texas2step 2.2.2__tar.gz → 2.2.4__tar.gz

{texas2step-2.2.2 → texas2step-2.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: texas2step
-Version: 2.2.2
+Version: 2.2.4
 Summary: Web-centric throughput, latency, jitter and packet-loss measurement between endpoints.
 Project-URL: Homepage, https://github.com/robert-patrick-texas/texas2step
 Project-URL: Documentation, https://robert-patrick-texas.github.io/texas2step/

{texas2step-2.2.2 → texas2step-2.2.4}/docs/access.md

@@ -49,10 +49,14 @@ networks, as addresses or CIDR blocks. Include the corporate addresses the desk'
 browsers reach the servers from.
 
 ```bash
-sudo texas2step config set access_code=daily internal_networks=10.0.0.0/8,198.51.100.0/24 --write
+sudo texas2step config set access_code=daily internal_networks=10.0.0.0/8,2001:db8::/32,198.51.100.0/24 --write
 sudo systemctl restart texas2step
 ```
 
+On the command line, separate the networks with commas. In `config.toml` they are a list
+of quoted strings: `internal_networks = ["10.0.0.0/8", "2001:db8::/32", "198.51.100.0/24"]`.
+One string of networks separated by spaces is refused.
+
 **3. Check** that the servers agree. On each:
 
 ```bash
@@ -87,7 +91,7 @@ To turn codes off again: `sudo texas2step config set access_code=off --write`, t
 | `access_pass_hours` | `12` | How long an entered code lets a browser keep testing |
 | `access_key_file` | `/etc/texas2step/access.key` | The key |
 | `access_phrases_file` | `/etc/texas2step/access-phrases.toml` | [Standing phrases](#standing-phrases), if the file exists |
-| `internal_networks` | `[]` | Your own networks: no code, and the desk's tools |
+| `internal_networks` | `[]` | Your own networks: no code, and the desk's tools. A list of IPv4 and IPv6 addresses and networks in CIDR form, mixed freely: `["192.168.0.0/16", "2001:db8::/32", "203.0.113.7"]`. An address alone is a single host. Bits past the prefix are ignored, so `10.2.1.30/24` means all of `10.2.1.0/24`. Give the addresses as the server sees them: staff who come in through your firewall's NAT arrive from its public address. |
 
 **Built-in words.** A code is two words and the digits: `maple.river.42`. The words come
 from the EFF's short word list of easily spelled words (credited in the package's
@@ -230,18 +234,29 @@ texas2step run https://speedtest.example.net/texas2step --code maple.river.42
 
 | | Needs |
 |---|---|
-| The page at `/`, which asks for the code; its scripts, styles and logo; `/api/v1/health` (for load balancers, without the version); `/api/v1/access` | Nothing |
-| The Monitor and Diag pages, the tests, and saving a result | A pass, or an address in `internal_networks`. Without a pass, `/monitor` and `/diag` send the visitor to `/`. |
+| The page, at `/`, `/monitor` or `/diag`, which asks for the code; its scripts, styles and logo; `/api/v1/health` (for load balancers, without the version); `/api/v1/access` | Nothing |
+| The tests, Monitor and Diag's measurements, and saving a result | A pass, or an address in `internal_networks` |
 | History, the API tab, `/r/<id>`, reading saved results, `/api/docs`, `/api/openapi.json`, `/api/v1/measure/*`, the current code, [lockouts and blocks](#lockouts-and-blocks) | An address in `internal_networks`; others get 404 |
 
-The pass goes with every request the page makes, as `?pass=`. A page load can't carry
-that, so a right code also sets the pass as a cookie for the server's own pages:
-`HttpOnly`, `Secure` over HTTPS, `SameSite=Strict`, gone when the pass expires.
-
-Until a visitor enters a code, nothing tells them the version: the page leaves it out and
-`/api/v1/health` answers only `{"status":"ok"}`. Inside `internal_networks`, and once in,
-it is there as before. This slows an attacker down rather than stopping one: the page's
-scripts are those of a published release.
+The page keeps the pass in the browser's local storage and sends it with every request
+it makes. To its own server it goes in an `Authorization: Bearer` header, and a
+WebSocket's in its subprotocol, which keeps the pass out of the URLs that
+TLS-inspecting proxies log. To the other servers in the picker it goes as `?pass=`: a
+header there would make the browser ask permission (a CORS preflight) before each timed
+request and skew the timings. The server takes the pass in any of these, so the CLI's
+`?pass=` works as before. There is no cookie: a page needs no pass to load, and asks for
+the code itself. A cookie an earlier version set is removed at the next right code.
