boneio 1.6.0.dev29__tar.gz → 1.6.0.dev31__tar.gz

{boneio-1.6.0.dev29/boneio.egg-info → boneio-1.6.0.dev31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev29
+Version: 1.6.0.dev31
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0

boneio-1.6.0.dev31/boneio/core/auth/jwt_secret.py

@@ -0,0 +1,129 @@
+"""The secret the panel signs its login tokens with.
+
+Kept in ``jwt_secret`` next to config.yaml so a token outlives a restart. Here
+rather than in the web server so recovery mode signs with the same secret
+without importing the web server, which pulls in the whole Manager: a token
+issued in recovery keeps working once the controller is back, and the other
+way round.
+
+The secret belongs to one controller, and the file says which: its second
+line is a hash of the machine-id it was drawn on. A file that names another
+machine — or none — came from somewhere else, most likely an SD card image
+built on a controller that had already run, and every device flashed from that
+image would otherwise sign with the same key. Anyone holding the image could
+then sign an administrator's token for all of them. Such a file is replaced
+rather than trusted, which signs everybody out once.
+
+Only the hash is stored: machine-id is meant to stay on the machine, and the
+file needs no more than to recognise it.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import secrets
+from pathlib import Path
+
+_LOGGER = logging.getLogger(__name__)
+
+JWT_SECRET_FILENAME = "jwt_secret"
+
+#: Where systemd keeps this installation's identity. Emptied when an image is
+#: sealed and drawn afresh on the first boot, which is what makes it the thing
+#: to bind to.
+MACHINE_ID_PATH = Path("/etc/machine-id")
+
+_BINDING_PREFIX = "machine:"
+
+
+def _machine_binding(machine_id_path: Path) -> str | None:
+    """The binding line for this machine, or None when it has no identity yet.
+
+    None is not an error. On an image being built machine-id is empty on
+    purpose; a secret drawn then stays unbound and is replaced on the first
+    boot, once there is an identity to bind it to.
+
+    Args:
+        machine_id_path: The machine-id file.
+
+    Returns:
+        ``machine:<sha256 of machine-id>``, or None.
+    """
+    try:
+        machine_id = machine_id_path.read_text().strip()
+    except OSError:
+        return None
+    if not machine_id:
+        return None
+    digest = hashlib.sha256(f"boneio-jwt:{machine_id}".encode()).hexdigest()
+    return f"{_BINDING_PREFIX}{digest}"
+
+
+def _write_secret(path: Path, secret: str, binding: str | None) -> None:
+    """Write the secret readable by its owner only, from the first byte.
+
+    Created 0600 rather than chmod-ed afterwards, and swapped in with a rename,
+    so there is never a moment when the key is on disk with looser permissions
+    or half written.
+    """
+    content = secret + (f"\n{binding}" if binding else "") + "\n"
+    tmp = path.with_name(f".{path.name}.tmp")
+    try:
+        tmp.unlink()
+    except FileNotFoundError:
+        pass
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(content)
+        f.flush()
+        os.fsync(f.fileno())
+    os.replace(tmp, path)
+
+
+def load_or_create_jwt_secret(
+    config_dir: str | os.PathLike[str],
+    machine_id_path: Path = MACHINE_ID_PATH,
+) -> str:
+    """Read the token secret, creating it on first use.
+
+    A stored secret is used only if it was drawn on this machine. One with no
+    binding, or another machine's, is replaced — unless this machine has no
+    identity to compare with, in which case it is kept as it is: replacing it
+    then would sign everybody out on every start.
+
+    Never raises: a secret that cannot be persisted is replaced by one that
+    lives as long as the process, which logs everybody out on the next restart
+    but does not keep the panel from starting.
+
+    Args:
+        config_dir: The directory config.yaml is in.
+        machine_id_path: The machine-id file. A parameter for the tests.
+
+    Returns:
+        The secret.
+    """
+    jwt_secret_file = Path(config_dir) / JWT_SECRET_FILENAME
+    binding = _machine_binding(machine_id_path)
+
+    try:
+        if jwt_secret_file.exists():
+            lines = jwt_secret_file.read_text().split()
+            stored = lines[0] if lines else ""
+            stored_binding = lines[1] if len(lines) > 1 else None
+            if stored and (binding is None or stored_binding == binding):
+                return stored
+            if stored:
+                _LOGGER.warning(
+                    "The token secret was not drawn on this controller; "
+                    "replacing it. Everybody signed in has to sign in again."
+                )
+
+        jwt_secret = secrets.token_hex(32)  # 256-bit random secret
+        _write_secret(jwt_secret_file, jwt_secret, binding)
+    except Exception as e:
+        # If we can't persist the secret, generate a temporary one
+        _LOGGER.error(f"Failed to handle JWT secret file: {e}")
+        jwt_secret = secrets.token_hex(32)
+    return jwt_secret

