KarpelesLab / pktkit / 24002717821

53%

Build Type

push

github

Committed by MagicalTux

Commit Message

Fix medium and low severity security issues across all packages

WireGuard: make now() overridable (default time.Now, opt-in cached clock
via UseCachedTime), per-keypair atomic send counter starting at 0, add
RejectAfterMessages/RekeyAfterTime/RekeyAfterMessages constants with
ErrRekeyRequired sentinel, zero all DH results and ephemeral keys after
use, store conn in atomic.Value, cap handshake/session maps at 10k,
lower DoS load threshold to 20 (configurable), O(1) peer lookup via
peerKey on keypair, delete responder handshake state after key derivation.

OpenVPN: fix data races (atomic.Bool for terminating, lock peers map in
monitor/Terminate), fix TCP peer nil-deref race by creating peer before
goroutine, guard double-close with sync.Once, sanitize AUTH_FAILED error
messages, guard zero-length readControlString.

Core: add bounds checks to SetIPv4SrcAddr/SetIPv4DstAddr, cap ARP/NDP
tables at 4096 entries with expired-entry pruning, cap L2Hub MAC table
at 8192 entries, validate IPv6 hop-limit==255 on NDP (RFC 4861), cap
DHCP leases at 1024.

Slirp: enforce IPv4 Total Length field, validate IHL>=20, cap virtTCP/
virtTCP6 maps at 10k connections.

NAT: validate IHL>=20 on both paths, cap reassembled packet size at
65535, validate FTP PORT octet range 0-255.

vtcp: replace O(n*m) byte-by-byte SACK retransmit scan with O(m^2)
range-based skip, cap out-of-order entries at 128.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

86 of 213 new or added lines in 23 files covered. (40.38%)

3 existing lines in 3 files now uncovered.

5832 of 13082 relevant lines covered (44.58%)

21.84 hits per line