+
+With `internal_networks` set, only those networks see the version. The page,
+`/api/v1/info` and `/api/v1/health` leave it out for everyone else, even after they enter
+a code, and a result they save gets it from the server. Without `internal_networks`, a
+visitor sees it once they have entered a code; until then the page leaves it out and
+`/api/v1/health` answers only `{"status":"ok"}`. This slows an attacker down rather than
+stopping one: the page's scripts are those of a published release.
+
+The desk's functions also refuse, with `403`, a browser's request made for a page on
+another site, so that a website an employee opens can't use them through the employee's
+browser ([Security](security.md#the-desks-tools)).
 
 Loopback addresses are always inside, so commands on the server itself need no code. The
 service sees each visitor's address through nginx (`trusted_proxies`), which the packaged
@@ -272,7 +287,8 @@ codes in a row from a network, it is locked out:
 * A network quiet for 30 minutes starts counting again from nothing, and so does one that
   enters a right code.
 * Visitors from `internal_networks` and loopback need no code, so they are never counted
-  or locked out. Passes already given keep working.
+  or locked out. Passes already given keep working through a lockout; a block set by hand
+  ends them (below).
 
 | Setting | Default | |
 |---|---|---|
@@ -320,6 +336,14 @@ longer if it keeps trying; blocking it again keeps it going. A block can't overl
 take effect at once, with no restart, and with
 [servers that defend together](#servers-that-defend-together), on every server.
 
+A block also ends the passes used from the network it covers. Until it ends, their
+requests are refused as if they carried none (`401`), and the WebSockets and UDP
+sessions they have open close within a few seconds. The page goes back to asking for the
+code, which the blocked network can't enter. A lockout from wrong codes ends no passes,
+so callers who share a network with a guesser keep testing with the pass they hold. A
+block set or ended through the API counts at once. One from the command line reaches
+each of the service's workers within 5 seconds, and so does one that ends.
+
 **From automation.** The same, as an API that answers only `internal_networks` and the
 server itself, so a script can carry a block from the server that saw an attack to all
 the others, and renew it there:
@@ -331,8 +355,9 @@ curl -s -X POST https://houston.example.net/texas2step/api/v1/access/blocks \
 curl -s -X DELETE 'https://houston.example.net/texas2step/api/v1/access/blocks?network=198.51.100.0/24'
 ```
 
-A list gives each lockout's `network`, `source`, `wrong_codes`, `since` and `until`, and
-`counting`, the networks with wrong codes in a row. A block that overlaps
+A list gives each lockout's `network`, `source`, `wrong_codes`, `since`, `until` and
+`by_hand` (a block, which ends passes too), and `counting`, the networks with wrong codes
+in a row. A block that overlaps
 `internal_networks`, or is wider than a /16 or a /32, is refused with `400`. These calls
 change only the server they are sent to; for one that reaches every server by itself, see
 [Servers that defend together](#servers-that-defend-together).
@@ -368,7 +393,9 @@ access_peer_networks = ["198.51.100.20", "2001:db8:20::20", "203.0.113.30"]
   third of `access_lockout_minutes`, so the others' blocks don't run out first.
   `sudo texas2step access block` and `access lockouts --clear` go to every server too:
   `--clear` on any one of them lets a caller back in everywhere. The
-  [API's blocks](#lockouts-and-blocks) stay on the server they are sent to.
+  [API's blocks](#lockouts-and-blocks) stay on the server they are sent to. A block from
+  `access block` ends passes on every server, as here; a lockout ends none anywhere. A
+  server on an earlier version sends either as a lockout.
 * **What a server takes.** Only requests from an address in its `access_peer_networks`,
   signed with a key the servers work out from the access key they share. Use the
   addresses the other servers' requests leave from, which behind NAT may not be the
@@ -484,8 +511,7 @@ many as you need (`results_max_rows`). `sudo texas2step results clear` deletes t
 | Your `access_words` file | Yours: kept by `apt purge` |
 | `/var/lib/texas2step/access.db` | Wrong codes, lockouts and blocks, and with servers that defend together, the one-time values of their requests; made by the service when access codes are on; removed with `apt purge` |
 
-The pass lives in the visitor's browser (local storage, and the cookie for this server's
-pages) until it expires. Passes are not written to the journal: the request log shows
+The pass lives in the visitor's browser, in local storage, until it expires. Passes are not written to the journal: the request log shows
 `pass=*` in their place. nginx's access log doesn't have them either: the packaged
 snippets log texas2step's requests to `/var/log/nginx/access.log` without their query
 strings (the `texas2step` log format, in `/etc/nginx/conf.d/texas2step-log.conf`).

{texas2step-2.2.2 → texas2step-2.2.4}/docs/api.md

@@ -91,11 +91,11 @@ every port in its `rtc_port_min`–`rtc_port_max` range is taken.
 
 | Method | Path | Returns |
 |---|---|---|
-| GET | `/api/v1/info` | name, version, server identity, capabilities (`stamps`: the UDP probe can [stamp](#udp-probe-protocol) its echoes), limits, ICE servers, UI defaults (`one_stream`: whether a test downloads over one stream too, unless asked otherwise), `monitor` (`profile`: Monitor's until a visitor picks; `video`: whether the Video call profile is offered); with a [traffic limit](traffic.md), `traffic` (below) |
+| GET | `/api/v1/info` | name, version (left out for clients outside `internal_networks`), server identity, capabilities (`stamps`: the UDP probe can [stamp](#udp-probe-protocol) its echoes), limits, ICE servers, UI defaults (`one_stream`: whether a test downloads over one stream too, unless asked otherwise), `monitor` (`profile`: Monitor's until a visitor picks; `video`: whether the Video call profile is offered); with a [traffic limit](traffic.md), `traffic` (below) |
 | GET | `/api/v1/whoami` | client IP, port, family, scheme, HTTP version, user agent |
 | GET | `/api/v1/diag/http` | both ends of this HTTP connection, its HTTP version and TLS, the server's TCP RTT and clock (below) |
 | GET | `/api/v1/locations` | servers offered in the picker (this one first) |
-| GET | `/api/v1/health` | `{"status": "ok", "version": …}`; without the version for clients that need an [access code](#access-codes) |
+| GET | `/api/v1/health` | `{"status": "ok", "version": …}`; without the version for clients outside `internal_networks`, or that need an [access code](#access-codes) |
 
 With a traffic limit, `traffic` says whether this client may start a test, and if not,
 what it is told:
@@ -175,21 +175,25 @@ curl -s -X POST https://dallas.example.net/texas2step/api/v1/measure/full \
 ## Access codes
 
 On a server with `access_code` on ([Access codes](access.md)), a client from outside
-`internal_networks` sends a pass as `?pass=<pass>` with each request under `/api/v1/`
-(except `/health` and `/access`); without a valid one it gets `401`. The WebSocket takes
-it the same way. With `internal_networks` set, clients from outside them get `404` for
+`internal_networks` sends a pass with each request under `/api/v1/` (except `/health`
+and `/access`); without a valid one it gets `401`. It goes as `?pass=<pass>`, or in an
+`Authorization: Bearer <pass>` header; a WebSocket can also carry it in its subprotocol,
+offering `texas2step` and `texas2step.pass.<pass>`, and is answered with `texas2step`. With `internal_networks` set, clients from outside them get `404` for
 reading results, `/api/v1/measure/*`, `/api/docs`, `/api/openapi.json`, the current code and
-the lockouts. `/api/v1/health` leaves out the version for clients that would need a pass.
+the lockouts, and the browser's requests to these made for a page on another site get
+`403`. With `internal_networks` set, `/api/v1/info` and `/api/v1/health` leave out the
+version for clients outside them; without them, `/api/v1/health` leaves it out for
+clients that would need a pass.