{boneio-1.6.0.dev29 → boneio-1.6.0.dev31}/boneio/core/cloud/registration.py

@@ -88,6 +88,7 @@ class CloudRegistration:
         self._task: asyncio.Task | None = None
         self._session: aiohttp.ClientSession | None = None
         self._last_error: str | None = None
+        self._switching = False
 
     @property
     def domain(self) -> str | None:
@@ -104,6 +105,18 @@ class CloudRegistration:
         """Get the last error message, if any."""
         return self._last_error
 
+    @property
+    def serving(self) -> bool:
+        """Whether Caddy is up on the cloud template with the certificate.
+
+        False while the template is being swapped and Caddy recreated: the
+        compose file already names the cloud script then, but the proxy — the
+        only way into a panel with ``web.expose: proxy`` — is down for the half
+        minute that takes. Anything sending somebody to the registered name
+        has to wait for this rather than for the template.
+        """
+        return self._domain is not None and not self._switching and self.is_cloud_config_active()
+
     @property
     def is_compose_writable(self) -> bool:
         """Check if docker-compose.yaml is writable without side effects."""
@@ -551,6 +564,14 @@ class CloudRegistration:
         Returns:
             True if the switch was successful.
         """
+        self._switching = True
+        try:
+            return await self._apply_cloud_config()
+        finally:
+            self._switching = False
+
+    async def _apply_cloud_config(self) -> bool:
+        """The body of :meth:`_switch_to_cloud_config`, without the flag."""
         # The init script still comes from the package; it is mounted read-only
         # into the container and is not what compose executes on the host.
         self._ensure_cloud_script()
@@ -571,7 +592,9 @@ class CloudRegistration:
             return False
 
         _LOGGER.info("Switched docker-compose.yaml to the cloud template")
-        return await self._recreate_caddy()
+        # The service definition changed, so ``up`` recreates the container
+        # and it reads the certificate as it starts.
+        return await self._recreate_caddy(restart=False)
 
     async def _restore_local_config(self) -> bool:
         """Restore the plain compose template and restart Caddy.
@@ -595,14 +618,21 @@ class CloudRegistration:
             return False
 
         _LOGGER.info("Restored the local docker-compose.yaml template")
-        return await self._recreate_caddy()
+        return await self._recreate_caddy(restart=False)
 
-    async def _recreate_caddy(self) -> bool:
+    async def _recreate_caddy(self, restart: bool = True) -> bool:
         """Recreate and restart Caddy so it picks up new certs or compose config.
 
         Both steps go through the container helper, so neither passes anything
         from here to Docker.
 
+        Args:
+            restart: Restart after ``up``. Needed when the compose file did not
+                change — ``up`` then leaves the running container alone and it
+                keeps the certificate it read at start. Not after a template
+                swap: ``up`` has just recreated it, and a restart on top takes
+                the proxy down a second time.
+
         Returns:
             True if the recreate was successful.
         """
@@ -614,12 +644,16 @@ class CloudRegistration:
             )
             return False
 
+        if not restart:
+            _LOGGER.info("Caddy container recreated successfully")
+            return True
+
         # Restart as well: mounted TLS certificates are only re-read on start.
-        restart = await loop.run_in_executor(None, containers.restart_caddy)
-        if not restart.ok:
+        restarted = await loop.run_in_executor(None, containers.restart_caddy)
+        if not restarted.ok:
             _LOGGER.warning(
                 "Caddy was recreated but the restart failed: %s",
-                restart.stderr.strip() or "unknown error",
+                restarted.stderr.strip() or "unknown error",
             )
 
