fix: bound per-tap IMDS server timeouts and connections (#1196)

Set read, write and idle timeouts and a header cap on each per-tap IMDS
http.Server, and cap its listener at 32 connections, so one guest cannot
hold unbounded vpcd descriptors and goroutines with idle keep-alives.

go.mod

@@ -46,6 +46,7 @@ require (
 	go.uber.org/goleak v1.3.1-0.20260602155401-5f791e3ef83b
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/crypto v0.58.0
+	golang.org/x/net v0.61.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/sys v0.49.0
 	golang.org/x/term v0.47.0
@@ -196,7 +197,6 @@ require (
 	go.uber.org/nilaway v0.0.0-20260721205819-4a0f7653488a // indirect
 	golang.org/x/exp/typeparams v0.0.0-20260611194520-c48552f49976 // indirect
 	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/net v0.61.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260924152758-ed294f943157 // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/vuln v1.6.0 // indirect

spinifex/handlers/imds/tap_responder.go

@@ -11,6 +11,7 @@ import (
 	"syscall"
 	"time"
 
+	"golang.org/x/net/netutil"
 	"golang.org/x/sys/unix"
 )
 
@@ -122,6 +123,8 @@ func (m *tapResponderManager) start(ctx context.Context, eniID, endpoint string)
 	if err != nil {
 		return fmt.Errorf("listen on endpoint %s: %w", endpoint, err)
 	}
+	// Cap per-tap connections so one guest cannot exhaust vpcd's shared descriptors.
+	listener = netutil.LimitListener(listener, 32)
 	ifindex, err := m.ifindex(endpoint)
 	if err != nil {
 		slog.DebugContext(ctx, "IMDS: endpoint ifindex unavailable; recreated-endpoint detection degraded", "endpoint", endpoint, "err", err)
@@ -130,6 +133,10 @@ func (m *tapResponderManager) start(ctx context.Context, eniID, endpoint string)
 	server := &http.Server{
 		Handler:           m.handler,
 		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       10 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       30 * time.Second,
+		MaxHeaderBytes:    16 << 10,
 		BaseContext: func(net.Listener) context.Context {
 			return context.WithValue(ctx, ctxKeyENI, eni)
 		},