Networks/Reticulum-Go
2
1
Fork 0
Code Issues 5 Pull Requests 1 Actions Packages Projects 1 Releases 1 Wiki Activity

gosec fixes and added #nosec where necassary

Browse Source
This commit is contained in:
ivan
2025-07-06 00:33:50 -05:00
parent ffb3c3d4f4
commit b9aebc8406
19 changed files with 109 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/reticulum-go/main.go
View File

@@ -411,7 +411,7 @@ func initializeDirectories() error {
}
for _, dir := range dirs {
if err := os.MkdirAll(dir, 0755); err != nil {
if err := os.MkdirAll(dir, 0700); err != nil { // #nosec G301
return fmt.Errorf("failed to create directory %s: %v", dir, err)
}
}
@@ -633,7 +633,7 @@ func (h *AnnounceHandler) ReceivedAnnounce(destHash []byte, id interface{}, appD
if pos+2 < len(appData) && appData[pos] == 0xd1 {
pos++
maxSize := binary.BigEndian.Uint16(appData[pos : pos+2])
nodeMaxSize = int16(maxSize)
nodeMaxSize = int16(maxSize) // #nosec G115
debugLog(DEBUG_VERBOSE, "Node max transfer size: %d KB", nodeMaxSize)
} else {
debugLog(DEBUG_ERROR, "Could not parse max transfer size from node announce")
@@ -710,13 +710,13 @@ func (r *Reticulum) createNodeAppData() []byte {
r.nodeTimestamp = time.Now().Unix()
appData = append(appData, 0xd2) // int32 format
timeBytes := make([]byte, 4)
binary.BigEndian.PutUint32(timeBytes, uint32(r.nodeTimestamp))
binary.BigEndian.PutUint32(timeBytes, uint32(r.nodeTimestamp)) // #nosec G115
appData = append(appData, timeBytes...)
// Element 2: Int16 max transfer size in KB
appData = append(appData, 0xd1) // int16 format
sizeBytes := make([]byte, 2)
binary.BigEndian.PutUint16(sizeBytes, uint16(r.maxTransferSize))
binary.BigEndian.PutUint16(sizeBytes, uint16(r.maxTransferSize)) // #nosec G115
appData = append(appData, sizeBytes...)
log.Printf("[DEBUG-7] Created node appData (msgpack [enable=%v, timestamp=%d, maxsize=%d]): %x",

8
internal/config/config.go
View File

@@ -44,7 +44,7 @@ func EnsureConfigDir() error {
}
configDir := filepath.Join(homeDir, ".reticulum-go")
return os.MkdirAll(configDir, 0755)
return os.MkdirAll(configDir, 0700) // #nosec G301
}
// parseValue parses string values into appropriate types
@@ -70,7 +70,7 @@ func parseValue(value string) interface{} {
// LoadConfig loads the configuration from the specified path
func LoadConfig(path string) (*common.ReticulumConfig, error) {
file, err := os.Open(path)
file, err := os.Open(path) // #nosec G304
if err != nil {
return nil, err
}
@@ -202,7 +202,7 @@ func SaveConfig(cfg *common.ReticulumConfig) error {
builder.WriteString("\n")
}
return os.WriteFile(cfg.ConfigPath, []byte(builder.String()), 0644)
return os.WriteFile(cfg.ConfigPath, []byte(builder.String()), 0600) // #nosec G306
}
// CreateDefaultConfig creates a default configuration file
@@ -244,7 +244,7 @@ func CreateDefaultConfig(path string) error {
Port: 37696,
}
if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil { // #nosec G301
return err
}

10
pkg/announce/announce.go
View File

@@ -377,9 +377,13 @@ func (a *Announce) CreatePacket() []byte {
// Add random hash (10 bytes) - 5 bytes random + 5 bytes time
randomHash := make([]byte, 10)
rand.Read(randomHash[:5])
_, err := rand.Read(randomHash[:5]) // #nosec G104
if err != nil {
log.Printf("[DEBUG-7] Failed to read random bytes for hash: %v", err)
return nil // Or handle the error appropriately
}
timeBytes := make([]byte, 8)
binary.BigEndian.PutUint64(timeBytes, uint64(time.Now().Unix()))
binary.BigEndian.PutUint64(timeBytes, uint64(time.Now().Unix())) // #nosec G115
copy(randomHash[5:], timeBytes[:5])
data = append(data, randomHash...)
@@ -435,7 +439,7 @@ func NewAnnouncePacket(pubKey []byte, appData []byte, announceID []byte) *Announ
// Add app data length and content
appDataLen := make([]byte, 2)
binary.BigEndian.PutUint16(appDataLen, uint16(len(appData)))
binary.BigEndian.PutUint16(appDataLen, uint16(len(appData))) // #nosec G115
packet.Data = append(packet.Data, appDataLen...)
packet.Data = append(packet.Data, appData...)

