- Assume the managed Caddy/HTTPS setup path is used. Do not spend this branch re-solving operator deployment exposure that is already handled by the Caddy setup path.
- Keep this list to repo-owned improvements that can be fixed, tested, or documented in this branch.
- Treat eBPF code size and verifier loadability as hard constraints. Prefer bounded checks, conservative pass behavior, counters, and tests over large parser expansions.
- Do not include OS, kernel, distro package, firewall, or live-host configuration findings in this branch task list.
## P0: A-Ready Blockers
### 1. Finish the remaining packet-capture stored-XSS cleanup in Node Manager
Status: Done. Packet-capture IP/address labels now use DOM text nodes via tested helpers; node_manager tests and build-contract validation passed on 2026-05-15.
Why:
DeepSeek's highest-risk finding is still visible in the source: the circuit packet-capture dropdown concatenates IP addresses into `innerHTML`. Even if the update note intended this class of issue to be fixed, this exact sink should be removed before calling the branch A-ready.
- Replace the packet-capture dropdown construction with DOM text nodes, or add a shared escaping helper and apply it to the IP/address insertions.
- Review remaining `innerHTML` assignments that mix trusted markup with operator-controlled values. Keep static icon markup separate from untrusted text.
- Add a focused regression check for the packet-capture IP path using an IP-like string containing HTML metacharacters.
Done when:
- Packet-capture IP/address labels render through DOM text APIs, not `innerHTML`.
- Node Manager build-contract validation passes.
### 2. Clamp and warn on all remaining 32-bit telemetry narrowing
Status: Done. NetFlow 9 timestamps and LTS2/Insight client-side telemetry conversions now clamp with warnings while preserving current wire field widths; focused Rust tests and `cargo check -p lqosd` passed on 2026-05-15.
The update audit still calls out NetFlow 9 timestamps and LTS2 stats submission counters that narrow wider values without a documented clamp. This is not an unauthenticated exploit, but A-grade security should avoid silent wraparound in operational telemetry.
Status: Done. Added the missing HTML route build-contract check, websocket same-origin guard, template-page block, and CORS regression test; existing cookie and read-only dashboard tests were rerun on 2026-05-15.
The branch fixed important auth behavior: no anonymous WebUI mode, CORS removed, session cookies hardened, durable session token no longer copied into websocket auth, and read-only dashboard writes denied. A-grade security needs a regression gate so these do not slip back.
- Add tests or a build-contract check proving every shipped `.html` page is routed through the authenticated/template path, except explicit login/health/first-run pages.
- Add checks for session cookie flags: `HttpOnly`, `SameSite=Lax`, and conditional `Secure` when SSL/Caddy mode is active.
- Add checks that CORS remains absent or non-credentialed on Node Manager.
- Add read-only authorization regression tests for dashboard theme save/delete and any other state-changing websocket/local-api route touched in this branch.
- Check websocket upgrade `Origin` handling. If cross-origin cookie-authenticated upgrades are accepted, add an Origin allowlist or document and test why the current browser cookie behavior is sufficient.
Done when:
- Auth, cookie, CORS, route whitelist, and read-only write behavior are covered by repeatable tests or build-contract checks.
### 4. Remove panic and silent-failure paths on operator-controlled inputs
DeepSeek found several low-to-medium reliability/security issues where malformed operator files, imported API data, or cleanup failures panic or silently hide an operational failure. These are not direct remote compromise vectors, but they are exactly the sort of hardening work that separates a B from an A.
The RTT `flowbee_events` ring-buffer path still ignores `bpf_ringbuf_output` failure. Heimdall now checks copy/output errors, but drop visibility should be consistent. This should be done with extreme care because recent eBPF changes already hit verifier and size limits.
Paths:
-`src/rust/lqos_sys/src/bpf/common/flows.h`
-`src/rust/lqos_sys/src/bpf/common/heimdall.h`
-`src/rust/lqos_sys/src/bpf/common/throughput.h`
- userspace readers that can expose low-rate pressure counters
Work:
- Add the smallest practical per-CPU drop counter for RTT ring-buffer failures.
- Avoid per-packet logging.
- Reuse existing map-pressure or insert-pressure reporting patterns if possible.
- Verify the BPF object still loads after every change.
Done when:
- Flow RTT event loss is observable under ring-buffer pressure.
- The eBPF program still builds and loads.
### 6. Expand malformed-traffic coverage without growing the hot path recklessly
- Add tests or verifier-focused fixtures for IPv6 packets with Hop-by-Hop, Routing, Destination Options, AH, and Fragment headers.
- Prefer "detect and pass without flow tracking" for IPv6 fragments and extension-header cases unless a small bounded parser fits the verifier and size budget.
- Add MPLS stacked-label tests for the current pass behavior.
- Document the fragment policy: what is shaped, what is passed, and why.
Done when:
- Malformed and extension-header traffic has explicit, tested behavior.
- No new eBPF size or verifier regression is introduced.
### 7. Move sensitive browser operational drafts out of durable localStorage
Status: Done. Network-mode drafts and pending-operation state now use tab-scoped `sessionStorage`, legacy durable values are migrated and removed, apply/confirm/revert/rollback/logout clear operational keys, harmless preferences remain durable, and node_manager storage/build-contract validation passed on 2026-05-15.
The update audit found no durable session tokens in browser storage, which is good. Remaining `localStorage` usage still includes operational drafts and pending network-mode state. On shared operator workstations, A-grade posture should reduce how much deployment detail survives logout or browser restart.
Status: Done. Authenticated templated pages and standalone login/first-run pages now emit an enforced CSP that keeps scripts self-hosted, preserves the existing inline template/style requirements, permits current websocket/API-docs/Insight tile needs, blocks framing, and is covered by Rust CSP tests plus `lqosd` check/clippy and node_manager build-contract validation on 2026-05-15.
CSP will not replace XSS fixes, but it reduces blast radius if a future trusted-HTML sink regresses. The current UI uses Bootstrap, FontAwesome, local scripts, and some inline bootstrap/theme snippets, so the policy should be practical rather than aspirational.
Status: Done. Managed Caddy Caddyfile tests now assert loopback API/WebUI upstreams and runtime enable/disable tests continue to preserve `lqos_api` restarts; operator docs now identify `LQOS_API_LISTEN` as an advanced override that should stay unset on managed Caddy systems unless direct API exposure is intentional and separately protected.
The branch assumes Caddy is set up. The useful repo-owned hardening is to prevent accidental drift from the intended Caddy/loopback shape, not to treat Caddy setup itself as missing.
- Do not retire `serde_cbor` in this security branch; the Insight/LTS2 protocol counterpart makes that too risky without coordinated work.
- Replace other unmaintained crates (`fxhash`, `bincode`, transitive `paste`) only when the migration is small or already planned. Track them as maintenance if they do not carry an active advisory.
- Add optional server-side redaction for read-only staff accounts as a product privacy feature. This is useful, but not required to preserve the intended trusted-support-staff model.
- Align userspace flow/host cache capacities with BPF LRU behavior if it can be done without destabilizing flow reporting. Treat this as observability correctness, not an A-blocking security issue.
