From b8a0b1dc17fff6621a4c9947f860fa2a4b7ea6f4 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Tue, 31 Mar 2026 21:25:50 -0400 Subject: [PATCH] networkmanager+avahi: 5-MOAD scan CLEAN Both targets scanned across all 5 MOADs. No defects found. NetworkManager: single-threaded GLib main loop, no hot-path O(N^2) scans, all WiFi PSK/EAP/VPN secrets guarded with "" in supplicant config log. avahi: single-threaded poll loop, hashmap-based record and lookup caching, no credentials, no thread-local context, no concurrent cache patterns. --- defects/avahi-scan/CLEAN.md | 45 ++++++++++++++++++++ defects/networkmanager-scan/CLEAN.md | 61 ++++++++++++++++++++++++++++ 2 files changed, 106 insertions(+) create mode 100644 defects/avahi-scan/CLEAN.md create mode 100644 defects/networkmanager-scan/CLEAN.md diff --git a/defects/avahi-scan/CLEAN.md b/defects/avahi-scan/CLEAN.md new file mode 100644 index 000000000..a6ef0561b --- /dev/null +++ b/defects/avahi-scan/CLEAN.md @@ -0,0 +1,45 @@ +# avahi — 5-MOAD Scan — CLEAN + +**Date:** 2026-03-31 +**Repo:** https://github.com/avahi/avahi (depth=1) +**Scanned:** avahi-core/, avahi-daemon/ + +## MOAD-0001 (CWE-407) — CLEAN + +No O(N^2) linear scan patterns in hot packet-processing paths. + +Patterns examined: + +- `avahi_cache_update()` — uses `avahi_hashmap_lookup()` for O(1) key lookup. Clean. +- `avahi_multicast_lookup_engine_notify()` — uses `avahi_hashmap_lookup()` for normal records; + falls back to linear scan only for CNAME records (rare special case). Acceptable. +- `avahi_interface_is_relevant()` — scans `deny_interfaces` / `allow_interfaces` config lists. + These are static configuration lists, typically 0-3 entries. O(L) where L is tiny. Not a + per-packet amplification. +- `reflect_filters` scan in `handle_response_packet()` — small static config list. + O(R * F) where R = records per packet, F = filter count (0-3 in practice). Not amplified. +- `avahi_string_list_find()` in `entry.c:add_magic_cookie()` — one-shot call per service + registration. Not in a hot loop. +- `find_slot()` in legacy unicast reflection — uses modulo hash (array indexed by id % MAX). + O(1). Clean. + +## MOAD-0002 (Intertangle) — CLEAN + +`AvahiServer` struct (in `avahi-core/internal.h`) holds all subsystem state as expected for +an mDNS daemon. Clean separation: cache, entry groups, lookup engines, interface monitor are +distinct components with clear interfaces. No pathological god-object coupling. + +## MOAD-0003 (Leaked Context) — CLEAN + +No thread-local storage found in avahi-core or avahi-daemon. avahi is single-threaded +(poll-based event loop). + +## MOAD-0004 (CWE-312) — CLEAN + +avahi is an mDNS/DNS-SD daemon with no credential concepts (no passwords, PSKs, or tokens). +No credential logging found in avahi-core or avahi-daemon. + +## MOAD-0005 (Thundering Herd) — CLEAN + +avahi is single-threaded (GLib poll_api event loop). No concurrent cache access patterns. +No mutex or thread primitives found in avahi-core. diff --git a/defects/networkmanager-scan/CLEAN.md b/defects/networkmanager-scan/CLEAN.md new file mode 100644 index 000000000..7ad189e19 --- /dev/null +++ b/defects/networkmanager-scan/CLEAN.md @@ -0,0 +1,61 @@ +# NetworkManager — 5-MOAD Scan — CLEAN + +**Date:** 2026-03-31 +**Repo:** https://github.com/NetworkManager/NetworkManager (depth=1) +**Scanned:** src/core/, src/core/devices/, src/core/dns/, src/core/supplicant/, src/core/vpn/ + +## MOAD-0001 (CWE-407) — CLEAN + +No O(N^2) linear scan patterns in hot paths. + +Patterns examined: + +- `nm_utils_g_slist_find_str` in `nm-settings.c:update_specs()` — called on plugin config-change + events (rare), not per-packet. P=plugins (2-3), S=specs (small). Not a hot path. +- `g_slist_find` in `nm-device-factory.c:nm_device_factory_manager_for_each_factory()` — + factory init/dedup, runs once at startup. +- `nm_strv_ptrarray_contains` in `nm-l3-config-data.c` for nameserver/domain/search dedup — + called per config-change on O(4) typical lists. Not a hot path. +- `nm_strv_find_first` in `nm-bond-manager.c` — already acknowledged as O(N^2) in a code + comment; applies only to bond member reordering, not a per-packet hot path. +- DNS manager (`nm-dns-manager.c`) uses `g_hash_table` for domain dedup. Clean. +- Supplicant config (`nm-supplicant-config.c`) uses `g_hash_table` for option storage. Clean. + +## MOAD-0002 (Intertangle) — CLEAN + +`nm-manager.c` is large (9992 lines) but represents normal single-daemon architecture for +a Linux network manager. No pathological shared-mutable-global-state coupling detected across +independent subsystems that would qualify as an Intertangle defect. + +## MOAD-0003 (Leaked Context) — CLEAN + +Thread-local usage found: + +- `_nm_utils_to_string_buffer` — formatting scratch buffer. Correct use. +- `_nm_utils_inet_ntop_buffer` — inet formatting buffer. Correct use. +- `_netns_stack` in `nmp-netns.c` — network namespace push/pop stack. Intentionally + thread-local for safe per-thread namespace management. Not request-scoped identity leakage. +- `_tls_reg_key` in `nm-shared-utils.c` — TLS destructor registration. Infrastructure. + +No request-scoped identity stored in thread-local context that outlives our request. + +## MOAD-0004 (CWE-312) — CLEAN + +All credential values are guarded with `""` display_value in +`nm_supplicant_config_add_option*()`: + +- WEP keys: `""` at all call sites. +- WPA PSK (passphrase + hex): `""`. +- SAE password: `""`. +- LEAP password: `""`. +- EAP password: `""`. +- SIM PIN: `""`. +- Private key password: `""`. +- MKA CAK: `""`. MKA CKN logged as hex string (key name, not key material). + +VPN secrets are passed via GVariant dicts and never logged verbatim. + +## MOAD-0005 (Thundering Herd) — CLEAN + +NetworkManager is single-threaded (GLib main loop). Only one mutex found +(`nmtst_host_id_lock`) in test infrastructure. No concurrent cache get+compute+put patterns.