fix: renforcer limites TLS, timeouts socket et validation config

Co-authored-by: aider (openrouter/openai/gpt-5.3-codex) <aider@aider.chat>

internal/output/writers.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"os"
 	"sync"
+	"time"
 
 	"ja4sentinel/api"
 )
@@ -76,25 +77,27 @@ func (w *FileWriter) Close() error {
 
 // UnixSocketWriter writes log records to a UNIX socket
 type UnixSocketWriter struct {
-	socketPath string
-	conn       net.Conn
-	mutex      sync.Mutex
+	socketPath   string
+	conn         net.Conn
+	mutex        sync.Mutex
+	dialTimeout  time.Duration
+	writeTimeout time.Duration
 }
 
 // NewUnixSocketWriter creates a new UNIX socket writer
 func NewUnixSocketWriter(socketPath string) (*UnixSocketWriter, error) {
 	w := &UnixSocketWriter{
-		socketPath: socketPath,
+		socketPath:   socketPath,
+		dialTimeout:  2 * time.Second,
+		writeTimeout: 2 * time.Second,
 	}
 
 	// Try to connect (socket may not exist yet)
-	conn, err := net.Dial("unix", socketPath)
-	if err != nil {
-		// Socket doesn't exist yet, we'll try to connect on first write
-		return w, nil
+	conn, err := net.DialTimeout("unix", socketPath, w.dialTimeout)
+	if err == nil {
+		w.conn = conn
 	}
 
-	w.conn = conn
 	return w, nil
 }
 
@@ -107,7 +110,7 @@ func (w *UnixSocketWriter) Write(rec api.LogRecord) error {
 		if w.conn != nil {
 			return nil
 		}
-		conn, err := net.Dial("unix", w.socketPath)
+		conn, err := net.DialTimeout("unix", w.socketPath, w.dialTimeout)
 		if err != nil {
 			return fmt.Errorf("failed to connect to socket %s: %w", w.socketPath, err)
 		}
@@ -123,22 +126,32 @@ func (w *UnixSocketWriter) Write(rec api.LogRecord) error {
 	if err != nil {
 		return fmt.Errorf("failed to marshal record: %w", err)
 	}
-
-	// Add newline for line-based protocols
 	data = append(data, '\n')
 
-	if _, err = w.conn.Write(data); err != nil {
+	if err := w.conn.SetWriteDeadline(time.Now().Add(w.writeTimeout)); err != nil {
+		return fmt.Errorf("failed to set write deadline: %w", err)
+	}
+	if _, err = w.conn.Write(data); err == nil {
+		return nil
+	}
+
+	_ = w.conn.Close()
+	w.conn = nil
+
+	if errConn := ensureConn(); errConn != nil {
+		return fmt.Errorf("failed to write to socket and reconnect failed: %w", errConn)
+	}
+
+	if errDeadline := w.conn.SetWriteDeadline(time.Now().Add(w.writeTimeout)); errDeadline != nil {
 		_ = w.conn.Close()
 		w.conn = nil
+		return fmt.Errorf("failed to set write deadline after reconnect: %w", errDeadline)
+	}
 
-		if err2 := ensureConn(); err2 != nil {
-			return fmt.Errorf("failed to write to socket and reconnect failed: %w", err2)
-		}
-		if _, err2 := w.conn.Write(data); err2 != nil {
-			_ = w.conn.Close()
-			w.conn = nil
-			return fmt.Errorf("failed to write to socket after reconnect: %w", err2)
-		}
+	if _, errRetry := w.conn.Write(data); errRetry != nil {
+		_ = w.conn.Close()
+		w.conn = nil
+		return fmt.Errorf("failed to write to socket after reconnect: %w", errRetry)
 	}
 
 	return nil