feat(connd): own all connectivity logic #723

vmenge · 2025-09-23T12:39:57Z

new

ensures default hotspot wlan profile is created on startup
ensures default cellular wwan profile is created on startup
imports existing wpa-supplicant conf to NetworkManager on startup then deletes old file
smart switching enabled, using url https://fleet.orb.worldcoin.org/api/v2/online_check for conn check
offers dbus methods to
- apply wifi qr code
- apply netconfig qr code (complete with orb-app signature verification, cc @max-pankin)
- check if we have internet connectivity

changed

mmcli refactored to be behind ModemManager for testing
dogstatd::Client refactored to be behind StatdClient for testing
iccid is optional when reporting to backend-status

related PRs

https://github.com/worldcoin/priv-orb-core/pull/1744
https://github.com/worldcoin/orb-os/pull/1234

todo

on startup clean network-mangaer/varlib on /usr/persistent if too big (.lease and seen-bssids only)

manual tests

(performed on a dev orb)

semgrep-code-worldcoin · 2025-09-23T12:44:46Z

orb-connd/src/telemetry/net_stats.rs

-            .trim()
-            .parse()?;
+        let tx_bytes = String::from_utf8_lossy(&fs::read(tx_path).await?).parse()?;
+        let rx_bytes = String::from_utf8_lossy(&fs::read(rx_path).await?).parse()?;


Semgrep identified an issue in your code:
The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

Dataflow graph

flowchart LR classDef invis fill:white, stroke: none classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none subgraph File0["orb-connd/src/telemetry/net_stats.rs"] direction LR %% Source subgraph Source direction LR v0["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L14 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 14] sysfs</a>"] end %% Intermediate subgraph Traces0[Traces] direction TB v2["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L14 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 14] stats_path</a>"] v3["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L22 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 22] rx_path</a>"] end v2 --> v3 %% Sink subgraph Sink direction LR v1["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L25 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 25] rx_path</a>"] end end %% Class Assignment Source:::invis Sink:::invis Traces0:::invis File0:::invis %% Connections Source --> Traces0 Traces0 --> Sink

Loading

To resolve this comment:

✨ Commit Assistant Fix Suggestion

Validate and sanitize the iface variable before using it in the file path. Only allow valid interface names (e.g., containing only alphanumeric characters, dashes and underscores). For example, add a check like: if !iface.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') { return Err(...); } before composing the path.

Optionally, check that the resulting stats_path stays within the expected sysfs directory to prevent directory traversal, by canonicalizing the constructed path and confirming it starts with your intended sysfs root.

Handle the case where the path does not exist or is not a regular file by returning an error before reading with fs::read.

Alternatively, if interface names are coming from a trusted system source, ensure this trust by documenting and enforcing the boundaries of where interface names can originate.

These checks will mitigate path traversal risks by ensuring that an attacker cannot manipulate iface to point to unintended files.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by tainted-path.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-worldcoin · 2025-09-23T12:44:46Z

orb-connd/src/telemetry/net_stats.rs

-            .ok_or_else(|| eyre!("Missing tx_bytes info line."))?
-            .trim()
-            .parse()?;
+        let tx_bytes = String::from_utf8_lossy(&fs::read(tx_path).await?).parse()?;


Semgrep identified an issue, but thinks it may be safe to ignore.
The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

Why this might be safe to ignore:

The code reads kernel sysfs paths built from an internal sysfs base and an interface name (used for local telemetry), not from untrusted external input; this is expected behavior for collecting stats and not a remotely exploitable path-traversal in normal use. If iface/sysfs can be set from untrusted sources, validate/sanitize them before joining paths.

