From 8572a0f5f4105f8bae12cec0db253fb1a8114172 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 13 Jun 2026 22:26:07 +0200 Subject: [PATCH] v0.30.0: AGENT-001 anti-retarget wipe fix (version bump + CHANGELOG) Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 18 ++++++++++++++++++ cmd/felhom-agent/main.go | 2 +- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index aa0c7b3..7d7a471 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,24 @@ All notable changes to **felhom-agent** are recorded here. Update on every code change that gets pushed. +## v0.30.0 — AGENT-001: anti-retarget re-resolution for inline customer-confirmed wipe (2026-06-13) + +**Security fix (from the 2026-06-13 deep-sweep audit).** The inline customer-confirmed wipe in +`internal/localapi/disks.go` `handleDiskFormat` inspected and gate-bound the device by its durable id +but then ran `mkfs` on the caller-supplied mutable `/dev` path (`req.Device`). A USB re-enumeration +reassigning that `/dev` node to a different physical disk between inspection and `mkfs` (a +classify→mkfs TOCTOU) could wipe the wrong drive. + +- New `internal/localapi/wipe_reresolve.go`: `antiRetargetResolve` (injected-deps, unit-tested) mirrors + `signedjobs.WipeExecutor.Execute` — resolve the confirmed durable id → current device, re-derive the + device's durable id and require an exact match, re-inspect (still data-bearing), and return the + re-resolved device. `(*Server).reresolveDurableForWipe` wires the real storage funcs. +- `handleDiskFormat` now formats the **re-resolved** device, never `req.Device`; any refusal → + `409 Conflict`, no `mkfs`. Injectable `reresolveWipe` seam on `Server` (defaults to the real path). +- Tests: `wipe_reresolve_test.go` covers happy-path, empty/gone/blank, re-inspect-error, and the core + `retarget-mismatch-refused` case. Round-trip safe for legitimate wipes (`DeviceDurableID` ↔ + `ResolveDurableDevice` schemes match). Agent-only deploy; no golden rebake. See `AGENT-001-FIX-NOTES.md`. + ## v0.29.1 — lanresolver: RESTART dnsmasq on change (not reload) — fixes stale split-horizon IP (2026-06-13) **Bug:** after a guest's DHCP IP moved (e.g. the v0.29.0 9201 re-provision: .151 → .141), the LAN diff --git a/cmd/felhom-agent/main.go b/cmd/felhom-agent/main.go index 17c69f7..64cc634 100644 --- a/cmd/felhom-agent/main.go +++ b/cmd/felhom-agent/main.go @@ -43,7 +43,7 @@ import ( // version is the agent version. Overridable at build time with // -ldflags "-X main.version="; defaults to the in-repo CHANGELOG version. -var version = "0.29.1" +var version = "0.30.0" func main() { var (