From 287f96274522fe9c4d81ce15e34fe2b85db32174 Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Sat, 20 Jun 2026 22:57:59 +0200
Subject: [PATCH] harden(wg): validate peer name charset in
 add-peer/remove-peer (final review)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docker/wg/clusev-wg.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docker/wg/clusev-wg.sh b/docker/wg/clusev-wg.sh
index f1f893c..d52e618 100755
--- a/docker/wg/clusev-wg.sh
+++ b/docker/wg/clusev-wg.sh
@@ -21,6 +21,9 @@ warn() { printf '\033[33m  ! %s\033[0m\n' "$*" >&2; }
 die()  { printf '\033[31m  x %s\033[0m\n' "$*" >&2; exit 1; }
 have() { command -v "$1" >/dev/null 2>&1; }
 need_root() { [ "$(id -u)" = 0 ] || die "Bitte mit sudo ausfuehren: sudo clusev wg ${1}"; }
+# Peer names land in a wg0.conf comment + are matched by awk/grep; restrict to a safe charset so a
+# name can never inject extra config lines (defence-in-depth — the caller is already root).
+valid_name() { case "$1" in ''|*[!A-Za-z0-9._-]*) return 1 ;; *) return 0 ;; esac; }
 
 # ── subnet helpers (SP1 assumes the default /24; documented in the runbook) ───────────────────
 subnet_first_ip() { local b="${1%%/*}"; printf '%s.%s\n' "${b%.*}" "$(( ${b##*.} + 1 ))"; }
@@ -110,6 +113,7 @@ next_free_ip() {
 cmd_add_peer() {
   need_root add-peer
   local name="${1:-}"; [ -n "$name" ] || die "Name fehlt: clusev wg add-peer <name>"
+  valid_name "$name" || die "Ungueltiger Peer-Name — erlaubt: A-Z a-z 0-9 . _ -"
   require_setup
   # shellcheck disable=SC1090
   . "$WG_ENV"
@@ -155,6 +159,7 @@ EOF
 cmd_remove_peer() {
   need_root remove-peer
   local name="${1:-}"; [ -n "$name" ] || die "Name fehlt: clusev wg remove-peer <name>"
+  valid_name "$name" || die "Ungueltiger Peer-Name — erlaubt: A-Z a-z 0-9 . _ -"
   require_setup
   local pub
   pub="$(WANT="# clusev-peer: ${name}" awk '$0==ENVIRON["WANT"]{f=1;next} f&&/PublicKey/{gsub(/[ \t]/,"");sub(/PublicKey=/,"");print;exit}' "$WG_CONF")"