Fix gogo test on Windows

Improve operator cert revocation

.github/workflows/unit-tests.yml

@@ -6,11 +6,13 @@ on:
     paths:
       - "go.mod"
       - "go.sum"
+      - ".github/workflows/unit-tests.yml"
       - "Makefile"
       - "**/*.go"
       - "**/*.c"
       - "**/*.h"
       - "**/*.sh"
+      - "**/*.ps1"
     types:
       - opened
       - reopened
@@ -18,8 +20,8 @@ on:
       - ready_for_review
 
 jobs:
-  linux-windows-build-test:
-    name: Linux & Windows Test
+  linux-build-test:
+    name: Linux Build & Test
     runs-on: ubuntu-latest
     timeout-minutes: 180
     steps:
@@ -64,6 +66,49 @@ jobs:
       - name: Test Linux
         run: make clean && make && ./sliver-server unpack --force && ./go-tests.sh ${{ steps.go-tests-flags.outputs.args }}
 
+  windows-build-test:
+    name: Windows Build & Test
+    runs-on: windows-latest
+    timeout-minutes: 180
+    steps:
+      - name: Go 1.25
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.25.6"
+
+      - name: Install make
+        run: choco install make -y --no-progress
+
+      - name: Check Out Code
+        uses: actions/checkout@v6
+
+      - name: Git Fetch Tags
+        run: git fetch --prune --unshallow --tags -f
+
+      - name: Make Windows (amd64)
+        run: make windows-amd64
+
+      - name: Determine go-tests flags
+        id: go-tests-flags
+        shell: pwsh
+        run: |
+          $baseSha = "${{ github.event.pull_request.base.sha }}"
+          $headSha = "${{ github.sha }}"
+          $changedFiles = git diff --name-only $baseSha $headSha
+
+          if ($changedFiles | Select-String -Pattern '^(implant/|server/gogo/|server/generate/)') {
+            "args=" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+          } else {
+            "args=--skip-generate" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+          }
+
+      - name: Test Windows
+        shell: pwsh
+        run: |
+          make clean
+          make
+          ./go-tests.ps1 ${{ steps.go-tests-flags.outputs.args }}
+
 
   macos-build-test:
     name: MacOS Test

.gitignore

@@ -1,3 +1,4 @@
+/.vscode
 /.vscode/*
 /.devcontainer
 /.idea

AGENTS.md

@@ -4,7 +4,7 @@
 - `make` builds server + client using vendored modules and runs `go-assets.sh`.
 - `make client` builds a CGO-free client; `make debug` keeps symbols.
 - `make pb` regenerates protobuf stubs from `protobuf/`.
-- `./go-tests.sh` runs the curated Go test suite with build tags.
+- `./go-tests.sh` runs the Go test suite, this is the only way you should run unit tests.
 - Docs site: `cd docs/sliver-docs && npm install && npm run dev` for local dev; `npm run build` for a static build.
 