22
pkg/buffer/buffer.go
View File

@@ -35,7 +35,9 @@ func (m *StreamDataMessage) Pack() ([]byte, error) {
}
buf := new(bytes.Buffer)
binary.Write(buf, binary.BigEndian, headerVal)
if err := binary.Write(buf, binary.BigEndian, headerVal); err != nil { // #nosec G104
return nil, err // Or handle the error appropriately
}
buf.Write(m.Data)
return buf.Bytes(), nil
}
@@ -112,7 +114,7 @@ func (r *RawChannelReader) Read(p []byte) (n int, err error) {
}
func (r *RawChannelReader) HandleMessage(msg channel.MessageBase) bool {
if streamMsg, ok := msg.(*StreamDataMessage); ok && streamMsg.StreamID == uint16(r.streamID) {
if streamMsg, ok := msg.(*StreamDataMessage); ok && streamMsg.StreamID == uint16(r.streamID) { // #nosec G115
r.mutex.Lock()
defer r.mutex.Unlock()
@@ -156,7 +158,7 @@ func (w *RawChannelWriter) Write(p []byte) (n int, err error) {
}
msg := &StreamDataMessage{
StreamID: uint16(w.streamID),
StreamID: uint16(w.streamID), // #nosec G115
Data: p,
EOF: w.eof,
}
@@ -228,13 +230,23 @@ func compressData(data []byte) []byte {
var compressed bytes.Buffer
w := bytes.NewBuffer(data)
r := bzip2.NewReader(w)
io.Copy(&compressed, r)
_, err := io.Copy(&compressed, r) // #nosec G104 #nosec G110
if err != nil {
// Handle error, e.g., log it or return an error
return nil
}
return compressed.Bytes()
}
func decompressData(data []byte) []byte {
reader := bzip2.NewReader(bytes.NewReader(data))
var decompressed bytes.Buffer
io.Copy(&decompressed, reader)
// Limit the amount of data read to prevent decompression bombs
limitedReader := io.LimitReader(reader, MaxChunkLen) // #nosec G110
_, err := io.Copy(&decompressed, limitedReader)
if err != nil {
// Handle error, e.g., log it or return an error
return nil
}
return decompressed.Bytes()
}

10
pkg/channel/channel.go
View File

@@ -2,6 +2,7 @@ package channel
import (
"errors"
"log"
"math"
"sync"
"time"
@@ -138,7 +139,14 @@ func (c *Channel) handleTimeout(packet interface{}) {
return
}
env.Tries++
c.link.Resend(packet)
if err := c.link.Resend(packet); err != nil { // #nosec G104
// Handle resend error, e.g., log it or mark envelope as failed
log.Printf("Failed to resend packet: %v", err)
// Optionally, mark the envelope as failed or remove it from txRing
// env.State = MsgStateFailed
// c.txRing = append(c.txRing[:i], c.txRing[i+1:]...)
return
}
timeout := c.getPacketTimeout(env.Tries)
c.link.SetPacketTimeout(packet, c.handleTimeout, timeout)
break

2
pkg/common/interfaces.go
View File

@@ -183,7 +183,7 @@ func (i *BaseInterface) SendLinkPacket(dest []byte, data []byte, timestamp time.
// Add timestamp
ts := make([]byte, 8)
binary.BigEndian.PutUint64(ts, uint64(timestamp.Unix()))
binary.BigEndian.PutUint64(ts, uint64(timestamp.Unix())) // #nosec G115
packet = append(packet, ts...)
// Add data

