mirror of
https://github.com/BigBodyCobain/Shadowbroker.git
synced 2026-05-28 01:52:28 +02:00
e36d1fc79c
External security audit by @tg12 (May 17, 2026) filed issues #201–#214 in addition to the #189–#200 batch already closed by PRs #227/#232/#260. This PR closes all eight that are real security bugs (the other six in the 201–214 range are either design discussions or upstream-abuse/TOS concerns we're keeping intentional, see issue triage notes on each). The user-facing principle for this PR: fix the security gap WITHOUT introducing a single hostile error or behavior change for legitimate users. Every fix follows the same template — fail forward, not loud. When the secure path is harder than the insecure one, build a fallback chain that ends in graceful degradation, not in a scary modal or 422 response. #205 — OpenMHZ audio redirect SSRF (services/radio_intercept.py) Replaced requests.get(..., allow_redirects=True) with a manual redirect loop that re-validates each hop's host against _OPENMHZ_AUDIO_HOSTS. Same-host redirects (CDN edge selection) still work, so legitimate audio playback is unaffected. Cross-host redirects to disallowed hosts return a generic 502 which the browser audio element handles gracefully. Cap at 5 hops. #207 — infonet/status verify_signatures DoS (routers/mesh_public.py) Silently downgrade verify_signatures=true to False for unauthenticated callers. No error surfaced — the response shape is identical, just without the O(n_events) signature verification. Authenticated callers (scoped mesh.audit) still get the full path. The frontend never passes this param so legitimate UI is unaffected. #211 — thermal/verify expensive analysis (routers/sigint.py) Added Depends(require_local_operator). Frontend has no direct callers (verified by grep); Tauri/AI agents use scoped tokens that pass the auth check. Anonymous abusers blocked silently — the legitimate UI keeps working through the Next.js admin-key proxy. #213, #214 — OpenMHZ calls/audio upstream abuse (routers/radio.py) Added Depends(require_local_operator) to both. Browser users hit these through the Next.js proxy at src/app/api/[...path]/route.ts which injects X-Admin-Key, so the auth check passes transparently. Direct attackers can no longer rotate sys_names to hammer api.openmhz.com or relay arbitrary audio streams through the backend's bandwidth. #202 — overflights unbounded hours (routers/data.py) Silently clamp `hours` to OVERFLIGHTS_MAX_HOURS (default 72, configurable). NO 422 — clients asking for an absurd window get a shorter window back with `requested_hours` and `effective_hours` hint fields. Postel's law: liberal in what we accept, conservative in what we compute. #203 — Meshtastic callsign UA leak (services/fetchers/meshtastic_map.py) Added MESHTASTIC_SEND_CALLSIGN_HEADER opt-out env var. Default is TRUE — preserves existing operator behavior (callsign sent so meshtastic.org can rate-limit per-install). Privacy-conscious operators set it to false to suppress. #206 — KiwiSDR upstream is HTTP-only (services/kiwisdr_fetcher.py) Upstream rx.linkfanel.net doesn't speak HTTPS (verified — Apache 2.4.10 only on port 80). We can't fix the transport. Instead added three layers: 1. Content validation on fetched data — reject responses with <50 receivers or >5% malformed entries (likely MITM injection). 2. Existing disk cache fallback (already present). 3. NEW: bundled static directory at backend/data/kiwisdr_directory.json shipping 798 known-good receivers. Used as last resort so the KiwiSDR map layer always renders something useful. #208 — Merkle proof DoS via /api/mesh/infonet/sync (services/mesh/mesh_hashchain.py) The endpoint is part of the cross-node federation protocol — peers legitimately call it without local-operator auth, so we can't add Depends(). Instead made the underlying operation O(1) per proof via a cached Merkle level structure on the Infonet instance: - _merkle_levels_cache + _merkle_levels_for_event_count on each Infonet instance - _invalidate_merkle_cache() called from every chain mutation point (append, ingest_events, apply_fork, cleanup_expired) - _get_merkle_levels() does the lazy recompute on first read after invalidation, then serves from cache thereafter Effect: anonymous attackers hammering the proofs endpoint hit a cached structure; the rebuild happens at most once per real chain advance. Federation untouched. #201 — Tor bundle SHA-256 bypass (services/tor_hidden_service.py) Docker users were already covered — backend/Dockerfile installs Tor via apt-get at build time (signed by Debian's package system). No runtime download needed for the 80%-of-users case. For Tauri desktop, replaced the single .sha256sum check with a multi-source verification chain implemented in _verify_tor_bundle(): 1. Try upstream .sha256sum (current behavior — fast path) 2. Try baked-in digest list at backend/data/tor_bundle_digests.json (pinned per-version, maintainer-updated) 3. If neither source is