Commit graph

8 commits

Author SHA1 Message Date
7606c0aa6c
fix: address bugs and security gaps found in code audit
- HTTP checks: use io.ReadAll with LimitReader instead of single Read()
  to handle bodies spanning multiple TCP segments
- HTTP checks: enforce TLS 1.2 minimum, matching websocket and mikrotik
- Ping/credential jobs: use select/default for channel sends to prevent
  goroutine leaks when result channel is full
- LLDP: check strconv.Atoi errors in IPv6 address parsing instead of
  silently producing incorrect addresses
- SNMP: use comma-ok type assertions in snmpValueToString to prevent
  panics from malformed device responses
- WebSocket: read handshake response line-by-line via bufio.Reader
  instead of single conn.Read that could miss multi-segment responses
2026-03-05 12:24:21 -06:00
4f5be74528 security: implement audit fixes (TOFU host keys, update TOCTOU, TLS enforcement, read timeouts) 2026-02-15 09:06:39 -06:00
a0516c2bd1
security: use net.JoinHostPort for SSH addresses to support IPv6
fmt.Sprintf("%s:%d") produces invalid addresses for IPv6. Also adds
mockable sshDial variable for testability.
2026-02-12 10:58:28 -06:00
e014e9ccd4
harden security: URL sanitization, security docs, credential zeroing utility
- Mask query parameters in log output to prevent credential leakage
- Document InsecureSkipVerify rationale for MikroTik self-signed certs
- Document InsecureIgnoreHostKey rationale for SSH device connections
- Add zeroBytes utility for future byte-slice credential clearing
2026-02-12 10:35:42 -06:00
94192f402a
propagate context to job executors for cancellation on disconnect 2026-02-12 09:59:45 -06:00
a36a2b7fd7
increase test coverage and improve logger output 2026-02-11 10:42:19 -06:00
58d1af4f84
refactor some code 2026-02-11 10:17:01 -06:00
769ac1f623
Full rewrite in golang 2026-02-11 10:04:30 -06:00