#46 Max body for osctrl, redact package URLs and stop on service errors on Windows Pull request opened by javuto Problem • (Medium): unbounded management responses can exhaust endpoint memory.

SendRequest

read every osctrl response, including error bodies, with an uncapped

io.ReadAll

. A faulty or compromised server could exhaust RAM well before the 10-minute timeout. • (Medium): Windows service stop errors are mistaken for an already stopped agent.

windowsServiceStop

returned

nil

for any

OpenService

or

Stop

error, including access denied. Restart, install, uninstall and upgrade could then continue with osqueryd still running. • (Medium): package mirror credentials can enter service logs.

downloadPackage

put the raw package URL into errors and the unverified-install warning, so a mirror's

?token=

reached the logs. Change •

SendRequest

reads at most 8 MiB (

maxResponseSize

). A larger body is an error rather than being cut short, so a truncated flags file or certificate is never written. • Non-200 errors include at most 512 bytes of the body (

errorBody

). •

windowsServiceStop

returns

nil

only for

ERROR_SERVICE_DOES_NOT_EXIST

and

ERROR_SERVICE_NOT_ACTIVE

. •

ERROR_SERVICE_CANNOT_ACCEPT_CTRL

(service between states) waits up to 30 seconds for

Stopped

, then times out with an error. • Every other error is returned. •

downloadPackage

shows the URL through the existing

redactURL

everywhere, and drops the full URL that a

*url.Error

repeats. • README and

ARCHITECTURE.md

updated. This includes the stale Transport sentence, which said there was no timeout or proxy support. Security / operational impact • A Windows endpoint where osctrld cannot stop the osquery service now fails restart, install, uninstall and upgrade instead of continuing. Previously these steps went on with osqueryd still running. • An osctrl response over 8 MiB now fails the request. Real responses are a few KB. • Package errors and logs show scheme, host and path only. Validation •

go test ./cmd/osctrld/ -race

passes •

golangci-lint run ./...

and `GOOS=windows golangci-lint run ./...`: 0 issues • New tests: •

TestSendRequestCapsResponse

•

TestHTTPStatusErrorTruncatesBody

•

TestAlreadyStopped

(Windows only) •

TestDownloadPackageRedactsURL

, confirmed to fail on the previous code • Not run on Windows. The stop change and its test are compiled and linted only. jmpsec/osctrld