REACHABLE: HTTPS-only fallback with a loud warning (avoids breaking first-run onboarding while the maintainer hasn't yet pinned a new Tor release) A mismatch from a source that DID respond is always fatal — only the "no source reachable" case falls back to HTTPS-only. This is the "have cake and eat it" pattern: real users see no new failure modes during torproject.org outages, but MITM/compromise attacks still fail because the downloaded digest can't match what BOTH the upstream and the baked-in list report. Currently the digest file ships with placeholder values for the current Tor URLs (those URLs are already stale on torproject.org too). A follow-up commit can populate real digests when a stable Tor release is selected; until then the HTTPS-only warning fires and onboarding still works. Tests (82 total, all passing): test_openmhz_redirect_ssrf.py (5 tests) — #205 test_infonet_status_verify_gate.py (2 tests) — #207 test_overflights_clamp.py (5 tests) — #202 test_meshtastic_callsign_optout.py (3 tests) — #203 test_kiwisdr_fallback.py (6 tests) — #206 test_merkle_cache.py (6 tests) — #208 test_tor_bundle_verification.py (6 tests) — #201 test_control_surface_auth.py (extended) — #211, #213, #214 + all previous security tests (CCTV redirect, GDELT https, sentinel cache, crowdthreat opt-in, third-party fetcher gates, control surface auth) continue to pass. Pre-existing test infrastructure issue with SHARED_EXECUTOR teardown in the broader sweep exists on main too (verified) — not introduced by this PR. Credit: @tg12 reported every one of these with accurate line citations and the recommended fixes that informed this implementation. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
280 lines
10 KiB
Python
280 lines
10 KiB
Python
"""Meshtastic Map fetcher — pulls global node positions from meshtastic.liamcottle.net.
|
|
|
|
Bootstrap + top-up strategy:
|
|
- On startup: fetch all nodes with positions to seed the map
|
|
- Every 4 hours: refresh from the API
|
|
- Persists to JSON cache so data survives restarts
|
|
- MQTT bridge provides real-time updates between API fetches
|
|
|
|
API source: https://meshtastic.liamcottle.net/api/v1/nodes (community project by Liam Cottle)
|
|
Polling interval deliberately kept low (4h) to be respectful to the service.
|
|
"""
|
|
|
|
import json
|
|
import logging
|
|
import time
|
|
from datetime import datetime, timezone, timedelta
|
|
from pathlib import Path
|
|
|
|
import requests
|
|
|
|
from services.fetchers._store import latest_data, _data_lock, _mark_fresh
|
|
|
|
logger = logging.getLogger("services.data_fetcher")
|
|
|
|
_API_URL = "https://meshtastic.liamcottle.net/api/v1/nodes"
|
|
_CACHE_FILE = Path(__file__).resolve().parent.parent.parent / "data" / "meshtastic_nodes_cache.json"
|
|
_FETCH_TIMEOUT = 90 # seconds — response is ~37MB, needs time on slow connections
|
|
_MAX_AGE_HOURS = 24 # discard nodes not seen within this window
|
|
# Skip network fetch if cached data is fresher than this — the API is a
|
|
# one-person hobby service, so we prefer stale data over hammering it.
|
|
_CACHE_TRUST_HOURS = 20
|
|
|
|
# Track when we last fetched so the frontend can show staleness
|
|
_last_fetch_ts: float = 0.0
|
|
|
|
|
|
def _parse_node(node: dict) -> dict | None:
|
|
"""Convert an API node into a slim signal-like dict."""
|
|
lat_i = node.get("latitude")
|
|
lng_i = node.get("longitude")
|
|
if lat_i is None or lng_i is None:
|
|
return None
|
|
|
|
lat = lat_i / 1e7
|
|
lng = lng_i / 1e7
|
|
|
|
# Basic validity
|
|
if not (-90 <= lat <= 90 and -180 <= lng <= 180):
|
|
return None
|
|
if abs(lat) < 0.1 and abs(lng) < 0.1:
|
|
return None
|
|
|
|
callsign = node.get("node_id_hex", "")
|
|
if not callsign:
|
|
nid = node.get("node_id")
|
|
callsign = f"!{int(nid):08x}" if nid else ""
|
|
if not callsign:
|
|
return None
|
|
|
|
# Position age from API — reject nodes older than _MAX_AGE_HOURS
|
|
pos_updated = node.get("position_updated_at") or node.get("updated_at", "")
|
|
if pos_updated:
|
|
try:
|
|
ts = datetime.fromisoformat(pos_updated.replace("Z", "+00:00"))
|
|
if datetime.now(timezone.utc) - ts > timedelta(hours=_MAX_AGE_HOURS):
|
|
return None
|
|
except (ValueError, TypeError):
|
|
pass
|
|
else:
|
|
return None # no timestamp at all — skip
|
|
|
|
return {
|
|
"callsign": callsign[:20],
|
|
"lat": round(lat, 5),
|
|
"lng": round(lng, 5),
|
|
"source": "meshtastic",
|
|
"confidence": 0.5,
|
|
"timestamp": pos_updated,
|
|
"position_updated_at": pos_updated,
|
|
"from_api": True,
|
|
"long_name": (node.get("long_name") or "")[:40],
|
|
"short_name": (node.get("short_name") or "")[:4],
|
|
"hardware": node.get("hardware_model_name", ""),
|
|
"role": node.get("role_name", ""),
|
|
"battery_level": node.get("battery_level"),
|
|
"voltage": node.get("voltage"),
|
|
"altitude": node.get("altitude"),
|
|
}
|
|
|
|
|
|
def _is_fresh(node: dict) -> bool:
|
|
"""Check if a cached node is still within the _MAX_AGE_HOURS window."""
