aa7ca96e95
harden security: file permissions, WebSocket accept validation, backoff jitter
...
- Self-update: write binary with 0700 permissions instead of 0755
- WebSocket: validate Sec-WebSocket-Accept per RFC 6455 to prevent MITM
- WebSocket: add computeAcceptKey helper with correct RFC 6455 GUID
- Agent: add nextBackoff with 25% jitter to prevent thundering herd
2026-02-12 10:33:17 -06:00
ab2c28c595
harden security: frame limits, HTTPS enforcement, checksum validation, download bounds
...
- WebSocket: reject frames exceeding 16 MB to prevent OOM
- MikroTik: reject words exceeding 10 MB to prevent OOM
- Self-update: require HTTPS for download URLs
- Self-update: require non-empty SHA256 checksum
- Self-update: use constant-time comparison for checksum verification
- Self-update: bound download size to 100 MB
2026-02-12 10:24:49 -06:00
82f5698802
combine WebSocket frame header and payload into single write
...
Build the entire frame (header + mask key + masked payload) in one
buffer and write it with a single syscall instead of two separate
writes. Removes the failOnNthWrite test that tested the old
two-write implementation detail.
2026-02-12 09:54:31 -06:00
fbaf7a07dc
buffer WebSocket reads to reduce syscalls
...
Wrap the WebSocket connection in an 8KB bufio.Reader so that small
reads (2-byte frame headers, length extensions) are served from
buffer instead of making individual syscalls.
2026-02-12 09:53:16 -06:00
a36a2b7fd7
increase test coverage and improve logger output
2026-02-11 10:42:19 -06:00
58d1af4f84
refactor some code
2026-02-11 10:17:01 -06:00
769ac1f623
Full rewrite in golang
2026-02-11 10:04:30 -06:00
