Finding
The router attaches only CorsLayer::permissive() and TraceLayer. There is no request-timeout layer, no global concurrency limit, and no request-body-size limit. A single request that triggers a slow or never-returning operation (e.g. probing an attacker-supplied unresponsive serial device via ?port=) occupies its task/connection indefinitely, and the number of simultaneously in-flight requests is unbounded.
Evidence
crates/akroasis-server/src/router.rs:23 and :24 are the only layers applied:
.layer(CorsLayer::permissive())
.layer(TraceLayer::new_for_http())No TimeoutLayer, ConcurrencyLimitLayer, or RequestBodyLimitLayer is present, and the API is unauthenticated.
Why this matters
Under the threat model the API is open to a LAN/OTA adversary on a counter-surveillance device. Without a per-request timeout, a malicious ?port= value (or any slow downstream call) pins a worker forever; without a concurrency cap, an attacker can open unbounded simultaneous requests, exhausting memory and threads. This is a low-cost unauthenticated denial-of-service amplifier layered on top of the blocking-dispatch issue, and a DoS against a sovereign phone's control plane is a surveillance opening (forced degradation, fallback to a compromised channel).
Desired correction
Apply backpressure and bounds at the router. Done when: the router enforces a request TimeoutLayer and a global ConcurrencyLimitLayer (and a RequestBodyLimitLayer) so no single unauthenticated request can occupy a worker indefinitely or drive unbounded resource use.
Finding
The router attaches only
CorsLayer::permissive()andTraceLayer. There is no request-timeout layer, no global concurrency limit, and no request-body-size limit. A single request that triggers a slow or never-returning operation (e.g. probing an attacker-supplied unresponsive serial device via?port=) occupies its task/connection indefinitely, and the number of simultaneously in-flight requests is unbounded.Evidence
crates/akroasis-server/src/router.rs:23and:24are the only layers applied:No
TimeoutLayer,ConcurrencyLimitLayer, orRequestBodyLimitLayeris present, and the API is unauthenticated.Why this matters
Under the threat model the API is open to a LAN/OTA adversary on a counter-surveillance device. Without a per-request timeout, a malicious
?port=value (or any slow downstream call) pins a worker forever; without a concurrency cap, an attacker can open unbounded simultaneous requests, exhausting memory and threads. This is a low-cost unauthenticated denial-of-service amplifier layered on top of the blocking-dispatch issue, and a DoS against a sovereign phone's control plane is a surveillance opening (forced degradation, fallback to a compromised channel).Desired correction
Apply backpressure and bounds at the router. Done when: the router enforces a request
TimeoutLayerand a globalConcurrencyLimitLayer(and aRequestBodyLimitLayer) so no single unauthenticated request can occupy a worker indefinitely or drive unbounded resource use.