From 2d056afb0fed19b4ebdafdd38dc3684042cbbea5 Mon Sep 17 00:00:00 2001 From: "rearden-grok[bot]" <317016512+rearden-grok[bot]@users.noreply.github.com> Date: Fri, 2 Oct 2026 16:06:26 -0700 Subject: [PATCH] docs: index the Livera review Stephan Livera's 2026-10-02 review needs a public status board next to the other external findings, owned by Q-72, before the fixes land. --- changelog.d/livera-review.md | 5 ++ .../052-livera-review-index.md | 49 +++++++++++++++++++ docs/external_findings/README.md | 1 + docs/quality.md | 3 +- 4 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 changelog.d/livera-review.md create mode 100644 docs/external_findings/052-livera-review-index.md diff --git a/changelog.d/livera-review.md b/changelog.d/livera-review.md new file mode 100644 index 000000000..76a094a37 --- /dev/null +++ b/changelog.d/livera-review.md @@ -0,0 +1,5 @@ +Security + +- Thanks to Stephan Livera for the 2026-10-02 review of P2P resource + accounting, inbound eviction, REST, and silent-payment logging. + Status board: docs/external_findings/052-livera-review-index.md. diff --git a/docs/external_findings/052-livera-review-index.md b/docs/external_findings/052-livera-review-index.md new file mode 100644 index 000000000..643f170da --- /dev/null +++ b/docs/external_findings/052-livera-review-index.md @@ -0,0 +1,49 @@ +# 052 — Livera review index + +Review by Stephan Livera, 2026-10-02, commit `058adb8d`. This index is +the status board. Each fixed row names the regression. No reproduction +steps. + +| Id | Severity | Topic | Status | Regression | +|----|----------|--------|--------|------------| +| C1 | critical | Unbounded parent-request tracker | open | — | +| N2 | low | Wtxid follow-up requested as a txid | open | — | +| H1 | high | Decoy and invalid-type packets skip the rate window | open | — | +| H2 | high | Inbound eviction drops the longest-connected peer | open | — | +| H2-ban | high | Misbehavior disconnect is not remembered | open | — | +| H3 | high | REST always on and shares the RPC work queue | open | — | +| H4 | medium | Silent-payment unsubscribe logs the scan secret | open | — | +| H5 | high | IBD reader credits unsolicited data as progress | open | — | +| N1 | medium | Inv getdata does not charge the send budget | open | — | +| M1 | medium | Block getdata can queue past the send budget | open | — | +| M2 | medium | Silent-payment scan span is unbounded when start is set | open | — | +| M3 | medium | RPC listener has no accept timeout; long-poll holds a permit | open | — | +| M4 | medium | fuse8 segment length need not be a power of two | open | — | +| M5 | medium | Class A bulk read ignores the published end | open | — | +| M6 | medium | Testnet milestone is height-only | open | — | +| M7 | medium | Mempool inv is one message per transaction | open | — | +| M8 | medium | Pending blocks and orphans are count-capped only | open | — | +| M9 | high | io_uring drop can free a buffer the kernel still owns | open | — | +| M10 | low | Secret types derive Debug; create-then-chmod | open | — | +| L1 | low | Height-0 BIP68 time lock uses median time 0 | open | — | +| L4 | low | Empty median time panics | open | — | +| L5 | low | Version nonce is not a CSPRNG | open | — | +| L6 | low | Recent-reject set clears at the cap | open | — | +| L8 | low | Manifest and txstat lengths allocate before a size check | open | — | +| L9 | low | Tor control password on argv | open | — | +| L10 | low | Datadir lock follows a symlink | open | — | +| L11 | low | Conf parse errors echo the raw line | open | — | +| L12 | low | Invalid-hash set grows without a cap | open | — | +| L13 | low | Rate window grants two budgets at the boundary | open | — | +| L14 | low | Mempool expiry runs only on admission | open | — | +| L15 | low | Write jobs form a mutable slice over a shared buffer | open | — | +| L2 | — | P2PKH fast path skips FindAndDelete | rejected | The fast path is the 25-byte template. A DER signature does not fit in that scriptCode, so FindAndDelete cannot change it. | +| L3 | — | Witness-v0 strict DER independent of