Fix critical bugs and security vulnerabilities

- Fix race condition in client cleanup by serializing operations
- Add proper nil checks in SendMessage for server/config
- Add semaphore to limit concurrent health check goroutines
- Reduce buffer size to RFC-compliant 512 bytes (was 4096)
- Add comprehensive input validation (length, null bytes, UTF-8)
- Improve SSL error handling with graceful degradation
- Replace unsafe conn.Close() with proper cleanup() calls
- Prevent goroutine leaks and memory exhaustion attacks
- Enhanced logging and error recovery throughout

These fixes address the freezing issues and improve overall
server stability, security, and RFC compliance.

server.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"sync"
 	"time"
+	"unicode/utf8"
 )
 
 type Server struct {
@@ -22,14 +23,16 @@ type Server struct {
 	mu             sync.RWMutex
 	shutdown       chan bool
 	healthMonitor  *HealthMonitor
+	healthCheckSem chan struct{} // Semaphore to limit concurrent health checks
 }
 
 func NewServer(config *Config) *Server {
 	server := &Server{
-		config:   config,
-		clients:  make(map[string]*Client, config.Limits.MaxClients),
-		channels: make(map[string]*Channel, config.Limits.MaxChannels),
-		shutdown: make(chan bool),
+		config:         config,
+		clients:        make(map[string]*Client, config.Limits.MaxClients),
+		channels:       make(map[string]*Channel, config.Limits.MaxChannels),
+		shutdown:       make(chan bool),
+		healthCheckSem: make(chan struct{}, 1), // Only allow 1 concurrent health check
 	}
 	server.healthMonitor = NewHealthMonitor(server)
 	return server
@@ -94,10 +97,17 @@ func (s *Server) Start() error {
 }
 
 func (s *Server) startSSLListener() {
+	// Validate SSL configuration
+	if s.config.Server.SSL.CertFile == "" || s.config.Server.SSL.KeyFile == "" {
+		log.Printf("SSL enabled but certificate or key file not specified")
+		return
+	}
+
 	// Load SSL certificates
 	cert, err := tls.LoadX509KeyPair(s.config.Server.SSL.CertFile, s.config.Server.SSL.KeyFile)
 	if err != nil {
-		log.Printf("Failed to load SSL certificates: %v", err)
+		log.Printf("CRITICAL: Failed to load SSL certificates (SSL disabled): %v", err)
+		log.Printf("SSL will not be available. Check certificate paths in config.")
 		return
 	}
 
@@ -106,12 +116,13 @@ func (s *Server) startSSLListener() {
 	addr := fmt.Sprintf("%s:%d", s.config.Server.Listen.Host, s.config.Server.Listen.SSLPort)
 	listener, err := tls.Listen("tcp", addr, tlsConfig)
 	if err != nil {
-		log.Printf("Failed to start SSL listener on %s: %v", addr, err)
+		log.Printf("CRITICAL: Failed to start SSL listener on %s: %v", addr, err)
+		log.Printf("SSL will not be available. Server continues with plain connections only.")
 		return
 	}
 	s.sslListener = listener
 
-	log.Printf("IRC SSL server listening on %s", addr)
+	log.Printf("✓ IRC SSL server listening on %s", addr)
 
 	for {
 		select {
@@ -143,11 +154,29 @@ func (s *Server) pingRoutine() {
 		case <-s.shutdown:
 			return
 		case <-ticker.C:
-			// Run ping check in a goroutine to prevent blocking
-			go s.performPingCheck()
+			// Run ping check with semaphore to prevent goroutine leaks
+			select {
+			case s.healthCheckSem <- struct{}{}:
+				go func() {
+					defer func() { <-s.healthCheckSem }()
+					s.performPingCheck()
+				}()
+			default:
+				// Skip ping check if one is already running
+				log.Printf("Skipping ping check - one already in progress")
+			}
 		case <-healthTicker.C:
-			// Run health check in a goroutine to prevent blocking
-			go s.performHealthCheck()
+			// Run health check with semaphore to prevent goroutine leaks
+			select {
+			case s.healthCheckSem <- struct{}{}:
+				go func() {
+					defer func() { <-s.healthCheckSem }()
+					s.performHealthCheck()
+				}()
+			default:
+				// Skip health check if one is already running
+				log.Printf("Skipping health check - one already in progress")
+			}
 		}
 	}
 }
@@ -551,6 +580,29 @@ func (s *Server) IsNickInUse(nick string) bool {
 }
 
 func (s *Server) HandleMessage(client *Client, message string) {
+	// Input validation
+	if len(message) == 0 {
+		return
+	}
+
+	// Check for maximum message length (IRC RFC limits to 512 bytes)
+	if len(message) > 510 { // 510 to account for CRLF
+		log.Printf("Message too long from %s (%d bytes), dropping", client.Host(), len(message))
+		return
+	}
+
+	// Check for null bytes (not allowed in IRC messages)
+	if strings.ContainsRune(message, '\x00') {
+		log.Printf("Message contains null bytes from %s, dropping", client.Host())
+		return
+	}
+
+	// Basic UTF-8 validation
+	if !utf8.ValidString(message) {
+		log.Printf("Message contains invalid UTF-8 from %s, dropping", client.Host())
+		return
+	}
+
 	// Parse IRCv3 message tags if present
 	var tags map[string]string
 	var actualMessage string