# wireguard-tools CWE-407 Scan — CLEAN

**Scan date:** 2026-03-29
**Target:** WireGuard/wireguard-tools
**Source root:** `src/`
**Hot paths scanned:** config.c, wg.c, set.c, setconf.c, show.c, ipc.c

## Summary

No CWE-407 defects found. The codebase is a CLI tool (not a server). Peer lists are small
by design (WireGuard limits to ~10,000 peers per interface), and all multi-peer operations
use sort-then-merge rather than nested linear scans.

## Findings

### config.c — parse_allowedips / process_line / config_read_cmd
No membership checks inside loops. AllowedIPs parsing builds a singly-linked list
(`new_allowedip->next_allowedip = ...`) in O(N) with no deduplication scan.

### setconf.c — sync_conf
The only multi-peer algorithm: merges file-peers and runtime-peers to compute the delta.
Uses `qsort(peers, peer_count, sizeof(*peers), peer_cmp)` then a single O(N) sorted merge.
Total: O(N log N). Correct algorithm, no O(N²) pattern.

### show.c — pretty_print / dump_print / ugly_print
Nested `for_each_wgpeer { for_each_wgallowedip }` loops are pure rendering (printf).
No membership test inside the inner loop. No deduplication. O(P×A) for output only.

### wg.c — main dispatch
Static subcommand array of 9 entries, linear scanned once per invocation.
Constant time in practice (N=9 always).

### ipc.c — ipc_list_devices
Builds a null-delimited string buffer. No membership checks.

## Conclusion

wireguard-tools is clean for CWE-407. The tool is a thin CLI wrapper over the kernel
WireGuard interface. All multi-peer operations are O(N log N) or pure output loops.
No O(N²) membership checks found.
