diff options
| author | tv <tv@krebsco.de> | 2026-11-08 15:39:06 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 16:47:25 +0100 |
| commit | 05943dad70ce17ff61b8c0352abeec0964ca14f0 (patch) | |
| tree | 3ef8953eaa44493d393c786090d09acb34c8e3c9 /src/node.rs | |
| parent | 0f55d5741b3dfda617670f92a77c3cd6e462be6d (diff) | |
login: logins by key capped per user
Review 6: a node remembers the challenges used until they expire, 10 000
at most, and refused every login by key once full. One user holding a
key could make 10 000 logins within five minutes and keep everyone else
out.
A user may now log in by key at most --key-logins-per-user times (100)
on a node within a challenge's lifetime, past which that user waits and
others don't; the 10 000 stay as the cap for all users together. The
lifetime, five minutes until now, is --challenge-lifetime.
Diffstat (limited to 'src/node.rs')
| -rw-r--r-- | src/node.rs | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/node.rs b/src/node.rs index a5e512e..8886f68 100644 --- a/src/node.rs +++ b/src/node.rs @@ -75,6 +75,9 @@ pub(crate) struct NodeConfig { /// `--token-lifetime`, `--session-lifetime`. pub(crate) token_lifetime: Duration, pub(crate) session_lifetime: Duration, + /// `--challenge-lifetime`, `--key-logins-per-user`. + pub(crate) challenge_lifetime: Duration, + pub(crate) key_logins_per_user: usize, /// `--cors-origins`. pub(crate) cors_origins: Vec<String>, pub(crate) files: Arc<Files>, @@ -166,6 +169,8 @@ impl Node { challenges: Default::default(), token_lifetime: config.token_lifetime, session_lifetime: config.session_lifetime, + challenge_lifetime: config.challenge_lifetime, + key_logins_per_user: config.key_logins_per_user, cors_origins: Arc::new(config.cors_origins), state_file: config.state_file, document_file: config.document_file, |