Two parallel adversarial audits (#8 feature + serving/API sweep). Real findings: - HIGH (resolver amplification): full-recursion had no wall-clock bound on a single client query's fan-out across the DNSSEC chain + CNAME hops, holding an inflight permit for an attacker-controlled duration. Wrap resolve_validated in a 10s tokio::timeout → SERVFAIL past the deadline, releasing the permit. (The full global query-budget + DS/DNSKEY cache remains tracked as #165; full-recursion only, the production master runs forward mode.) - MEDIUM (authz): an 'admin:false, role:Admin' account was admin for role-based may_write but not for the explicit !caller.admin gates — inconsistent. from_account now sets admin = u.admin || role==Admin so the two can never disagree. - #8 F1: validate policy name (≤64, no control/quote/backslash) and every blacklist_extra domain (validate_dns_name) — matching the blacklist/split-horizon handlers. #8 F3: MAX_POLICIES=256 + MAX_POLICY_DOMAINS=4096 caps (slow-path O(N)/file-size DoS bound). #8 F4: log a warning on corrupt subnet-policies.json instead of silently wiping (fail-open made visible). - F7: CidrBlock::parse rejects an out-of-range prefix (/99) so the API CIDR gate is real. Audits confirmed SOUND: negative-answer SOA validation, CD/cache, TC, wire-parser panic surface, API auth (no secret leak), per-subnet match/cache/fast-path isolation. Verified live. 437 tests, clippy -D clean. Note: this is an [AI-ADVERSARIAL] cycle — the independent human/different-model re-audit (#170) remains required before go-live.

[v1.0] Third-party human security audit #170

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions