golang.org/x/net@v0.59.0 security report

This file is a defensive debug-only utility that tracks goroutine IDs for internal consistency checks. It reads an environment variable DEBUG_HTTP2_GOROUTINES to enable debugging and uses runtime.Stack to parse goroutine IDs. No network, file system, process spawning, or obfuscated code is present.

The init() function reads the GODEBUG environment variable to enable verbose HTTP/2 logging. This is a standard Go debugging mechanism, not credential harvesting, but it is an environment variable read at import time.

The tool dials arbitrary hosts/ports specified on the command line, including a -dial flag that permits connecting to a different SNI name. This is expected behavior for an interactive HTTP/2 client but could be abused if the binary is invoked with untrusted arguments.

The program sets the terminal to raw mode via term.MakeRaw, capturing all keystrokes. This is standard for interactive consoles but could theoretically capture sensitive input if the user types credentials.

The init() function runs at import time, which is normal for Go packages. It only configures logging and protocol flags based on environment variables and does not perform any malicious actions.

The init() function reads the GODEBUG environment variable to enable verbose logging and extended CONNECT protocol. This is a standard Go debugging mechanism, not credential harvesting or exfiltration. It only checks for specific substrings (http2debug=1, http2debug=2, http2xconnect=1) and does not send data externally.

In writeGoAway.writeFrame, the error returned by ctx.Flush() is deliberately ignored. This is intentional and documented ('ignore error: we're hanging up on them anyway') and does not introduce a security vulnerability.

writeResHeaders.writeFrame and writePushPromise.writeFrame panic if the HPACK header block is empty. The code comments suggest this should be unreachable, but a panic could be triggered by unusual header state, potentially causing a denial of service. This is likely an internal invariant rather than an attacker-controlled path.

The shallowStructCopy function uses reflection to copy fields from one struct to another. While this is a legitimate technique, it can be misused to bypass access controls or type checks. However, in this context, it enforces that all fields are exported and assignable, which mitigates some risks. Still, reflection-based manipulation can be a vector for unexpected behavior if the source or destination types are not fully trusted.

The writeSettings function notes that settings values that don't fit in a QUIC varint will panic when sizeVarint is called. This is a robustness issue but not malicious; it's a standard Go library implementation where callers are expected to provide valid values. It could lead to a denial of service if an attacker can control the settings values, but the function is internal and likely called with trusted constants.

The program fetches XML registries over HTTPS from www.iana.org only during 'go generate' and writes generated Go constants locally. These are expected, bounded, and not malicious.

Writes generated output to 'const.go' in the current directory. This is intended generator behavior, not package runtime behavior, and is gated behind the 'ignore' build tag.

Reads SSLKEYLOGFILE environment variable and writes TLS session keys to the specified file, which could leak sensitive secrets if the env var is set in an untrusted environment.

serveReq joins *root with the request path after only checking filepath.IsLocal. While IsLocal blocks traversal, it still permits opening arbitrary local files under root, which is the intended server behavior but is a file-system exposure surface.

The set method uses unsafe.Pointer to obtain a pointer to the first byte of the slice. This is a standard pattern in Go networking libraries (e.g., golang.org/x/net) for constructing iovec structures for syscalls like readv/writev. The pointer is set to &b[0], which is safe because the length check ensures the slice is non-empty. No memory is accessed beyond the slice bounds.

This file uses the unsafe package to convert a byte slice into a raw pointer for an I/O vector (iovec). While the pointer is only stored and length is bounded by the slice length, any future misuse could lead to memory safety issues. The code is legitimate and standard for the golang.org/x/sys/unix package.

The ControlMessage type provides direct kernel-level sendmsg/recvmsg control message marshaling and parsing. Malformed control messages can be used in exploits (e.g., CMSG parsing bugs), though this appears to be legitimate golang.org/x/net code that mirrors upstream Go source.

Methods RecvMsg, SendMsg, RecvMsgs, SendMsgs expose raw recvmsg/sendmsg/recvmmsg/sendmmsg syscalls to callers with caller-controlled flags. This is expected functionality for a socket utility package, but provides a powerful interface that could be misused by dependents.

The code performs standard socket option and message operations (getsockopt, setsockopt, recvmsg, sendmsg) and address conversions. There is no data exfiltration, credential harvesting, obfuscation, dynamic code execution, cryptocurrency mining, backdoor, network calls to external servers, file system manipulation, process spawning, or dynamic imports. The code is consistent with the legitimate golang.org/x/net package.

The file uses //go:linkname to access unexported syscall functions (syscall.getsockopt, syscall.setsockopt) and unsafe.Pointer operations. While this is a known pattern in the golang.org/x/net/internal/socket package for performance and compatibility reasons, it bypasses Go's type safety and relies on internal runtime details that may change. However, no malicious payload is present.

