feat(server): harden hostile input and overload behavior (#15)

src/FinalFactory.Rendezvous.Server/Program.cs

@@ -1,5 +1,6 @@
 using System.Net;
 using FinalFactory.Rendezvous.Contracts;
+using FinalFactory.Rendezvous.Server.Abuse;
 using FinalFactory.Rendezvous.Server.Browser;
 using FinalFactory.Rendezvous.Server.ConnectionOutcomes;
 using FinalFactory.Rendezvous.Server.Http;
@@ -8,6 +9,7 @@ using FinalFactory.Rendezvous.Server.Provisioning;
 using FinalFactory.Rendezvous.Server.Sessions;
 using FinalFactory.Rendezvous.Server.State;
 using FinalFactory.Rendezvous.Server.Transport;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.OpenApi;
 
 WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
@@ -96,6 +98,31 @@ builder.Services.AddOpenApi("v1", static options =>
                     [attemptReference] = [],
                 });
             }
+
+            foreach (OpenApiOperation operation in path.Operations.Values)
+            {
+                if (operation.Responses is null
+                    || !operation.Responses.TryGetValue(
+                        StatusCodes.Status429TooManyRequests.ToString(
+                            System.Globalization.CultureInfo.InvariantCulture),
+                        out IOpenApiResponse? response)
+                    || response is not OpenApiResponse concreteResponse)
+                {
+                    continue;
+                }
+
+                concreteResponse.Headers ??=
+                    new Dictionary<string, IOpenApiHeader>(StringComparer.OrdinalIgnoreCase);
+                concreteResponse.Headers["Retry-After"] = new OpenApiHeader
+                {
+                    Description = "Whole seconds before the caller should retry (1-60).",
+                    Schema = new OpenApiSchema
+                    {
+                        Type = JsonSchemaType.Integer,
+                        Format = "int32",
+                    },
+                };
+            }
         }
 
         return Task.CompletedTask;
@@ -107,6 +134,45 @@ builder.Services.Configure<RouteHandlerOptions>(static options =>
     options.ThrowOnBadRequest = true);
 builder.Services.AddProblemDetails();
 builder.Services.AddExceptionHandler<RendezvousExceptionHandler>();
+builder.WebHost.ConfigureKestrel(static options =>
+    options.Limits.MaxRequestBodySize = ContractLimits.HttpRequestMaxBytes);
+
+builder.Services
+    .AddOptions<AbuseProtectionOptions>()
+    .BindConfiguration(AbuseProtectionOptions.SectionName)
+    .ValidateDataAnnotations()
+    .Validate(
+        options => options.HttpOptionalRequestsPerWindow
+                   < options.HttpGlobalRequestsPerWindow,
+        "The optional HTTP request budget must leave global capacity for lease operations.")
+    .Validate(
+        options => options.HttpOptionalConcurrency < options.HttpGlobalConcurrency,
+        "The optional HTTP concurrency budget must leave global capacity for lease operations.")
+    .Validate(
+        options => options.HttpOptionalIpPrefixRequestsPerWindow
+                   < options.HttpIpPrefixRequestsPerWindow,
+        "The optional HTTP source budget must leave capacity for lease operations.")
+    .Validate(
+        options => options.HttpOptionalIpPrefixConcurrency
+                   < options.HttpIpPrefixConcurrency,
+        "The optional HTTP source concurrency must leave capacity for lease operations.")
+    .Validate(
+        options => options.CriticalTrackedKeyReserve >= 16
+                   && options.UdpTrackedKeyLimit + options.CriticalTrackedKeyReserve
+                   < options.MaxTrackedKeys,
+        "The tracked-key reserve must leave at least 16 keys for critical operations.")
+    .Validate(
+        options => options.TrustedProxyAddresses is { Length: <= 32 } addresses
+                   && addresses.All(
+                       static value => IPAddress.TryParse(value, out _)),
+        "Trusted proxy addresses must contain at most 32 literal IP addresses.")
+    .ValidateOnStart();
+builder.Services.AddSingleton<AbuseProtectionService>();
+AbuseProtectionOptions configuredAbuseProtection = builder.Configuration
+    .GetSection(AbuseProtectionOptions.SectionName)
+    .Get<AbuseProtectionOptions>() ?? new AbuseProtectionOptions();
+builder.Services.Configure<ForwardedHeadersOptions>(options =>
+    TrustedProxyForwarding.Configure(options, configuredAbuseProtection));
 
 SystemRendezvousClock rendezvousClock = new();
 EphemeralStoreOptions stateOptions = new();
@@ -176,13 +242,19 @@ if (!isOpenApiGeneration)
 WebApplication app = builder.Build();
 app.Lifetime.ApplicationStopping.Register(() => stateStore.BeginDrain());
 
+if (TrustedProxyForwarding.IsEnabled(configuredAbuseProtection))
+{
+    app.UseForwardedHeaders();
+}
 app.UseExceptionHandler();
+app.UseMiddleware<HttpAbuseProtectionMiddleware>();
 app.MapOpenApi();
 app.MapRendezvousContractEndpoints();
 app.MapGet(
         "/health/live",
         static () => Results.Ok(new HealthResponse { Status = "live" }))
     .Produces<HealthResponse>()
+    .Produces<ApiError>(StatusCodes.Status429TooManyRequests)
     .WithName("GetLiveness")
     .WithTags("Health");
 app.MapGet(
@@ -198,6 +270,7 @@ app.MapGet(
         ? Results.StatusCode(StatusCodes.Status503ServiceUnavailable)
         : Results.Ok(new HealthResponse { Status = "ready" }))
     .Produces<HealthResponse>()
+    .Produces<ApiError>(StatusCodes.Status429TooManyRequests)
     .Produces(StatusCodes.Status503ServiceUnavailable)
     .WithName("GetReadiness")
     .WithTags("Health");