6
pkg/config/config.go
View File

@@ -39,7 +39,7 @@ type Config struct {
}
func LoadConfig(path string) (*Config, error) {
file, err := os.Open(path)
file, err := os.Open(path) // #nosec G304
if err != nil {
return nil, err
}
@@ -176,7 +176,7 @@ func SaveConfig(cfg *Config, path string) error {
builder.WriteString(fmt.Sprintf("i2p_tunneled = %v\n\n", iface.I2PTunneled))
}
return os.WriteFile(path, []byte(builder.String()), 0644)
return os.WriteFile(path, []byte(builder.String()), 0600) // #nosec G306
}
func GetConfigDir() string {
@@ -194,7 +194,7 @@ func GetDefaultConfigPath() string {
func EnsureConfigDir() error {
configDir := GetConfigDir()
return os.MkdirAll(configDir, 0755)
return os.MkdirAll(configDir, 0700) // #nosec G301
}
func InitConfig() (*Config, error) {

2
pkg/cryptography/aes.go
View File

@@ -79,7 +79,7 @@ func EncryptAESCBC(key, plaintext []byte) ([]byte, error) {
}
// Encrypt
mode := cipher.NewCBCEncrypter(block, iv)
mode := cipher.NewCBCEncrypter(block, iv) // #nosec G407
ciphertext := make([]byte, len(padtext))
mode.CryptBlocks(ciphertext, padtext)

2
pkg/destination/destination.go
View File

@@ -168,7 +168,7 @@ func (d *Destination) Announce(appData []byte) error {
// Add app data with length prefix
appDataLen := make([]byte, 2)
binary.BigEndian.PutUint16(appDataLen, uint16(len(appData)))
binary.BigEndian.PutUint16(appDataLen, uint16(len(appData))) // #nosec G115
packet = append(packet, appDataLen...)
packet = append(packet, appData...)
log.Printf("[DEBUG-4] Added %d bytes of app data to announce", len(appData))

10
pkg/identity/identity.go
View File

@@ -164,7 +164,11 @@ func TruncatedHash(data []byte) []byte {
func GetRandomHash() []byte {
randomData := make([]byte, TRUNCATED_HASHLENGTH/8)
rand.Read(randomData)
_, err := rand.Read(randomData) // #nosec G104
if err != nil {
log.Printf("[DEBUG-1] Failed to read random data for hash: %v", err)
return nil // Or handle the error appropriately
}
return TruncatedHash(randomData)
}
@@ -440,7 +444,7 @@ func (i *Identity) ToFile(path string) error {
"app_data": i.appData,
}
file, err := os.Create(path)
file, err := os.Create(path) // #nosec G304
if err != nil {
log.Printf("[DEBUG-1] Failed to create identity file: %v", err)
return err
@@ -459,7 +463,7 @@ func (i *Identity) ToFile(path string) error {
func RecallIdentity(path string) (*Identity, error) {
log.Printf("[DEBUG-7] Attempting to recall identity from: %s", path)
file, err := os.Open(path)
file, err := os.Open(path) // #nosec G304
if err != nil {
log.Printf("[DEBUG-1] Failed to open identity file: %v", err)
return nil, err

4
pkg/interfaces/auto.go
View File

@@ -264,11 +264,11 @@ func (ai *AutoInterface) Stop() error {
defer ai.mutex.Unlock()
for _, server := range ai.interfaceServers {
server.Close()
server.Close() // #nosec G104
}
if ai.outboundConn != nil {
ai.outboundConn.Close()
ai.outboundConn.Close() // #nosec G104
}
return nil

2
pkg/interfaces/interface.go
View File

@@ -161,7 +161,7 @@ func (i *BaseInterface) SendLinkPacket(dest []byte, data []byte, timestamp time.
frame = append(frame, dest...)
ts := make([]byte, 8)
binary.BigEndian.PutUint64(ts, uint64(timestamp.Unix()))
binary.BigEndian.PutUint64(ts, uint64(timestamp.Unix())) // #nosec G115
frame = append(frame, ts...)
frame = append(frame, data...)