 ## Coding Style & Naming Conventions

Makefile

@@ -1,184 +1,333 @@
-#
-# Makefile for Sliver
-#
-
-GO ?= go
-ARTIFACT_SUFFIX ?= 
-ENV =
-TAGS ?= -tags go_sqlite
-CGO_ENABLED = 0
-
-ifneq (,$(findstring cgo_sqlite,$(TAGS)))
-	CGO_ENABLED = 1
-endif
-
-#
-# Prerequisites 
-#
-# https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile
-EXECUTABLES = uname sed git date cut $(GO)
-K := $(foreach exec,$(EXECUTABLES),\
-        $(if $(shell which $(exec)),some string,$(error "No $(exec) in PATH")))
-
-#
-# Build Information
-#
-GO_MAJOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f1)
-GO_MINOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
-MIN_SUPPORTED_GO_MAJOR_VERSION = 1
-MIN_SUPPORTED_GO_MINOR_VERSION = 25
-GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)
-
-SLIVER_PUBLIC_KEY ?= RWTZPg959v3b7tLG7VzKHRB1/QT+d3c71Uzetfa44qAoX5rH7mGoQTTR
-ARMORY_PUBLIC_KEY ?= RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
-ARMORY_REPO_URL ?= https://api.github.com/repos/sliverarmory/armory/releases
-CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
-SLIVER_UPDATE_PKG = github.com/bishopfox/sliver/client/command/update
-
-LDFLAGS = -ldflags "-s -w \
-	-X $(SLIVER_UPDATE_PKG).SliverPublicKey=$(SLIVER_PUBLIC_KEY) \
-	-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
-	-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
-
-# Debug builds shouldn't be stripped (-s -w flags)
-LDFLAGS_DEBUG = -ldflags "-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
-	-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
-
-SED_INPLACE := sed -i
-STATIC_TARGET := linux
-
-UNAME_S := $(shell uname -s)
-UNAME_P := $(shell uname -p)
-
-# Programs required for generating protobuf/grpc files
-PB_COMPILERS = protoc protoc-gen-go protoc-gen-go-grpc
-ifeq ($(MAKECMDGOALS), pb)
-	K := $(foreach exec,$(PB_COMPILERS),\
-			$(if $(shell which $(exec)),some string,$(error "Missing protobuf util $(exec) in PATH")))
-endif
-
-# *** Darwin ***
-ifeq ($(UNAME_S),Darwin)
-	SED_INPLACE := sed -i ''
-	STATIC_TARGET := macos
-endif
-
-# If no target is specified, determine GOARCH
-ifeq ($(UNAME_P),arm)
-	ifeq ($(MAKECMDGOALS), )
-		ifeq ($(origin GOARCH), undefined)
-			ENV += GOARCH=arm64
-		endif
-	endif
-endif
-
-ifeq ($(MAKECMDGOALS), linux)
-	# Redefine LDFLAGS to add the static part
-	LDFLAGS = -ldflags "-s -w \
-		-extldflags '-static' \
-		-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
-		-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
-endif
-
-#
-# Targets
-#
-.PHONY: default
-default: clean validate-go-version
-	env -u GOOS -u GOARCH $(MAKE) GOOS= GOARCH= .downloaded_assets
-	$(ENV) $(if $(GOOS),GOOS=$(GOOS)) $(if $(GOARCH),GOARCH=$(GOARCH)) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
-	$(ENV) $(if $(GOOS),GOOS=$(GOOS)) $(if $(GOARCH),GOARCH=$(GOARCH)) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
-
-# Allows you to build a CGO-free client for any target e.g. `GOOS=windows GOARCH=arm64 make client`
-# NOTE: WireGuard is not supported on all platforms, but most 64-bit GOOS/GOARCH combinations should work.
-.PHONY: client
-client: clean .downloaded_assets validate-go-version
-	$(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client ./client
-
-.PHONY: macos-amd64
-macos-amd64: clean .downloaded_assets validate-go-version
-	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
-	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
-
-.PHONY: macos-arm64
-macos-arm64: clean .downloaded_assets validate-go-version
-	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
-	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
-
-.PHONY: linux-amd64
-linux-amd64: clean .downloaded_assets validate-go-version
-	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
-	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
-
-.PHONY: linux-arm64
-linux-arm64: clean .downloaded_assets validate-go-version
-	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
-	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
-
-.PHONY: windows-amd64
-windows-amd64: clean .downloaded_assets validate-go-version
-	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX).exe ./server
-	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX).exe ./client
-
-.PHONY: clients
-clients: clean .downloaded_assets validate-go-version
-	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_macos-amd64$(ARTIFACT_SUFFIX) ./client
-	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_macos-arm64$(ARTIFACT_SUFFIX) ./client
-	GOOS=linux GOARCH=386 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_linux-386$(ARTIFACT_SUFFIX) ./client
-	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_linux-amd64$(ARTIFACT_SUFFIX) ./client
-	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_linux-arm64$(ARTIFACT_SUFFIX) ./client
-	GOOS=windows GOARCH=386 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_windows-386$(ARTIFACT_SUFFIX).exe ./client
-	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_windows-amd64$(ARTIFACT_SUFFIX).exe ./client
-	GOOS=windows GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_windows-arm64$(ARTIFACT_SUFFIX).exe ./client
-	GOOS=freebsd GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_freebsd-amd64$(ARTIFACT_SUFFIX) ./client
-	GOOS=freebsd GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_freebsd-arm64$(ARTIFACT_SUFFIX) ./client
-
-.PHONY: servers
-servers: clean .downloaded_assets validate-go-version
-	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_windows-amd64$(ARTIFACT_SUFFIX).exe ./server
-	GOOS=windows GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_windows-arm64$(ARTIFACT_SUFFIX).exe ./server
-	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-amd64$(ARTIFACT_SUFFIX) ./server
-	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-arm64$(ARTIFACT_SUFFIX) ./server
-	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-arm64$(ARTIFACT_SUFFIX) ./server
-	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-amd64$(ARTIFACT_SUFFIX) ./server
-
-.PHONY: pb
-pb:
-	protoc -I protobuf/ protobuf/commonpb/common.proto --go_out=paths=source_relative:protobuf/
-	protoc -I protobuf/ protobuf/sliverpb/sliver.proto --go_out=paths=source_relative:protobuf/
-	protoc -I protobuf/ protobuf/clientpb/client.proto --go_out=paths=source_relative:protobuf/
-	protoc -I protobuf/ protobuf/dnspb/dns.proto --go_out=paths=source_relative:protobuf/
-	protoc -I protobuf/ protobuf/rpcpb/services.proto --go_out=paths=source_relative:protobuf/ --go-grpc_out=protobuf/ --go-grpc_opt=paths=source_relative 
-
-.PHONY: debug
-debug: clean
-	$(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor $(TAGS),server $(LDFLAGS_DEBUG) -o sliver-server$(ARTIFACT_SUFFIX) ./server
-	$(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor $(TAGS),client $(LDFLAGS_DEBUG) -o sliver-client$(ARTIFACT_SUFFIX) ./client
-
-validate-go-version:
-	@if [ $(GO_MAJOR_VERSION) -gt $(MIN_SUPPORTED_GO_MAJOR_VERSION) ]; then \
-		exit 0 ;\
-	elif [ $(GO_MAJOR_VERSION) -lt $(MIN_SUPPORTED_GO_MAJOR_VERSION) ]; then \
-		echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
-		exit 1; \
-	elif [ $(GO_MINOR_VERSION) -lt $(MIN_SUPPORTED_GO_MINOR_VERSION) ] ; then \
-		echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
-		exit 1; \
-	fi
-
-.PHONY: clean-all
-clean-all: clean
-	rm -rf ./server/assets/fs/darwin/amd64
-	rm -rf ./server/assets/fs/darwin/arm64
-	rm -rf ./server/assets/fs/windows/amd64
-	rm -rf ./server/assets/fs/linux/amd64
-	rm -f ./server/assets/fs/*.zip
-	rm -f ./.downloaded_assets
-
-.PHONY: clean
-clean:
-	rm -f sliver-client sliver-client_* sliver-server sliver-server_* sliver-*.exe
-
-.downloaded_assets:
-	$(ENV) $(GO) run -mod=vendor ./util/cmd/assets
-	touch ./.downloaded_assets
+#
+# Makefile for Sliver
+#
+
+ifneq ($(OS),Windows_NT)
+
+GO ?= go
+ARTIFACT_SUFFIX ?= 
+ENV =
+TAGS ?= -tags go_sqlite
+CGO_ENABLED = 0
+
+ifneq (,$(findstring cgo_sqlite,$(TAGS)))
+	CGO_ENABLED = 1
+endif
+
+#
+# Prerequisites 
+#
+# https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile
+EXECUTABLES = uname sed git date cut $(GO)
+K := $(foreach exec,$(EXECUTABLES),\
+        $(if $(shell which $(exec)),some string,$(error "No $(exec) in PATH")))
+
+#
+# Build Information
+#
+GO_MAJOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f1)
+GO_MINOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
+MIN_SUPPORTED_GO_MAJOR_VERSION = 1
+MIN_SUPPORTED_GO_MINOR_VERSION = 25
+GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)
+
+SLIVER_PUBLIC_KEY ?= RWTZPg959v3b7tLG7VzKHRB1/QT+d3c71Uzetfa44qAoX5rH7mGoQTTR
+ARMORY_PUBLIC_KEY ?= RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
+ARMORY_REPO_URL ?= https://api.github.com/repos/sliverarmory/armory/releases
+CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
+SLIVER_UPDATE_PKG = github.com/bishopfox/sliver/client/command/update
+
+LDFLAGS = -ldflags "-s -w \
+	-X $(SLIVER_UPDATE_PKG).SliverPublicKey=$(SLIVER_PUBLIC_KEY) \
+	-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
+	-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+
+# Debug builds shouldn't be stripped (-s -w flags)
+LDFLAGS_DEBUG = -ldflags "-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
+	-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+
+SED_INPLACE := sed -i
+STATIC_TARGET := linux
+
+UNAME_S := $(shell uname -s)
+UNAME_P := $(shell uname -p)
+
+# Programs required for generating protobuf/grpc files
+PB_COMPILERS = protoc protoc-gen-go protoc-gen-go-grpc
+ifeq ($(MAKECMDGOALS), pb)
+	K := $(foreach exec,$(PB_COMPILERS),\
+			$(if $(shell which $(exec)),some string,$(error "Missing protobuf util $(exec) in PATH")))
+endif
+
+# *** Darwin ***
+ifeq ($(UNAME_S),Darwin)
+	SED_INPLACE := sed -i ''
+	STATIC_TARGET := macos
+endif
+
+# If no target is specified, determine GOARCH
+ifeq ($(UNAME_P),arm)
+	ifeq ($(MAKECMDGOALS), )
+		ifeq ($(origin GOARCH), undefined)
+			ENV += GOARCH=arm64
+		endif
+	endif
+endif
+
+ifeq ($(MAKECMDGOALS), linux)
+	# Redefine LDFLAGS to add the static part
+	LDFLAGS = -ldflags "-s -w \
+		-extldflags '-static' \
+		-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
+		-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+endif
+
+#
+# Targets
+#
+.PHONY: default
+default: clean validate-go-version
+	env -u GOOS -u GOARCH $(MAKE) GOOS= GOARCH= .downloaded_assets
+	$(ENV) $(if $(GOOS),GOOS=$(GOOS)) $(if $(GOARCH),GOARCH=$(GOARCH)) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	$(ENV) $(if $(GOOS),GOOS=$(GOOS)) $(if $(GOARCH),GOARCH=$(GOARCH)) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+# Allows you to build a CGO-free client for any target e.g. `GOOS=windows GOARCH=arm64 make client`
+# NOTE: WireGuard is not supported on all platforms, but most 64-bit GOOS/GOARCH combinations should work.
+.PHONY: client
+client: clean .downloaded_assets validate-go-version
+	$(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client ./client
+
+.PHONY: macos-amd64
+macos-amd64: clean .downloaded_assets validate-go-version
+	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+.PHONY: macos-arm64
+macos-arm64: clean .downloaded_assets validate-go-version
+	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+.PHONY: linux-amd64
+linux-amd64: clean .downloaded_assets validate-go-version
+	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+.PHONY: linux-arm64
+linux-arm64: clean .downloaded_assets validate-go-version
+	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+.PHONY: windows-amd64
+windows-amd64: clean .downloaded_assets validate-go-version
+	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX).exe ./server
+	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX).exe ./client
+
+.PHONY: clients
+clients: clean .downloaded_assets validate-go-version
+	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_macos-amd64$(ARTIFACT_SUFFIX) ./client
+	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_macos-arm64$(ARTIFACT_SUFFIX) ./client
+	GOOS=linux GOARCH=386 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_linux-386$(ARTIFACT_SUFFIX) ./client
+	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_linux-amd64$(ARTIFACT_SUFFIX) ./client
+	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_linux-arm64$(ARTIFACT_SUFFIX) ./client
+	GOOS=windows GOARCH=386 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_windows-386$(ARTIFACT_SUFFIX).exe ./client
+	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_windows-amd64$(ARTIFACT_SUFFIX).exe ./client
+	GOOS=windows GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_windows-arm64$(ARTIFACT_SUFFIX).exe ./client
+	GOOS=freebsd GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_freebsd-amd64$(ARTIFACT_SUFFIX) ./client
+	GOOS=freebsd GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client_freebsd-arm64$(ARTIFACT_SUFFIX) ./client
+
+.PHONY: servers
+servers: clean .downloaded_assets validate-go-version
+	GOOS=windows GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_windows-amd64$(ARTIFACT_SUFFIX).exe ./server
+	GOOS=windows GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_windows-arm64$(ARTIFACT_SUFFIX).exe ./server
+	GOOS=linux GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-amd64$(ARTIFACT_SUFFIX) ./server
+	GOOS=linux GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_linux-arm64$(ARTIFACT_SUFFIX) ./server
+	GOOS=darwin GOARCH=arm64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-arm64$(ARTIFACT_SUFFIX) ./server
+	GOOS=darwin GOARCH=amd64 $(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server_darwin-amd64$(ARTIFACT_SUFFIX) ./server
+
+.PHONY: pb
+pb:
+	protoc -I protobuf/ protobuf/commonpb/common.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/sliverpb/sliver.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/clientpb/client.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/dnspb/dns.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/rpcpb/services.proto --go_out=paths=source_relative:protobuf/ --go-grpc_out=protobuf/ --go-grpc_opt=paths=source_relative 
+
+.PHONY: debug
+debug: clean
+	$(ENV) CGO_ENABLED=$(CGO_ENABLED) $(GO) build -mod=vendor $(TAGS),server $(LDFLAGS_DEBUG) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	$(ENV) CGO_ENABLED=0 $(GO) build -mod=vendor $(TAGS),client $(LDFLAGS_DEBUG) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+validate-go-version:
+	@if [ $(GO_MAJOR_VERSION) -gt $(MIN_SUPPORTED_GO_MAJOR_VERSION) ]; then \
+		exit 0 ;\
+	elif [ $(GO_MAJOR_VERSION) -lt $(MIN_SUPPORTED_GO_MAJOR_VERSION) ]; then \
+		echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
+		exit 1; \
+	elif [ $(GO_MINOR_VERSION) -lt $(MIN_SUPPORTED_GO_MINOR_VERSION) ] ; then \
+		echo '$(GO_VERSION_VALIDATION_ERR_MSG)';\
+		exit 1; \
+	fi
+
+.PHONY: clean-all
+clean-all: clean
+	rm -rf ./server/assets/fs/darwin/amd64
+	rm -rf ./server/assets/fs/darwin/arm64
+	rm -rf ./server/assets/fs/windows/amd64
+	rm -rf ./server/assets/fs/linux/amd64
+	rm -f ./server/assets/fs/*.zip
+	rm -f ./.downloaded_assets
+
+.PHONY: clean
+clean:
+	rm -f sliver-client sliver-client_* sliver-server sliver-server_* sliver-*.exe
+
+.downloaded_assets:
+	$(ENV) $(GO) run -mod=vendor ./util/cmd/assets
+	touch ./.downloaded_assets
+
+
+#
+# >>> WINDOWS <<<
+#
+else
+
+GO ?= go
+ARTIFACT_SUFFIX ?=
+ENV =
+TAGS ?= -tags go_sqlite
+CGO_ENABLED = 0
+
+ifneq (,$(findstring cgo_sqlite,$(TAGS)))
+	CGO_ENABLED = 1
+endif
+
+SHELL := cmd.exe
+.SHELLFLAGS := /C
+
+GO_VERSION := $(patsubst go%,%,$(strip $(shell $(GO) env GOVERSION)))
+GO_MAJOR_VERSION := $(word 1,$(subst ., ,$(GO_VERSION)))
+GO_MINOR_VERSION := $(word 2,$(subst ., ,$(GO_VERSION)))
+MIN_SUPPORTED_GO_MAJOR_VERSION = 1
+MIN_SUPPORTED_GO_MINOR_VERSION = 25
+GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)
+
+SLIVER_PUBLIC_KEY ?= RWTZPg959v3b7tLG7VzKHRB1/QT+d3c71Uzetfa44qAoX5rH7mGoQTTR
+ARMORY_PUBLIC_KEY ?= RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
+ARMORY_REPO_URL ?= https://api.github.com/repos/sliverarmory/armory/releases
+CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
+SLIVER_UPDATE_PKG = github.com/bishopfox/sliver/client/command/update
+
+LDFLAGS = -ldflags "-s -w -X $(SLIVER_UPDATE_PKG).SliverPublicKey=$(SLIVER_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+
+LDFLAGS_DEBUG = -ldflags "-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+
+PB_COMPILERS = protoc protoc-gen-go protoc-gen-go-grpc
+COMMA := ,
+
+ifeq ($(MAKECMDGOALS), linux)
+	LDFLAGS = -ldflags "-s -w -extldflags '-static' -X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+endif
+
+define windows_exec
+$(strip $(foreach envvar,$(1),set "$(envvar)" && ))$(2)
+endef
+
+define windows_go_build
+$(call windows_exec,$(ENV) GOOS=$(1) GOARCH=$(2) CGO_ENABLED=$(3),"$(GO)" build $(4) $(TAGS)$(COMMA)$(5) $(6) -o $(7) ./$(5))
+endef
+
+.PHONY: default
+default: clean validate-go-version
+	$(call windows_exec,$(ENV) GOOS= GOARCH=,"$(MAKE)" GOOS= GOARCH= .downloaded_assets)
+	$(call windows_go_build,$(GOOS),$(GOARCH),$(CGO_ENABLED),-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,$(GOOS),$(GOARCH),0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client$(ARTIFACT_SUFFIX))
+
+.PHONY: client
+client: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,$(GOOS),$(GOARCH),0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client)
+
+.PHONY: macos-amd64
+macos-amd64: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,darwin,amd64,$(CGO_ENABLED),-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,darwin,amd64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client$(ARTIFACT_SUFFIX))
+
+.PHONY: macos-arm64
+macos-arm64: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,darwin,arm64,$(CGO_ENABLED),-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,darwin,arm64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client$(ARTIFACT_SUFFIX))
+
+.PHONY: linux-amd64
+linux-amd64: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,linux,amd64,$(CGO_ENABLED),-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,linux,amd64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client$(ARTIFACT_SUFFIX))
+
+.PHONY: linux-arm64
+linux-arm64: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,linux,arm64,$(CGO_ENABLED),-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,linux,arm64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client$(ARTIFACT_SUFFIX))
+
+.PHONY: windows-amd64
+windows-amd64: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,windows,amd64,$(CGO_ENABLED),-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server$(ARTIFACT_SUFFIX).exe)
+	$(call windows_go_build,windows,amd64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client$(ARTIFACT_SUFFIX).exe)
+
+.PHONY: clients
+clients: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,darwin,amd64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_macos-amd64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,darwin,arm64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_macos-arm64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,linux,386,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_linux-386$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,linux,amd64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_linux-amd64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,linux,arm64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_linux-arm64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,windows,386,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_windows-386$(ARTIFACT_SUFFIX).exe)
+	$(call windows_go_build,windows,amd64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_windows-amd64$(ARTIFACT_SUFFIX).exe)
+	$(call windows_go_build,windows,arm64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_windows-arm64$(ARTIFACT_SUFFIX).exe)
+	$(call windows_go_build,freebsd,amd64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_freebsd-amd64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,freebsd,arm64,0,-mod=vendor -trimpath,client,$(LDFLAGS),sliver-client_freebsd-arm64$(ARTIFACT_SUFFIX))
+
+.PHONY: servers
+servers: clean .downloaded_assets validate-go-version
+	$(call windows_go_build,windows,amd64,0,-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server_windows-amd64$(ARTIFACT_SUFFIX).exe)
+	$(call windows_go_build,windows,arm64,0,-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server_windows-arm64$(ARTIFACT_SUFFIX).exe)
+	$(call windows_go_build,linux,amd64,0,-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server_linux-amd64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,linux,arm64,0,-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server_linux-arm64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,darwin,arm64,0,-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server_darwin-arm64$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,darwin,amd64,0,-mod=vendor -trimpath,server,$(LDFLAGS),sliver-server_darwin-amd64$(ARTIFACT_SUFFIX))
+
+.PHONY: pb
+pb: validate-pb-compilers
+	protoc -I protobuf/ protobuf/commonpb/common.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/sliverpb/sliver.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/clientpb/client.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/dnspb/dns.proto --go_out=paths=source_relative:protobuf/
+	protoc -I protobuf/ protobuf/rpcpb/services.proto --go_out=paths=source_relative:protobuf/ --go-grpc_out=protobuf/ --go-grpc_opt=paths=source_relative
+
+.PHONY: debug
+debug: clean
+	$(call windows_go_build,$(GOOS),$(GOARCH),$(CGO_ENABLED),-mod=vendor,server,$(LDFLAGS_DEBUG),sliver-server$(ARTIFACT_SUFFIX))
+	$(call windows_go_build,$(GOOS),$(GOARCH),0,-mod=vendor,client,$(LDFLAGS_DEBUG),sliver-client$(ARTIFACT_SUFFIX))
+
+.PHONY: validate-pb-compilers
+validate-pb-compilers:
+	@for %%P in ($(PB_COMPILERS)) do @where.exe %%P >NUL || (echo Missing protobuf util %%P in PATH & exit /b 1)
+
+validate-go-version:
+	@if $(GO_MAJOR_VERSION) GTR $(MIN_SUPPORTED_GO_MAJOR_VERSION) (exit /b 0) else if $(GO_MAJOR_VERSION) LSS $(MIN_SUPPORTED_GO_MAJOR_VERSION) (echo $(GO_VERSION_VALIDATION_ERR_MSG) & exit /b 1) else if $(GO_MINOR_VERSION) LSS $(MIN_SUPPORTED_GO_MINOR_VERSION) (echo $(GO_VERSION_VALIDATION_ERR_MSG) & exit /b 1)
+
+.PHONY: clean-all
+clean-all: clean
+	-rmdir /S /Q server\assets\fs\darwin\amd64
+	-rmdir /S /Q server\assets\fs\darwin\arm64
+	-rmdir /S /Q server\assets\fs\windows\amd64
+	-rmdir /S /Q server\assets\fs\linux\amd64
+	-del /Q /F server\assets\fs\*.zip 2>NUL
+	-del /Q /F .downloaded_assets 2>NUL
+
+.PHONY: clean
+clean:
+	-del /Q /F sliver-client sliver-client_* sliver-server sliver-server_* sliver-*.exe 2>NUL
+
+.downloaded_assets:
+	$(call windows_exec,$(ENV),"$(GO)" run -mod=vendor ./util/cmd/assets)
+	@type NUL > .downloaded_assets
+
+endif

client/command/alias/load.go

@@ -250,7 +250,7 @@ func LoadAlias(manifestPath string, cmd *cobra.Command, con *console.SliverClien
 	f.StringP("process-arguments", "A", "", "arguments to pass to the hosting process")
 	f.Uint32P("ppid", "P", 0, "parent process ID to use when creating the hosting process (Windows only)")
 	f.BoolP("save", "s", false, "Save output to disk")
-	f.IntP("timeout", "t", defaultTimeout, "command timeout in seconds")
+	f.Int64P("timeout", "t", defaultTimeout, "command timeout in seconds")
 	addAliasCmd.Flags().AddFlagSet(f)
 
 	// Setup completions for alias arguments

client/command/beacons/commands.go

@@ -28,7 +28,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		},
 	}
 	flags.Bind("beacons", true, beaconsCmd, func(f *pflag.FlagSet) {
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 	flags.Bind("beacons", false, beaconsCmd, func(f *pflag.FlagSet) {
 		f.StringP("kill", "k", "", "kill the designated beacon")

client/command/extensions/extensions_test.go

@@ -3,6 +3,8 @@ package extensions
 import (
 	"encoding/json"
 	"testing"
+
+	"github.com/bishopfox/sliver/util"
 )
 
 /*
@@ -114,6 +116,8 @@ const (
 )
 
 func TestParseExtensionManifest(t *testing.T) {
+	expectedPath := util.ResolvePath("foo/test1.dll")
+
 	extManifest, err := ParseExtensionManifest([]byte(sample1))
 	if err != nil {
 		t.Fatalf("Error parsing extension manifest: %s", err)
@@ -150,8 +154,8 @@ func TestParseExtensionManifest(t *testing.T) {
 		if extCmd.Files[0].Arch != "amd64" {
 			t.Errorf("Expected Arch 'amd64', got '%s'", extCmd.Files[0].Arch)
 		}
-		if extCmd.Files[0].Path != "/foo/test1.dll" {
-			t.Errorf("Expected path '/foo/test1.dll', got '%s'", extCmd.Files[0].Path)
+		if extCmd.Files[0].Path != expectedPath {
+			t.Errorf("Expected path '%s', got '%s'", expectedPath, extCmd.Files[0].Path)
 		}
 	}
 