|
|
ts_str = node.get("position_updated_at") or node.get("timestamp", "")
|
|
if not ts_str:
|
|
return False
|
|
try:
|
|
ts = datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
|
|
return datetime.now(timezone.utc) - ts <= timedelta(hours=_MAX_AGE_HOURS)
|
|
except (ValueError, TypeError):
|
|
return False
|
|
|
|
|
|
def _load_cache() -> list[dict]:
|
|
"""Load cached nodes from disk, filtering out stale entries."""
|
|
if _CACHE_FILE.exists():
|
|
try:
|
|
data = json.loads(_CACHE_FILE.read_text(encoding="utf-8"))
|
|
nodes = data.get("nodes", [])
|
|
fresh = [n for n in nodes if _is_fresh(n)]
|
|
logger.info(f"Meshtastic map cache loaded: {len(fresh)} fresh / {len(nodes)} total")
|
|
return fresh
|
|
except Exception as e:
|
|
logger.warning(f"Failed to load meshtastic cache: {e}")
|
|
return []
|
|
|
|
|
|
def _save_cache(nodes: list[dict], fetch_ts: float):
|
|
"""Persist processed nodes to disk."""
|
|
try:
|
|
_CACHE_FILE.parent.mkdir(parents=True, exist_ok=True)
|
|
_CACHE_FILE.write_text(
|
|
json.dumps(
|
|
{
|
|
"fetched_at": fetch_ts,
|
|
"count": len(nodes),
|
|
"nodes": nodes,
|
|
}
|
|
),
|
|
encoding="utf-8",
|
|
)
|
|
except Exception as e:
|
|
logger.warning(f"Failed to save meshtastic cache: {e}")
|
|
|
|
|
|
def fetch_meshtastic_nodes():
|
|
"""Fetch global Meshtastic node positions from Liam Cottle's map API.
|
|
|
|
Stores processed nodes in latest_data["meshtastic_map_nodes"].
|
|
Persists to JSON cache for restart resilience.
|
|
"""
|
|
from services.fetchers._store import is_any_active
|
|
|
|
if not is_any_active("sigint_meshtastic"):
|
|
return
|
|
global _last_fetch_ts
|
|
|
|
# Trust a recent cache on disk — avoids hammering the upstream HTTP API
|
|
# when every install polls on roughly the same cadence.
|
|
try:
|
|
if _CACHE_FILE.exists():
|
|
mtime = _CACHE_FILE.stat().st_mtime
|
|
if time.time() - mtime < _CACHE_TRUST_HOURS * 3600:
|
|
# If memory is empty (cold start), hydrate from cache and skip fetch.
|
|
with _data_lock:
|
|
has_memory = bool(latest_data.get("meshtastic_map_nodes"))
|
|
if not has_memory:
|
|
cached = _load_cache()
|
|
if cached:
|
|
with _data_lock:
|
|
latest_data["meshtastic_map_nodes"] = cached
|
|
latest_data["meshtastic_map_fetched_at"] = mtime
|
|
_mark_fresh("meshtastic_map")
|
|
logger.info(
|
|
"Meshtastic map: cache fresh (<%.0fh), skipping network fetch",
|
|
_CACHE_TRUST_HOURS,
|
|
)
|
|
return
|
|
else:
|
|
logger.info(
|
|
"Meshtastic map: cache fresh (<%.0fh), skipping network fetch",
|
|
_CACHE_TRUST_HOURS,
|
|
)
|
|
return
|
|
except Exception as e:
|
|
logger.debug(f"Meshtastic cache freshness check failed: {e}")