BIP66 | rejected | BIP141 witness verification is strict DER. Mainnet, testnet, signet, and regtest are unaffected. | +| L7 | low | Rewind deeper than 1024 is refused | won't-fix | `REWIND_MAX_DEPTH` is a deliberate denial-of-service cap. Removing it needs an operator decision. No new knob. | +| L16 | — | Warnet image is pinned by tag | won't-fix | `scripts/core-functional/warnet/Dockerfile` is a lab image, not a Release. | +| eclipse | — | Inverted eviction eclipses the node | rejected | Outbound peers are not eviction candidates. The defect is inbound-slot monopoly, tracked as H2. | +| M2-sh | — | Silent-payment subscribe must require `--sh-index` | rejected | The scan uses the tweak index, not the scripthash index (finding 036). | +| M8-fee | — | Fee and sigop checks at orphan park | rejected | The parent outputs are not available yet. Shape checks already run before park. | +| M6-flag | — | Height-only `--milestone` needs a new flag | rejected | Explicit `--milestone HEIGHT` is already that switch (finding 042). | + +Owner: [`quality.md`](../quality.md) **Q-72**. diff --git a/docs/external_findings/README.md b/docs/external_findings/README.md index bcebd9432..349e7cb92 100644 --- a/docs/external_findings/README.md +++ b/docs/external_findings/README.md @@ -56,6 +56,7 @@ rbitcoin reference, or redteam static analysis). Numbered reports live beside th | [044](./044-local-auth.md) | low | Tor SAFECOOKIE, datadir `0700`, socket mode, overlay permissions | fixed | `tor_control_onion_lifecycle` | | [043](./043-peer-send-buffer.md) | high | Unbounded per-peer outbound queue | fixed | `hostile_peer_session` | | [040](./040-corrupt-bounds.md) | medium | Corrupt uleb128, seqsigwit lengths, and BDZ modulus | fixed | `read_packed_zero_modulus_or_vertices_is_corrupt` | +| [052](./052-livera-review-index.md) | — | Livera review index | index | Q-72 | **012–021:** fuzzamoto differential report (`rbitcoin-report.tar.gz`, baseline `8f3990f`). Report-local 001–010 are **renumbered** here. Identity/BIP30 diff --git a/docs/quality.md b/docs/quality.md index 0b4b46eee..b0730e07b 100644 --- a/docs/quality.md +++ b/docs/quality.md @@ -37,9 +37,10 @@ Counts and procedures stay in the owner doc. A row is the rank and the outcome. | 7 | **Q-70** | Batch lookup-path hit counters if a profile names them | `head_resolve_stats::add_hit_rank` does two relaxed `fetch_add`s per resolved txid (`head_resolve_denserels`, `tx_table`). SH extract collect flushes output and hit counts once per fk batch, not per output. Still once per event: `accepted_wb` (`SeqCst`, per confirmed block), `serve_perf::note_serve` (per historical getdata), `page_ios` (per SH page read). Done: a profile shows `add_hit_rank` on confirm lookup and those counters flush per batch, or the profile shows the line is noise and this row moves to Won't-fix. `add_hit_ages` is already a batched flush; `add_hit_age` remains the one-bucket path. | | 8 | **Q-71** | Talip review remediations | Every row in [`external_findings/024-talip-review-index.md`](./external_findings/024-talip-review-index.md) is fixed, rejected, or won't-fix, and each fixed row names a regression. | | 9 | **Q-64** | SV2 template provider (TDP server) | Node serves Noise-encrypted Template Distribution Protocol in-process: `CoinbaseOutputConstraints` → pushed `NewTemplate` / `SetNewPrevHash` on tip change and fee delta, `RequestTransactionData`, `SubmitSolution` → `accept_block`. Roadmap (plans A → B → C, one PR each): [`sv2-template-provider.md`](./sv2-template-provider.md). | +| 10 | **Q-72** | Livera review remediations | Every row in [`external_findings/052-livera-review-index.md`](./external_findings/052-livera-review-index.md) is fixed, rejected, or won't-fix, and each fixed row names a regression. | R-ids were the 2026-08-12 slice. Canonical id is **bold**. Do not start -**R-11+**. Next unused Q-id is **Q-72**. +**R-11+**. Next unused Q-id is **Q-73**. Close work by **writing the Open row into `changelog.d/`** in the same edit as the landing change (do not grow a Completed museum here). New item: insert