@@ -178,14 +182,16 @@ func TestParseExtensionManifest(t *testing.T) {
 		if extManifest2.Files[0].Arch != "amd64" {
 			t.Errorf("Expected Arch 'amd64', got '%s'", extManifest2.Files[0].Arch)
 		}
-		if extManifest2.Files[0].Path != "/foo/test1.dll" {
-			t.Errorf("Expected path '/foo/test1.dll', got '%s'", extManifest2.Files[0].Path)
+		if extManifest2.Files[0].Path != expectedPath {
+			t.Errorf("Expected path '%s', got '%s'", expectedPath, extManifest2.Files[0].Path)
 		}
 	}
 
 }
 
 func TestParseMultipleCmdManifest(t *testing.T) {
+	expectedPath := util.ResolvePath("ex.dll")
+
 	mextManifest, err := ParseExtensionManifest([]byte(multicmd))
 	if err != nil {
 		t.Errorf("error parsing manifest: %s", err)
@@ -206,11 +212,11 @@ func TestParseMultipleCmdManifest(t *testing.T) {
 	if mextManifest.ExtCommand[1].Entrypoint != "Test2" {
 		t.Errorf("expected entrypoint Test2, got %s", mextManifest.ExtCommand[1].Entrypoint)
 	}
-	if mextManifest.ExtCommand[0].Files[0].Path != "/ex.dll" { //path cleaning adds a root path here? I am not sure if this should be a bug or not... works fine in prod
-		t.Errorf("expected path ex.dll, got %s", mextManifest.ExtCommand[0].Files[0].Path)
+	if mextManifest.ExtCommand[0].Files[0].Path != expectedPath { // path normalization is platform-specific
+		t.Errorf("expected path %s, got %s", expectedPath, mextManifest.ExtCommand[0].Files[0].Path)
 	}
-	if mextManifest.ExtCommand[1].Files[0].Path != "/ex.dll" { //path cleaning adds a root path here? I am not sure if this should be a bug or not... works fine in prod
-		t.Errorf("expected path ex.dll, got %s", mextManifest.ExtCommand[0].Files[0].Path)
+	if mextManifest.ExtCommand[1].Files[0].Path != expectedPath { // path normalization is platform-specific
+		t.Errorf("expected path %s, got %s", expectedPath, mextManifest.ExtCommand[1].Files[0].Path)
 	}
 	//maybe some more? args?
 }

client/command/extensions/load.go

@@ -377,7 +377,7 @@ func ExtensionRegisterCommand(extCmd *ExtCommand, cmd *cobra.Command, con *conso
 	// Flags
 	f := pflag.NewFlagSet(extCmd.CommandName, pflag.ContinueOnError)
 	f.BoolP("save", "s", false, "Save output to disk")
-	f.IntP("timeout", "t", defaultTimeout, "command timeout in seconds")
+	f.Int64P("timeout", "t", defaultTimeout, "command timeout in seconds")
 	extensionCmd.Flags().AddFlagSet(f)
 	extensionCmd.Flags().ParseErrorsWhitelist.UnknownFlags = true
 

client/command/generate/commands.go

@@ -36,7 +36,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		GroupID: consts.PayloadsHelpGroup,
 	}
 	flags.Bind("generate", true, generateCmd, func(f *pflag.FlagSet) {
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 
 	// Session flags and completions.

client/command/jobs/commands.go

@@ -43,12 +43,12 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		GroupID: consts.NetworkHelpGroup,
 	}
 	flags.Bind("jobs", true, jobsCmd, func(f *pflag.FlagSet) {
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 	flags.Bind("jobs", false, jobsCmd, func(f *pflag.FlagSet) {
 		f.Int32P("kill", "k", -1, "kill a background job")
 		f.BoolP("kill-all", "K", false, "kill all jobs")
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 	flags.BindFlagCompletions(jobsCmd, func(comp *carapace.ActionMap) {
 		(*comp)["kill"] = JobsIDCompleter(con)

client/command/loot/commands.go

@@ -24,7 +24,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		GroupID: consts.SliverHelpGroup,
 	}
 	flags.Bind("loot", true, lootCmd, func(f *pflag.FlagSet) {
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 	flags.Bind("loot", false, lootCmd, func(f *pflag.FlagSet) {
 		f.StringP("filter", "f", "", "filter based on loot type")

client/command/pivots/commands.go

@@ -81,7 +81,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	}
 	pivotsCmd.AddCommand(pivotDetailsCmd)
 	flags.Bind("", false, pivotDetailsCmd, func(f *pflag.FlagSet) {
-		f.IntP("id", "i", 0, "id of the pivot listener to get details for")
+		f.Uint32P("id", "i", 0, "id of the pivot listener to get details for")
 	})
 	flags.BindFlagCompletions(pivotDetailsCmd, func(comp *carapace.ActionMap) {
 		(*comp)["id"] = PivotIDCompleter(con)

client/command/portfwd/commands.go

@@ -39,6 +39,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	flags.Bind("", false, addCmd, func(f *pflag.FlagSet) {
 		f.StringP("remote", "r", "", "remote target host:port (e.g., 10.0.0.1:445)")
 		f.StringP("bind", "b", "127.0.0.1:8080", "bind port forward to interface")
+		f.Int32P("keepalive", "k", 0, "keepalive period in seconds (default 30s, -1 to disable)")
 	})
 	flags.BindFlagCompletions(addCmd, func(comp *carapace.ActionMap) {
 		(*comp)["bind"] = completers.ClientInterfacesCompleter()

client/command/portfwd/portfwd-add.go

@@ -68,13 +68,23 @@ func PortfwdAddCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 		bindAddr = fmt.Sprintf("127.0.0.1:%s", bindAddr)
 	}
 
+	keepAlive, _ := cmd.Flags().GetInt32("keepalive")
+	var keepAlivePeriod time.Duration
+	if keepAlive > 0 {
+		keepAlivePeriod = time.Duration(keepAlive) * time.Second
+	} else if keepAlive < 0 {
+		keepAlivePeriod = -1 * time.Second
+	} else {
+		keepAlivePeriod = 30 * time.Second
+	}
+
 	tcpProxy := &tcpproxy.Proxy{}
 	channelProxy := &core.ChannelProxy{
 		Rpc:             con.Rpc,
 		Session:         session,
 		RemoteAddr:      remoteAddr,
 		BindAddr:        bindAddr,
-		KeepAlivePeriod: 60 * time.Second,
+		KeepAlivePeriod: keepAlivePeriod,
 		DialTimeout:     30 * time.Second,
 	}
 	tcpProxy.AddRoute(bindAddr, channelProxy)

client/command/privilege/commands.go

@@ -74,7 +74,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 			GetSystemCmd(cmd, con, args)
 		},
 		GroupID:     consts.PrivilegesHelpGroup,
-		Annotations: flags.RestrictTargets(consts.WindowsCmdsFilter),
+		Annotations: flags.RestrictTargets(consts.WindowsCmdsFilter, consts.SessionCmdsFilter),
 	}
 	flags.Bind("", false, getSystemCmd, func(f *pflag.FlagSet) {
 		f.StringP("process", "p", "spoolsv.exe", "SYSTEM process to inject into")

client/command/privilege/getsystem.go

@@ -37,6 +37,10 @@ func GetSystemCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 	if session == nil && beacon == nil {
 		return
 	}
+	if session == nil {
+		con.PrintErrorf("Command is only supported for sessions.\n")
+		return
+	}
 	targetOS := getOS(session, beacon)
 	if targetOS != "windows" {
 		con.PrintErrorf("Command only supported on Windows.\n")
@@ -45,6 +49,10 @@ func GetSystemCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 
 	process, _ := cmd.Flags().GetString("process")
 	config := con.GetActiveSessionConfig()
+	if config == nil {
+		con.PrintErrorf("Failed to derive active session config.\n")
+		return
+	}
 
 	/* If the HTTP C2 Config name is not defined, then put in the default value
 	   This will have no effect on implants that do not use HTTP C2

client/command/processes/commands.go

@@ -52,7 +52,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.BoolP("loot", "X", false, "save output as loot")
 		f.StringP("loot-name", "N", "", "name to assign when adding the memory dump to the loot store (optional)")
 
-		f.Int32P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 	flags.BindFlagCompletions(procdumpCmd, func(comp *carapace.ActionMap) {
 		(*comp)["save"] = carapace.ActionFiles()

client/command/processes/procdump.go

@@ -55,7 +55,7 @@ func ProcdumpCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 		return
 	}
 
-	timeout, _ := cmd.Flags().GetInt32("timeout")
+	timeout, _ := cmd.Flags().GetInt64("timeout")
 
 	if timeout < 1 {
 		con.PrintErrorf("Invalid timeout argument\n")
@@ -68,7 +68,7 @@ func ProcdumpCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	dump, err := con.Rpc.ProcessDump(context.Background(), &sliverpb.ProcessDumpReq{
 		Request: con.ActiveTarget.Request(cmd),
 		Pid:     int32(pid),
-		Timeout: timeout,
+		Timeout: int32(timeout),
 	})
 	ctrl <- true
 	<-ctrl

client/command/registry/commands.go

@@ -22,7 +22,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		Annotations: flags.RestrictTargets(consts.WindowsCmdsFilter),
 	}
 	flags.Bind("registry", true, registryCmd, func(f *pflag.FlagSet) {
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 
 	registryReadCmd := &cobra.Command{

client/command/rportfwd/commands.go

@@ -39,6 +39,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	flags.Bind("", false, rportfwdAddCmd, func(f *pflag.FlagSet) {
 		f.StringP("remote", "r", "", "remote address <ip>:<port> connection is forwarded to")
 		f.StringP("bind", "b", "", "bind address <ip>:<port> for implants to listen on")
+		f.Int32P("keepalive", "k", 0, "keepalive period in seconds (default 30s, -1 to disable)")
 	})
 	flags.BindFlagCompletions(rportfwdAddCmd, func(comp *carapace.ActionMap) {
 		(*comp)["remote"] = completers.ClientInterfacesCompleter()

client/command/rportfwd/portfwd-add.go

@@ -53,10 +53,13 @@ func StartRportFwdListenerCmd(cmd *cobra.Command, con *console.SliverClient, arg
 	if portNumberOnlyRegexp.MatchString(forwardAddress) {
 		forwardAddress = fmt.Sprintf("127.0.0.1:%s", forwardAddress)
 	}
+	keepAlive, _ := cmd.Flags().GetInt32("keepalive")
+
 	rportfwdListener, err := con.Rpc.StartRportFwdListener(context.Background(), &sliverpb.RportFwdStartListenerReq{
 		Request:        con.ActiveTarget.Request(cmd),
 		BindAddress:    bindAddress,
 		ForwardAddress: forwardAddress,
+		KeepAlive:      keepAlive,
 	})
 	if err != nil {
 		con.PrintWarnf("%s\n", err)

client/command/sessions/commands.go

@@ -27,7 +27,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		GroupID: consts.SliverHelpGroup,
 	}
 	flags.Bind("sessions", true, sessionsCmd, func(f *pflag.FlagSet) {
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 	flags.Bind("sessions", false, sessionsCmd, func(f *pflag.FlagSet) {
 		f.StringP("interact", "i", "", "interact with a session")

client/command/tasks/commands.go

@@ -23,7 +23,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		Annotations: flags.RestrictTargets(consts.BeaconCmdsFilter),
 	}
 	flags.Bind("tasks", true, tasksCmd, func(f *pflag.FlagSet) {
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 		f.BoolP("overflow", "O", false, "overflow terminal width (display truncated rows)")
 		f.IntP("skip-pages", "S", 0, "skip the first n page(s)")
 		f.StringP("filter", "f", "", "filter based on task type (case-insensitive prefix matching)")

client/command/update/commands.go

@@ -28,7 +28,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.StringP("save", "s", "", "save downloaded files to specific directory (default downloads dir)")
 		f.BoolP("insecure", "I", false, "skip tls certificate validation")
 		f.Bool("force", false, "skip version comparison and download the latest release")
-		f.IntP("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
+		f.Int64P("timeout", "t", flags.DefaultTimeout, "grpc timeout in seconds")
 	})
 	flags.BindFlagCompletions(updateCmd, func(comp *carapace.ActionMap) {
 		(*comp)["proxy"] = completers.LocalProxyCompleter()

client/command/update/update.go

@@ -60,7 +60,7 @@ const (
 func UpdateCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	VerboseVersionsCmd(cmd, con, args)
 