         _LOGGER.info("Caddy container recreated and restarted successfully")

boneio-1.6.0.dev31/boneio/core/nodered_guard.py

@@ -0,0 +1,153 @@
+"""Make sure the running Node-RED asks for a password.
+
+Node-RED reads ``settings.js`` once, when its container starts. The file can
+say ``adminAuth`` while the editor still answers anyone: a migration installs
+the file during an update, and an update restarts boneIO, not the controller,
+so the container goes on with the settings it started with — an open editor,
+and deploying a flow with an ``exec`` node is code execution in it.
+
+So after boneIO starts it asks Node-RED, through the local proxy the way a
+browser would, what its login looks like. An editor that wants no login while
+the file on disk asks for one is restarted, once. Anything else is left alone:
+Node-RED switched off, still starting, or behind a proxy that is being
+recreated all look like "no answer", which is not a reason to restart.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import re
+import ssl
+import urllib.error
+import urllib.request
+from collections.abc import Callable
+from pathlib import Path
+
+from boneio.core import containers
+
+_LOGGER = logging.getLogger(__name__)
+
+SETTINGS_FILE = containers.PROJECT_DIR / "node-red" / "settings.js"
+
+#: Node-RED needs a while after a boot; so does the first start of Caddy.
+FIRST_CHECK_AFTER = 60.0
+RETRY_EVERY = 60.0
+ATTEMPTS = 10
+
+OPEN = "open"
+PROTECTED = "protected"
+UNKNOWN = "unknown"
+
+
+def probe(port: int, timeout: float = 5.0) -> str:
+    """Ask the editor how it signs people in.
+
+    ``GET /nodered/auth/login`` answers ``{}`` when ``adminAuth`` is off and
+    names the login type when it is on. The proxy's certificate is the
+    device's own, unverifiable from here, and this request never leaves the
+    machine, so it is not checked.
+
+    Args:
+        port: The HTTPS port Caddy publishes.
+        timeout: Seconds to wait.
+
+    Returns:
+        OPEN, PROTECTED, or UNKNOWN when there was no usable answer.
+    """
+    context = ssl.create_default_context()
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE
+    url = f"https://127.0.0.1:{port}/nodered/auth/login"
+    try:
+        with urllib.request.urlopen(url, timeout=timeout, context=context) as response:  # noqa: S310
+            body = json.loads(response.read(4096) or b"null")
+    except (OSError, ValueError, urllib.error.URLError):
+        return UNKNOWN
+    if not isinstance(body, dict):
+        return UNKNOWN
+    return PROTECTED if body.get("type") else OPEN
+
+
+#: Comments, so a commented-out ``adminAuth`` — or the shipped file's own
+#: explanation of it — does not count as one that is set.
+_JS_COMMENTS = re.compile(r"/\*.*?\*/|//[^\n]*", re.DOTALL)
+_ADMIN_AUTH = re.compile(r"\badminAuth\s*:")
+
+
+def settings_require_login(path: Path = SETTINGS_FILE) -> bool:
+    """Whether the settings on disk turn ``adminAuth`` on.
+
+    A property, outside comments. Not a JavaScript parser: it decides only
+    whether restarting Node-RED could help, and a file that fools it gets an
+    error in the log instead of a restart that changes nothing.
+
+    Args:
+        path: Node-RED's settings.js.
+
+    Returns:
+        True when the file configures it.
+    """
+    try:
+        code = _JS_COMMENTS.sub("", path.read_text())
+    except OSError:
+        return False
+    return bool(_ADMIN_AUTH.search(code))
+
+
+async def ensure_admin_auth(
+    port: int,
+    *,
+    first_check_after: float = FIRST_CHECK_AFTER,
+    retry_every: float = RETRY_EVERY,
+    attempts: int = ATTEMPTS,
+    probe_fn: Callable[[int], str] = probe,
+    settings_path: Path = SETTINGS_FILE,
+    restart: Callable[[], containers.Result] = containers.restart_nodered,
+) -> str:
+    """Restart Node-RED once if it runs open while its settings say otherwise.
+
+    Args:
+        port: The HTTPS port Caddy publishes.
+        first_check_after: Seconds before the first look.
+        retry_every: Seconds between looks while there is no answer.
+        attempts: Looks before giving up on an editor that never answers.
+        probe_fn: The probe. A parameter for the tests.
+        settings_path: Node-RED's settings.js.
+        restart: Restarts the container. A parameter for the tests.
+
+    Returns:
+        What it found or did: ``protected``, ``restarted``, ``open`` (the file
+        itself asks for no login), ``restart_failed`` or ``unknown``.
+    """
+    loop = asyncio.get_running_loop()
+    await asyncio.sleep(first_check_after)
+    for attempt in range(attempts):
+        if attempt:
+            await asyncio.sleep(retry_every)
+        state = await loop.run_in_executor(None, probe_fn, port)
+        if state == UNKNOWN:
+            continue
+        if state == PROTECTED:
+            return PROTECTED
+        if not settings_require_login(settings_path):
+            _LOGGER.error(
+                "Node-RED's editor accepts anyone, and %s does not configure "
+                "adminAuth either. Apply the pending system migrations.",
+                settings_path,
+            )
+            return OPEN
+        _LOGGER.warning(
+            "Node-RED is running without the login its settings ask for; "
+            "restarting it so it reads them."
+        )
+        result = await loop.run_in_executor(None, restart)
+        if not result.ok:
+            _LOGGER.error(
+                "Could not restart Node-RED: %s",
+                (result.stderr or result.stdout).strip() or "unknown error",
+            )
+            return "restart_failed"
+        return "restarted"
+    return UNKNOWN

