perf: sync protocol and core hardening updates

internal/rpc/temp_key_cache.go

@@ -6,7 +6,7 @@ import (
 	"time"
 )
 
-const defaultTempKeyResolveCacheMaxEntries = 4096
+const defaultTempKeyResolveCacheMaxEntries = 262144
 
 type tempKeyResolveEntry struct {
 	perm     [8]byte
@@ -22,6 +22,7 @@ type tempKeyResolveCache struct {
 	mu      sync.Mutex
 	max     int
 	entries map[[8]byte]*list.Element
+	byPerm  map[[8]byte]map[[8]byte]struct{}
 	order   *list.List
 }
 
@@ -30,8 +31,12 @@ func newTempKeyResolveCache(maxEntries int) *tempKeyResolveCache {
 		maxEntries = defaultTempKeyResolveCacheMaxEntries
 	}
 	return &tempKeyResolveCache{
-		max:     maxEntries,
-		entries: make(map[[8]byte]*list.Element, maxEntries),
+		max: maxEntries,
+		// maxEntries is an eviction ceiling, not an expected steady-state population.  A
+		// capacity hint of 262k eagerly reserves a large hash table for every Router even when
+		// PFS/temp keys are never used; let the map grow lazily with actual bindings instead.
+		entries: make(map[[8]byte]*list.Element),
+		byPerm:  make(map[[8]byte]map[[8]byte]struct{}),
 		order:   list.New(),
 	}
 }
@@ -55,20 +60,25 @@ func (c *tempKeyResolveCache) Get(rawAuthKeyID, expectedPermAuthKeyID [8]byte, n
 	return item.entry.perm, true
 }
 
-func (c *tempKeyResolveCache) Store(rawAuthKeyID, permAuthKeyID [8]byte, expireAt, now time.Time) {
+func (c *tempKeyResolveCache) Store(rawAuthKeyID, permAuthKeyID [8]byte, expireAt, _ time.Time) {
 	if c == nil || c.max <= 0 || rawAuthKeyID == ([8]byte{}) || permAuthKeyID == ([8]byte{}) {
 		return
 	}
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	if el := c.entries[rawAuthKeyID]; el != nil {
+		old := el.Value.(tempKeyResolveCacheItem)
+		if old.entry.perm != permAuthKeyID {
+			c.removeReverseLocked(old.raw, old.entry.perm)
+			c.addReverseLocked(rawAuthKeyID, permAuthKeyID)
+		}
 		el.Value = tempKeyResolveCacheItem{raw: rawAuthKeyID, entry: tempKeyResolveEntry{perm: permAuthKeyID, expireAt: expireAt}}
 		c.order.MoveToBack(el)
 		return
 	}
-	c.evictExpiredLocked(now)
 	el := c.order.PushBack(tempKeyResolveCacheItem{raw: rawAuthKeyID, entry: tempKeyResolveEntry{perm: permAuthKeyID, expireAt: expireAt}})
 	c.entries[rawAuthKeyID] = el
+	c.addReverseLocked(rawAuthKeyID, permAuthKeyID)
 	for len(c.entries) > c.max {
 		c.removeElementLocked(c.order.Front())
 	}
@@ -91,35 +101,43 @@ func (c *tempKeyResolveCache) DeleteByPerm(permAuthKeyID [8]byte) [][8]byte {
 	}
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	rawAuthKeyIDs := make([][8]byte, 0)
-	for el := c.order.Front(); el != nil; {
-		next := el.Next()
-		item := el.Value.(tempKeyResolveCacheItem)
-		if item.entry.perm == permAuthKeyID {
-			rawAuthKeyIDs = append(rawAuthKeyIDs, item.raw)
+	raws := c.byPerm[permAuthKeyID]
+	rawAuthKeyIDs := make([][8]byte, 0, len(raws))
+	for raw := range raws {
+		rawAuthKeyIDs = append(rawAuthKeyIDs, raw)
+		if el := c.entries[raw]; el != nil {
 			c.removeElementLocked(el)
 		}
-		el = next
 	}
 	return rawAuthKeyIDs
 }
 
-func (c *tempKeyResolveCache) evictExpiredLocked(now time.Time) {
-	for el := c.order.Front(); el != nil; {
-		next := el.Next()
-		item := el.Value.(tempKeyResolveCacheItem)
-		if !item.entry.expireAt.After(now) {
-			c.removeElementLocked(el)
-		}
-		el = next
-	}
-}
-
 func (c *tempKeyResolveCache) removeElementLocked(el *list.Element) {
 	if el == nil {
 		return
 	}
 	item := el.Value.(tempKeyResolveCacheItem)
 	delete(c.entries, item.raw)
+	c.removeReverseLocked(item.raw, item.entry.perm)
 	c.order.Remove(el)
 }
+
+func (c *tempKeyResolveCache) addReverseLocked(raw, perm [8]byte) {
+	raws := c.byPerm[perm]
+	if raws == nil {
+		raws = make(map[[8]byte]struct{})
+		c.byPerm[perm] = raws
+	}
+	raws[raw] = struct{}{}
+}
+
+func (c *tempKeyResolveCache) removeReverseLocked(raw, perm [8]byte) {
+	raws := c.byPerm[perm]
+	if raws == nil {
+		return
+	}
+	delete(raws, raw)
+	if len(raws) == 0 {
+		delete(c.byPerm, perm)
+	}
+}