-	timeoutF, _ := cmd.Flags().GetInt("timeout")
+	timeoutF, _ := cmd.Flags().GetInt64("timeout")
 	timeout := time.Duration(timeoutF) * time.Second
 
 	insecure, _ := cmd.Flags().GetBool("insecure")

client/core/portfwd.go

@@ -216,6 +216,7 @@ func (p *ChannelProxy) dialImplant(ctx context.Context) (*TunnelIO, error) {
 		Port:     p.Port(),
 		Protocol: sliverpb.PortFwdProtoTCP,
 		TunnelID: tunnel.ID,
+		KeepAlive: int32(p.KeepAlivePeriod.Seconds()),
 	})
 	if err != nil {
 		return nil, err

go-tests.ps1

@@ -0,0 +1,393 @@
+#!/usr/bin/env pwsh
+
+# Sliver Implant Framework
+# Copyright (C) 2019  Bishop Fox
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+[CmdletBinding()]
+param(
+    [switch]$SkipGenerate,
+    [switch]$UnitOnly,
+    [Parameter(ValueFromRemainingArguments = $true)]
+    [string[]]$RemainingArgs
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+foreach ($arg in $RemainingArgs) {
+    switch ($arg) {
+        "--skip-generate" {
+            $SkipGenerate = $true
+            continue
+        }
+        "--unit-only" {
+            $UnitOnly = $true
+            $SkipGenerate = $true
+            continue
+        }
+        default {
+            throw "Unknown argument: $arg"
+        }
+    }
+}
+
+if ($UnitOnly) {
+    $SkipGenerate = $true
+}
+
+$script:TestTmpRoot = $null
+$script:CreatedTestRoot = $false
+
+function Invoke-ExternalCommand {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$FilePath,
+        [string[]]$Arguments = @(),
+        [hashtable]$Environment = @{}
+    )
+
+    $previous = @{}
+    try {
+        foreach ($name in $Environment.Keys) {
+            $previous[$name] = [System.Environment]::GetEnvironmentVariable($name, "Process")
+            [System.Environment]::SetEnvironmentVariable($name, $Environment[$name], "Process")
+        }
+
+        & $FilePath @Arguments
+        if ($LASTEXITCODE -ne 0) {
+            throw "Command exited with code ${LASTEXITCODE}: $FilePath $($Arguments -join ' ')"
+        }
+    } catch {
+        Write-Host $_
+        throw
+    } finally {
+        foreach ($name in $Environment.Keys) {
+            [System.Environment]::SetEnvironmentVariable($name, $previous[$name], "Process")
+        }
+    }
+}
+
+function Write-FailureLogs {
+    $logPath = Join-Path $env:SLIVER_ROOT_DIR "logs\sliver.log"
+    if (Test-Path -LiteralPath $logPath) {
+        Get-Content -LiteralPath $logPath -ErrorAction SilentlyContinue
+    }
+}
+
+function Invoke-TestStep {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Name,
+        [Parameter(Mandatory = $true)]
+        [scriptblock]$Action
+    )
+
+    Write-Host ""
+    Write-Host "==> $Name"
+    try {
+        & $Action
+        return
+    } catch {
+        Write-FailureLogs
+        throw "Test step failed: $Name"
+    }
+}
+
+function Test-SkipPackage {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Package,
+        [string]$Tags = ""
+    )
+
+    $goListArgs = @("list", "-e", "-f", "{{if .Error}}{{.Error}}{{end}}")
+    if ($Tags) {
+        $goListArgs += "-tags=$Tags"
+    }
+    $goListArgs += $Package
+
+    $goListError = & go @goListArgs 2>$null
+    $goListText = ($goListError | Out-String)
+    if ($goListText -like "*build constraints exclude all Go files*") {
+        Write-Host ""
+        Write-Host "==> Skipping $Package (unsupported on current platform)"
+        return $true
+    }
+
+    return $false
+}
+
+function Get-TestDirectories {
+    Get-ChildItem -Path @("client", "implant", "server", "util") -Recurse -Filter "*_test.go" -File |
+        ForEach-Object {
+            [string](Resolve-Path -LiteralPath $_.DirectoryName -Relative).Replace("\", "/")
+        } |
+        Sort-Object -Unique
+}
+
+function Get-ServerBinaryPath {
+    $candidates = @(
+        (Join-Path $PWD.Path "sliver-server.exe"),
+        (Join-Path $PWD.Path "sliver-server")
+    )
+
+    foreach ($candidate in $candidates) {
+        if (Test-Path -LiteralPath $candidate) {
+            return $candidate
+        }
+    }
+
+    return $null
+}
+
+function Invoke-UnpackServerAssets {
+    $serverBinary = Get-ServerBinaryPath
+    if ($serverBinary) {
+        try {
+            Invoke-ExternalCommand -FilePath $serverBinary -Arguments @("unpack", "--force")
+            return
+        } catch {
+            Write-Host "sliver-server unpack failed, falling back to go run ./server unpack --force"
+        }
+    }
+
+    Invoke-ExternalCommand -FilePath "go" -Arguments @("run", "-tags=server,go_sqlite", "./server", "unpack", "--force")
+}
+
+function Stop-TestProcesses {
+    if (-not $script:CreatedTestRoot -or -not $script:TestTmpRoot) {
+        return
+    }
+
+    try {
+        $escapedRoot = [Regex]::Escape($script:TestTmpRoot)
+        $relatedProcesses = Get-CimInstance Win32_Process -ErrorAction Stop |
+            Where-Object {
+                $_.ParentProcessId -eq $PID -or
+                ($_.CommandLine -and $_.CommandLine -match $escapedRoot)
+            } |
+            Sort-Object ProcessId -Unique
+
+        foreach ($proc in $relatedProcesses) {
+            Stop-Process -Id $proc.ProcessId -Force -ErrorAction SilentlyContinue
+        }
+    } catch {
+        # Best-effort cleanup only.
+    }
+}
+
+function Remove-TestRoot {
+    if (-not $script:CreatedTestRoot -or -not $script:TestTmpRoot) {
+        return
+    }
+
+    for ($attempt = 0; $attempt -lt 5; $attempt++) {
+        try {
+            Remove-Item -LiteralPath $script:TestTmpRoot -Recurse -Force -ErrorAction Stop
+        } catch {
+            Start-Sleep -Seconds 1
+        }
+
+        if (-not (Test-Path -LiteralPath $script:TestTmpRoot)) {
+            return
+        }
+    }
+
+    if (Test-Path -LiteralPath $script:TestTmpRoot) {
+        Write-Warning "Failed to fully clean temp dir: $script:TestTmpRoot"
+    }
+}
+
+try {
+    Write-Host "----------------------------------------------------------------"
+    Write-Host "WARNING: Running unit tests on slow systems can take a LONG time"
+    Write-Host "         Recommended to only run on 16+ CPU cores and 32Gb+ RAM"
+    Write-Host "----------------------------------------------------------------"
+
+    $tags = "osusergo,netgo,go_sqlite"
+
+    $script:TestTmpRoot = Join-Path ([System.IO.Path]::GetTempPath()) ("sliver-go-tests-" + [System.Guid]::NewGuid().ToString("N"))
+    New-Item -ItemType Directory -Path $script:TestTmpRoot -Force | Out-Null
+    $script:CreatedTestRoot = $true
+
+    $env:SLIVER_ROOT_DIR = Join-Path $script:TestTmpRoot "sliver"
+    $env:SLIVER_CLIENT_DIR = Join-Path $script:TestTmpRoot "sliver-client"
+    $env:SLIVER_CLIENT_ROOT_DIR = $env:SLIVER_CLIENT_DIR
+    $env:HOME = Join-Path $script:TestTmpRoot "home"
+    $env:XDG_CONFIG_HOME = Join-Path $script:TestTmpRoot "xdg-config"
+    $env:XDG_CACHE_HOME = Join-Path $script:TestTmpRoot "xdg-cache"
+    $env:XDG_DATA_HOME = Join-Path $script:TestTmpRoot "xdg-data"
+    $env:TMPDIR = Join-Path $script:TestTmpRoot "tmp"
+    $env:TMP = $env:TMPDIR
+    $env:TEMP = $env:TMPDIR
+    $env:GOCACHE = Join-Path $script:TestTmpRoot "go-cache"
+    $env:GOTMPDIR = Join-Path $script:TestTmpRoot "go-tmp"
+    if ($env:GOFLAGS) {
+        $env:GOFLAGS = ($env:GOFLAGS.Trim() + " -mod=vendor").Trim()
+    } else {
+        $env:GOFLAGS = "-mod=vendor"
+    }
+
+    @(
+        $env:SLIVER_ROOT_DIR,
+        $env:SLIVER_CLIENT_DIR,
+        $env:HOME,
+        $env:XDG_CONFIG_HOME,
+        $env:XDG_CACHE_HOME,
+        $env:XDG_DATA_HOME,
+        $env:TMPDIR,
+        $env:GOCACHE,
+        $env:GOTMPDIR
+    ) | ForEach-Object {
+        New-Item -ItemType Directory -Path $_ -Force | Out-Null
+    }
+
+    $isWindowsPlatform = [System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform(
+        [System.Runtime.InteropServices.OSPlatform]::Windows
+    )
+    $sliverGoBin = Join-Path $env:SLIVER_ROOT_DIR "go\bin"
+    if (-not $isWindowsPlatform) {
+        $env:PATH = [string]::Join([System.IO.Path]::PathSeparator, @($sliverGoBin, $env:PATH))
+    }
+
+    Write-Host "Using isolated temp directories:"
+    Write-Host "  SLIVER_ROOT_DIR=$env:SLIVER_ROOT_DIR"
+    Write-Host "  SLIVER_CLIENT_DIR=$env:SLIVER_CLIENT_DIR"
+
+    Invoke-TestStep -Name "unpack server assets" -Action { Invoke-UnpackServerAssets }
+
+    $testDirs = @(Get-TestDirectories)
+    $clientTestPkgs = @()
+    $implantTestPkgs = @()
+    $serverUtilTestPkgs = @()
+
+    foreach ($testDir in $testDirs) {
+        $pkg = if ($testDir.StartsWith(".")) { $testDir } else { "./$testDir" }
+        switch -Wildcard ($pkg) {
+            "./server/c2" { continue }
+            "./server/generate" { continue }
+            "./client/*" {
+                $clientTestPkgs += $pkg
+                continue
+            }
+            "./implant/*" {
+                $implantTestPkgs += $pkg
+                continue
+            }
+            "./server/*" {
+                $serverUtilTestPkgs += $pkg
+                continue
+            }
+            "./util*" {
+                $serverUtilTestPkgs += $pkg
+                continue
+            }
+        }
+    }
+
+    foreach ($pkg in $clientTestPkgs) {
+        if (Test-SkipPackage -Package $pkg -Tags "client,$tags") {
+            continue
+        }
+
+        Invoke-TestStep -Name $pkg -Action {
+            Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-tags=client,$tags", $pkg)
+        }
+    }
+
+    foreach ($pkg in $implantTestPkgs) {
+        if (Test-SkipPackage -Package $pkg) {
+            continue
+        }
+
+        Invoke-TestStep -Name $pkg -Action {
+            Invoke-ExternalCommand -FilePath "go" -Arguments @("test", $pkg)
+        }
+    }
+
+    foreach ($pkg in $serverUtilTestPkgs) {
+        if (Test-SkipPackage -Package $pkg -Tags "server,$tags") {
+            continue
+        }
+
+        switch ($pkg) {
+            "./server/assets/traffic-encoders" {
+                Invoke-TestStep -Name $pkg -Action {
+                    Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-timeout", "10m", "-tags=server,$tags", $pkg)
+                }
+                continue
+            }
+            "./server/encoders" {
+                Invoke-TestStep -Name $pkg -Action {
+                    Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-timeout", "10m", "-tags=server,$tags", $pkg)
+                }
+                continue
+            }
+            "./server/rpc" {
+                Invoke-TestStep -Name $pkg -Action {
+                    Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-vet=off", "-timeout", "30m", "-tags=server,$tags", $pkg)
+                }
+                continue
+            }
+            default {
+                Invoke-TestStep -Name $pkg -Action {
+                    Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-tags=server,$tags", $pkg)
+                }
+            }
+        }
+    }
+
+    Invoke-TestStep -Name "./server/c2" -Action {
+        Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-tags=server,$tags", "./server/c2")
+    }
+
+    if ($UnitOnly) {
+        Write-Host ""
+        Write-Host "Skipping ./server/c2 e2e tests (--unit-only)"
+    } else {
+        Invoke-TestStep -Name "./server/c2 (e2e yamux)" -Action {
+            Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-tags=server,$tags,sliver_e2e", "./server/c2", "-run", "Test(MTLS|WG)Yamux_", "-count=1")
+        }
+        Invoke-TestStep -Name "./server/c2 (e2e dns)" -Action {
+            Invoke-ExternalCommand -FilePath "go" -Arguments @("test", "-tags=server,$tags,sliver_e2e", "./server/c2", "-run", "TestDNS_", "-count=1")
+        }
+    }
+
+    if (-not $SkipGenerate) {
+        $generateGoMaxProcs = if ($env:SLIVER_GENERATE_GOMAXPROCS) { $env:SLIVER_GENERATE_GOMAXPROCS } else { "2" }
+        $generateGoP = if ($env:SLIVER_GENERATE_GO_P) { $env:SLIVER_GENERATE_GO_P } else { "1" }
+        $generateTestParallel = if ($env:SLIVER_GENERATE_TEST_PARALLEL) { $env:SLIVER_GENERATE_TEST_PARALLEL } else { "1" }
+
+        Invoke-TestStep -Name "./server/generate" -Action {
+            Invoke-ExternalCommand -FilePath "go" `
+                -Arguments @("test", "-timeout", "6h", "-p", $generateGoP, "-parallel", $generateTestParallel, "-tags=server,$tags", "./server/generate") `
+                -Environment @{
+                    GOMAXPROCS = $generateGoMaxProcs
+                    GOPROXY    = "off"
+                }
+        }
+    } else {
+        Write-Host ""
+        if ($UnitOnly) {
+            Write-Host "Skipping ./server/generate tests (--unit-only)"
+        } else {
+            Write-Host "Skipping ./server/generate tests (--skip-generate)"
+        }
+    }
+} finally {
+    Stop-TestProcesses
+    Remove-TestRoot
+}

go-tests.sh

@@ -20,10 +20,15 @@ set -u
 set -o pipefail
 
 SKIP_GENERATE=0
+UNIT_ONLY=0
 for arg in "$@"; do
 	if [ "$arg" = "--skip-generate" ]; then
 		SKIP_GENERATE=1
 	fi
+	if [ "$arg" = "--unit-only" ]; then
+		UNIT_ONLY=1
+		SKIP_GENERATE=1
+	fi
 done
 
 echo "----------------------------------------------------------------"
@@ -219,8 +224,13 @@ done
 
 ## Server c2 (unit + e2e)
 run_test_cmd "./server/c2" go test -tags="server,$TAGS" ./server/c2 || exit 1
-run_test_cmd "./server/c2 (e2e yamux)" go test -tags="server,$TAGS,sliver_e2e" ./server/c2 -run 'Test(MTLS|WG)Yamux_' -count=1 || exit 1
-run_test_cmd "./server/c2 (e2e dns)" go test -tags="server,$TAGS,sliver_e2e" ./server/c2 -run 'TestDNS_' -count=1 || exit 1
+if [ "$UNIT_ONLY" -eq 1 ]; then
+	echo
+	echo "Skipping ./server/c2 e2e tests (--unit-only)"
+else
+	run_test_cmd "./server/c2 (e2e yamux)" go test -tags="server,$TAGS,sliver_e2e" ./server/c2 -run 'Test(MTLS|WG)Yamux_' -count=1 || exit 1
+	run_test_cmd "./server/c2 (e2e dns)" go test -tags="server,$TAGS,sliver_e2e" ./server/c2 -run 'TestDNS_' -count=1 || exit 1
+fi
 
