From c03cd7361bd010b5b72c112b0ec5bf24a64d1fef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BD=D0=B4=D1=80=D0=B5=D0=B9=20=D0=91=D0=BE=D0=B1?= =?UTF-8?q?=D1=8B=D1=80=D0=B5=D0=B2?= Date: Fri, 5 Jun 2026 20:19:11 +0300 Subject: [PATCH] fix: harden WARP route bridge setup --- app.py | 15 +++++++++++++-- systemd/warp-webui.service | 2 +- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/app.py b/app.py index d4068cd..123e0ca 100755 --- a/app.py +++ b/app.py @@ -367,8 +367,18 @@ RestartSec=2 [Install] WantedBy=multi-user.target """ - with open(unit_path, "w", encoding="utf-8") as f: - f.write(unit) + try: + with open(unit_path, "w", encoding="utf-8") as f: + f.write(unit) + except OSError as e: + log_event("error", "socks_bridge_write_failed", unit=unit_path, error=str(e)) + return { + "unit": unit_path, + "bridge": f"{BRIDGE_HOST}:{BRIDGE_PORT}", + "target": f"127.0.0.1:{target_port}", + "ok": False, + "error": str(e), + } run_cmd(["systemctl", "daemon-reload"]) c1, _, _ = run_cmd(["systemctl", "enable", "--now", "warp-socks-bridge.service"]) c2, out, err = run_cmd(["systemctl", "is-active", "warp-socks-bridge.service"]) @@ -376,6 +386,7 @@ WantedBy=multi-user.target "unit": unit_path, "bridge": f"{BRIDGE_HOST}:{BRIDGE_PORT}", "target": f"127.0.0.1:{target_port}", + "ok": c1 == 0 and c2 == 0, "enable_code": c1, "active": out.strip() if c2 == 0 else "unknown", "stderr": err, diff --git a/systemd/warp-webui.service b/systemd/warp-webui.service index 0d7c130..88125e3 100644 --- a/systemd/warp-webui.service +++ b/systemd/warp-webui.service @@ -14,7 +14,7 @@ NoNewPrivileges=true PrivateTmp=true ProtectSystem=full ProtectHome=true -ReadWritePaths=/run /var/log /etc/default /etc/warp-webui /var/backups/warp-webui /etc/sysctl.d /etc/nftables.conf /etc/iptables +ReadWritePaths=/run /var/log /etc/default /etc/warp-webui /var/backups/warp-webui /etc/sysctl.d /etc/nftables.conf /etc/iptables /etc/systemd/system [Install] WantedBy=multi-user.target