russell@unturf.com b8a0b1dc17 networkmanager+avahi: 5-MOAD scan CLEAN

Both targets scanned across all 5 MOADs. No defects found.

NetworkManager: single-threaded GLib main loop, no hot-path O(N^2) scans,
all WiFi PSK/EAP/VPN secrets guarded with "<hidden>" in supplicant config log.

avahi: single-threaded poll loop, hashmap-based record and lookup caching,
no credentials, no thread-local context, no concurrent cache patterns.

2026-03-31 21:25:50 -04:00

1.9 KiB

Raw Permalink Blame History

avahi — 5-MOAD Scan — CLEAN

Date: 2026-03-31 Repo: https://github.com/avahi/avahi (depth=1) Scanned: avahi-core/, avahi-daemon/

MOAD-0001 (CWE-407) — CLEAN

No O(N^2) linear scan patterns in hot packet-processing paths.

Patterns examined:

avahi_cache_update() — uses avahi_hashmap_lookup() for O(1) key lookup. Clean.
avahi_multicast_lookup_engine_notify() — uses avahi_hashmap_lookup() for normal records; falls back to linear scan only for CNAME records (rare special case). Acceptable.
avahi_interface_is_relevant() — scans deny_interfaces / allow_interfaces config lists. These are static configuration lists, typically 0-3 entries. O(L) where L is tiny. Not a per-packet amplification.
reflect_filters scan in handle_response_packet() — small static config list. O(R * F) where R = records per packet, F = filter count (0-3 in practice). Not amplified.
avahi_string_list_find() in entry.c:add_magic_cookie() — one-shot call per service registration. Not in a hot loop.
find_slot() in legacy unicast reflection — uses modulo hash (array indexed by id % MAX). O(1). Clean.

MOAD-0002 (Intertangle) — CLEAN

AvahiServer struct (in avahi-core/internal.h) holds all subsystem state as expected for an mDNS daemon. Clean separation: cache, entry groups, lookup engines, interface monitor are distinct components with clear interfaces. No pathological god-object coupling.

MOAD-0003 (Leaked Context) — CLEAN

No thread-local storage found in avahi-core or avahi-daemon. avahi is single-threaded (poll-based event loop).

MOAD-0004 (CWE-312) — CLEAN

avahi is an mDNS/DNS-SD daemon with no credential concepts (no passwords, PSKs, or tokens). No credential logging found in avahi-core or avahi-daemon.

MOAD-0005 (Thundering Herd) — CLEAN

avahi is single-threaded (GLib poll_api event loop). No concurrent cache access patterns. No mutex or thread primitives found in avahi-core.

1.9 KiB Raw Permalink Blame History