{boneio-1.6.0.dev29 → boneio-1.6.0.dev31}/boneio/migrations/assets/MANIFEST.sha256

@@ -25,6 +25,7 @@ d28f2e9336b881b102c42f4278ec9ddf046c83dab4469dc5be7326768e074cb6  kernel/postins
 99a9d81f833347563e8349599a248a641216d01d182e8a2723344b017d87f9f4  motd/20-boneio
 e4dc9400201f74f04e71e2e9eaab3eed4dca39f0906dd717511578c138fcf97b  overlays/BONEIO-BLACK-PINS-v0.2-v0.3.dtbo
 6289c9b3d6e7836fcd809b7a9dcd85f5a2acf85af09be279dd6e466b99a14209  sshd/10-boneio-hardening.conf
+e8759a106b07c05a7f945f5cb9cc0e53c1d190a93d8e9184ae2b864967e4fa81  sshd/15-boneio-penalties.conf
 27adb0eb71d07b1f0e3fbd5098795325672a55f8d6bb6f5bb505300152dd5256  sshd/20-boneio-banner.conf
 00e4fb7961045f99f2559ebc76472c9d001f8e128182e48762f7a2b177896d11  sshd/boneio-banner
 6c994908ea9d8d0cb85501480b7a6236a31310012deebe6ee3d034da2dc2d4e9  sudoers/boneio

boneio-1.6.0.dev31/boneio/migrations/assets/sshd/15-boneio-penalties.conf

@@ -0,0 +1,19 @@
+# boneIO SSH guessing penalty. Installed by migration 1.6.35; edit at your own
+# risk, as a later migration may replace it.
+#
+# Password login stays on: people setting up from Windows with PuTTY rarely
+# have a key, and a controller they cannot reach is worse than one they reach
+# with a password. What it must not allow is guessing at network speed.
+#
+# sshd keeps the count itself (OpenSSH 9.8+), per source address, in memory —
+# no log parser, no firewall rules, no extra daemon on a board with half a
+# gigabyte of RAM. A connection that ends without a successful login costs its
+# source five minutes in which sshd refuses it outright; repeated, the penalty
+# adds up to an hour. Typing the password wrong and then right in the same
+# connection costs nothing. Three guesses per connection (MaxAuthTries, in
+# 10-boneio-hardening.conf) every five minutes is under nine hundred a day.
+#
+# The penalty is per address, so behind one NAT a stranger's guessing also
+# keeps a colleague out for those minutes. The panel's own login is counted
+# separately and is unaffected.
+PerSourcePenalties authfail:300s max:3600s

boneio-1.6.0.dev31/boneio/migrations/plans/1.6.34.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/home/boneio/docker/nodered/node-red/settings.js","expected_sha256":"bff00753c72fb17609a6f7b3a58ef78b7b394da12d19fd65b875f2889695e2b4","group":"boneio","mode":420,"owner":"boneio","src":"docker/nodered/node-red/settings.js","template_vars":{}}]

boneio-1.6.0.dev31/boneio/migrations/plans/1.6.34.sig

@@ -0,0 +1,2 @@
+/�Kb'щ��*���g��fJ<�҃wߏ
+�G��)���J�ؼ���v*���4�>Z�z�
��

boneio-1.6.0.dev31/boneio/migrations/plans/1.6.35.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/etc/ssh/sshd_config.d/15-boneio-penalties.conf","expected_sha256":"e8759a106b07c05a7f945f5cb9cc0e53c1d190a93d8e9184ae2b864967e4fa81","group":"root","mode":420,"on_change":{"action":"systemctl_reload","unit":"ssh"},"owner":"root","src":"sshd/15-boneio-penalties.conf","template_vars":{},"validate":"sshd"}]