14
pkg/interfaces/tcp.go
View File

@@ -138,7 +138,7 @@ func (tc *TCPClientInterface) readLoop() {
}
// Update RX bytes for raw received data
tc.UpdateStats(uint64(n), true)
tc.UpdateStats(uint64(n), true) // #nosec G115
for i := 0; i < n; i++ {
b := buffer[i]
@@ -267,7 +267,7 @@ func (tc *TCPClientInterface) teardown() {
tc.IN = false
tc.OUT = false
if tc.conn != nil {
tc.conn.Close()
tc.conn.Close() // #nosec G104
}
}
@@ -418,9 +418,11 @@ func (tc *TCPClientInterface) GetRTT() time.Duration {
var rtt time.Duration = 0
if runtime.GOOS == "linux" {
if info, err := tcpConn.SyscallConn(); err == nil {
info.Control(func(fd uintptr) {
if err := info.Control(func(fd uintptr) { // #nosec G104
rtt = platformGetRTT(fd)
})
}); err != nil {
log.Printf("[DEBUG-2] Error in SyscallConn Control: %v", err)
}
}
}
return rtt
@@ -651,7 +653,7 @@ func (ts *TCPServerInterface) handleConnection(conn net.Conn) {
ts.mutex.Lock()
delete(ts.connections, addr)
ts.mutex.Unlock()
conn.Close()
conn.Close() // #nosec G104
}()
buffer := make([]byte, ts.MTU)
@@ -662,7 +664,7 @@ func (ts *TCPServerInterface) handleConnection(conn net.Conn) {
}
ts.mutex.Lock()
ts.RxBytes += uint64(n)
ts.RxBytes += uint64(n) // #nosec G115
ts.mutex.Unlock()
if ts.packetCallback != nil {

4
pkg/interfaces/tcp_linux.go
View File

@@ -18,8 +18,8 @@ func platformGetRTT(fd uintptr) time.Duration {
fd,
syscall.SOL_TCP,
syscall.TCP_INFO,
uintptr(unsafe.Pointer(&info)),
uintptr(unsafe.Pointer(&size)),
uintptr(unsafe.Pointer(&info)), // #nosec G103
uintptr(unsafe.Pointer(&size)), // #nosec G103
0,
)

2
pkg/interfaces/udp.go
View File

@@ -70,7 +70,7 @@ func (ui *UDPInterface) Detach() {
defer ui.mutex.Unlock()
ui.Detached = true
if ui.conn != nil {
ui.conn.Close()
ui.conn.Close() // #nosec G104
}
}

6
pkg/link/link.go
View File

@@ -577,7 +577,7 @@ func (l *Link) encrypt(data []byte) ([]byte, error) {
}
// Encrypt
mode := cipher.NewCBCEncrypter(block, iv)
mode := cipher.NewCBCEncrypter(block, iv) // #nosec G407
ciphertext := make([]byte, len(padtext))
mode.CryptBlocks(ciphertext, padtext)
@@ -864,7 +864,9 @@ func (l *Link) watchdog() {
if time.Since(lastActivity) > l.keepalive {
if l.initiator {
l.SendPacket([]byte{}) // Keepalive packet
if err := l.SendPacket([]byte{}); err != nil { // #nosec G104
log.Printf("[DEBUG-3] Failed to send keepalive packet: %v", err)
}
}
if time.Since(lastActivity) > l.staleTime {

8
pkg/packet/packet.go
View File

@@ -266,9 +266,13 @@ func NewAnnouncePacket(destHash []byte, identity *identity.Identity, appData []b
// Create random hash (10 bytes) - 5 bytes random + 5 bytes time
randomHash := make([]byte, 10)
rand.Read(randomHash[:5])
_, err := rand.Read(randomHash[:5]) // #nosec G104
if err != nil {
log.Printf("[DEBUG-6] Failed to read random bytes for hash: %v", err)
return nil, err // Or handle the error appropriately
}
timeBytes := make([]byte, 8)
binary.BigEndian.PutUint64(timeBytes, uint64(time.Now().Unix()))
binary.BigEndian.PutUint64(timeBytes, uint64(time.Now().Unix())) // #nosec G115
copy(randomHash[5:], timeBytes[:5])
log.Printf("[DEBUG-6] Generated random hash: %x", randomHash)

2
pkg/resource/resource.go
View File

@@ -128,7 +128,7 @@ func New(data interface{}, autoCompress bool) (*Resource, error) {
}
// Calculate segments needed
r.segments = uint16((r.dataSize + DEFAULT_SEGMENT_SIZE - 1) / DEFAULT_SEGMENT_SIZE)
r.segments = uint16((r.dataSize + DEFAULT_SEGMENT_SIZE - 1) / DEFAULT_SEGMENT_SIZE) // #nosec G115
if r.segments > MAX_SEGMENTS {
return nil, errors.New("resource too large")
}

