From 033ca2f20e418add1a06571c12571e286ebad783 Mon Sep 17 00:00:00 2001
From: Alejandro Mery <amery@jpi.io>
Date: Thu, 7 Sep 2023 15:33:39 +0000
Subject: [PATCH] zones: validate Machine names

Signed-off-by: Alejandro Mery <amery@jpi.io>
---
 pkg/zones/errors.go       |  8 ++++++++
 pkg/zones/machine_scan.go | 20 +++++++++++++++++---
 2 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 pkg/zones/errors.go

diff --git a/pkg/zones/errors.go b/pkg/zones/errors.go
new file mode 100644
index 0000000..58781cf
--- /dev/null
+++ b/pkg/zones/errors.go
@@ -0,0 +1,8 @@
+package zones
+
+import "errors"
+
+var (
+	// ErrInvalidName indicates the name isn't valid
+	ErrInvalidName = errors.New("invalid name")
+)
diff --git a/pkg/zones/machine_scan.go b/pkg/zones/machine_scan.go
index 52efe6e..aca379e 100644
--- a/pkg/zones/machine_scan.go
+++ b/pkg/zones/machine_scan.go
@@ -4,7 +4,10 @@ import (
 	"context"
 	"net/netip"
 	"strconv"
+	"strings"
 	"time"
+
+	"darvaza.org/core"
 )
 
 // LookupNetIP uses the DNS Resolver to get the public addresses associated
@@ -30,21 +33,32 @@ func (m *Machine) UpdatePublicAddresses() error {
 
 func (m *Machine) init() error {
 	if err := m.setID(); err != nil {
-		return err
+		return core.Wrap(err, m.Name)
 	}
 
 	for i := 0; i < RingsCount; i++ {
 		if err := m.tryReadWireguardKeys(i); err != nil {
-			return err
+			return core.Wrap(err, m.Name)
 		}
 	}
+
 	return nil
 }
 
 func (m *Machine) setID() error {
 	zoneName := m.zone.Name
-	suffix := m.Name[len(zoneName)+1:]
 
+	l := len(zoneName)
+	switch {
+	case len(m.Name) < l+2:
+		return ErrInvalidName
+	case !strings.HasPrefix(m.Name, zoneName):
+		return ErrInvalidName
+	case m.Name[l] != '-':
+		return ErrInvalidName
+	}
+
+	suffix := m.Name[l+1:]
 	id, err := strconv.ParseInt(suffix, 10, 8)
 	if err != nil {
 		return err