 ## Server generate
 if [ "$SKIP_GENERATE" -eq 0 ]; then
@@ -235,5 +245,9 @@ if [ "$SKIP_GENERATE" -eq 0 ]; then
 		go test -timeout 6h -p "$GENERATE_GO_P" -parallel "$GENERATE_TEST_PARALLEL" -tags="server,$TAGS" ./server/generate || exit 1
 else
 	echo
-	echo "Skipping ./server/generate tests (--skip-generate)"
+	if [ "$UNIT_ONLY" -eq 1 ]; then
+		echo "Skipping ./server/generate tests (--unit-only)"
+	else
+		echo "Skipping ./server/generate tests (--skip-generate)"
+	fi
 fi

go.mod

@@ -211,7 +211,6 @@ require (
 )
 
 require (
-	charm.land/bubbles/v2 v2.0.0
 	charm.land/bubbletea/v2 v2.0.0
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
@@ -231,7 +230,7 @@ require (
 	github.com/carapace-sh/carapace v1.11.0
 	github.com/carapace-sh/carapace-shlex v1.1.1 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.4.2 // indirect
+	github.com/charmbracelet/colorprofile v0.4.2
 	github.com/charmbracelet/x/ansi v0.11.6
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect

go.sum

@@ -4,8 +4,6 @@ c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd h1:ZLsPO6WdZ5zatV4UfVpr7oAw
 c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
 cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
-charm.land/bubbles/v2 v2.0.0 h1:tE3eK/pHjmtrDiRdoC9uGNLgpopOd8fjhEe31B/ai5s=
-charm.land/bubbles/v2 v2.0.0/go.mod h1:rCHoleP2XhU8um45NTuOWBPNVHxnkXKTiZqcclL/qOI=
 charm.land/bubbletea/v2 v2.0.0 h1:p0d6CtWyJXJ9GfzMpUUqbP/XUUhhlk06+vCKWmox1wQ=
 charm.land/bubbletea/v2 v2.0.0/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
 charm.land/lipgloss/v2 v2.0.0 h1:sd8N/B3x892oiOjFfBQdXBQp3cAkvjGaU5TvVZC3ivo=
@@ -194,8 +192,6 @@ github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 h1:eyFRb
 github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8/go.mod h1:SQpCTRNBtzJkwku5ye4S3HEuthAlGy2n9VXZnWkEW98=
 github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
 github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
-github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
-github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
 github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
 github.com/charmbracelet/x/conpty v0.1.0 h1:4zc8KaIcbiL4mghEON8D72agYtSeIgq8FSThSPQIb+U=

implant/sliver/handlers/tun-rportfwd.go

@@ -97,11 +97,20 @@ func rportFwdStartListenerHandler(envelope *pb.Envelope, connection *transports.
 		}
 	}
 	tcpProxy := &tcpproxy.Proxy{}
+	var keepAlivePeriod time.Duration
+	if req.KeepAlive > 0 {
+		keepAlivePeriod = time.Duration(req.KeepAlive) * time.Second
+	} else if req.KeepAlive < 0 {
+		keepAlivePeriod = -1 * time.Second
+	} else {
+		keepAlivePeriod = 30 * time.Second
+	}
+
 	channelProxy := &rportfwd.ChannelProxy{
 		Conn:            connection,
 		RemoteAddr:      req.ForwardAddress,
 		BindAddr:        req.BindAddress,
-		KeepAlivePeriod: 1000 * time.Second,
+		KeepAlivePeriod: keepAlivePeriod,
 		DialTimeout:     30 * time.Second,
 	}
 	tcpProxy.AddRoute(req.BindAddress, channelProxy)

implant/sliver/handlers/tunnel_handlers/portfwd_handler.go

@@ -81,9 +81,16 @@ func PortfwdReqHandler(envelope *sliverpb.Envelope, connection *transports.Conne
 		// {{if .Config.Debug}}
 		log.Printf("[portfwd] Configuring keep alive")
 		// {{end}}
-		conn.SetKeepAlive(true)
-		// TODO: Make KeepAlive configurable
-		conn.SetKeepAlivePeriod(30 * time.Second)
+		if portfwdReq.KeepAlive < 0 {
+			conn.SetKeepAlive(false)
+		} else {
+			conn.SetKeepAlive(true)
+			if portfwdReq.KeepAlive > 0 {
+				conn.SetKeepAlivePeriod(time.Duration(portfwdReq.KeepAlive) * time.Second)
+			} else {
+				conn.SetKeepAlivePeriod(30 * time.Second)
+			}
+		}
 	}
 
 	// Add tunnel

implant/sliver/rportfwd/portfwd.go

@@ -140,9 +140,16 @@ func (p *ChannelProxy) HandleConn(src net.Conn) {
 		// {{if .Config.Debug}}
 		log.Printf("[portfwd] Configuring keep alive")
 		// {{end}}
-		conn.SetKeepAlive(true)
-		// TODO: Make KeepAlive configurable
-		conn.SetKeepAlivePeriod(30 * time.Second)
+		if p.KeepAlivePeriod < 0 {
+			conn.SetKeepAlive(false)
+		} else {
+			conn.SetKeepAlive(true)
+			if p.KeepAlivePeriod > 0 {
+				conn.SetKeepAlivePeriod(p.KeepAlivePeriod)
+			} else {
+				conn.SetKeepAlivePeriod(30 * time.Second)
+			}
+		}
 	}
 	// Add tunnel
 	// {{if .Config.Debug}}

implant/sliver/transports/httpclient/drivers/win/wininet/client_windows.go

@@ -58,6 +58,7 @@ func (c *Client) Do(request *http.Request) (*http.Response, error) {
 	var buf []byte
 	var err error
 	var reqHandle uintptr
+	var connHandle uintptr
 	var resp *Response
 
 	var rawBody []byte
@@ -81,9 +82,17 @@ func (c *Client) Do(request *http.Request) (*http.Response, error) {
 		Body:    rawBody,
 	}
 
-	if reqHandle, err = buildRequest(c.handle, req); err != nil {
+	if connHandle, reqHandle, err = buildRequest(c.handle, req); err != nil {
+		if reqHandle != 0 {
+			InternetCloseHandle(reqHandle)
+		}
+		if connHandle != 0 {
+			InternetCloseHandle(connHandle)
+		}
 		return nil, err
 	}
+	defer InternetCloseHandle(reqHandle)
+	defer InternetCloseHandle(connHandle)
 
 	if c.Timeout > 0 {
 		buf = make([]byte, 4)
@@ -232,3 +241,11 @@ func (jar *Jar) SetCookies(u *url.URL, cookies []*Cookie) {
 func (jar *Jar) Cookies(u *url.URL) []*Cookie {
 	return jar.cookies
 }
+
+// Close will close the client handle
+func (c *Client) Close() {
+	if c.handle != 0 {
+		InternetCloseHandle(c.handle)
+		c.handle = 0
+	}
+}

implant/sliver/transports/httpclient/drivers/win/wininet/utils_windows.go

@@ -17,7 +17,7 @@ func convertFail(str string, err error) error {
 	)
 }
 
-func buildRequest(sessionHndl uintptr, r *Request) (uintptr, error) {
+func buildRequest(sessionHndl uintptr, r *Request) (uintptr, uintptr, error) {
 	var connHndl uintptr
 	var err error
 	var flags uintptr
@@ -29,7 +29,7 @@ func buildRequest(sessionHndl uintptr, r *Request) (uintptr, error) {
 
 	// Parse URL
 	if uri, err = url.Parse(r.URL); err != nil {
-		return 0, fmt.Errorf("failed to parse url %s: %w", r.URL, err)
+		return 0, 0, fmt.Errorf("failed to parse url %s: %w", r.URL, err)
 	}
 
 	passwd, _ = uri.User.Password()
@@ -37,7 +37,7 @@ func buildRequest(sessionHndl uintptr, r *Request) (uintptr, error) {
 	if uri.Port() != "" {
 		if port, err = strconv.ParseInt(uri.Port(), 10, 64); err != nil {
 			err = fmt.Errorf("port %s invalid: %w", uri.Port(), err)
-			return 0, err
+			return 0, 0, err
 		}
 	}
 
@@ -58,7 +58,7 @@ func buildRequest(sessionHndl uintptr, r *Request) (uintptr, error) {
 		0,
 	)
 	if err != nil {
-		return 0, fmt.Errorf("failed to create connection: %w", err)
+		return 0, 0, fmt.Errorf("failed to create connection: %w", err)
 	}
 
 	// Send query string too
@@ -82,10 +82,10 @@ func buildRequest(sessionHndl uintptr, r *Request) (uintptr, error) {
 		0,
 	)
 	if err != nil {
-		return 0, fmt.Errorf("failed to open request: %w", err)
+		return connHndl, 0, fmt.Errorf("failed to open request: %w", err)
 	}
 
-	return reqHndl, nil
+	return connHndl, reqHndl, nil
 }
 
 var cookies []*Cookie

implant/sliver/transports/httpclient/drivers/win/wininet/wininet_windows.go

@@ -213,6 +213,20 @@ func HTTPSendRequestW(
 	return nil
 }
 
+// InternetCloseHandle is from wininet.h
+func InternetCloseHandle(hndl uintptr) error {
+	var err error
+	var proc string = "InternetCloseHandle"
+	var success uintptr
+
+	success, _, err = wininet.NewProc(proc).Call(hndl)
+	if success == 0 {
+		return fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return nil
+}
+
 // InternetConnectW is from wininet.h
 func InternetConnectW(
 	sessionHndl uintptr,
@@ -437,7 +451,7 @@ func InternetErrorDlg(
 	)
 	// we expect 12032 if user hits okay, otherwise we return the response code as an error
 	if uint32(success) != ERROR_INTERNET_FORCE_RETRY {
-		return success, fmt.Errorf("%s: %s", proc, success)
+		return success, fmt.Errorf("%s: %v", proc, success)
 	}
 
 	*lppvData = buf

protobuf/sliverpb/sliver.proto

@@ -883,6 +883,7 @@ message PortfwdReq {
   int32 Protocol = 2;
   string Host = 3;
 
+  int32 KeepAlive = 4; 
   uint64 TunnelID = 8 [jstype = JS_STRING]; // Bind to this tunnel
   commonpb.Request Request = 9;
 }
@@ -1185,6 +1186,7 @@ message RportFwdStartListenerReq {
   uint32 BindPort = 2;
   uint32 ForwardPort = 3;
   string ForwardAddress = 4;
+  int32 KeepAlive = 5; 
 
   commonpb.Request Request = 9;
 }

server/c2/envelope_reader.go

@@ -0,0 +1,69 @@
+package c2
+
+import (
+	"io"
+	"os"
+)
+
+const (
+	// socketEnvelopeDiskSpoolThreshold is the point where envelope payloads are
+	// streamed to disk first to avoid large attacker-triggered allocations.
+	socketEnvelopeDiskSpoolThreshold = 64 * 1024 * 1024
+
+	// socketEnvelopeReadChunkSize bounds peak in-memory usage while reading large
+	// envelopes from the network.
+	socketEnvelopeReadChunkSize = 1 * 1024 * 1024
+)
+
+func readSocketEnvelopeData(reader io.Reader, dataLength int, inMemoryLimit int) ([]byte, error) {
+	if dataLength <= inMemoryLimit {
+		dataBuf := make([]byte, dataLength)
+		if _, err := io.ReadFull(reader, dataBuf); err != nil {
+			return nil, err
+		}
+		return dataBuf, nil
+	}
+
+	tmpFile, err := os.CreateTemp("", "sliver-envelope-*")
+	if err != nil {
+		return nil, err
+	}
+	tmpPath := tmpFile.Name()
+	defer func() {
+		_ = tmpFile.Close()
+		_ = os.Remove(tmpPath)
+	}()
+
+	chunkSize := socketEnvelopeReadChunkSize
+	if dataLength < chunkSize {
+		chunkSize = dataLength
+	}
+	chunkBuf := make([]byte, chunkSize)
+
+	remaining := dataLength
+	for remaining > 0 {
+		nextRead := chunkSize
+		if remaining < nextRead {
+			nextRead = remaining
+		}
+
+		if _, err := io.ReadFull(reader, chunkBuf[:nextRead]); err != nil {
+			return nil, err
+		}
+		if _, err := tmpFile.Write(chunkBuf[:nextRead]); err != nil {
+			return nil, err
+		}
+
+		remaining -= nextRead
+	}
+
+	if _, err := tmpFile.Seek(0, io.SeekStart); err != nil {
+		return nil, err
+	}
+
+	dataBuf := make([]byte, dataLength)
+	if _, err := io.ReadFull(tmpFile, dataBuf); err != nil {
+		return nil, err
+	}
+	return dataBuf, nil
+}

