ms2k/opnsense-nordvpn-plugin
SHA256
Watch
0
Code Releases Activity

Reject managed UUID ownership mismatches

Browse source
This commit is contained in:
ms2k 2026-08-03 01:03:30 +09:00
commit df99e50da4
1 changed files with 39 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

46
src/opnsense/mvc/app/library/OPNsense/NordVPN/ManagedConfiguration.php
View file

@ -31,7 +31,12 @@ class ManagedConfiguration
$this->validateCandidate($candidate);
$clients = new Client();
$peer = $this->managedNode($clients, 'clients.client', (string)$this->settings->managed->peer_uuid);
$peer = $this->managedNode(
$clients,
'clients.client',
(string)$this->settings->managed->peer_uuid,
'NordVPN-managed-peer'
);
if ($peer === null) {
$this->assertNameAvailable($clients->clients->client->iterateItems(), 'NordVPN-managed-peer');
$peer = $clients->clients->client->add();
@ -41,7 +46,12 @@ class ManagedConfiguration
$clients->serializeToConfig();
$servers = new Server();
$instance = $this->managedNode($servers, 'servers.server', (string)$this->settings->managed->instance_uuid);
$instance = $this->managedNode(
$servers,
'servers.server',
(string)$this->settings->managed->instance_uuid,
'NordVPN-managed'
);
if ($instance === null) {
$this->assertNameAvailable($servers->servers->server->iterateItems(), 'NordVPN-managed');
$instance = $servers->servers->server->add();
@ -66,7 +76,12 @@ class ManagedConfiguration
$this->ensureInterface((string)$instance->interface);
$gateways = new Gateways();
$gateway = $this->managedNode($gateways, 'gateway_item', (string)$this->settings->managed->gateway_uuid);
$gateway = $this->managedNode(
$gateways,
'gateway_item',
(string)$this->settings->managed->gateway_uuid,
self::GATEWAY
);
if ($gateway === null) {
$this->assertNameAvailable($gateways->gateway_item->iterateItems(), self::GATEWAY);
$gateway = $gateways->gateway_item->add();
@ -96,7 +111,12 @@ class ManagedConfiguration
{
$this->validateCandidate($candidate);
$clients = new Client();
$peer = $this->managedNode($clients, 'clients.client', (string)$this->settings->managed->peer_uuid);
$peer = $this->managedNode(
$clients,
'clients.client',
(string)$this->settings->managed->peer_uuid,
'NordVPN-managed-peer'
);
if ($peer === null) {
throw new \RuntimeException('The managed WireGuard peer is missing.');
}
@ -111,7 +131,12 @@ class ManagedConfiguration
public function interfaceName(): ?string
{
$servers = new Server();
$instance = $this->managedNode($servers, 'servers.server', (string)$this->settings->managed->instance_uuid);
$instance = $this->managedNode(
$servers,
'servers.server',
(string)$this->settings->managed->instance_uuid,
'NordVPN-managed'
);
return $instance === null ? null : (string)$instance->interface;
}
@ -154,9 +179,16 @@ class ManagedConfiguration
$interface->virtual = '1';
}
private function managedNode($model, string $reference, string $uuid)
private function managedNode($model, string $reference, string $uuid, string $name)
{
return $uuid === '' ? null : $model->getNodeByReference($reference . '.' . $uuid);
if ($uuid === '') {
return null;
}
$node = $model->getNodeByReference($reference . '.' . $uuid);
if ($node !== null && (string)$node->name !== $name) {
throw new \RuntimeException(sprintf('Managed UUID does not reference %s.', $name));
}
return $node;
}
private function assertNameAvailable(iterable $nodes, string $name): void