russell@unturf.com
b8a0b1dc17
Both targets scanned across all 5 MOADs. No defects found. NetworkManager: single-threaded GLib main loop, no hot-path O(N^2) scans, all WiFi PSK/EAP/VPN secrets guarded with "<hidden>" in supplicant config log. avahi: single-threaded poll loop, hashmap-based record and lookup caching, no credentials, no thread-local context, no concurrent cache patterns.
61 lines
2.7 KiB
Markdown
61 lines
2.7 KiB
Markdown
# NetworkManager — 5-MOAD Scan — CLEAN
|
|
|
|
**Date:** 2026-03-31
|
|
**Repo:** https://github.com/NetworkManager/NetworkManager (depth=1)
|
|
**Scanned:** src/core/, src/core/devices/, src/core/dns/, src/core/supplicant/, src/core/vpn/
|
|
|
|
## MOAD-0001 (CWE-407) — CLEAN
|
|
|
|
No O(N^2) linear scan patterns in hot paths.
|
|
|
|
Patterns examined:
|
|
|
|
- `nm_utils_g_slist_find_str` in `nm-settings.c:update_specs()` — called on plugin config-change
|
|
events (rare), not per-packet. P=plugins (2-3), S=specs (small). Not a hot path.
|
|
- `g_slist_find` in `nm-device-factory.c:nm_device_factory_manager_for_each_factory()` —
|
|
factory init/dedup, runs once at startup.
|
|
- `nm_strv_ptrarray_contains` in `nm-l3-config-data.c` for nameserver/domain/search dedup —
|
|
called per config-change on O(4) typical lists. Not a hot path.
|
|
- `nm_strv_find_first` in `nm-bond-manager.c` — already acknowledged as O(N^2) in a code
|
|
comment; applies only to bond member reordering, not a per-packet hot path.
|
|
- DNS manager (`nm-dns-manager.c`) uses `g_hash_table` for domain dedup. Clean.
|
|
- Supplicant config (`nm-supplicant-config.c`) uses `g_hash_table` for option storage. Clean.
|
|
|
|
## MOAD-0002 (Intertangle) — CLEAN
|
|
|
|
`nm-manager.c` is large (9992 lines) but represents normal single-daemon architecture for
|
|
a Linux network manager. No pathological shared-mutable-global-state coupling detected across
|
|
independent subsystems that would qualify as an Intertangle defect.
|
|
|
|
## MOAD-0003 (Leaked Context) — CLEAN
|
|
|
|
Thread-local usage found:
|
|
|
|
- `_nm_utils_to_string_buffer` — formatting scratch buffer. Correct use.
|
|
- `_nm_utils_inet_ntop_buffer` — inet formatting buffer. Correct use.
|
|
- `_netns_stack` in `nmp-netns.c` — network namespace push/pop stack. Intentionally
|
|
thread-local for safe per-thread namespace management. Not request-scoped identity leakage.
|
|
- `_tls_reg_key` in `nm-shared-utils.c` — TLS destructor registration. Infrastructure.
|
|
|
|
No request-scoped identity stored in thread-local context that outlives our request.
|
|
|
|
## MOAD-0004 (CWE-312) — CLEAN
|
|
|
|
All credential values are guarded with `"<hidden>"` display_value in
|
|
`nm_supplicant_config_add_option*()`:
|
|
|
|
- WEP keys: `"<hidden>"` at all call sites.
|
|
- WPA PSK (passphrase + hex): `"<hidden>"`.
|
|
- SAE password: `"<hidden>"`.
|
|
- LEAP password: `"<hidden>"`.
|
|
- EAP password: `"<hidden>"`.
|
|
- SIM PIN: `"<hidden>"`.
|
|
- Private key password: `"<hidden>"`.
|
|
- MKA CAK: `"<hidden>"`. MKA CKN logged as hex string (key name, not key material).
|
|
|
|
VPN secrets are passed via GVariant dicts and never logged verbatim.
|
|
|
|
## MOAD-0005 (Thundering Herd) — CLEAN
|
|
|
|
NetworkManager is single-threaded (GLib main loop). Only one mutex found
|
|
(`nmtst_host_id_lock`) in test infrastructure. No concurrent cache get+compute+put patterns.
|