 
 | Method | Path | Purpose |
 |---|---|---|
 | GET | `/api/v1/access?pass=<pass>` | `{"required", "desk"}`: whether this client needs a pass, and gets the desk's functions; with `pass`, also whether that pass is valid and when it expires |
-| POST | `/api/v1/access` | `{"code": "maple.river.42"}` (any case and separators, or a standing phrase) returns `{"pass", "expires"}`, and sets the pass as a cookie for this server's pages. A wrong code is `403`. After `access_lockout_after` wrong codes in a row from one /24 or /48, every code from it gets that same `403`, unread, until `access_lockout_minutes` pass without one ([Lockouts and blocks](access.md#lockouts-and-blocks)). A body over 1 KB is `413` |
+| POST | `/api/v1/access` | `{"code": "maple.river.42"}` (any case and separators, or a standing phrase) returns `{"pass", "expires"}`. A wrong code is `403`. After `access_lockout_after` wrong codes in a row from one /24 or /48, every code from it gets that same `403`, unread, until `access_lockout_minutes` pass without one ([Lockouts and blocks](access.md#lockouts-and-blocks)). A body over 1 KB is `413` |
 | GET | `/api/v1/access/code` | The current code, when it changes, and the previous one while it still works; only from `internal_networks` |
-| GET | `/api/v1/access/blocks` | `{"lockouts": [{"network", "source", "wrong_codes", "since", "until"}], "counting"}`; only from `internal_networks` and the server itself |
-| POST | `/api/v1/access/blocks` | `{"network": "198.51.100.0/24", "minutes": 120}` locks a network out by hand, or keeps its lockout going; `minutes` defaults to `access_lockout_minutes`. One that overlaps `internal_networks`, or is wider than a /16 or a /32, is `400` |
+| GET | `/api/v1/access/blocks` | `{"lockouts": [{"network", "source", "wrong_codes", "since", "until", "by_hand"}], "counting"}` (`by_hand`: a block, which ends the passes used from the network too); only from `internal_networks` and the server itself |
+| POST | `/api/v1/access/blocks` | `{"network": "198.51.100.0/24", "minutes": 120}` locks a network out by hand, or keeps its lockout going, and ends the passes used from it; `minutes` defaults to `access_lockout_minutes`. One that overlaps `internal_networks`, or is wider than a /16 or a /32, is `400` |
 | DELETE | `/api/v1/access/blocks?network=<network>` | Ends the lockouts that overlap it (`all`: every one); returns `{"cleared": [...]}` |
-| POST | `/api/v1/access/peer` | For [servers that defend together](access.md#servers-that-defend-together): `{"from", "to", "action": "block" \| "clear" \| "check", "network", "minutes"}`, signed in `X-Texas2step-Time`, `-Nonce` and `-Signature`. Only from `access_peer_networks`, with `access_share_lockouts` on; `404` to everyone else |
+| POST | `/api/v1/access/peer` | For [servers that defend together](access.md#servers-that-defend-together): `{"from", "to", "action": "block" \| "clear" \| "check", "network", "minutes", "kind": "lockout" \| "block"}` (`kind`: a block set by hand, which ends passes there too; `lockout` when left out), signed in `X-Texas2step-Time`, `-Nonce` and `-Signature`. Only from `access_peer_networks`, with `access_share_lockouts` on; `404` to everyone else |
 
 ```bash
 pass=$(curl -s -X POST https://speedtest.example.net/texas2step/api/v1/access \

{texas2step-2.2.2 → texas2step-2.2.4}/docs/configuration.md

@@ -7,8 +7,9 @@ Settings come from, in increasing priority:
 3. environment variables `TEXAS2STEP_<SETTING>` (upper case).
 
 Lists in environment variables are comma separated. Booleans accept `1/0`,
-`true/false`, `yes/no` and `on/off`. Unknown keys in the TOML file are an error, so
-typos don't fail silently. The package installs a fully commented file listing every
+`true/false`, `yes/no` and `on/off`. Spaces around any value, or around each item of a
+list, are ignored, wherever the setting comes from. Unknown keys in the TOML file are an
+error, so typos don't fail silently. The package installs a fully commented file listing every
 setting and its default as `/etc/texas2step/config.toml` (source:
 [`src/texas2step/config_template.toml`](../src/texas2step/config_template.toml)); restart
 the service after editing it. After an upgrade, `texas2step config merge` brings your

{texas2step-2.2.2 → texas2step-2.2.4}/docs/roadmap.md

@@ -116,6 +116,21 @@ links and footer credit. Three places still say texas2step:
 
 Newest first. Each release's notes have the details and its upgrade steps.
 
+### [2.2.4](https://github.com/robert-patrick-texas/texas2step/releases/tag/v2.2.4) (2026-10-25)
+
+- [x] The desk's functions refuse requests made for pages on other sites; with
+  `internal_networks` set, only those networks see the version.
+- [x] API answers are kept in no browser cache.
+- [x] A block set by hand ends the passes used from its network, sessions already open
+  included.