boneio-1.6.0.dev31/boneio/migrations/plans/1.6.35.sig

@@ -0,0 +1 @@
+?aQ�N���>ZN0�"�����/5��s�".YCi߿�ܠnYd�XP�L�Fh/6Dx��

{boneio-1.6.0.dev29 → boneio-1.6.0.dev31}/boneio/migrations/plans/manifest.json

@@ -1 +1 @@
-{"plans":{"1.3.0":"645ac6bdda8dc0a73c219aa3684a29df4bdd4032aad97a833b259de489b2ce32","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"19508f66d84f1e16bd24932aaa17d45417912ffd1c20d326b2f003b931ac2f8c","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"8cfaeae24ceefe171d40241549c1f62527ce41821e5fd2904c0df1973596c0c7","1.6.16":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.17":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.18":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.19":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.20":"28027c836eef19b21b95500760961e181f6078d22cccf8cca62b77bbbb11a0c5","1.6.21":"b0d0777e81edc8532d42bcd3b6d518fecd6078153dfe9f5f859469d2c13b369d","1.6.22":"6600f96197356bdc676e9cd7d2d40b18c9d8838323f8cae0892f056175396313","1.6.23":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.24":"701460ed5e3ed236c8c7273ba0a98a0235786b4a04bd6c7aa6088fb835549aa6","1.6.25":"efa09d1677148bdfe4639273479c9a1fa527d4cf5d2ca9af6dd876883652ba22","1.6.26":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.27":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.28":"6e219d09a06a5de8162a521c9b3c3b54067e6bb4d1d15b3b47a8ec522fd76b5c","1.6.29":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.30":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.31":"fe5e93397dfe4e459cb7c19bfb09153707ebe4b6c92a60a279bf61b0fbc482fb","1.6.32":"c5dbc5a513107d179d55c2f7360e66299167107acd92bc1f5c3a6b19bc7b6e31","1.6.33":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"65a083182affb9a2beef674bb17dee390bec0007441f1ee71b92e05117c65937","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"5c03d447037a48211f0223bb9ecc8cdc1fa84b93bec8e61b1a3073188ac7ea4e","1.6.9":"978c88cc23a2ce07fe419d40a4f9aaf1a1388d01c6b43235e6f08fc09a03a96f"},"release":"1.6.0.dev29"}
+{"plans":{"1.3.0":"645ac6bdda8dc0a73c219aa3684a29df4bdd4032aad97a833b259de489b2ce32","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"19508f66d84f1e16bd24932aaa17d45417912ffd1c20d326b2f003b931ac2f8c","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"8cfaeae24ceefe171d40241549c1f62527ce41821e5fd2904c0df1973596c0c7","1.6.16":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.17":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.18":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.19":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.20":"28027c836eef19b21b95500760961e181f6078d22cccf8cca62b77bbbb11a0c5","1.6.21":"b0d0777e81edc8532d42bcd3b6d518fecd6078153dfe9f5f859469d2c13b369d","1.6.22":"6600f96197356bdc676e9cd7d2d40b18c9d8838323f8cae0892f056175396313","1.6.23":"4b7e00dbe218a173ee83dd9cb32103f7129520352bdb4b11172d62e55df519c1","1.6.24":"701460ed5e3ed236c8c7273ba0a98a0235786b4a04bd6c7aa6088fb835549aa6","1.6.25":"efa09d1677148bdfe4639273479c9a1fa527d4cf5d2ca9af6dd876883652ba22","1.6.26":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.27":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.28":"6e219d09a06a5de8162a521c9b3c3b54067e6bb4d1d15b3b47a8ec522fd76b5c","1.6.29":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.30":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.31":"fe5e93397dfe4e459cb7c19bfb09153707ebe4b6c92a60a279bf61b0fbc482fb","1.6.32":"c5dbc5a513107d179d55c2f7360e66299167107acd92bc1f5c3a6b19bc7b6e31","1.6.33":"7f87b537e2d2618d0fed97683c9db9b13143025f63aae7fa6bf6ee2534d9cf68","1.6.34":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.35":"f111f7717fd1fb7f36ff50c59e5aae0f37440ae8e60ae649e0a781d107f13216","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"65a083182affb9a2beef674bb17dee390bec0007441f1ee71b92e05117c65937","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"5c03d447037a48211f0223bb9ecc8cdc1fa84b93bec8e61b1a3073188ac7ea4e","1.6.9":"978c88cc23a2ce07fe419d40a4f9aaf1a1388d01c6b43235e6f08fc09a03a96f"},"release":"1.6.0.dev31"}