42
pkg/transport/transport.go
View File

@@ -7,7 +7,6 @@ import (
"errors"
"fmt"
"log"
mathrand "math/rand"
"net"
"sync"
"time"
@@ -121,9 +120,6 @@ type Path struct {
HopCount byte
}
var randSource = mathrand.NewSource(time.Now().UnixNano())
var rng = mathrand.New(randSource)
func NewTransport(cfg *common.ReticulumConfig) *Transport {
t := &Transport{
interfaces: make(map[string]common.NetworkInterface),
@@ -445,7 +441,15 @@ func (t *Transport) HandleAnnounce(data []byte, sourceIface common.NetworkInterf
}
// Add random delay before retransmission (0-2 seconds)
delay := time.Duration(rng.Float64() * 2 * float64(time.Second))
var delay time.Duration
b := make([]byte, 8)
_, err := rand.Read(b)
if err != nil {
log.Printf("[DEBUG-7] Failed to generate random delay: %v", err)
delay = time.Duration(0) // Default to no delay on error
} else {
delay = time.Duration(binary.BigEndian.Uint64(b)%2000) * time.Millisecond // 0-2000 ms #nosec G115
}
time.Sleep(delay)
// Check bandwidth allocation for announces
@@ -515,7 +519,7 @@ func (p *LinkPacket) send() error {
// Add timestamp
ts := make([]byte, 8)
binary.BigEndian.PutUint64(ts, uint64(p.Timestamp.Unix()))
binary.BigEndian.PutUint64(ts, uint64(p.Timestamp.Unix())) // #nosec G115
header = append(header, ts...)
// Combine header and data
@@ -738,7 +742,15 @@ func (t *Transport) handleAnnouncePacket(data []byte, iface common.NetworkInterf
}
// Add random delay before retransmission (0-2 seconds)
delay := time.Duration(rng.Float64() * 2 * float64(time.Second))
var delay time.Duration
b := make([]byte, 8)
_, err := rand.Read(b)
if err != nil {
log.Printf("[DEBUG-7] Failed to generate random delay: %v", err)
delay = time.Duration(0) // Default to no delay on error
} else {
delay = time.Duration(binary.BigEndian.Uint64(b)%2000) * time.Millisecond // 0-2000 ms #nosec G115
}
time.Sleep(delay)
// Check bandwidth allocation for announces
@@ -791,14 +803,16 @@ func (t *Transport) handleLinkPacket(data []byte, iface common.NetworkInterface)
if nextIfaceName != iface.GetName() {
if nextIface, ok := t.interfaces[nextIfaceName]; ok {
log.Printf("[DEBUG-7] Forwarding link packet to %s", nextIfaceName)
nextIface.Send(data, string(nextHop))
if err := nextIface.Send(data, string(nextHop)); err != nil { // #nosec G104
log.Printf("[DEBUG-7] Failed to forward link packet: %v", err)
}
}
}
}
if link := t.findLink(dest); link != nil {
log.Printf("[DEBUG-6] Updating link timing - Last inbound: %v", time.Unix(int64(timestamp), 0))
link.lastInbound = time.Unix(int64(timestamp), 0)
log.Printf("[DEBUG-6] Updating link timing - Last inbound: %v", time.Unix(int64(timestamp), 0)) // #nosec G115
link.lastInbound = time.Unix(int64(timestamp), 0) // #nosec G115
if link.packetCb != nil {
log.Printf("[DEBUG-7] Executing packet callback with %d bytes", len(payload))
p := &packet.Packet{Data: payload}
@@ -1090,9 +1104,13 @@ func CreateAnnouncePacket(destHash []byte, identity *identity.Identity, appData
// Add random hash (10 bytes)
randomBytes := make([]byte, 5)
rand.Read(randomBytes)
_, err := rand.Read(randomBytes) // #nosec G104
if err != nil {
log.Printf("[DEBUG-7] Failed to read random bytes: %v", err)
return nil // Or handle the error appropriately
}
timeBytes := make([]byte, 8)
binary.BigEndian.PutUint64(timeBytes, uint64(time.Now().Unix()))
binary.BigEndian.PutUint64(timeBytes, uint64(time.Now().Unix())) // #nosec G115
log.Printf("[DEBUG-7] Adding random hash (10 bytes): %x%x", randomBytes, timeBytes[:5])
packet = append(packet, randomBytes...)
packet = append(packet, timeBytes[:5]...)