server/c2/envelope_reader_test.go

@@ -0,0 +1,135 @@
+package c2
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"io"
+	"math"
+	"net"
+	"runtime"
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/util/minisign"
+)
+
+type readSizeRecorder struct {
+	reader  io.Reader
+	maxRead int
+}
+
+func (r *readSizeRecorder) Read(p []byte) (int, error) {
+	if len(p) > r.maxRead {
+		r.maxRead = len(p)
+	}
+	return r.reader.Read(p)
+}
+
+func envelopeFrameWithDeclaredLength(dataLength uint32, payload []byte) []byte {
+	frame := make([]byte, minisign.RawSigSize+4+len(payload))
+	binary.LittleEndian.PutUint16(frame[:2], minisign.EdDSA)
+	binary.LittleEndian.PutUint32(frame[minisign.RawSigSize:minisign.RawSigSize+4], dataLength)
+	copy(frame[minisign.RawSigSize+4:], payload)
+	return frame
+}
+
+func measureEnvelopeReadAlloc(t *testing.T, readFunc func(net.Conn) (*sliverpb.Envelope, error), frame []byte) (uint64, error) {
+	t.Helper()
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := readFunc(srv)
+		errCh <- err
+	}()
+
+	runtime.GC()
+	var before runtime.MemStats
+	runtime.ReadMemStats(&before)
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+
+	runtime.GC()
+	var after runtime.MemStats
+	runtime.ReadMemStats(&after)
+
+	if after.TotalAlloc < before.TotalAlloc {
+		return 0, err
+	}
+	return after.TotalAlloc - before.TotalAlloc, err
+}
+
+func assertLargeTruncatedFrameHasBoundedAlloc(t *testing.T, readFunc func(net.Conn) (*sliverpb.Envelope, error)) {
+	t.Helper()
+
+	declaredLength := uint32(socketEnvelopeDiskSpoolThreshold + (8 * 1024 * 1024))
+	frame := envelopeFrameWithDeclaredLength(declaredLength, []byte{0x01})
+
+	minAllocDelta := uint64(math.MaxUint64)
+	for i := 0; i < 3; i++ {
+		allocDelta, err := measureEnvelopeReadAlloc(t, readFunc, frame)
+		if err == nil {
+			t.Fatalf("expected read failure for truncated frame")
+		}
+		if !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+			t.Fatalf("expected EOF-like error for truncated frame, got %v", err)
+		}
+		if allocDelta < minAllocDelta {
+			minAllocDelta = allocDelta
+		}
+	}
+
+	const maxAllowedAlloc = 24 * 1024 * 1024
+	if minAllocDelta > maxAllowedAlloc {
+		t.Fatalf("expected bounded allocation <= %d bytes, got %d", maxAllowedAlloc, minAllocDelta)
+	}
+}
+
+func TestReadSocketEnvelopeDataKeepsSmallPayloadsInMemory(t *testing.T) {
+	payload := bytes.Repeat([]byte{0x7a}, 4096)
+	recorder := &readSizeRecorder{reader: bytes.NewReader(payload)}
+
+	got, err := readSocketEnvelopeData(recorder, len(payload), 8192)
+	if err != nil {
+		t.Fatalf("readSocketEnvelopeData returned err: %v", err)
+	}
+	if !bytes.Equal(got, payload) {
+		t.Fatalf("unexpected payload contents")
+	}
+	if recorder.maxRead != len(payload) {
+		t.Fatalf("expected in-memory read size %d, got %d", len(payload), recorder.maxRead)
+	}
+}
+
+func TestReadSocketEnvelopeDataSpoolsLargePayloadsInChunks(t *testing.T) {
+	payload := bytes.Repeat([]byte{0x42}, (2*socketEnvelopeReadChunkSize)+123)
+	recorder := &readSizeRecorder{reader: bytes.NewReader(payload)}
+
+	got, err := readSocketEnvelopeData(recorder, len(payload), socketEnvelopeReadChunkSize/2)
+	if err != nil {
+		t.Fatalf("readSocketEnvelopeData returned err: %v", err)
+	}
+	if !bytes.Equal(got, payload) {
+		t.Fatalf("unexpected payload contents")
+	}
+	if recorder.maxRead > socketEnvelopeReadChunkSize {
+		t.Fatalf("expected max read chunk <= %d, got %d", socketEnvelopeReadChunkSize, recorder.maxRead)
+	}
+}
+
+func TestMTLSSocketReadEnvelopeLargeTruncatedMessageBoundsAllocation(t *testing.T) {
+	assertLargeTruncatedFrameHasBoundedAlloc(t, socketReadEnvelope)
+}
+
+func TestWGSocketReadEnvelopeLargeTruncatedMessageBoundsAllocation(t *testing.T) {
+	assertLargeTruncatedFrameHasBoundedAlloc(t, socketWGReadEnvelope)
+}

server/c2/mtls.go

@@ -358,10 +358,8 @@ func socketReadEnvelope(connection net.Conn) (*sliverpb.Envelope, error) {
 		return nil, errors.New("[pivot] invalid data length")
 	}
 
-	dataBuf := make([]byte, dataLength)
-
-	n, err = io.ReadFull(connection, dataBuf)
-	if err != nil || n != dataLength {
+	dataBuf, err := readSocketEnvelopeData(connection, dataLength, socketEnvelopeDiskSpoolThreshold)
+	if err != nil {
 		mtlsLog.Errorf("Socket error (read data): %v", err)
 		return nil, err
 	}

server/c2/wireguard.go

@@ -452,11 +452,8 @@ func socketWGReadEnvelope(connection net.Conn) (*sliverpb.Envelope, error) {
 		return nil, errors.New("[wireguard] zero data length")
 	}
 
-	dataBuf := make([]byte, dataLength)
-
-	n, err = io.ReadFull(connection, dataBuf)
-
-	if err != nil || n != dataLength {
+	dataBuf, err := readSocketEnvelopeData(connection, dataLength, socketEnvelopeDiskSpoolThreshold)
+	if err != nil {
 		wgLog.Errorf("Socket error (read data): %v", err)
 		return nil, err
 	}

server/certs/operators.go

@@ -21,6 +21,7 @@ package certs
 import (
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 
 	"github.com/bishopfox/sliver/server/db"
@@ -35,6 +36,17 @@ const (
 	serverNamespace = "server" // Operator servers
 )
 
+var (
+	// ErrOperatorClientCertificateNotFound indicates that the presented operator
+	// client certificate is no longer trusted because it is not present in the
+	// certificate store.
+	ErrOperatorClientCertificateNotFound = errors.New("operator client certificate not found in database")
+
+	// ErrInvalidOperatorClientCertificate indicates that the presented
+	// certificate is not shaped like an operator client leaf certificate.
+	ErrInvalidOperatorClientCertificate = errors.New("invalid operator client certificate")
+)
+
 // OperatorClientGenerateCertificate - Generate a certificate signed with a given CA
 func OperatorClientGenerateCertificate(operator string) ([]byte, []byte, error) {
 	cert, key := GenerateECCCertificate(OperatorCA, operator, false, true, true)
@@ -52,6 +64,52 @@ func OperatorClientRemoveCertificate(operator string) error {
 	return RemoveCertificate(OperatorCA, ECCKey, fmt.Sprintf("%s.%s", clientNamespace, operator))
 }
 
+// ValidateOperatorClientCertificate ensures that the presented operator client
+// certificate is still present in the database. A valid chain alone is not
+// enough; the exact leaf certificate must still exist in storage.
+func ValidateOperatorClientCertificate(peerCertificates []*x509.Certificate) error {
+	if len(peerCertificates) == 0 || peerCertificates[0] == nil {
+		return ErrInvalidOperatorClientCertificate
+	}
+
+	leaf := peerCertificates[0]
+	if leaf.IsCA || leaf.Subject.CommonName == "" || !hasExtKeyUsage(leaf, x509.ExtKeyUsageClientAuth) {
+		return ErrInvalidOperatorClientCertificate
+	}
+
+	pemBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: leaf.Raw,
+	})
+	if len(pemBytes) == 0 {
+		return ErrInvalidOperatorClientCertificate
+	}
+
+	record := &models.Certificate{}
+	result := db.Session().Select("id").Where(&models.Certificate{
+		CommonName:     fmt.Sprintf("%s.%s", clientNamespace, leaf.Subject.CommonName),
+		CAType:         OperatorCA,
+		KeyType:        ECCKey,
+		CertificatePEM: string(pemBytes),
+	}).First(record)
+	if result.Error == nil {
+		return nil
+	}
+	if errors.Is(result.Error, db.ErrRecordNotFound) {
+		return ErrOperatorClientCertificateNotFound
+	}
+	return result.Error
+}
+
+func hasExtKeyUsage(cert *x509.Certificate, usage x509.ExtKeyUsage) bool {
+	for _, extKeyUsage := range cert.ExtKeyUsage {
+		if extKeyUsage == usage {
+			return true
+		}
+	}
+	return false
+}
+
 // OperatorServerGetCertificate - Helper function to fetch a server cert
 func OperatorServerGetCertificate(hostname string) ([]byte, []byte, error) {
 	return GetECCCertificate(OperatorCA, fmt.Sprintf("%s.%s", serverNamespace, hostname))

server/certs/operators_validation_test.go

@@ -0,0 +1,117 @@
+package certs
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/bishopfox/sliver/server/db"
+	"github.com/bishopfox/sliver/server/db/models"
+)
+
+func TestValidateOperatorClientCertificateAdversarial(t *testing.T) {
+	SetupCAs()
+
+	t.Run("accepts stored operator client leaf", func(t *testing.T) {
+		operatorName := uniqueOperatorCertificateName(t, "stored")
+		certPEM, _, err := OperatorClientGenerateCertificate(operatorName)
+		if err != nil {
+			t.Fatalf("generate operator client certificate: %v", err)
+		}
+
+		err = ValidateOperatorClientCertificate([]*x509.Certificate{mustParseCertificate(t, certPEM)})
+		if err != nil {
+			t.Fatalf("expected stored operator client certificate to be accepted, got %v", err)
+		}
+	})
+
+	t.Run("rejects valid stored certificate hidden behind an unstored first certificate", func(t *testing.T) {
+		operatorName := uniqueOperatorCertificateName(t, "hidden")
+		storedCertPEM, _, err := OperatorClientGenerateCertificate(operatorName)
+		if err != nil {
+			t.Fatalf("generate stored operator certificate: %v", err)
+		}
+		rogueCertPEM, _ := GenerateECCCertificate(OperatorCA, operatorName, false, true, true)
+
+		err = ValidateOperatorClientCertificate([]*x509.Certificate{
+			mustParseCertificate(t, rogueCertPEM),
+			mustParseCertificate(t, storedCertPEM),
+		})
+		if !errors.Is(err, ErrOperatorClientCertificateNotFound) {
+			t.Fatalf("expected first unstored certificate to be rejected, got %v", err)
+		}
+	})
+
+	t.Run("rejects same-common-name different-leaf certificate", func(t *testing.T) {
+		operatorName := uniqueOperatorCertificateName(t, "same-cn")
+		_, _, err := OperatorClientGenerateCertificate(operatorName)
+		if err != nil {
+			t.Fatalf("generate stored operator certificate: %v", err)
+		}
+		rogueCertPEM, _ := GenerateECCCertificate(OperatorCA, operatorName, false, true, true)
+
+		err = ValidateOperatorClientCertificate([]*x509.Certificate{mustParseCertificate(t, rogueCertPEM)})
+		if !errors.Is(err, ErrOperatorClientCertificateNotFound) {
+			t.Fatalf("expected rotated or forged same-CN leaf to be rejected, got %v", err)
+		}
+	})
+
+	t.Run("rejects stored operator server certificate", func(t *testing.T) {
+		hostName := uniqueOperatorCertificateName(t, "server")
+		serverCertPEM, _, err := OperatorServerGenerateCertificate(hostName)
+		if err != nil {
+			t.Fatalf("generate operator server certificate: %v", err)
+		}
+
+		err = ValidateOperatorClientCertificate([]*x509.Certificate{mustParseCertificate(t, serverCertPEM)})
+		if !errors.Is(err, ErrInvalidOperatorClientCertificate) {
+			t.Fatalf("expected stored operator server certificate to be rejected, got %v", err)
+		}
+	})
+
+	t.Run("rejects operator CA certificate even if inserted into the certificates table", func(t *testing.T) {
+		caCertPEM, caKeyPEM, err := GetCertificateAuthorityPEM(OperatorCA)
+		if err != nil {
+			t.Fatalf("get operator CA: %v", err)
+		}
+		caCert := mustParseCertificate(t, caCertPEM)
+
+		record := &models.Certificate{
+			CommonName:     fmt.Sprintf("%s.%s", clientNamespace, caCert.Subject.CommonName),
+			CAType:         OperatorCA,
+			KeyType:        ECCKey,
+			CertificatePEM: string(caCertPEM),
+			PrivateKeyPEM:  string(caKeyPEM),
+		}
+		if err := db.Session().Create(record).Error; err != nil {
+			t.Fatalf("insert CA cert into certificates table: %v", err)
+		}
+
+		err = ValidateOperatorClientCertificate([]*x509.Certificate{caCert})
+		if !errors.Is(err, ErrInvalidOperatorClientCertificate) {
+			t.Fatalf("expected CA certificate to be rejected, got %v", err)
+		}
+	})
+}
+
+func mustParseCertificate(t *testing.T, certPEM []byte) *x509.Certificate {
+	t.Helper()
+
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		t.Fatal("failed to decode certificate PEM")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		t.Fatalf("parse x509 certificate: %v", err)
+	}
+	return cert
+}
+
+func uniqueOperatorCertificateName(t *testing.T, prefix string) string {
+	t.Helper()
+	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
+}

server/configs/database.go

@@ -24,7 +24,6 @@ import (
 	"fmt"
 	"net/url"
 	"os"
-	"path"
 	"path/filepath"
 	"sort"
 
@@ -169,7 +168,7 @@ func encodeSQLiteParams(rawParams map[string]string, pragmas map[string]string)
 // Save - Save config file to disk
 func (c *DatabaseConfig) Save() error {
 	configPath := GetDatabaseConfigPath()
-	configDir := path.Dir(configPath)
+	configDir := filepath.Dir(configPath)
 	if _, err := os.Stat(configDir); os.IsNotExist(err) {
 		databaseConfigLog.Debugf("Creating config dir %s", configDir)
 		err := os.MkdirAll(configDir, 0700)

server/console/console-admin.go

@@ -218,18 +218,9 @@ func kickOperatorCmd(cmd *cobra.Command, args []string) {
 	}
 
 	fmt.Printf(Info+"Removing auth token(s) for %s, please wait ... \n", operator)
-	err = db.Session().Where(&models.Operator{
-		Name: operator,
-	}).Delete(&models.Operator{}).Error
+	err = kickOperator(operator)
 	if err != nil {
-		fmt.Printf(Warn+"Failed to remove operator %s: %v\n", operator, err)
-		return
-	}
-	transport.ClearTokenCache()
-	fmt.Printf(Info+"Removing client certificate(s) for %s, please wait ... \n", operator)
-	err = certs.OperatorClientRemoveCertificate(operator)
-	if err != nil {
-		fmt.Printf(Warn+"Failed to remove the operator certificate: %v \n", err)
+		fmt.Printf(Warn+"Failed to kick operator %s: %v\n", operator, err)
 		return
 	}
 	fmt.Printf(Info+"Operator %s has been kicked out.\n", operator)
@@ -242,6 +233,33 @@ func shouldPromptKickOperator(cmd *cobra.Command, args []string) bool {
 	return cmd.Flags().NFlag() == 0
 }
 
