fix(upnp): Upnp issue fix (#2081)

UPnP security fix.

The release build now applies and validates the local
@runonflux/nat-upnp patch after npm installs, so the API artifact used
by the test plugin includes the fix.

Author: SimonFair

.limetech/ai-review-markers/fix-os-879-upnp-security-cf5b3ba337ac.json

@@ -0,0 +1,8 @@
+{
+  "disposition": "PATCH",
+  "forecast_commit": "af00989e28fe2f2825ee8792544bcfa2c176c264",
+  "reviewed_sha": "7d67f03cae08139cb767f69ac62d5b9de933ea26",
+  "schema": "limetech.ai-review-marker.v2",
+  "stage": "final",
+  "unresolved_proportionality_findings": []
+}

api/scripts/build.ts

@@ -29,6 +29,17 @@ const WORKSPACE_PACKAGES_TO_VENDOR = {
     'unraid-api-plugin-connect': 'packages/unraid-api-plugin-connect',
 } as const;
 
+const REPOSITORY_ROOT = resolve('..');
+
+const LOCAL_PATCHED_DEPENDENCIES = [
+    {
+        packageName: '@runonflux/nat-upnp',
+        patchPath: join(REPOSITORY_ROOT, 'patches/@runonflux__nat-upnp@1.0.2.patch'),
+        validationPath: 'build/src/nat-upnp/client.js',
+        validationMarker: 'No trusted gateway addresses found',
+    },
+] as const;
+
 /**
  * Packs a workspace package and installs it as a tarball dependency.
  */
@@ -49,6 +60,34 @@ const packAndInstallWorkspacePackage = async (pkgName: string, pkgPath: string,
     await $`npm install ${tarballPattern}`;
 };
 
+const applyLocalPatchesToProductionDependencies = async () => {
+    for (const dependency of LOCAL_PATCHED_DEPENDENCIES) {
+        const dependencyPath = resolve('node_modules', dependency.packageName);
+
+        if (!existsSync(dependencyPath)) {
+            throw new Error(`Patched dependency ${dependency.packageName} was not installed`);
+        }
+
+        if (!existsSync(dependency.patchPath)) {
+            throw new Error(`Patch file not found: ${dependency.patchPath}`);
+        }
+
+        console.log(`Applying local patch to ${dependency.packageName}...`);
+        const reverseCheck =
+            await $`GIT_DIR=/dev/null git -C ${dependencyPath} apply --reverse --check --no-index ${dependency.patchPath}`
+                .nothrow()
+                .quiet();
+        if (reverseCheck.exitCode !== 0) {
+            await $`GIT_DIR=/dev/null git -C ${dependencyPath} apply --no-index ${dependency.patchPath}`;
+        }
+
+        const patchedSource = await readFile(join(dependencyPath, dependency.validationPath), 'utf-8');
+        if (!patchedSource.includes(dependency.validationMarker)) {
+            throw new Error(`Patch validation failed for ${dependency.packageName}`);
+        }
+    }
+};
+
 /**------------------------------------------------------------------------
  *                             Build Script
  *
@@ -138,6 +177,8 @@ try {
         }
     }
 
+    await applyLocalPatchesToProductionDependencies();
+
     // Clean the release directory
     await $`rm -rf ../release/*`;
 

api/src/upnp/default-gateway.spec.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest';
+
+import { parseDefaultGatewayAddresses } from '@app/upnp/default-gateway.js';
+
+describe('parseDefaultGatewayAddresses', () => {
+    it('extracts unique IPv4 and IPv6 default gateways', () => {
+        const output = [
+            'default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.50 metric 100',
+            'default via fe80::1 dev eth0 proto ra metric 1024',
+            'default via 192.168.1.1 dev eth1 metric 200',
+        ].join('\n');
+
+        expect(parseDefaultGatewayAddresses(output)).toEqual(['192.168.1.1', 'fe80::1']);
+    });
+
+    it('ignores routes without a gateway and invalid gateway values', () => {
+        const output = [
+            'default dev eth0 scope link',
+            'default via not-an-ip dev eth1',
+            '10.0.0.0/8 via 10.0.0.1 dev eth0',
+        ].join('\n');
+
+        expect(parseDefaultGatewayAddresses(output)).toEqual([]);
+    });
+});