|
|
|
|
# Build a polite User-Agent. Historically this included the operator
|
|
# callsign so meshtastic.org could rate-limit per-install; that's still
|
|
# the default behavior for backward compatibility. Operators who want
|
|
# stricter outbound privacy can suppress the callsign by setting
|
|
# MESHTASTIC_SEND_CALLSIGN_HEADER=false. Issue #203.
|
|
import os as _os
|
|
try:
|
|
from services.config import get_settings
|
|
|
|
callsign = str(getattr(get_settings(), "MESHTASTIC_OPERATOR_CALLSIGN", "") or "").strip()
|
|
except Exception:
|
|
callsign = ""
|
|
|
|
send_callsign_header = str(
|
|
_os.environ.get("MESHTASTIC_SEND_CALLSIGN_HEADER", "true")
|
|
).strip().lower() not in {"0", "false", "no", "off", ""}
|
|
|
|
from services.network_utils import DEFAULT_USER_AGENT
|
|
ua_base = f"{DEFAULT_USER_AGENT}; 24h polling"
|
|
if callsign and send_callsign_header:
|
|
user_agent = f"{ua_base}; node={callsign}"
|
|
else:
|
|
user_agent = ua_base
|
|
|
|
try:
|
|
logger.info("Fetching Meshtastic map nodes from API...")
|
|
resp = requests.get(
|
|
_API_URL,
|
|
timeout=_FETCH_TIMEOUT,
|
|
headers={
|
|
"User-Agent": user_agent,
|
|
"Accept": "application/json",
|
|
},
|
|
)
|
|
resp.raise_for_status()
|
|
|
|
raw = resp.json()
|
|
raw_nodes = raw.get("nodes", []) if isinstance(raw, dict) else raw
|
|
|
|
# Parse and filter to only nodes with valid positions
|
|
parsed = []
|
|
for node in raw_nodes:
|
|
sig = _parse_node(node)
|
|
if sig:
|
|
parsed.append(sig)
|
|
|
|
_last_fetch_ts = time.time()
|
|
_save_cache(parsed, _last_fetch_ts)
|
|
|
|
with _data_lock:
|
|
latest_data["meshtastic_map_nodes"] = parsed
|
|
latest_data["meshtastic_map_fetched_at"] = _last_fetch_ts
|
|
try:
|
|
from services.fetchers.sigint import refresh_sigint_snapshot
|
|
|
|
refresh_sigint_snapshot()
|
|
except Exception as exc:
|
|
logger.debug(f"Meshtastic map: SIGINT snapshot refresh skipped: {exc}")
|
|
|
|
logger.info(
|
|
f"Meshtastic map: {len(parsed)} nodes with positions " f"(from {len(raw_nodes)} total)"
|
|
)
|
|
|
|
except Exception as e:
|
|
logger.error(f"Meshtastic map fetch failed: {e}")
|
|
# Fall back to cache if available and we have nothing in memory
|
|
with _data_lock:
|
|
if not latest_data.get("meshtastic_map_nodes"):
|
|
cached = _load_cache()
|
|
if cached:
|
|
latest_data["meshtastic_map_nodes"] = cached
|
|
latest_data["meshtastic_map_fetched_at"] = (
|
|
_CACHE_FILE.stat().st_mtime if _CACHE_FILE.exists() else 0
|
|
)
|
|
logger.info(
|
|
f"Meshtastic map: using {len(cached)} cached nodes (API unavailable)"
|
|
)
|
|
try:
|
|
from services.fetchers.sigint import refresh_sigint_snapshot
|
|
|
|
refresh_sigint_snapshot()
|
|
except Exception as exc:
|
|
logger.debug(f"Meshtastic map cache: SIGINT snapshot refresh skipped: {exc}")
|
|
|
|
_mark_fresh("meshtastic_map")
|
|
|
|
|
|
def load_meshtastic_cache_if_available():
|
|
"""On startup, load cached nodes immediately (before first API fetch)."""
|
|
global _last_fetch_ts
|
|
cached = _load_cache()
|
|
if cached:
|
|
with _data_lock:
|
|
latest_data["meshtastic_map_nodes"] = cached
|
|
_last_fetch_ts = _CACHE_FILE.stat().st_mtime if _CACHE_FILE.exists() else 0
|
|
latest_data["meshtastic_map_fetched_at"] = _last_fetch_ts
|
|
try:
|
|
from services.fetchers.sigint import refresh_sigint_snapshot
|
|
|
|
refresh_sigint_snapshot()
|
|
except Exception as exc:
|
|
logger.debug(f"Meshtastic preload: SIGINT snapshot refresh skipped: {exc}")
|
|
logger.info(f"Meshtastic map: preloaded {len(cached)} nodes from cache")
|