boneio-1.6.0.dev31/boneio/migrations/plans/manifest.sig

@@ -0,0 +1 @@
+��G�����z�`���k� ]=}�m��9�-X��O��r��=�-X��;�`�ڲQ/�vE~

boneio-1.6.0.dev31/boneio/migrations/versions/v1_6_34_nodered_admin_auth_again.py

@@ -0,0 +1,51 @@
+"""BoneIO 1.6.34 — install the Node-RED settings that require a login, again.
+
+1.6.0 installed ``settings.js`` with ``adminAuth`` delegated to boneIO, and
+recorded itself as applied. On the SD card images that record did not mean the
+file was still there: the images are built on a rootfs that had already been
+through setup once, so 1.6.0 counted as done, and the image script's own step
+then wrote its four-line ``settings.js`` over the real one — no ``adminAuth``.
+Every controller flashed from such an image (seen on dev29, blk239bb2, audit
+finding A-02) ran Node-RED's editor open to anyone who could reach the device,
+which is F-01 back: a flow with an ``exec`` node is code execution.
+
+The same file again, under a new version so it is applied once more on every
+device. Where the file is already the right one, the helper finds the hash
+matching and writes nothing.
+
+The running container keeps the settings it started with. boneIO restarts it
+on its own after starting, when the editor answers without a login while this
+file asks for one (see :mod:`boneio.core.nodered_guard`), so an update is
+enough and no reboot is needed.
+
+To retry on a device, delete ``/var/lib/boneio/migrations.d/1.6.34.applied``
+and restart boneIO.
+"""
+
+from __future__ import annotations
+
+from boneio.migrations.actions import InstallFile, MigrationAction
+
+VERSION = "1.6.34"
+DESCRIPTION = "Install the Node-RED settings that require a login, again (F-01, A-02)"
+REQUIRES_ROOT = True
+
+_BONEIO_HOME = "/home/boneio"
+_BONEIO_USER = "boneio"
+
+
+def plan() -> list[MigrationAction]:
+    """Return the ordered list of migration actions for version 1.6.34.
+
+    Returns:
+        List of :class:`MigrationAction` to apply in order.
+    """
+    return [
+        InstallFile(
+            src="docker/nodered/node-red/settings.js",
+            dst=f"{_BONEIO_HOME}/docker/nodered/node-red/settings.js",
+            mode=0o644,
+            owner=_BONEIO_USER,
+            group=_BONEIO_USER,
+        ),
+    ]

boneio-1.6.0.dev31/boneio/migrations/versions/v1_6_35_ssh_guessing_penalty.py

@@ -0,0 +1,52 @@
+"""BoneIO 1.6.35 — make guessing an SSH password slow.
+
+1.6.4 cut attempts per connection to three and shortened the window, but
+nothing stopped a client opening the next connection straight away, so a
+password could still be guessed at network speed. The audit of blk239bb2 on
+dev30 (A-03, the SSH half of F-06) found exactly that: password login on,
+``boneio`` a sudoer with that same password, and no throttling.
+
+Password login stays on — owners setting up from Windows with PuTTY rarely
+have a key. Instead a drop-in sets ``PerSourcePenalties``: sshd, not a log
+parser, keeps the count per source address and refuses a source for five
+minutes after a connection that ends without logging in, accumulating up to an
+hour. No new package, no daemon, nothing in the firewall; fail2ban was weighed
+and set aside for its memory on a 512 MB board.
+
+A file of its own rather than a line in ``10-boneio-hardening.conf``, so the
+1.6.4 plan and its signature stay as they are. Validated with ``sshd -t``
+before it goes in, like the other drop-ins: OpenSSH learned the keyword in 9.8,
+and every 1.6 device runs Debian 13 (OpenSSH 10). On an older sshd the
+validation would fail this migration rather than leave a config that sshd
+cannot start with. Reloaded, not restarted — open sessions stay up.
+
+To retry on a device, delete ``/var/lib/boneio/migrations.d/1.6.35.applied``
+and restart boneIO.
+"""
+
+from __future__ import annotations
+
+from boneio.migrations.actions import InstallFile, MigrationAction, SystemctlReload
+
+VERSION = "1.6.35"
+DESCRIPTION = "Make guessing an SSH password slow: per-source penalties (F-06, A-03)"
+REQUIRES_ROOT = True
+
+
+def plan() -> list[MigrationAction]:
+    """Return the ordered list of migration actions for version 1.6.35.
+
+    Returns:
+        List of :class:`MigrationAction` to apply in order.
+    """
+    return [
+        InstallFile(
+            src="sshd/15-boneio-penalties.conf",
+            dst="/etc/ssh/sshd_config.d/15-boneio-penalties.conf",
+            mode=0o644,
+            owner="root",
+            group="root",
+            validate="sshd",
+            on_change=SystemctlReload(unit="ssh"),
+        ),
+    ]

