|
|
6bf9584cb2
|
test: push coverage from 92% to 97.6% (249 tests)
Refactor main.go to extract testable runMain() function, make
icmpListenPacket and syscallExec injectable, fix worker pool tests
to properly fill queue buffers (n*4 capacity). Add comprehensive
tests for CLI argument parsing, ping exec fallback, ICMP timeout
paths, self-update happy path, and SNMP context cancellation.
|
2026-03-04 16:35:02 -06:00 |
|
|
|
4f5be74528
|
security: implement audit fixes (TOFU host keys, update TOCTOU, TLS enforcement, read timeouts)
|
2026-02-15 09:06:39 -06:00 |
|
|
|
442b019b0b
|
security: sanitize token from re-exec log line
os.Args logged during self-update re-exec could expose --token value
in plaintext to log aggregators. sanitizeArgs masks the value.
|
2026-02-12 10:59:08 -06:00 |
|
|
|
aa7ca96e95
|
harden security: file permissions, WebSocket accept validation, backoff jitter
- Self-update: write binary with 0700 permissions instead of 0755
- WebSocket: validate Sec-WebSocket-Accept per RFC 6455 to prevent MITM
- WebSocket: add computeAcceptKey helper with correct RFC 6455 GUID
- Agent: add nextBackoff with 25% jitter to prevent thundering herd
|
2026-02-12 10:33:17 -06:00 |
|
|
|
ab2c28c595
|
harden security: frame limits, HTTPS enforcement, checksum validation, download bounds
- WebSocket: reject frames exceeding 16 MB to prevent OOM
- MikroTik: reject words exceeding 10 MB to prevent OOM
- Self-update: require HTTPS for download URLs
- Self-update: require non-empty SHA256 checksum
- Self-update: use constant-time comparison for checksum verification
- Self-update: bound download size to 100 MB
|
2026-02-12 10:24:49 -06:00 |
|
|
|
5ad95fac42
|
fix errcheck lint violations in test files
|
2026-02-11 10:48:41 -06:00 |
|
|
|
a36a2b7fd7
|
increase test coverage and improve logger output
|
2026-02-11 10:42:19 -06:00 |
|
|
|
58d1af4f84
|
refactor some code
|
2026-02-11 10:17:01 -06:00 |
|
|
|
769ac1f623
|
Full rewrite in golang
|
2026-02-11 10:04:30 -06:00 |
|
