Two non-gating hardenings on the #1590/PR#93 PoolProviderLocator (dig-node-core, crates/dig-node-core/src/download.rs + seams/dig_peer/pool_locator.rs), flagged by the PR#93 gate (reviewer + adversarial F2 + security). Both bounded-safe today; defense-in-depth.
-
Self-exclusion symmetry (F2): the pool arm is unioned into download_locator OUTSIDE the SelfExcludingLocator wrap (unlike #1584's DHT arm which is inside it). Non-exploitable today (dig-gossip's #1584 pool guard never emits PeerAdded for self, and a hypothetical self entry answers getAvailability:false → dropped). Wrap the download_locator branch in SelfExcludingLocator too so the pool source inherits the same defense-in-depth as the DHT source (download.rs:~541).
-
Cap per-peer addr Vec (security note): on_pool_event PeerAdded (download.rs:~658-661) appends to the per-peer Vec<SocketAddr> in connected_pool with NO cap → unbounded growth if a peer emits many PeerAdded with distinct addrs for one peer_id. Bounded in practice (downstream dial capped at 8 by UnionLocator sanitize; PeerRemoved clears the entry; gossip ~1 addr/peer). Cap the per-peer addr Vec (mirror MAX_ADDRS_PER_PROVIDER).
Priority Low (both bounded-safe; consistency + belt-and-suspenders).
Two non-gating hardenings on the #1590/PR#93
PoolProviderLocator(dig-node-core, crates/dig-node-core/src/download.rs + seams/dig_peer/pool_locator.rs), flagged by the PR#93 gate (reviewer + adversarial F2 + security). Both bounded-safe today; defense-in-depth.Self-exclusion symmetry (F2): the pool arm is unioned into
download_locatorOUTSIDE theSelfExcludingLocatorwrap (unlike #1584's DHT arm which is inside it). Non-exploitable today (dig-gossip's #1584 pool guard never emits PeerAdded for self, and a hypothetical self entry answers getAvailability:false → dropped). Wrap thedownload_locatorbranch inSelfExcludingLocatortoo so the pool source inherits the same defense-in-depth as the DHT source (download.rs:~541).Cap per-peer addr Vec (security note):
on_pool_eventPeerAdded (download.rs:~658-661) appends to the per-peerVec<SocketAddr>inconnected_poolwith NO cap → unbounded growth if a peer emits many PeerAdded with distinct addrs for one peer_id. Bounded in practice (downstream dial capped at 8 by UnionLocator sanitize; PeerRemoved clears the entry; gossip ~1 addr/peer). Cap the per-peer addr Vec (mirrorMAX_ADDRS_PER_PROVIDER).Priority Low (both bounded-safe; consistency + belt-and-suspenders).