+- [x] No cookie: the pass stays in local storage and goes to the page's own server in a
+  header; a Content-Security-Policy on the page and the API explorer.
+
+### [2.2.3](https://github.com/robert-patrick-texas/texas2step/releases/tag/v2.2.3) (2026-10-24)
+
+- [x] Spaces around any setting or typed value are ignored; a stray one in
+  `internal_networks` no longer breaks every request.
+
 ### [2.2.2](https://github.com/robert-patrick-texas/texas2step/releases/tag/v2.2.2) (2026-10-24)
 
 - [x] UDP works in Firefox: Monitor, Diag and the Test page's packet loss no longer fall

{texas2step-2.2.2 → texas2step-2.2.4}/docs/security.md

@@ -38,9 +38,13 @@ pass.
   is kept out of the world-readable `config.toml`. `texas2step access show` prints a
   fingerprint to compare servers by, which reveals nothing about the key.
 * **Passes.** A right code buys a pass for `access_pass_hours` (12 by default): an expiry
-  time signed with the key, checked by every server that holds it. The browser sends it
-  as `?pass=`; this server's own pages get it as a cookie that is `HttpOnly`,
-  `SameSite=Strict`, and `Secure` over HTTPS.
+  time signed with the key, checked by every server that holds it. The page keeps it in
+  local storage, with no cookie, and sends it to its own server in an `Authorization`
+  header (a WebSocket's in its subprotocol), so it stays out of URLs that proxies log;
+  to the other servers, as `?pass=`. A pass is a bearer token: it isn't tied to
+  an address or a browser, and works until it expires. A
+  [block set by hand](access.md#lockouts-and-blocks) ends it for the network blocked,
+  WebSockets and UDP sessions already open included. A new access key ends every pass.
 * **Standing phrases.** For the desk away from a PC, in their own `0640` file
   (`access-phrases.toml`), with an optional last day. Each use is a journal warning with
   the phrase's name, never the phrase. The examples published in the docs are refused.
@@ -97,10 +101,22 @@ server itself), and `404` to everyone else, as if they weren't there:
 * the API explorer (`/api/docs`, `/api/openapi.json`);
 * the server-side measurements (`/api/v1/measure/*`).
 
+They also refuse, with `403`, a browser's request made for a page on another site. They
+trust the address a request comes from, and CORS lets any page read the answer, so a
+website an employee opens inside could otherwise read History, the current code and the
+blocks through that employee's browser, or set blocks. The browser says where a request
+came from in its `Sec-Fetch-Site` header, or, without one, in its `Origin`. A link from
+elsewhere still opens the desk's pages, because the other site can't read them. Scripts,
+the CLI and monitoring send neither header and work as before.
+
 Server-side measurements only reach the servers in `[[locations]]`, unless
 `allow_any_target` is set, so the server can't be used to make requests to other hosts.
 At most two run at once on each worker.
 
+**The version** would tell an attacker which flaws to try. With `internal_networks` set,
+only those networks see it: the page, `/api/v1/info` and `/api/v1/health` leave it out for
+everyone else, even after they enter a code. A result they save gets it from the server.
+
 ## Abuse of the service
 
 A speed test exists to move a lot of data, so each part has a cap:
@@ -138,6 +154,13 @@ A speed test exists to move a lot of data, so each part has a cap:
   figures) belong to the service user. The traffic figures hold no addresses.
 * **No third parties.** The web page loads nothing from other sites: no CDN, fonts,
   analytics or telemetry. No public STUN server is used unless listed in `ice_servers`.
+* **A Content-Security-Policy** on the page and the API explorer lets only their own
+  scripts run, and the one written into each page by its hash, and lets them connect
+  only to this server and the others in `[[locations]]`. A script injected some other
+  way can't run, or send what it finds to another site.
+* **Its own hostname.** A browser shares local storage across a whole origin, the scheme,
+  host and port. Where texas2step sits beside other applications on one hostname, any page
+  there could read the pass, so serve it from a hostname of its own where you can.
 
 ## Cryptography
 

{texas2step-2.2.2 → texas2step-2.2.4}/src/texas2step/__init__.py

@@ -1,3 +1,3 @@
 """texas2step: web-centric throughput, latency, jitter and packet-loss measurement."""