Dataflow graph

flowchart LR classDef invis fill:white, stroke: none classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none subgraph File0["orb-connd/src/telemetry/net_stats.rs"] direction LR %% Source subgraph Source direction LR v0["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L14 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 14] sysfs</a>"] end %% Intermediate subgraph Traces0[Traces] direction TB v2["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L14 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 14] stats_path</a>"] v3["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L21 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 21] tx_path</a>"] end v2 --> v3 %% Sink subgraph Sink direction LR v1["<a href=https://github.com/worldcoin/orb-software/blob/4df282d5a78c351722bc55606e5c68f7c72e3e8d/orb-connd/src/telemetry/net_stats.rs#L24 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 24] tx_path</a>"] end end %% Class Assignment Source:::invis Sink:::invis Traces0:::invis File0:::invis %% Connections Source --> Traces0 Traces0 --> Sink

Loading

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by tainted-path.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

…d-nm

semgrep-code-worldcoin · 2025-09-23T18:14:54Z

orb-connd/src/service/mod.rs

+
+    pub async fn import_wpa_conf(&self, wpa_conf_dir: impl AsRef<Path>) -> Result<()> {
+        let wpa_conf = wpa_conf_dir.as_ref().join("wpa_supplicant-wlan0.conf");
+        match File::open(&wpa_conf).await {


Semgrep identified an issue in your code:
The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

Dataflow graph

flowchart LR classDef invis fill:white, stroke: none classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none subgraph File0["orb-connd/src/service/mod.rs"] direction LR %% Source subgraph Source direction LR v0["<a href=https://github.com/worldcoin/orb-software/blob/9eb3d14a7f73d26ea277dee93d1354dd1855a6a5/orb-connd/src/service/mod.rs#L118 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 118] wpa_conf_dir</a>"] end %% Intermediate subgraph Traces0[Traces] direction TB v2["<a href=https://github.com/worldcoin/orb-software/blob/9eb3d14a7f73d26ea277dee93d1354dd1855a6a5/orb-connd/src/service/mod.rs#L118 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 118] wpa_conf</a>"] end %% Sink subgraph Sink direction LR v1["<a href=https://github.com/worldcoin/orb-software/blob/9eb3d14a7f73d26ea277dee93d1354dd1855a6a5/orb-connd/src/service/mod.rs#L119 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 119] &wpa_conf</a>"] end end %% Class Assignment Source:::invis Sink:::invis Traces0:::invis File0:::invis %% Connections Source --> Traces0 Traces0 --> Sink

Loading

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by tainted-path.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

stupid clanker

…d-nm

… a good boy in the future and will fix the tests

…d-nm

…vm/connd-nm

… will be a good boy in the future and will fix the tests" This reverts commit 82228f6.

This reverts commit a51d349.

valff · 2025-10-01T20:04:31Z

orb-connd/src/service/wifi.rs

+        let wifi_str = wifi_str.replace("WIFI:", "");
+        let map: HashMap<_, _> = wifi_str
+            .split(";")
+            .flat_map(|entry| entry.split_once(":"))
+            .collect();
+
+        let sec = map
+            .get("T")
+            .and_then(|sec| WifiSec::parse(sec))
+            .wrap_err_with(|| {
+                format!("invalid or missing wifi sec on qr code: {wifi_str}")
+            })?;
+
+        let ssid = map
+            .get("S")
+            .wrap_err_with(|| format!("missing wifi ssid on qr code: {wifi_str}"))?
+            .to_string();
+
+        let hidden = map
+            .get("H")
+            .map(|h| h.parse())
+            .transpose()?
+            .unwrap_or_default();
+
+        let psk = map.get("P").map(|p| p.to_string());


Why not keep using the existing nom-based Mecard parser for this?

switched back to nom parser, but removed hex encoding for ssids (kept it for pws, but changed check to make sure psks are 64 chars to avoid false positives)

valff · 2025-10-01T20:06:15Z

orb-connd/src/service/netconfig.rs

+}
+
+impl NetConfig {
+    pub fn parse(netconfig_str: &str) -> Result<NetConfig> {


Have you considered using nom crate for this kind of parser?

valff

Also by the standard, the entries could be hex-encoded.

valff · 2025-10-01T20:13:29Z

orb-connd/src/service/netconfig.rs

+
+impl NetConfig {
+    pub fn parse(netconfig_str: &str) -> Result<NetConfig> {
+        let netconfig_str = netconfig_str.replace("WIFI:", "");


What if there is an SSID named MYWIFI:HOME? A real parser wouldn't have this issue.

valff · 2025-10-01T20:15:02Z

orb-connd/src/service/netconfig.rs

+        let map: HashMap<_, _> = netconfig_str
+            .split(";")
+            .flat_map(|entry| entry.split_once(":"))
+            .collect();


If there is an entry without a colon, we ignore it. Perhaps this is fine.
But what if there is a password that contains a colon? This is quite common.

