From 05943dad70ce17ff61b8c0352abeec0964ca14f0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 8 Nov 2026 15:39:06 +0000
Subject: login: logins by key capped per user

Review 6: a node remembers the challenges used until they expire, 10 000
at most, and refused every login by key once full. One user holding a
key could make 10 000 logins within five minutes and keep everyone else
out.

A user may now log in by key at most --key-logins-per-user times (100)
on a node within a challenge's lifetime, past which that user waits and
others don't; the 10 000 stay as the cap for all users together. The
lifetime, five minutes until now, is --challenge-lifetime.
---
 src/api/login.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/api/login.rs')

diff --git a/src/api/login.rs b/src/api/login.rs
index 4b42178..e3f8d02 100644
--- a/src/api/login.rs
+++ b/src/api/login.rs
@@ -283,7 +283,7 @@ pub(crate) async fn challenge(State(state): State<AppState>) -> Result<Response,
         .node_key
         .as_ref()
         .ok_or(ApiError(StatusCode::SERVICE_UNAVAILABLE, None))?;
-    let (challenge, exp) = challenge::issue(key, now);
+    let (challenge, exp) = challenge::issue(key, now, state.challenge_lifetime.as_millis() as u64);
     Ok(Json(json!({
         "challenge": challenge,
         "namespace": challenge::NAMESPACE,
@@ -340,6 +340,7 @@ pub(crate) async fn login_key(
             &request.user,
             now,
             &mut used,
+            state.key_logins_per_user,
         )
         .map_err(|why| {
             debug!(user = %request.user, reason = %why, "Refused a login by key");
-- 
cgit v1.3.1