From 13a22db383841ce080047cbf59d38aefacc60b90 Mon Sep 17 00:00:00 2001 From: Paul Hinze Date: Fri, 24 Jul 2026 16:56:58 -0500 Subject: [PATCH 1/2] Delete unused rpc.DefaultTransport, which set InsecureSkipVerify DefaultTransport had no references anywhere outside its own init(). Live client connections build TLS config from State.clientTlsCfg and pin the peer certificate through VerifyPeerCertificate, so nothing ever reached this transport or the InsecureSkipVerify on it. Removing it clears a CodeQL go/disabled-certificate-check alert that was pointing at dead code. DefaultQUICConfig stays, since client.go and State.qc both still use it. --- pkg/rpc/state.go | 9 --------- 1 file changed, 9 deletions(-) diff --git a/pkg/rpc/state.go b/pkg/rpc/state.go index 1be4ee89..29a78c28 100644 --- a/pkg/rpc/state.go +++ b/pkg/rpc/state.go @@ -26,19 +26,12 @@ import ( ) var ( - DefaultTransport http3.Transport DefaultQUICConfig quic.Config DefaultLogLevel = slog.LevelInfo ) func init() { - DefaultTransport.EnableDatagrams = true - DefaultTransport.Logger = slog.Default() - DefaultTransport.TLSClientConfig = &tls.Config{ - InsecureSkipVerify: true, - } - DefaultQUICConfig = quic.Config{ // Pin the QUIC Initial at the 1200-byte spec minimum so the handshake // fits a 1280-MTU path (Tailscale/WireGuard tunnels, the IPv6 minimum). @@ -60,8 +53,6 @@ func init() { InitialConnectionReceiveWindow: 10 * 1024 * 1024, // 10MB total MaxConnectionReceiveWindow: 20 * 1024 * 1024, // 20MB total max } - - DefaultTransport.QUICConfig = &DefaultQUICConfig } // closedPacketConn is a stub net.PacketConn that returns net.ErrClosed on all operations. From 50a852446bed79ce28147203097e29ee88672095 Mon Sep 17 00:00:00 2001 From: Paul Hinze Date: Fri, 24 Jul 2026 16:56:58 -0500 Subject: [PATCH 2/2] Reject out-of-range integer attribute values instead of truncating MakeAttr parsed with ParseInt(..., 64) and then converted to int, which silently truncates on 32-bit builds. The value is user-supplied, so an oversized input would be stored as some unrelated number rather than refused. Atoi parses at the platform's int width and returns ErrRange, so the existing error path rejects it at the boundary. Clears a CodeQL go/incorrect-integer-conversion alert. --- servers/entityserver/entityserver.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/servers/entityserver/entityserver.go b/servers/entityserver/entityserver.go index d4760243..9906d47a 100644 --- a/servers/entityserver/entityserver.go +++ b/servers/entityserver/entityserver.go @@ -677,12 +677,14 @@ func (e *EntityServer) MakeAttr(ctx context.Context, req *entityserver_v1alpha.E value = entity.StringValue(args.Value()) case entity.TypeInt: - i, err := strconv.ParseInt(args.Value(), 10, 64) + // Atoi parses at the platform's int width, so out-of-range values are + // rejected rather than silently truncated on 32-bit builds. + i, err := strconv.Atoi(args.Value()) if err != nil { return fmt.Errorf("invalid integer value: %w", err) } - value = entity.IntValue(int(i)) + value = entity.IntValue(i) case entity.TypeFloat: f, err := strconv.ParseFloat(args.Value(), 64)