Both getsockopt and setsockopt pass unsafe.Pointer(&b[0]) without checking that len(b) > 0. If an empty slice is passed, this would cause an index out of range panic. This is a correctness/robustness issue rather than a security vulnerability, but it's an unsafe pattern.

The code executes the external command 'go tool cgo -godefs' via os/exec. This is a standard part of the Go toolchain and is gated behind the 'ignore' build tag, so it only runs during explicit code generation, not during normal package import/build. However, spawning subprocesses is a pattern that warrants scrutiny in a malicious context.

The code writes generated Go source files (zsys_*.go and iana.go) to the current directory. This is expected behavior for a code generator, but writing files based on network content could allow an attacker controlling the remote registry to inject arbitrary code into generated files.

The code fetches XML data from an external IANA URL (https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xml) via http.Get. While this is a legitimate source for protocol constants, it demonstrates external network dependency and could be a vector for supply chain issues if the remote content were compromised or if the URL were altered in a malicious fork.

Uses unsafe.Pointer for type conversion in getICMPFilter and setICMPFilter. This is a common and legitimate pattern in low-level networking code for zero-copy struct conversion, but could theoretically lead to memory safety issues if sizes mismatched.

This file uses cgo to map C struct types from system headers (sys/socket.h, netinet/in.h, netinet/icmp6.h) to Go types for IPv6 socket programming. It is a standard Go x/net style generated definition file guarded by //go:build ignore, meaning it is not compiled as part of the normal build. It contains no executable logic, network calls, file I/O, process spawning, or dynamic code execution.

genzsys executes an external command via exec.Command("go", "tool", "cgo", "-godefs", defs). The 'go' binary is resolved via PATH, which in a hostile environment could be hijacked; however, this is standard for Go code generation and argument injection is limited to runtime.GOOS-derived filenames.

The program writes generated files (zsys_*.go, iana.go) to the current working directory using os.WriteFile with fixed names derived from runtime.GOOS/GOARCH and hardcoded strings. Writes are confined to expected generated-file names, so risk is limited.

The code uses unsafe.Pointer with fixed offsets to access fields in groupReq and groupSourceReq structs. While this is standard practice in Go's syscall/net packages to match OS-level struct layouts, it is a fragile pattern that could lead to memory corruption if offsets are incorrect. However, no malicious intent is present.

Code contains architecture-specific handling for FreeBSD 32-bit compatibility, which is legitimate for socket options. No suspicious behavior detected.

Use of unsafe.Pointer for struct-to-byte conversion is standard in this Go networking library but could theoretically lead to memory safety issues if struct sizes or layouts change. However, this is not malicious and is guarded by build constraints and platform-specific code.

LocalPath() creates a temporary file via os.CreateTemp and then removes it to obtain a unique path for Unix domain socket tests. No tampering with files outside the temporary directory occurs.

The code executes the external command 'oslevel' on AIX systems to check the OS version for Unix socket support. This is a benign, read-only system query with no user input involved.

The init() function reads the GODEBUG environment variable to enable packet logging. This is a standard Go debugging mechanism and does not harvest credentials or exfiltrate data. Logging is opt-in and writes only to stdout, not to external servers or files.

The init() function runs at import time as part of Go's standard initialization semantics. It only performs endianness detection and calls probeRoutingStack() to configure local routing table parsing parameters. No external commands, network activity, or file access occur.

unsafe.Pointer is used only to determine native endianness by inspecting the first byte of a uint32. This is a common, benign idiom in the Go standard library and does not permit arbitrary memory access here.

syscall.RTM_VERSION is referenced as a constant fallback for the routing message version. No privileged syscall operations or side effects are performed in this file.

An init() function registers fixed handlers on http.DefaultServeMux and panics if /debug/requests is already registered. This executes at import time and takes over global routing, which is an unexpected invasive side effect for a library and can affect any program that imports the package (directly or transitively).

The init() function panics when /debug/requests is already registered on DefaultServeMux. Merely importing two copies of golang.org/x/net/trace (e.g., through vendoring) will crash the process at startup, creating a trivially reachable DoS if dependency resolution produces duplicates.

Trace titles/events include request URL paths and error messages. Sensitive flag defaults to false for many entries (e.g., LazyPrintf always uses sensitive=false), so unless ShowSensitive is explicitly turned off (only via the optional 'show_sensitive=0' query parameter), potentially sensitive request details are rendered to anyone who can reach the debug endpoints.

The Decoder.CharsetReader field allows the caller to supply a function which returns an io.Reader that is used by the parser. This is not suspicious by itself as it is a documented feature of the stdlib encoding/xml package. No malicious use is present in this file.

The file is a standard implementation of the WebSocket protocol from the Go standard library (golang.org/x/net/websocket). It contains no data exfiltration, credential harvesting, obfuscated code, dynamic code execution, crypto mining, backdoor/reverse shell, install-time execution, suspicious network requests, file system manipulation, process spawning, or dynamic imports with computed input. All imports and API usage are consistent with the stated purpose of implementing RFC 6455.