 
-__version__ = "2.2.2"
+__version__ = "2.2.4"

{texas2step-2.2.2 → texas2step-2.2.4}/src/texas2step/api/access.py

@@ -9,7 +9,8 @@ from datetime import UTC, datetime
 from typing import Any, Literal
 
 from fastapi import APIRouter, HTTPException, Query, Request, Response
-from pydantic import BaseModel, Field, ValidationError
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+from starlette.requests import HTTPConnection
 
 from .. import cluster
 from ..access import Codes, is_internal
@@ -20,14 +21,37 @@ router = APIRouter(prefix="/api/v1/access", tags=["access"])
 log = logging.getLogger(__name__)
 
 WRONG = "that isn't the current access code"  # also the answer while a network is locked out
-PASS_COOKIE = "texas2step_pass"  # the pass again, for loading this server's own pages
+# Earlier versions sent the pass back as this cookie too, for loading the server's own
+# pages; pages need no pass now, and POST /access removes it.
+PASS_COOKIE = "texas2step_pass"
+# The page's WebSockets to its own server carry the pass in their subprotocol, as a
+# browser can't give them a header: "texas2step.pass.<pass>", answered with "texas2step".
+WS_PROTOCOL = "texas2step"
+WS_PASS = WS_PROTOCOL + ".pass."
+
+
+def given_pass(conn: HTTPConnection) -> str:
+    """The pass a request carries: as ?pass= (the CLI, and the page to other servers), in
+    an Authorization: Bearer header (the page to its own server, keeping it out of URLs
+    that proxies log), or in a WebSocket's subprotocol."""
+    if token := conn.query_params.get("pass", ""):
+        return token
+    scheme, _, token = conn.headers.get("authorization", "").partition(" ")
+    if scheme.lower() == "bearer":
+        return token.strip()
+    for protocol in conn.headers.get("sec-websocket-protocol", "").split(","):
+        if (protocol := protocol.strip()).startswith(WS_PASS):
+            return protocol[len(WS_PASS) :]
+    return ""
 
 
 class CodeIn(BaseModel):
+    model_config = ConfigDict(str_strip_whitespace=True)  # as typed or pasted
     code: str = Field(max_length=200, description="The code, with any case and separators")
 
 
 class BlockIn(BaseModel):
+    model_config = ConfigDict(str_strip_whitespace=True)
     network: str = Field(
         max_length=64,
         description="An address or network outside internal_networks, e.g. 203.0.113.0/24",
@@ -49,6 +73,9 @@ class PeerIn(BaseModel):
     action: Literal["block", "clear", "check"]
     network: str = Field("", max_length=64)
     minutes: float | None = Field(None, gt=0, le=cluster.MOST_MINUTES)
+    # A block set by hand there ends passes here too; one from wrong codes doesn't. Older
+    # servers send no kind, so theirs count as lockouts.
+    kind: Literal["lockout", "block"] = "lockout"
 
 
 def internal(request: Request) -> bool:
@@ -73,8 +100,13 @@ async def status(
         "required": codes is not None and not internal(request),
         "desk": desk(request),
     }
+    pass_ = pass_ or given_pass(request)  # the page sends its own server's in a header
     if codes is not None and pass_:
         expires = codes.pass_expires(pass_)
+        # A block set by hand on this client's network ends its pass (app.AccessGate).
