Esa Kataja
eb95bd0a03
The deployment is a public hostname behind Traefik rather than a LAN-only box, which changes two things. TLS is now terminated by the proxy, so Basic credentials are no longer in cleartext. The container publishes no ports: doing so would leave an unencrypted copy of the app on the host, bypassing the proxy. The hostname lives in .env rather than compose.yaml, so no infrastructure detail is committed and the MIT publication option stays open. The password is now the only thing between the internet and the app, and a 500 ms sleep is not a defence at that exposure. Wrong guesses are rate limited per client address: five in a burst, then one per ten seconds, answered with 429. Two details that decide whether this works at all: - a request with no Authorization header is not charged. That is the handshake every browser session opens with, and counting it would lock the household out for simply opening the app a few times. - X-Forwarded-For is believed only when the connection arrived from a private address, i.e. through the proxy, and then only its last entry, which is the one the proxy observed. A direct client could otherwise forge a fresh address per attempt and walk past the limiter entirely. None of this substitutes for a strong password. It removes brute force as a practical route, nothing more. PRD §3, §9 and §10 are updated: "no external internet exposure" is no longer true.
112 lines
2.9 KiB
Go
112 lines
2.9 KiB
Go
package main
|
|
|
|
import (
|
|
"net"
|
|
"net/http"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
"golang.org/x/time/rate"
|
|
)
|
|
|
|
// The app is reachable from the internet, so a shared password needs more
|
|
// than a sleep in front of it. These allow a family fumbling the password a
|
|
// handful of quick retries, then roughly six a minute — useless for guessing,
|
|
// unnoticeable to anyone who knows it.
|
|
//
|
|
// This buys time; it is not the defence. A strong password is.
|
|
const (
|
|
guessBurst = 5
|
|
guessInterval = 10 * time.Second
|
|
|
|
// Bounds on the per-IP table, so a spray across many addresses cannot
|
|
// grow it without limit.
|
|
throttleMaxEntries = 4096
|
|
throttleIdle = 15 * time.Minute
|
|
)
|
|
|
|
type visitor struct {
|
|
limiter *rate.Limiter
|
|
seen time.Time
|
|
}
|
|
|
|
// throttle rate-limits failed password attempts per client address.
|
|
//
|
|
// ponytail: one mutex over one map. At household traffic this will never be
|
|
// contended; shard it if that ever stops being true.
|
|
type throttle struct {
|
|
mu sync.Mutex
|
|
visitors map[string]*visitor
|
|
}
|
|
|
|
func newThrottle() *throttle {
|
|
return &throttle{visitors: make(map[string]*visitor)}
|
|
}
|
|
|
|
// allow reports whether another wrong guess from this address is permitted.
|
|
func (t *throttle) allow(ip string) bool {
|
|
now := time.Now()
|
|
|
|
t.mu.Lock()
|
|
defer t.mu.Unlock()
|
|
|
|
if len(t.visitors) >= throttleMaxEntries {
|
|
t.pruneLocked(now)
|
|
}
|
|
|
|
v := t.visitors[ip]
|
|
if v == nil {
|
|
v = &visitor{limiter: rate.NewLimiter(rate.Every(guessInterval), guessBurst)}
|
|
t.visitors[ip] = v
|
|
}
|
|
v.seen = now
|
|
|
|
return v.limiter.Allow()
|
|
}
|
|
|
|
func (t *throttle) pruneLocked(now time.Time) {
|
|
for ip, v := range t.visitors {
|
|
if now.Sub(v.seen) > throttleIdle {
|
|
delete(t.visitors, ip)
|
|
}
|
|
}
|
|
// Still full of live entries: a spray is in progress. Drop the lot rather
|
|
// than grow without bound. Everyone gets a fresh allowance, which is the
|
|
// safe direction to fail — the password is still required.
|
|
if len(t.visitors) >= throttleMaxEntries {
|
|
clear(t.visitors)
|
|
}
|
|
}
|
|
|
|
// clientIP resolves the address to rate-limit against.
|
|
//
|
|
// X-Forwarded-For is only believed when the connection itself came from a
|
|
// private address, meaning it arrived through the reverse proxy on the
|
|
// container network. A client connecting directly could otherwise forge a
|
|
// fresh address on every attempt and walk straight past the limiter.
|
|
func clientIP(r *http.Request) string {
|
|
host, _, err := net.SplitHostPort(r.RemoteAddr)
|
|
if err != nil {
|
|
host = r.RemoteAddr
|
|
}
|
|
|
|
ip := net.ParseIP(host)
|
|
if ip == nil || !(ip.IsPrivate() || ip.IsLoopback()) {
|
|
return host
|
|
}
|
|
|
|
forwarded := r.Header.Get("X-Forwarded-For")
|
|
if forwarded == "" {
|
|
return host
|
|
}
|
|
// The nearest proxy appends the address it saw, so the last entry is the
|
|
// trustworthy one; anything before it was supplied by the client.
|
|
parts := strings.Split(forwarded, ",")
|
|
last := strings.TrimSpace(parts[len(parts)-1])
|
|
if net.ParseIP(last) == nil {
|
|
return host
|
|
}
|
|
return last
|
|
}
|