+func removeOperator(operator string) error {
+	err := db.Session().Where(&models.Operator{
+		Name: operator,
+	}).Delete(&models.Operator{}).Error
+	if err != nil {
+		return err
+	}
+	transport.ClearTokenCache()
+	return nil
+}
+
+func revokeOperatorClientCertificate(operator string) error {
+	return certs.OperatorClientRemoveCertificate(operator)
+}
+
+func closeOperatorStreams(operator string) {
+	transport.CloseOperatorStreams(operator)
+}
+
+func kickOperator(operator string) error {
+	if err := removeOperator(operator); err != nil {
+		return err
+	}
+	defer closeOperatorStreams(operator)
+	return revokeOperatorClientCertificate(operator)
+}
+
 func operatorNames() ([]string, error) {
 	operators, err := db.OperatorAll()
 	if err != nil {

server/console/console-admin_kick_test.go

@@ -0,0 +1,211 @@
+package console
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"testing"
+	"time"
+
+	clientassets "github.com/bishopfox/sliver/client/assets"
+	clienttransport "github.com/bishopfox/sliver/client/transport"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/server/certs"
+	"github.com/bishopfox/sliver/server/core"
+	servertransport "github.com/bishopfox/sliver/server/transport"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/test/bufconn"
+)
+
+func TestKickOperatorClosesActiveEventStreams(t *testing.T) {
+	certs.SetupCAs()
+
+	listener := bufconn.Listen(2 * 1024 * 1024)
+	grpcServer, err := servertransport.StartMtlsClientServer(listener)
+	if err != nil {
+		t.Fatalf("start mTLS client server: %v", err)
+	}
+	defer grpcServer.Stop()
+	defer listener.Close()
+
+	operatorName := uniqueKickOperatorName(t)
+	t.Cleanup(func() {
+		_ = removeOperator(operatorName)
+		_ = revokeOperatorClientCertificate(operatorName)
+		closeOperatorStreams(operatorName)
+	})
+
+	config := mustNewOperatorAssetsConfig(t, operatorName)
+	rpcClient, conn, err := mustMTLSBufconnClient(t, listener, config)
+	if err != nil {
+		t.Fatalf("connect operator client: %v", err)
+	}
+	defer conn.Close()
+
+	stream, err := rpcClient.Events(context.Background(), &commonpb.Empty{})
+	if err != nil {
+		t.Fatalf("start events stream: %v", err)
+	}
+
+	waitForCondition(t, 3*time.Second, func() bool {
+		return operatorActive(operatorName)
+	}, "operator to appear in the active client registry")
+
+	recvErr := make(chan error, 1)
+	go func() {
+		_, err := stream.Recv()
+		recvErr <- err
+	}()
+
+	if err := kickOperator(operatorName); err != nil {
+		t.Fatalf("kick operator: %v", err)
+	}
+
+	select {
+	case err := <-recvErr:
+		if err == nil {
+			t.Fatal("expected kicked operator event stream to close")
+		}
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		code := status.Code(err)
+		if code != codes.Canceled && code != codes.Unavailable && code != codes.Unknown {
+			t.Fatalf("expected stream cancellation after kick, got %v", err)
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("timed out waiting for kicked operator event stream to close")
+	}
+
+	waitForCondition(t, 3*time.Second, func() bool {
+		return !operatorActive(operatorName)
+	}, "operator to leave the active client registry")
+
+	_, err = rpcClient.GetVersion(context.Background(), &commonpb.Empty{})
+	if err == nil {
+		t.Fatal("expected kicked operator to be denied on subsequent RPCs")
+	}
+	code := status.Code(err)
+	if code != codes.Unauthenticated && code != codes.Unavailable {
+		t.Fatalf("expected unauthenticated or unavailable after kick, got %v", err)
+	}
+
+	exists, err := operatorExists(operatorName)
+	if err != nil {
+		t.Fatalf("lookup operator after kick: %v", err)
+	}
+	if exists {
+		t.Fatal("expected operator record to be removed after kick")
+	}
+
+	_, _, err = certs.OperatorClientGetCertificate(operatorName)
+	if !errors.Is(err, certs.ErrCertDoesNotExist) {
+		t.Fatalf("expected operator certificate to be removed after kick, got %v", err)
+	}
+}
+
+func mustNewOperatorAssetsConfig(t *testing.T, operatorName string) *clientassets.ClientConfig {
+	t.Helper()
+
+	configJSON, err := NewOperatorConfig(operatorName, "bufnet", 31337, []string{"all"})
+	if err != nil {
+		t.Fatalf("generate operator config: %v", err)
+	}
+
+	config := &clientassets.ClientConfig{}
+	if err := json.Unmarshal(configJSON, config); err != nil {
+		t.Fatalf("parse operator config: %v", err)
+	}
+	return config
+}
+
+func mustMTLSBufconnClient(t *testing.T, listener *bufconn.Listener, config *clientassets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.ClientConn, error) {
+	t.Helper()
+
+	dialCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	conn, err := grpc.DialContext(dialCtx, "bufnet",
+		grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
+			return listener.Dial()
+		}),
+		grpc.WithTransportCredentials(credentials.NewTLS(mustClientTLSConfig(t, config))),
+		grpc.WithPerRPCCredentials(staticTokenAuth(config.Token)),
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(clienttransport.ClientMaxReceiveMessageSize)),
+		grpc.WithBlock(),
+	)
+	if err != nil {
+		return nil, nil, err
+	}
+	return rpcpb.NewSliverRPCClient(conn), conn, nil
+}
+
+func mustClientTLSConfig(t *testing.T, config *clientassets.ClientConfig) *tls.Config {
+	t.Helper()
+
+	clientCert, err := tls.X509KeyPair([]byte(config.Certificate), []byte(config.PrivateKey))
+	if err != nil {
+		t.Fatalf("parse client certificate: %v", err)
+	}
+
+	caCertPool := x509.NewCertPool()
+	caCertPool.AppendCertsFromPEM([]byte(config.CACertificate))
+
+	return &tls.Config{
+		Certificates:       []tls.Certificate{clientCert},
+		RootCAs:            caCertPool,
+		InsecureSkipVerify: true,
+		MinVersion:         tls.VersionTLS13,
+		VerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+			return clienttransport.RootOnlyVerifyCertificate(config.CACertificate, rawCerts)
+		},
+	}
+}
+
+func operatorActive(name string) bool {
+	for _, active := range core.Clients.ActiveOperators() {
+		if active == name {
+			return true
+		}
+	}
+	return false
+}
+
+func waitForCondition(t *testing.T, timeout time.Duration, predicate func() bool, description string) {
+	t.Helper()
+
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if predicate() {
+			return
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for %s", description)
+}
+
+func uniqueKickOperatorName(t *testing.T) string {
+	t.Helper()
+	return fmt.Sprintf("kick-operator-%d", time.Now().UnixNano())
+}
+
+type staticTokenAuth string
+
+func (t staticTokenAuth) GetRequestMetadata(context.Context, ...string) (map[string]string, error) {
+	return map[string]string{
+		"Authorization": "Bearer " + string(t),
+	}, nil
+}
+
+func (staticTokenAuth) RequireTransportSecurity() bool {
+	return true
+}

server/generate/linkflags_test.go

@@ -81,7 +81,7 @@ func TestApplyZigStaticLinking_NotLinux(t *testing.T) {
 }
 
 func TestSanitizeZigForBuild_LinuxSharedObject(t *testing.T) {
-	t.Setenv("SLIVER_ROOT_DIR", "/tmp/sliver-test-root")
+	t.Setenv("SLIVER_ROOT_DIR", t.TempDir())
 	cfg := &gogo.GoConfig{
 		GOOS: "linux",
 		CGO:  "1",
@@ -108,7 +108,7 @@ func TestSanitizeZigForBuild_LinuxSharedObject(t *testing.T) {
 }
 
 func TestSanitizeZigForBuild_Windows(t *testing.T) {
-	t.Setenv("SLIVER_ROOT_DIR", "/tmp/sliver-test-root")
+	t.Setenv("SLIVER_ROOT_DIR", t.TempDir())
 	cfg := &gogo.GoConfig{
 		GOOS: "windows",
 		CGO:  "1",

server/gogo/go.go

@@ -24,6 +24,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 
 	"github.com/bishopfox/sliver/server/assets"
@@ -86,32 +87,71 @@ func getHomeDir() string {
 	return home
 }
 
-// GarbleCmd - Execute a go command
-func GarbleCmd(config GoConfig, cwd string, command []string) ([]byte, error) {
-	target := fmt.Sprintf("%s/%s", config.GOOS, config.GOARCH)
-	if _, ok := ValidCompilerTargets(config)[target]; !ok {
-		return nil, fmt.Errorf("%s", fmt.Sprintf("Invalid compiler target: %s", target))
+func joinPathList(paths ...string) string {
+	filtered := make([]string, 0, len(paths))
+	for _, path := range paths {
+		if strings.TrimSpace(path) == "" {
+			continue
+		}
+		filtered = append(filtered, path)
 	}
-	garbleBinPath := filepath.Join(config.GOROOT, "bin", "garble")
-	garbleFlags := []string{"-seed=random", "-literals", "-tiny"}
-	command = append(garbleFlags, command...)
-	cmd := exec.Command(garbleBinPath, command...)
-	cmd.Dir = cwd
-	cmd.Env = []string{
+	return strings.Join(filtered, string(os.PathListSeparator))
+}
+
+func goToolExecutableName(name, hostGOOS string) string {
+	if hostGOOS == "windows" {
+		return name + ".exe"
+	}
+	return name
+}
+
+func goToolPath(goRoot string, toolName string) string {
+	return filepath.Join(goRoot, "bin", goToolExecutableName(toolName, runtime.GOOS))
+}
+
+func buildCommandEnv(config GoConfig, extra map[string]string) []string {
+	goBinDir := ""
+	if strings.TrimSpace(config.GOROOT) != "" {
+		goBinDir = filepath.Join(config.GOROOT, "bin")
+	}
+
+	env := append([]string{}, os.Environ()...)
+	overrides := []string{
 		fmt.Sprintf("CC=%s", config.CC),
 		fmt.Sprintf("CGO_ENABLED=%s", config.CGO),
 		fmt.Sprintf("GOOS=%s", config.GOOS),
 		fmt.Sprintf("GOARCH=%s", config.GOARCH),
+		fmt.Sprintf("GOROOT=%s", config.GOROOT),
 		fmt.Sprintf("GOPATH=%s", config.ProjectDir),
 		fmt.Sprintf("GOCACHE=%s", config.GOCACHE),
 		fmt.Sprintf("GOMODCACHE=%s", config.GOMODCACHE),
 		fmt.Sprintf("GOPROXY=%s", config.GOPROXY),
 		fmt.Sprintf("HTTP_PROXY=%s", config.HTTPPROXY),
 		fmt.Sprintf("HTTPS_PROXY=%s", config.HTTPSPROXY),
-		fmt.Sprintf("PATH=%s:%s:%s", filepath.Join(config.GOROOT, "bin"), assets.GetZigDir(), os.Getenv("PATH")),
-		fmt.Sprintf("GOGARBLE=%s", config.GOGARBLE),
+		fmt.Sprintf("PATH=%s", joinPathList(goBinDir, assets.GetZigDir(), os.Getenv("PATH"))),
 		fmt.Sprintf("HOME=%s", getHomeDir()),
 	}
+	for name, value := range extra {
+		overrides = append(overrides, fmt.Sprintf("%s=%s", name, value))
+	}
+
+	return append(env, overrides...)
+}
+
+// GarbleCmd - Execute a go command
+func GarbleCmd(config GoConfig, cwd string, command []string) ([]byte, error) {
+	target := fmt.Sprintf("%s/%s", config.GOOS, config.GOARCH)
+	if _, ok := ValidCompilerTargets(config)[target]; !ok {
+		return nil, fmt.Errorf("%s", fmt.Sprintf("Invalid compiler target: %s", target))
+	}
+	garbleBinPath := goToolPath(config.GOROOT, "garble")
+	garbleFlags := []string{"-seed=random", "-literals", "-tiny"}
+	command = append(garbleFlags, command...)
+	cmd := exec.Command(garbleBinPath, command...)
+	cmd.Dir = cwd
+	cmd.Env = buildCommandEnv(config, map[string]string{
+		"GOGARBLE": config.GOGARBLE,
+	})
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	cmd.Stdout = &stdout
@@ -137,23 +177,10 @@ func GarbleCmd(config GoConfig, cwd string, command []string) ([]byte, error) {
 
 // GoCmd - Execute a go command
 func GoCmd(config GoConfig, cwd string, command []string) ([]byte, error) {
-	goBinPath := filepath.Join(config.GOROOT, "bin", "go")
+	goBinPath := goToolPath(config.GOROOT, "go")
 	cmd := exec.Command(goBinPath, command...)
 	cmd.Dir = cwd
-	cmd.Env = []string{
-		fmt.Sprintf("CC=%s", config.CC),
-		fmt.Sprintf("CGO_ENABLED=%s", config.CGO),
-		fmt.Sprintf("GOOS=%s", config.GOOS),
-		fmt.Sprintf("GOARCH=%s", config.GOARCH),
-		fmt.Sprintf("GOPATH=%s", config.ProjectDir),
-		fmt.Sprintf("GOCACHE=%s", config.GOCACHE),
-		fmt.Sprintf("GOMODCACHE=%s", config.GOMODCACHE),
-		fmt.Sprintf("GOPROXY=%s", config.GOPROXY),
-		fmt.Sprintf("HTTP_PROXY=%s", config.HTTPPROXY),
-		fmt.Sprintf("HTTPS_PROXY=%s", config.HTTPSPROXY),
-		fmt.Sprintf("PATH=%s:%s:%s", filepath.Join(config.GOROOT, "bin"), assets.GetZigDir(), os.Getenv("PATH")),
-		fmt.Sprintf("HOME=%s", getHomeDir()),
-	}
+	cmd.Env = buildCommandEnv(config, nil)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	cmd.Stdout = &stdout

server/gogo/go_test.go

@@ -19,21 +19,64 @@ package gogo
 */
 
 import (
-	"fmt"
+	"runtime"
+	"strings"
 	"testing"
-
-	"github.com/bishopfox/sliver/server/assets"
 )
 