+        ip, _ = client_address(request)
+        if expires is not None and body["required"] and await request.app.state.blocks.cover(ip):
+            expires = None
         body["pass"] = {"valid": expires is not None, "expires": expires}
     return body
 
@@ -126,15 +158,14 @@ async def unlock(request: Request, given: CodeIn, response: Response) -> dict[st
     if note != "access code":  # a standing phrase: every use is logged, so a leaked one shows
         log.warning("%s used from %s", note, ip)
     token, expires = codes.issue()
-    response.set_cookie(
-        PASS_COOKIE,
-        token,
-        max_age=codes.pass_seconds,
-        path=request.scope.get("root_path", "") + "/",
-        secure=_https(request),
-        httponly=True,
-        samesite="strict",
-    )
+    if PASS_COOKIE in request.cookies:  # an earlier version's: the page keeps the pass itself
+        response.delete_cookie(
+            PASS_COOKIE,
+            path=request.scope.get("root_path", "") + "/",
+            secure=_https(request),
+            httponly=True,
+            samesite="strict",
+        )
     return {"pass": token, "expires": expires}
 
 
@@ -209,6 +240,7 @@ def _lockout(codes: Codes, lockout: Lockout) -> dict[str, Any]:
         "network": lockout.network,
         "source": lockout.source,
         "wrong_codes": lockout.failures,
+        "by_hand": lockout.by_hand,  # a block: it ends the passes used from the network too
         "since": datetime.fromtimestamp(since, codes.zone).isoformat() if since else None,
         "until": datetime.fromtimestamp(lockout.expires, codes.zone).isoformat(),
     }
@@ -244,6 +276,7 @@ async def block(request: Request, given: BlockIn) -> dict[str, Any]:
     lockouts = request.app.state.lockouts
     why = f"blocked by the API from {ip}"
     lockout = await asyncio.to_thread(lockouts.block, str(net), minutes, why)
+    request.app.state.blocks.forget()
     codes = request.app.state.codes
     log.warning("%s blocked until %s, by the API from %s", net, _at(codes, lockout.expires), ip)
     until = datetime.fromtimestamp(lockout.expires, codes.zone)
@@ -261,6 +294,7 @@ async def unblock(
     ),
 ) -> dict[str, Any]:
     ip = _desk_client(request)
+    network = network.strip()
     try:
         target = None if network == "all" else str(parse_network(network))
     except ValueError as exc:
@@ -316,7 +350,8 @@ async def peer(request: Request) -> dict[str, Any]:
         raise HTTPException(403, why)
     if given.action == "check":
         return {"server": settings.server_id, "ok": True}
-    source = f"{SHARED_BY}{given.sender} from {ip}"
+    by_hand = given.kind == "block"
+    source = f"{SHARED_BY}{given.sender} from {ip}" + (", set by hand" if by_hand else "")
     if given.action == "clear":
         try:  # ending lockouts can't harm: any network, or all
             target = None if given.network == "all" else str(parse_network(given.network))
@@ -335,7 +370,8 @@ async def peer(request: Request) -> dict[str, Any]:
         )
         raise HTTPException(429, f"this server holds {cluster.MOST_HELD} blocks from others")
     minutes = given.minutes or settings.access_lockout_minutes
-    lockout = await asyncio.to_thread(lockouts.block, net, minutes, source)
+    lockout = await asyncio.to_thread(lambda: lockouts.block(net, minutes, source, by_hand=by_hand))
+    request.app.state.blocks.forget()
     log.warning("%s blocked until %s, %s", net, _at(codes, lockout.expires), source)
     until = datetime.fromtimestamp(lockout.expires, codes.zone)
     cluster.hook_in_background(request.app, "block", net, until, source)

{texas2step-2.2.2 → texas2step-2.2.4}/src/texas2step/api/measure.py

@@ -15,7 +15,7 @@ from typing import Any
 
 import httpx
 from fastapi import APIRouter, HTTPException, Request
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 from .. import engine
 from ..store import TRANSFERS
@@ -27,6 +27,7 @@ _slots = asyncio.Semaphore(2)
 
 
 class Target(BaseModel):
+    model_config = ConfigDict(str_strip_whitespace=True)
     target: str = Field(description="Base URL of a texas2step server, e.g. https://peer.example")
 
 

{texas2step-2.2.2 → texas2step-2.2.4}/src/texas2step/api/meta.py

@@ -91,6 +91,10 @@ async def info(request: Request) -> dict[str, Any]:
         # Monitor's profile until a visitor picks one, and whether the video one is offered.
         "monitor": {"profile": s.monitor_profile, "video": s.monitor_video},
     }
+    # With internal_networks set, the version is theirs only. Without them, anyone who
+    # reaches this has entered the code or needs none (AccessGate).
+    if s.internal_networks and not shows_version(request):
+        del out["version"]
     if (meter := request.app.state.traffic) is not None:
         # Whether a traffic limit lets this client test; for the desk, how much is left.
         kind = meter.kind(client_address(request)[0])
@@ -204,9 +208,11 @@ async def health(request: Request) -> dict[str, str]:
 
 
 def shows_version(request: HTTPConnection) -> bool:
-    """Whether this client may see the version: not one that needs an access code first.
-    Knowing it would tell an attacker which flaws to try."""
-    if request.app.state.codes is None:
+    """Whether this client may see the version: knowing it would tell an attacker which
+    flaws to try. With internal_networks set, only they do; without them, not a visitor
+    who needs an access code; on a server open to all, everyone."""
