M-09: manifest freshness uses two-sided bounds; per-field caps and validation

@@ -7,6 +7,17 @@77 /** 0x03 adds relay routing to each introduced peer edge. */88 const val DEVICE_MANIFEST_VERSION = 0x0399 private const val DEVICE_MANIFEST_FRESHNESS_MS = 5 * 60_000L10+/**11+ * Upper bounds on what verifyDeviceManifest will accept. A pathological peer12+ * could otherwise craft a manifest that consumes unbounded memory or skips13+ * sanity checks (e.g. `issuedAt = Long.MIN_VALUE` bypasses `abs(...) > window`14+ * because `abs(Long.MIN_VALUE)` is still negative). These caps match the15+ * realistic limits of the pairing protocol: a handful of paired devices, a16+ * bounded revocation list, and string fields long enough for any honest use.17+ */18+private const val MAX_MANIFEST_DEVICES = 25619+private const val MAX_MANIFEST_REVOCATIONS = 50020+private const val MAX_MANIFEST_STRING = 2561021 internal const val NO_KEY_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000"1122 1223 interface PairedDeviceRegistry {@@ -69,7 +80,15 @@6980 ): DeviceManifestBody? {7081     val body = manifest.body7182     if (body.manifestVersion != DEVICE_MANIFEST_VERSION) return null72-    if (kotlin.math.abs(nowMs - body.issuedAt) > freshnessMs) return null83+    // Two-sided bounds — avoids `abs(...) > window`, which overflows for84+    // `Long.MIN_VALUE` and lets a peer-presented timestamp bypass the85+    // freshness gate. Reject negative `issuedAt` outright so the bounds86+    // arithmetic can't be steered into a wrap-around by the manifest.87+    if (body.issuedAt < 0L) return null88+    if (body.issuedAt < nowMs - freshnessMs || body.issuedAt > nowMs + freshnessMs) return null89+    if (body.issuerDeviceId.isBlank() || body.issuerDeviceId.length > MAX_MANIFEST_STRING) return null90+    if (body.devices.size > MAX_MANIFEST_DEVICES) return null91+    if (body.revoked.size > MAX_MANIFEST_REVOCATIONS) return null7392     if (!isHex(manifest.signatureHex, 128)) return null7493     if (!body.devices.all { normaliseManifestEntry(it) != null }) return null7594     if (!body.revoked.all { isValidRevocation(it) }) return null@@ -110,12 +129,18 @@110129 111130 private fun normaliseManifestEntry(entry: ManifestDeviceEntry): ManifestDeviceEntry? {112131     if (entry.deviceId.isBlank() || entry.deviceName.isBlank()) return null132+    // Bound string fields — a peer could otherwise send multi-megabyte strings133+    // that pass the format checks and bloat the canonical signature input.134+    if (entry.deviceId.length > MAX_MANIFEST_STRING || entry.deviceName.length > MAX_MANIFEST_STRING) return null113135     if (entry.deviceType !in setOf("extension", "android", "ios")) return null114136     if (!isHex(entry.longTermPublicKeyHex, 64) || !isHex(entry.signingPublicKeyHex, 64)) return null115137     if (entry.wsPort != null && entry.wsPort !in 1..65_535) return null138+    if (entry.pairedAt < 0L) return null116139     if (117-        entry.relayUrl != null &&118-        runCatching { Rendezvous.normalizeRelayUrl(entry.relayUrl) }.isFailure140+        entry.relayUrl != null && (141+            entry.relayUrl.length > MAX_MANIFEST_STRING ||142+            runCatching { Rendezvous.normalizeRelayUrl(entry.relayUrl) }.isFailure143+        )119144     ) return null120145     return entry.copy(121146         longTermPublicKeyHex = entry.longTermPublicKeyHex.lowercase(),@@ -127,9 +152,10 @@127152     r.copy(longTermPublicKeyHex = r.longTermPublicKeyHex.lowercase())128153 129154 private fun isValidRevocation(r: DeviceRevocation): Boolean =130-    r.deviceId.isNotBlank() &&155+    r.deviceId.isNotBlank() && r.deviceId.length <= MAX_MANIFEST_STRING &&131156         isHex(r.longTermPublicKeyHex.lowercase(), 64) &&132-        r.revokedByDeviceId.isNotBlank()157+        r.revokedByDeviceId.isNotBlank() && r.revokedByDeviceId.length <= MAX_MANIFEST_STRING &&158+        r.revokedAt >= 0L133159 134160 private fun revocationMap(r: DeviceRevocation): Map<String, Any> = linkedMapOf(135161     "deviceId" to r.deviceId,

@@ -304,7 +304,11 @@304304     ours.filter { (id, ts) -> ts > (peer[id] ?: 0L) }305305 306306 private fun warnOnSkew(localTime: Long, remoteTime: Long) {307-    if (kotlin.math.abs(localTime - remoteTime) > CLOCK_SKEW_WARN_MS) {307+    // Two-sided bounds — `abs(...) > window` wraps at `Long.MIN_VALUE` and308+    // would let a peer-supplied timestamp dodge the skew warn entirely. CLOCK_SKEW_WARN_MS309+    // is small relative to any sane wall-clock value, so no arithmetic on these two310+    // longs can overflow for realistic inputs.311+    if (remoteTime < localTime - CLOCK_SKEW_WARN_MS || remoteTime > localTime + CLOCK_SKEW_WARN_MS) {308312         android.util.Log.w("peach-sync", "clock skew detected: local=$localTime remote=$remoteTime")309313     }310314 }