-func TestGoGoVersion(t *testing.T) {
-	appDir := assets.GetRootAppDir()
-	winConfig := GoConfig{
-		GOOS:   "windows",
-		GOARCH: "amd64",
-		GOROOT: GetGoRootDir(appDir),
+func TestGoToolExecutableName(t *testing.T) {
+	tests := []struct {
+		name     string
+		toolName string
+		hostGOOS string
+		want     string
+	}{
+		{
+			name:     "windows go binary",
+			toolName: "go",
+			hostGOOS: "windows",
+			want:     "go.exe",
+		},
+		{
+			name:     "windows garble binary",
+			toolName: "garble",
+			hostGOOS: "windows",
+			want:     "garble.exe",
+		},
+		{
+			name:     "unix go binary",
+			toolName: "go",
+			hostGOOS: "linux",
+			want:     "go",
+		},
 	}
-	_, err := GoVersion(winConfig)
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := goToolExecutableName(test.toolName, test.hostGOOS); got != test.want {
+				t.Fatalf("goToolExecutableName(%q, %q) = %q, want %q", test.toolName, test.hostGOOS, got, test.want)
+			}
+		})
+	}
+}
+
+func TestGoVersionUsesHostToolchain(t *testing.T) {
+	goRoot := runtime.GOROOT()
+	if goRoot == "" {
+		t.Fatal("runtime.GOROOT() is empty")
+	}
+
+	config := GoConfig{
+		GOOS:   runtime.GOOS,
+		GOARCH: runtime.GOARCH,
+		GOROOT: goRoot,
+	}
+
+	output, err := GoVersion(config)
 	if err != nil {
-		t.Errorf("%s", fmt.Sprintf("version cmd failed %v", err))
+		t.Fatalf("GoVersion failed: %v", err)
+	}
+	if !strings.Contains(string(output), "go version") {
+		t.Fatalf("unexpected go version output: %q", string(output))
 	}
 }

server/transport/middleware.go

@@ -74,6 +74,7 @@ func initMiddleware(enableAuth bool) []grpc.ServerOption {
 			grpc.ChainStreamInterceptor(
 				grpc_auth.StreamServerInterceptor(tokenAuthFunc),
 				permissionsStreamServerInterceptor(),
+				trackOperatorStreamInterceptor(),
 				grpc_tags.StreamServerInterceptor(grpc_tags.WithFieldExtractor(grpc_tags.CodeGenRequestFieldExtractor)),
 				grpc_logrus.StreamServerInterceptor(logrusEntry, logrusOpts...),
 				grpc_logrus.PayloadStreamServerInterceptor(logrusEntry, deciderStream),
@@ -90,6 +91,7 @@ func initMiddleware(enableAuth bool) []grpc.ServerOption {
 			),
 			grpc.ChainStreamInterceptor(
 				grpc_auth.StreamServerInterceptor(serverAuthFunc),
+				trackOperatorStreamInterceptor(),
 				grpc_tags.StreamServerInterceptor(grpc_tags.WithFieldExtractor(grpc_tags.CodeGenRequestFieldExtractor)),
 				grpc_logrus.StreamServerInterceptor(logrusEntry, logrusOpts...),
 				grpc_logrus.PayloadStreamServerInterceptor(logrusEntry, deciderStream),

server/transport/mtls.go

@@ -21,6 +21,7 @@ package transport
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"net"
 	"runtime/debug"
@@ -50,15 +51,34 @@ var (
 // StartMtlsClientListener - Start a mutual TLS listener
 func StartMtlsClientListener(host string, port uint16) (*grpc.Server, net.Listener, error) {
 	mtlsLog.Infof("Starting gRPC/mtls  listener on %s:%d", host, port)
-
-	tlsConfig := getOperatorServerTLSConfig("multiplayer")
-
-	creds := credentials.NewTLS(tlsConfig)
 	ln, err := net.Listen("tcp", fmt.Sprintf("%s:%d", host, port))
 	if err != nil {
 		mtlsLog.Error(err)
 		return nil, nil, err
 	}
+
+	grpcServer, err := StartMtlsClientServer(ln)
+	if err != nil {
+		ln.Close()
+		return nil, nil, err
+	}
+	return grpcServer, ln, nil
+}
+
+// StartMtlsClientServer serves the authenticated multiplayer gRPC server on an
+// existing listener. This is primarily useful for tests that need the full mTLS
+// + auth stack without opening a real TCP socket.
+func StartMtlsClientServer(ln net.Listener) (*grpc.Server, error) {
+	if ln == nil {
+		return nil, errors.New("listener is required")
+	}
+
+	tlsConfig := getOperatorServerTLSConfig("multiplayer")
+	if tlsConfig == nil {
+		return nil, errors.New("failed to create operator TLS config")
+	}
+
+	creds := credentials.NewTLS(tlsConfig)
 	options := []grpc.ServerOption{
 		grpc.Creds(creds),
 		grpc.MaxRecvMsgSize(ServerMaxMessageSize),
@@ -81,7 +101,7 @@ func StartMtlsClientListener(host string, port uint16) (*grpc.Server, net.Listen
 			panicked = false
 		}
 	}()
-	return grpcServer, ln, nil
+	return grpcServer, nil
 }
 
 // getOperatorServerTLSConfig - Generate the TLS configuration, we do now allow the end user
@@ -115,6 +135,9 @@ func getOperatorServerTLSConfig(host string) *tls.Config {
 		ClientCAs:    caCertPool,
 		Certificates: []tls.Certificate{cert},
 		MinVersion:   tls.VersionTLS13,
+		VerifyConnection: func(state tls.ConnectionState) error {
+			return certs.ValidateOperatorClientCertificate(state.PeerCertificates)
+		},
 	}
 
 	return tlsConfig

server/transport/mtls_test.go

@@ -0,0 +1,153 @@
+package transport
+
+import (
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/bishopfox/sliver/server/certs"
+)
+
+func TestOperatorClientCertificateValidation(t *testing.T) {
+	certs.SetupCAs()
+
+	t.Run("accepts stored operator certificate", func(t *testing.T) {
+		operatorName := uniqueOperatorName(t, "stored")
+		certPEM, keyPEM, err := certs.OperatorClientGenerateCertificate(operatorName)
+		if err != nil {
+			t.Fatalf("generate operator certificate: %v", err)
+		}
+
+		err = performMutualTLSHandshake(getOperatorServerTLSConfig("multiplayer"), newClientTLSConfig(t, certPEM, keyPEM))
+		if err != nil {
+			t.Fatalf("expected stored operator certificate to be accepted, got %v", err)
+		}
+	})
+
+	t.Run("rejects deleted operator certificate", func(t *testing.T) {
+		operatorName := uniqueOperatorName(t, "deleted")
+		certPEM, keyPEM, err := certs.OperatorClientGenerateCertificate(operatorName)
+		if err != nil {
+			t.Fatalf("generate operator certificate: %v", err)
+		}
+		if err := certs.OperatorClientRemoveCertificate(operatorName); err != nil {
+			t.Fatalf("remove operator certificate: %v", err)
+		}
+
+		err = performMutualTLSHandshake(getOperatorServerTLSConfig("multiplayer"), newClientTLSConfig(t, certPEM, keyPEM))
+		if err == nil {
+			t.Fatal("expected deleted operator certificate to be rejected")
+		}
+		if !strings.Contains(err.Error(), certs.ErrOperatorClientCertificateNotFound.Error()) {
+			t.Fatalf("expected database rejection error, got %v", err)
+		}
+	})
+
+	t.Run("rejects rotated-out certificate but accepts current one", func(t *testing.T) {
+		operatorName := uniqueOperatorName(t, "rotated")
+		oldCertPEM, oldKeyPEM, err := certs.OperatorClientGenerateCertificate(operatorName)
+		if err != nil {
+			t.Fatalf("generate original operator certificate: %v", err)
+		}
+		if err := certs.OperatorClientRemoveCertificate(operatorName); err != nil {
+			t.Fatalf("remove original operator certificate: %v", err)
+		}
+		newCertPEM, newKeyPEM, err := certs.OperatorClientGenerateCertificate(operatorName)
+		if err != nil {
+			t.Fatalf("generate replacement operator certificate: %v", err)
+		}
+
+		err = performMutualTLSHandshake(getOperatorServerTLSConfig("multiplayer"), newClientTLSConfig(t, oldCertPEM, oldKeyPEM))
+		if err == nil {
+			t.Fatal("expected rotated-out operator certificate to be rejected")
+		}
+		if !strings.Contains(err.Error(), certs.ErrOperatorClientCertificateNotFound.Error()) {
+			t.Fatalf("expected rotated certificate to fail database validation, got %v", err)
+		}
+
+		err = performMutualTLSHandshake(getOperatorServerTLSConfig("multiplayer"), newClientTLSConfig(t, newCertPEM, newKeyPEM))
+		if err != nil {
+			t.Fatalf("expected replacement operator certificate to be accepted, got %v", err)
+		}
+	})
+
+	t.Run("rejects certificate from another authority", func(t *testing.T) {
+		certPEM, keyPEM := certs.GenerateECCCertificate(certs.HTTPSCA, uniqueOperatorName(t, "wrong-ca"), false, true, false)
+
+		err := performMutualTLSHandshake(getOperatorServerTLSConfig("multiplayer"), newClientTLSConfig(t, certPEM, keyPEM))
+		if err == nil {
+			t.Fatal("expected certificate from another authority to be rejected")
+		}
+		if strings.Contains(err.Error(), certs.ErrOperatorClientCertificateNotFound.Error()) {
+			t.Fatalf("expected trust-chain rejection before database lookup, got %v", err)
+		}
+	})
+}
+
+func newClientTLSConfig(t *testing.T, certPEM []byte, keyPEM []byte) *tls.Config {
+	t.Helper()
+
+	clientCert, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		t.Fatalf("parse client certificate: %v", err)
+	}
+
+	return &tls.Config{
+		Certificates:       []tls.Certificate{clientCert},
+		InsecureSkipVerify: true,
+		MinVersion:         tls.VersionTLS13,
+	}
+}
+
+func performMutualTLSHandshake(serverConfig *tls.Config, clientConfig *tls.Config) error {
+	serverConn, clientConn := net.Pipe()
+	defer serverConn.Close()
+	defer clientConn.Close()
+
+	deadline := time.Now().Add(2 * time.Second)
+	_ = serverConn.SetDeadline(deadline)
+	_ = clientConn.SetDeadline(deadline)
+
+	serverTLS := tls.Server(serverConn, serverConfig)
+	clientTLS := tls.Client(clientConn, clientConfig)
+	defer serverTLS.Close()
+	defer clientTLS.Close()
+
+	type handshakeResult struct {
+		side string
+		err  error
+	}
+
+	results := make(chan handshakeResult, 2)
+	go func() {
+		results <- handshakeResult{side: "server", err: serverTLS.Handshake()}
+	}()
+	go func() {
+		results <- handshakeResult{side: "client", err: clientTLS.Handshake()}
+	}()
+
+	var errs []string
+	for i := 0; i < 2; i++ {
+		result := <-results
+		if result.err == nil {
+			continue
+		}
+		if errors.Is(result.err, net.ErrClosed) {
+			continue
+		}
+		errs = append(errs, fmt.Sprintf("%s: %v", result.side, result.err))
+	}
+	if len(errs) == 0 {
+		return nil
+	}
+	return errors.New(strings.Join(errs, "; "))
+}
+
+func uniqueOperatorName(t *testing.T, prefix string) string {
+	t.Helper()
+	return fmt.Sprintf("%s-%d", prefix, time.Now().UnixNano())
+}

server/transport/operator_streams.go

@@ -0,0 +1,130 @@
+package transport
+
+import (
+	"context"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"github.com/bishopfox/sliver/server/db/models"
+	"google.golang.org/grpc"
+)
+
+type trackedServerStream struct {
+	grpc.ServerStream
+	ctx context.Context
+}
+
+func (s *trackedServerStream) Context() context.Context {
+	return s.ctx
+}
+
+type operatorStreamRegistry struct {
+	mu        sync.Mutex
+	nextID    atomic.Uint64
+	operators map[string]map[uint64]context.CancelFunc
+}
+
+var activeOperatorStreams = &operatorStreamRegistry{
+	operators: map[string]map[uint64]context.CancelFunc{},
+}
+
+func (r *operatorStreamRegistry) register(operator string, cancel context.CancelFunc) uint64 {
+	if cancel == nil {
+		return 0
+	}
+
+	operator = strings.TrimSpace(operator)
+	if operator == "" {
+		return 0
+	}
+
+	streamID := r.nextID.Add(1)
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	streams := r.operators[operator]
+	if streams == nil {
+		streams = map[uint64]context.CancelFunc{}
+		r.operators[operator] = streams
+	}
+	streams[streamID] = cancel
+	return streamID
+}
+
+func (r *operatorStreamRegistry) unregister(operator string, streamID uint64) {
+	if streamID == 0 {
+		return
+	}
+
+	operator = strings.TrimSpace(operator)
+	if operator == "" {
+		return
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	streams := r.operators[operator]
+	if streams == nil {
+		return
+	}
+	delete(streams, streamID)
+	if len(streams) == 0 {
+		delete(r.operators, operator)
+	}
+}
+
+func (r *operatorStreamRegistry) close(operator string) int {
+	operator = strings.TrimSpace(operator)
+	if operator == "" {
+		return 0
+	}
+
+	r.mu.Lock()
+	streams := r.operators[operator]
+	if len(streams) == 0 {
+		r.mu.Unlock()
+		return 0
+	}
+
+	cancels := make([]context.CancelFunc, 0, len(streams))
+	for streamID, cancel := range streams {
+		cancels = append(cancels, cancel)
+		delete(streams, streamID)
+	}
+	delete(r.operators, operator)
+	r.mu.Unlock()
+
+	for _, cancel := range cancels {
+		cancel()
+	}
+	return len(cancels)
+}
+
+// CloseOperatorStreams cancels all tracked operator-owned gRPC streams.
+func CloseOperatorStreams(operator string) int {
+	return activeOperatorStreams.close(operator)
+}
+
+func trackOperatorStreamInterceptor() grpc.StreamServerInterceptor {
+	return func(srv interface{}, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		operator, ok := ss.Context().Value(Operator).(*models.Operator)
+		if !ok || operator == nil || strings.TrimSpace(operator.Name) == "" {
+			return handler(srv, ss)
+		}
+
+		ctx, cancel := context.WithCancel(ss.Context())
+		streamID := activeOperatorStreams.register(operator.Name, cancel)
+		defer func() {
+			activeOperatorStreams.unregister(operator.Name, streamID)
+			cancel()
+		}()
+
+		return handler(srv, &trackedServerStream{
+			ServerStream: ss,
+			ctx:          ctx,
+		})
+	}
+}