# CLEAN — Tor Anonymity Network
Scanned 2026-03-29 for CWE-407 (algorithmic complexity: O(N²) linear membership tests, O(2^D) diamond recursion).

## Scope
- `src/feature/client/entrynodes.c` — guard node selection, sampled/confirmed guard lists
- `src/feature/client/circpathbias.c` — circuit path bias tracking
- `src/feature/nodelist/node_select.c` — node selection with exclusion lists
- `src/feature/nodelist/nodelist.c` — family membership, `nodes_have_common_family_id`
- `src/feature/nodelist/routerlist.c` — router descriptor ingestion
- `src/feature/hs/hs_service.c` — hidden service hsdir tracking
- `src/feature/relay/dns.c` — DNS wildcard detection

## Findings
- **`nodelist_subtract`** (`node_select.c:890`) — explicitly noted in comments as "delivers linear performance when smartlist_subtract would be quadratic." Uses `bitarray_t` indexed by `node->nodelist_idx`. O(N+M). CLEAN.
- **`nodes_have_common_family_id`** (`nodelist.c:2190`) — O(|ids_a| × |ids_b|) nested loop over family certificate IDs. Both lists are tiny (typically 1–3 IDs per relay). Outer loop in `nodelist_add_node_and_family` iterates all ~7000 relays but inner product is O(F²) where F≪1. Not a scalable O(N²). CLEAN.
- **`entrynodes.c` guard lists** — `smartlist_contains` on `primary_entry_guards` and `confirmed_entry_guards`: bounded by `MAX_SAMPLE_THRESHOLD` (dozens), called in setup/error paths (BUG assertions), not hot per-circuit. CLEAN.
- **`hs_service.c` `previous_hsdirs`** — `smartlist_contains_string` on a list bounded by `REND_NUMBER_OF_CONSECUTIVE_REPLICAS` (6). CLEAN.
- **`dns.c` `dns_wildcard_list`** — linear scan on a list of hijacked IPs. In practice contains 0–10 entries; called once per DNS response. CLEAN.
- **Router descriptor ingestion** — `requested_fingerprints` shrinks as each router is processed (O(N) total). CLEAN.

**Result: No actionable CWE-407 defects. Tor's hot node-selection paths use bitarray-indexed O(N) exclusion; all family/guard list scans operate on constant-bounded collections.**