Ok, a password with a colon would pass, because we use split_once here, and it would be something like this: P:abc:def

But what if the password contains ;? What if it contains \"? What if it's quoted?

…m/connd-nm

vmenge added 8 commits September 8, 2025 09:54

wip

6e1f5f2

wip

49cf408

wip

380824f

doom didnt use .git so why should my commits be small

0127ded

fix qr code verification

04ac434

netconfig parsing

60d4638

apply netconfig qr

7276631

fleet mngmt online check uri

4df282d

semgrep-code-worldcoin bot reviewed Sep 23, 2025

View reviewed changes

vmenge added 3 commits September 23, 2025 17:37

magic qr

0ebd178

import wpa conf on startup

9eb3d14

Merge branch 'main' of github.com:worldcoin/orb-software into vm/conn…

e1911ac

…d-nm

semgrep-code-worldcoin bot reviewed Sep 23, 2025

View reviewed changes

vmenge added 5 commits September 23, 2025 20:30

clippy

30879bb

has_connectivity

7e47312

fix: xtask ssh

50b07ff

small fixes

d13ba66

Merge branch 'main' of github.com:worldcoin/orb-software into vm/conn…

6622f93

…d-nm

vmenge force-pushed the vm/connd-nm branch from 2d2df52 to 6622f93 Compare September 24, 2025 08:25

AlexKaravaev and others added 10 commits September 24, 2025 13:53

REVERT ME temporary disable macos test to enable deployments

a51d349

REVERT ME: i am vmenge and i my tests are not passing ever, i will be…

82228f6

… a good boy in the future and will fix the tests

fix tests

ae77c65

Merge branch 'main' of github.com:worldcoin/orb-software into vm/conn…

e4c83f2

…d-nm

Merge branch 'vm/connd-nm' of github.com:worldcoin/orb-software into …

b6404bc

…vm/connd-nm

Revert "REVERT ME: i am vmenge and i my tests are not passing ever, i…

a5bb639

… will be a good boy in the future and will fix the tests" This reverts commit 82228f6.

Revert "REVERT ME temporary disable macos test to enable deployments"

a7894c8

This reverts commit a51d349.

backend status connd report

15b7d70

connd report to backend

5ebf43d

clippy

81e79ef

vmenge added 6 commits September 29, 2025 13:22

macos test ignore 🙄

873e57d

allow force apply of wifi qr

6a7d86f

remove skip restrictions

85df86c

i hate macos so much its unreal

c22d6bf

dont block wifi reporting on failed primary conn query

47f504f

stop devs (me) from bricking orbs. improve logging

4cc812b

valff reviewed Oct 1, 2025

View reviewed changes

vmenge added 18 commits October 2, 2025 12:44

ruh roh

f6fddc1

lint

ac9ed65

disable wifi power saving just in case

e734281

fix for lte-less orbs

776cd39

yes clippy sure clippy

e777cfc

wip

a5c46f1

clankers are dumb

52afb7e

fixing clanker nonsense

b801749

re enable signed test

e1d27d7

more sig verification tests

e7b4ef0

wip

0fb3674

new fixture

926f3ff

default wifi profile test

d52c3e6

default to unlimited autoconnect retries

969a06c

deactivate active wifi on profile adding

713f255

Merge branch 'main' of ssh://github.com/worldcoin/orb-software into v…

773a385

…m/connd-nm

rust, wtf

0b3bd51

better profile switch logic on new conn

3f74135

vmenge marked this pull request as ready for review October 9, 2025 09:11

vmenge requested a review from a team as a code owner October 9, 2025 09:11

feat(connd): own all connectivity logic #723

Are you sure you want to change the base?

feat(connd): own all connectivity logic #723

Uh oh!

Conversation

vmenge commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

new

changed

related PRs

todo

manual tests

Uh oh!

semgrep-code-worldcoin bot Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

semgrep-code-worldcoin bot Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

semgrep-code-worldcoin bot Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

valff left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vmenge commented Sep 23, 2025 •

edited

Loading