{boneio-1.6.0.dev29 → boneio-1.6.0.dev31}/boneio/runner.py

@@ -616,6 +616,16 @@ async def async_run(
 
     stable_task = asyncio.create_task(_forgive_earlier_crashes())
 
+    # An update restarts boneIO, not the controller, so a Node-RED settings
+    # file installed by it is not what the running editor read. Not in the
+    # main gather either: it finishes after a look or two.
+    from boneio.const import DEFAULT_PROXY_PORT
+    from boneio.core.nodered_guard import ensure_admin_auth
+
+    nodered_task = asyncio.create_task(
+        ensure_admin_auth(_config_helper.proxy_port or DEFAULT_PROXY_PORT)
+    )
+
     try:
         # Convert tasks set to list for main gather
         task_list = list(tasks)
@@ -668,6 +678,7 @@ async def async_run(
     finally:
         _LOGGER.info("Cleaning up resources...")
         stable_task.cancel()
+        nodered_task.cancel()
 
         # Cancel pending deferred state saves and write final state synchronously.
         # This MUST happen before event_bus.stop() which may trigger sigterm

boneio-1.6.0.dev31/boneio/version.py

@@ -0,0 +1,2 @@
+# flake8: noqa
+__version__ = "1.6.0.dev31"

{boneio-1.6.0.dev29 → boneio-1.6.0.dev31}/boneio/webui/app.py

@@ -14,7 +14,7 @@ from typing import TYPE_CHECKING
 from fastapi import Depends, FastAPI, WebSocket, WebSocketDisconnect
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.middleware.gzip import GZipMiddleware
-from fastapi.responses import FileResponse, JSONResponse
+from fastapi.responses import FileResponse, JSONResponse, Response
 from fastapi.staticfiles import StaticFiles
 from starlette.types import Receive, Scope, Send
 from starlette.websockets import WebSocketState
@@ -1096,6 +1096,12 @@ if FRONTEND_DIR.exists() and (FRONTEND_DIR / "index.html").exists():
             headers={"Cache-Control": "no-store, no-cache, must-revalidate"},
         )
 
+    #: FastAPI's own schema and docs routes. In dev mode they are registered
+    #: ahead of this catch-all and answer first; otherwise nothing should.
+    _API_DOC_PATHS = frozenset(
+        {"docs", "docs/oauth2-redirect", "redoc", "openapi.json", "openapi.yaml"}
+    )
+
     @app.get("/{filename:path}")
     async def serve_react_app(filename: str):
         """Serve static files from frontend-dist, fallback to index.html for SPA routing.
@@ -1104,6 +1110,13 @@ if FRONTEND_DIR.exists() and (FRONTEND_DIR / "index.html").exists():
         them. index.html (SPA fallback) is never cached to prevent stale
         versions being served through Cloudflare Tunnel or other caching proxies.
         """
+        # Matched loosely — a trailing slash or capitals reach the same
+        # fallback, and a scanner tries both.
+        if filename.strip("/").lower() in _API_DOC_PATHS:
+            # The schema is off outside dev mode, and these names answering
+            # with the panel's index.html read to a scanner as an exposed API
+            # schema. Saying "not here" is the truth.
+            return Response(status_code=404)
         file_path = (FRONTEND_DIR / filename).resolve()
         if filename and file_path.is_relative_to(FRONTEND_DIR.resolve()) and file_path.exists() and file_path.is_file():
             return FileResponse(str(file_path))