Commit graph

13 commits

Author SHA1 Message Date
e014e9ccd4
harden security: URL sanitization, security docs, credential zeroing utility
- Mask query parameters in log output to prevent credential leakage
- Document InsecureSkipVerify rationale for MikroTik self-signed certs
- Document InsecureIgnoreHostKey rationale for SSH device connections
- Add zeroBytes utility for future byte-slice credential clearing
2026-02-12 10:35:42 -06:00
aa7ca96e95
harden security: file permissions, WebSocket accept validation, backoff jitter
- Self-update: write binary with 0700 permissions instead of 0755
- WebSocket: validate Sec-WebSocket-Accept per RFC 6455 to prevent MITM
- WebSocket: add computeAcceptKey helper with correct RFC 6455 GUID
- Agent: add nextBackoff with 25% jitter to prevent thundering herd
2026-02-12 10:33:17 -06:00
ab2c28c595
harden security: frame limits, HTTPS enforcement, checksum validation, download bounds
- WebSocket: reject frames exceeding 16 MB to prevent OOM
- MikroTik: reject words exceeding 10 MB to prevent OOM
- Self-update: require HTTPS for download URLs
- Self-update: require non-empty SHA256 checksum
- Self-update: use constant-time comparison for checksum verification
- Self-update: bound download size to 100 MB
2026-02-12 10:24:49 -06:00
94192f402a
propagate context to job executors for cancellation on disconnect 2026-02-12 09:59:45 -06:00
04d8349a6c
pool protobuf marshal buffers to reduce allocations
Use sync.Pool to reuse 4KB byte slices for protobuf marshaling via
MarshalAppend instead of allocating fresh buffers per result message.
Reduces GC pressure under high-throughput polling.
2026-02-12 09:55:38 -06:00
da8b644f40
batch SNMP results before sending over WebSocket
Accumulate SNMP results and flush in batches of 50 or every 100ms,
whichever comes first. Reduces per-message overhead when thousands
of devices produce results near-simultaneously. Also flushes
remaining results on disconnect/shutdown.
2026-02-12 09:55:08 -06:00
c57addc6c7
increase channel buffer sizes to handle thousands of devices
Raise write channel from 500 to 10000, SNMP/monitoring result
channels from 1000 to 10000, MikroTik/credential channels to 5000.
Prevents silent data loss when polling thousands of devices.
2026-02-12 09:50:46 -06:00
8b866ae946
add worker pool with bounded concurrency for job dispatch
Replace unbounded goroutine spawning with fixed-size worker pools:
100 workers for SNMP, 20 for MikroTik, 50 for ping. Prevents file
descriptor exhaustion and device overload when handling thousands
of concurrent jobs. Pool provides backpressure when saturated.
2026-02-12 09:50:17 -06:00
07e7ed2745
replace fmt.Sprintf with strconv in hot paths
Use strconv.FormatInt/FormatUint instead of fmt.Sprintf for integer
conversions in snmpValueToString. Use encoding/hex + strings.Builder
instead of fmt.Sprintf loop in formatHex. Use strconv.FormatUint for
WebSocket ref counter. Reduces allocations per OID significantly.
2026-02-12 09:47:42 -06:00
a36a2b7fd7
increase test coverage and improve logger output 2026-02-11 10:42:19 -06:00
58d1af4f84
refactor some code 2026-02-11 10:17:01 -06:00
37f411ec55
cleanup 2026-02-11 10:07:27 -06:00
769ac1f623
Full rewrite in golang 2026-02-11 10:04:30 -06:00