api/src/upnp/default-gateway.ts

@@ -0,0 +1,33 @@
+import { isIP } from 'node:net';
+
+import { execa } from 'execa';
+
+const IP_COMMAND = '/sbin/ip';
+const ROUTE_FAMILIES = ['-4', '-6'] as const;
+
+export function parseDefaultGatewayAddresses(output: string): string[] {
+    const addresses = output.split(/\r?\n/).flatMap((line) => {
+        const match = line.match(/^\s*default\s+via\s+(\S+)/);
+        return match ? [match[1]] : [];
+    });
+
+    return [...new Set(addresses.filter((address) => isIP(address) !== 0))];
+}
+
+export async function getDefaultGatewayAddresses(): Promise<string[]> {
+    const results = await Promise.allSettled(
+        ROUTE_FAMILIES.map((family) =>
+            execa(IP_COMMAND, [family, 'route', 'show', 'default'], { reject: false })
+        )
+    );
+
+    return [
+        ...new Set(
+            results.flatMap((result) =>
+                result.status === 'fulfilled' && result.value.exitCode === 0
+                    ? parseDefaultGatewayAddresses(result.value.stdout)
+                    : []
+            )
+        ),
+    ];
+}

api/src/upnp/helpers.ts

@@ -2,11 +2,13 @@ import { Client } from '@runonflux/nat-upnp';
 
 import { THIRTY_SECONDS_MS } from '@app/consts.js';
 import { IS_DOCKER } from '@app/environment.js';
+import { getDefaultGatewayAddresses } from '@app/upnp/default-gateway.js';
 import { MockUpnpClient } from '@app/upnp/mock-upnp-client.js';
 
 // If we're in docker mode, load the mock client
 export const upnpClient = IS_DOCKER
     ? new MockUpnpClient({ timeout: THIRTY_SECONDS_MS })
     : new Client({
           timeout: THIRTY_SECONDS_MS,
+          gatewayAddresses: getDefaultGatewayAddresses,
       });

api/src/upnp/nat-upnp-security.spec.ts

@@ -0,0 +1,52 @@
+import EventEmitter from 'node:events';
+
+import type { ISsdp, SsdpEmitter } from '@runonflux/nat-upnp';
+import { Client, Device } from '@runonflux/nat-upnp';
+import { describe, expect, it } from 'vitest';
+
+const DEVICE_TYPE = 'urn:schemas-upnp-org:device:InternetGatewayDevice:1';
+const COMPRESSED_GATEWAY = '2001:db8::1';
+const EXPANDED_GATEWAY = '2001:0db8:0:0:0:0:0:1';
+
+const createSsdp = (locationAddress: string, gatewayAddress: string): ISsdp => ({
+    search: () => {
+        const emitter = new EventEmitter() as SsdpEmitter;
+        queueMicrotask(() =>
+            emitter.emit(
+                'device',
+                {
+                    location: `http://[${locationAddress}]/root.xml`,
+                    st: DEVICE_TYPE,
+                },
+                gatewayAddress,
+                '192.0.2.2'
+            )
+        );
+        return emitter;
+    },
+    close: () => undefined,
+});
+
+describe('nat-upnp IPv6 address matching', () => {
+    it('accepts equivalent IPv6 forms in the gateway allow-list', async () => {
+        const client = new Client({
+            gatewayAddresses: [EXPANDED_GATEWAY],
+            ssdp: createSsdp(COMPRESSED_GATEWAY, COMPRESSED_GATEWAY),
+            timeout: 100,
+        });
+
+        await expect(client.getGateway()).resolves.toMatchObject({
+            gatewayAddress: COMPRESSED_GATEWAY,
+        });
+        client.close();
+    });
+
+    it('accepts equivalent IPv6 forms in the device address check', () => {
+        expect(
+            () =>
+                new Device(`http://[${EXPANDED_GATEWAY}]/root.xml`, {
+                    allowedAddress: COMPRESSED_GATEWAY,
+                })
+        ).not.toThrow();
+    });
+});