+    networks = request.app.state.settings.internal_networks
+    if request.app.state.codes is None and not networks:
         return True
     ip, _ = client_address(request)
-    return is_internal(ip, request.app.state.settings.internal_networks)
+    return is_internal(ip, networks)

{texas2step-2.2.2 → texas2step-2.2.4}/src/texas2step/api/results.py

@@ -8,6 +8,7 @@ from typing import Any
 from fastapi import APIRouter, HTTPException, Query, Request
 from starlette.concurrency import run_in_threadpool
 
+from .. import __version__
 from .meta import client_address
 
 router = APIRouter(prefix="/api/v1/results", tags=["results"])
@@ -34,6 +35,15 @@ async def save(request: Request) -> dict[str, Any]:
         raise HTTPException(400, "body must be JSON") from exc
     if not isinstance(result, dict) or result.get("version") != 1:
         raise HTTPException(422, "expected a texas2step result object (version 1)")
+    # A visitor outside internal_networks isn't told the version, so its page leaves it out.
+    # This server served that page, and fills in its own; and its own as the tested
+    # server's, when the test was of this server.
+    if result.get("tool") == "texas2step-web/dev":
+        result["tool"] = f"texas2step-web/{__version__}"
+    server = result.get("server")
+    own = request.app.state.settings.server_id
+    if isinstance(server, dict) and not server.get("version") and server.get("id") == own:
+        server["version"] = __version__
     ip, _ = client_address(request)
     return await run_in_threadpool(store.add, result, ip)
 
@@ -50,7 +60,7 @@ async def recent(
 
 @router.get("/{rid}", summary="A saved result, in full")
 async def one(rid: str, request: Request) -> dict[str, Any]:
-    result = await run_in_threadpool(_store(request).get, rid)
+    result = await run_in_threadpool(_store(request).get, rid.strip())
     if result is None:
         raise HTTPException(404, "no such result")
     return result

{texas2step-2.2.2 → texas2step-2.2.4}/src/texas2step/api/wire.py

@@ -20,6 +20,7 @@ from starlette.requests import ClientDisconnect
 from .. import payload
 from ..rtc import RtcBusy, RtcUnavailable
 from ..traffic import Closed, TrafficMeter
+from .access import WS_PROTOCOL
 from .meta import client_address
 
 router = APIRouter(prefix="/api/v1", tags=["wire"])
@@ -155,10 +156,22 @@ async def up(request: Request, test: TestId = None) -> Response:
 @router.websocket("/ws")
 async def ws_echo(ws: WebSocket) -> None:
     """Echoes every message unchanged. Used for latency under load and live monitoring."""
-    await ws.accept()
+    # The page's own sockets carry the pass in a subprotocol (api/access.py): answer it.
+    offered = WS_PROTOCOL in ws.scope.get("subprotocols", [])
+    await ws.accept(subprotocol=WS_PROTOCOL if offered else None)
+    # With access codes, a block set by hand on the client's network ends its socket too,
+    # as it ends its pass (app.AccessGate); looked at as messages come, every few seconds.
+    ip, _ = client_address(ws)
+    blocks = ws.app.state.blocks if ws.app.state.codes is not None else None
+    checked = time.monotonic()
     try:
         while True:
             message = await ws.receive()
+            if blocks is not None and time.monotonic() - checked >= blocks.EVERY:
+                checked = time.monotonic()
+                if await blocks.cover(ip):
+                    await ws.close(code=1008, reason="access code required")
+                    return
             if message["type"] == "websocket.disconnect":
                 return
             if message.get("bytes") is not None:
@@ -191,8 +204,11 @@ async def rtc_offer(offer: Offer, request: Request) -> dict[str, str]:
     try:
         # Whose traffic a voice or video profile is, should a traffic limit count it.
         meter = request.app.state.traffic
-        whose = meter.kind(client_address(request)[0]) if meter is not None else None
-        return await request.app.state.rtc.answer(offer.sdp, whose=whose)
+        ip, _ = client_address(request)
+        whose = meter.kind(ip) if meter is not None else None
+        # With access codes, the session ends should a block set by hand cover this client.
+        watched = ip if request.app.state.codes is not None else None
+        return await request.app.state.rtc.answer(offer.sdp, whose=whose, ip=watched)
     except RtcUnavailable as exc:
         raise HTTPException(501, str(exc)) from exc
     except RtcBusy as exc: