Make the public HTTP/UDP service safe under hostile inputs and abusive bursts.
Scope
Apply tenant/environment/session/protocol authorization to every HTTP and UDP path without existence oracles.
Add configurable rate/concurrency limits by tenant, principal, operation, IP/IPv6 prefix, listing, and global budget; avoid relying only on IP behind shared NAT.
HTTP limiting returns bounded typed 429; limited/invalid UDP is dropped.
An abusive-burst test proves recovery and bounded state.
Fuzz failures retain deterministic regression cases and seeds.
Captured logs/exceptions contain no credentials, tokens, raw endpoint data, or hostile markup.
Parent: #1
Depends on: #14
## Outcome
Make the public HTTP/UDP service safe under hostile inputs and abusive bursts.
## Scope
- Apply tenant/environment/session/protocol authorization to every HTTP and UDP path without existence oracles.
- Add configurable rate/concurrency limits by tenant, principal, operation, IP/IPv6 prefix, listing, and global budget; avoid relying only on IP behind shared NAT.
- Bound sessions, attempts, replay markers, endpoints, queues, metadata, request bodies, datagrams, retransmits, response sizes, and parsing work.
- Enforce anti-reflection/amplification and private-network-probe controls.
- Add property/fuzz tests for HTTP/UDP envelopes, capabilities/tickets, endpoints, metadata, and state transitions.
- Add cross-tenant, replay, role-swap, token-leak, credential-rotation, and abusive-load suites.
- Define shedding priorities that protect established leases and keep invalid UDP silent.
## Acceptance criteria
- Malformed/truncated/oversized input cannot crash the process or cause unbounded CPU, memory, bandwidth, queue, or allocation growth.
- UDP sends only to verified recent sources and remains within the documented amplification budget.
- Cross-tenant/object probes return non-disclosing errors.
- HTTP limiting returns bounded typed `429`; limited/invalid UDP is dropped.
- An abusive-burst test proves recovery and bounded state.
- Fuzz failures retain deterministic regression cases and seeds.
- Captured logs/exceptions contain no credentials, tokens, raw endpoint data, or hostile markup.
Starting implementation on a stacked branch from verified integration-harness commit 2ff7cd6.
I will first inventory existing isolation, replay, parser, amplification, and capacity controls against every acceptance criterion; then fill the missing rate/concurrency/shedding and hostile-input paths, add deterministic property/fuzz/burst recovery suites and security-safe diagnostics, document budgets, run adversarial review, and execute full Debug/Release hardening gates.
Starting implementation on a stacked branch from verified integration-harness commit `2ff7cd6`.
I will first inventory existing isolation, replay, parser, amplification, and capacity controls against every acceptance criterion; then fill the missing rate/concurrency/shedding and hostile-input paths, add deterministic property/fuzz/burst recovery suites and security-safe diagnostics, document budgets, run adversarial review, and execute full Debug/Release hardening gates.
Kyuubi
self-assigned this 2026-07-16 11:51:36 +02:00
Shipped in v1.0.0. The pre-release security review (2026-08-22) verified the hardening invariants closed by reading the release code paths: signature-before-decode, constant-time compares, canonical-encoding rejection, cross-tenant key scope binding, exact-length hostile-packet parsing, no UDP response to unverified endpoints, single-consumption introductions, HMAC-bound cursors, and rate limiting on every endpoint. Four minor non-blocking findings from that review are tracked separately: #33, #34, #35, #36.
Shipped in [v1.0.0](https://git.finalfactory.de/HeiKyu/Rendezvous/releases/tag/v1.0.0). The pre-release security review (2026-08-22) verified the hardening invariants closed by reading the release code paths: signature-before-decode, constant-time compares, canonical-encoding rejection, cross-tenant key scope binding, exact-length hostile-packet parsing, no UDP response to unverified endpoints, single-consumption introductions, HMAC-bound cursors, and rate limiting on every endpoint. Four minor non-blocking findings from that review are tracked separately: #33, #34, #35, #36.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Depends on: #14
Outcome
Make the public HTTP/UDP service safe under hostile inputs and abusive bursts.
Scope
Acceptance criteria
429; limited/invalid UDP is dropped.Starting implementation on a stacked branch from verified integration-harness commit
2ff7cd6.I will first inventory existing isolation, replay, parser, amplification, and capacity controls against every acceptance criterion; then fill the missing rate/concurrency/shedding and hostile-input paths, add deterministic property/fuzz/burst recovery suites and security-safe diagnostics, document budgets, run adversarial review, and execute full Debug/Release hardening gates.
Implemented issue #15 on
codex/issue-15-hostile-input-hardeningat commit88ef946(stacked on #14).Delivered:
0x152026,0x154A50,0x1557A7E), 20k concurrent burst, 10k steady-state allocation gate, 1k mutated state transitions, proxy spoofing, rotating-credential, cross-scope, tracker exhaustion/recovery, malformed/oversized, replay/role/rotation, and raw UDP tests;docs/security/abuse-protection.md.Verification:
dotnet format Rendezvous.slnx --verify-no-changes --no-restore: passgit diff --check: passThe issue remains open until the dependency stack is landed on the default branch and reconciled.
Shipped in v1.0.0. The pre-release security review (2026-08-22) verified the hardening invariants closed by reading the release code paths: signature-before-decode, constant-time compares, canonical-encoding rejection, cross-tenant key scope binding, exact-length hostile-packet parsing, no UDP response to unverified endpoints, single-consumption introductions, HMAC-bound cursors, and rate limiting on every endpoint. Four minor non-blocking findings from that review are tracked separately: #33, #34, #35, #36.