop = nil
 	}
 	if m.tailConn != nil {
-		unsub := api.WSUnsubscribeRequest{Type: "unsubscribe_events", ID: "tail-2"}
+		unsub := api.WSUnsubscribeRequest{Type: "unsubscribe_events", ID: "tail-1"}
 		data, _ := json.Marshal(unsub)
 		_ = m.tailConn.Write(context.Background(), websocket.MessageText, data)
 		m.tailConn.Close(websocket.StatusNormalClosure, "client disconnected")

internal/ctl/ctl_actions.go

@@ -61,7 +61,11 @@ func lookupNodeForAgent(agentCredID int) int {
 		name = fmt.Sprintf("node-%d", agentCredID)
 	}
 
-	meshIP := nextMeshIP()
+	meshIP, err := nextMeshIP()
+	if err != nil {
+		slog.Error("mesh full, cannot auto-create node", "agent_id", agentCredID)
+		return 0
+	}
 	_, err = store.Exec(
 		"INSERT INTO node (label, wg_pubkey, allowed_ips, agent_credential_id) VALUES (?,?,?,?)",
 		name, "pending", meshIP, agentCredID,
@@ -77,12 +81,12 @@ func lookupNodeForAgent(agentCredID int) int {
 }
 
 // nextMeshIP finds the next available IP in the 10.0.0.0/24 mesh.
-// 10.0.0.1 is reserved for the server.
-func nextMeshIP() string {
+// 10.0.0.1 is reserved for the server. Returns an error if all 253 addresses are exhausted.
+func nextMeshIP() (string, error) {
 	var maxOctet int
 	rows, err := store.Query("SELECT allowed_ips FROM node")
 	if err != nil {
-		return "10.0.0.2/32"
+		return "10.0.0.2/32", nil
 	}
 	defer rows.Close()
 
@@ -108,9 +112,9 @@ func nextMeshIP() string {
 		next = 2 // 10.0.0.1 is the server
 	}
 	if next > 254 {
-		next = 254
+		return "", fmt.Errorf("mesh full: all 253 addresses in use")
 	}
-	return fmt.Sprintf("10.0.0.%d/32", next)
+	return fmt.Sprintf("10.0.0.%d/32", next), nil
 }
 
 // handleWGStatus processes a wg.status message from a node agent.

node.go

@@ -69,7 +69,10 @@ func TestNextMeshIP(t *testing.T) {
 		t.Fatalf("insert node 2: %v", err)
 	}
 
-	got := nextMeshIP()
+	got, err := nextMeshIP()
+	if err != nil {
+		t.Fatalf("nextMeshIP() unexpected error: %v", err)
+	}
 	if got != "10.0.0.4/32" {
 		t.Errorf("nextMeshIP() = %q, want %q", got, "10.0.0.4/32")
 	}
@@ -79,7 +82,10 @@ func TestNextMeshIP_SkipsServer(t *testing.T) {
 	nodeTestSetup(t)
 
 	// No nodes in the database yet. First call should skip .1 (server) and return .2.
-	got := nextMeshIP()
+	got, err := nextMeshIP()
+	if err != nil {
+		t.Fatalf("nextMeshIP() unexpected error: %v", err)
+	}
 	if got != "10.0.0.2/32" {
 		t.Errorf("nextMeshIP() = %q, want %q", got, "10.0.0.2/32")
 	}

node_test.go

@@ -116,6 +116,10 @@ func handleOpsAgentCreate(w http.ResponseWriter, r *http.Request) {
 		jsonError(w, 400, "VALIDATION_ERROR", "Name required")
 		return
 	}
+	if !validLabel(body.Name) {
+		jsonError(w, 400, "VALIDATION_ERROR", "Name must be 1-32 alphanumeric or hyphen characters")
+		return
+	}
 
 	apiKey := randomHex(32) // 256-bit key
 	keyHash := hashAPIKey(apiKey)

ops.go

@@ -126,7 +126,7 @@ func setTokenCookies(w http.ResponseWriter, uid int, sid string) error {
 	if err != nil {
 		return err
 	}
-	refresh, err := signToken(uid, sid, "refresh", cfg.RefreshSecret, refreshExpiry)
+	refresh, err := signRefreshToken(uid, sid, cfg.RefreshSecret, 0) // gen=0 matches initial session refresh_gen
 	if err != nil {
 		return err
 	}

respond.go

@@ -83,9 +83,15 @@ func handleAgentWS(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	c, err := websocket.Accept(w, r, &websocket.AcceptOptions{
-		InsecureSkipVerify: true,
-	})
+	opts := &websocket.AcceptOptions{}
+	if cfg.WSAllowedOrigins != "" {
+		for _, o := range strings.Split(cfg.WSAllowedOrigins, ",") {
+			if o = strings.TrimSpace(o); o != "" {
+				opts.OriginPatterns = append(opts.OriginPatterns, o)
+			}
+		}
+	}
+	c, err := websocket.Accept(w, r, opts)
 	if err != nil {
 		return
 	}

ws.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"log/slog"
 	"strings"
 	"sync"
 	"time"
@@ -70,7 +71,8 @@ func handleWSQueryEvents(conn *wsConn, id string, payload json.RawMessage) {
 			"SELECT type, COUNT(*) FROM security_event WHERE created_at >= ? GROUP BY type", since,
 		)
 		if err != nil {
-			sendWSError(conn, id, "QUERY_ERROR", err.Error())
+			slog.Error("ws query_events aggregate", "error", err)
+			sendWSError(conn, id, "QUERY_ERROR", "Query failed")
 			return
 		}
 		defer rows.Close()
@@ -102,7 +104,8 @@ func handleWSQueryEvents(conn *wsConn, id string, payload json.RawMessage) {
 		args...,
 	)
 	if err != nil {
-		sendWSError(conn, id, "QUERY_ERROR", err.Error())
+		slog.Error("ws query_events", "error", err)
+		sendWSError(conn, id, "QUERY_ERROR", "Query failed")
 		return
 	}
 	defer rows.Close()