HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Harden tenant isolation, rate limits, replay defense, parsers, and overload behavior #15

New Issue
Open
opened 2026-07-15 10:04:25 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:25 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #14

Outcome

Make the public HTTP/UDP service safe under hostile inputs and abusive bursts.

Scope

  • Apply tenant/environment/session/protocol authorization to every HTTP and UDP path without existence oracles.
  • Add configurable rate/concurrency limits by tenant, principal, operation, IP/IPv6 prefix, listing, and global budget; avoid relying only on IP behind shared NAT.
  • Bound sessions, attempts, replay markers, endpoints, queues, metadata, request bodies, datagrams, retransmits, response sizes, and parsing work.
  • Enforce anti-reflection/amplification and private-network-probe controls.
  • Add property/fuzz tests for HTTP/UDP envelopes, capabilities/tickets, endpoints, metadata, and state transitions.
  • Add cross-tenant, replay, role-swap, token-leak, credential-rotation, and abusive-load suites.
  • Define shedding priorities that protect established leases and keep invalid UDP silent.

Acceptance criteria

  • Malformed/truncated/oversized input cannot crash the process or cause unbounded CPU, memory, bandwidth, queue, or allocation growth.
  • UDP sends only to verified recent sources and remains within the documented amplification budget.
  • Cross-tenant/object probes return non-disclosing errors.
  • HTTP limiting returns bounded typed 429; limited/invalid UDP is dropped.
  • An abusive-burst test proves recovery and bounded state.
  • Fuzz failures retain deterministic regression cases and seeds.
  • Captured logs/exceptions contain no credentials, tokens, raw endpoint data, or hostile markup.
Parent: #1 Depends on: #14 ## Outcome Make the public HTTP/UDP service safe under hostile inputs and abusive bursts. ## Scope - Apply tenant/environment/session/protocol authorization to every HTTP and UDP path without existence oracles. - Add configurable rate/concurrency limits by tenant, principal, operation, IP/IPv6 prefix, listing, and global budget; avoid relying only on IP behind shared NAT. - Bound sessions, attempts, replay markers, endpoints, queues, metadata, request bodies, datagrams, retransmits, response sizes, and parsing work. - Enforce anti-reflection/amplification and private-network-probe controls. - Add property/fuzz tests for HTTP/UDP envelopes, capabilities/tickets, endpoints, metadata, and state transitions. - Add cross-tenant, replay, role-swap, token-leak, credential-rotation, and abusive-load suites. - Define shedding priorities that protect established leases and keep invalid UDP silent. ## Acceptance criteria - Malformed/truncated/oversized input cannot crash the process or cause unbounded CPU, memory, bandwidth, queue, or allocation growth. - UDP sends only to verified recent sources and remains within the documented amplification budget. - Cross-tenant/object probes return non-disclosing errors. - HTTP limiting returns bounded typed `429`; limited/invalid UDP is dropped. - An abusive-burst test proves recovery and bounded state. - Fuzz failures retain deterministic regression cases and seeds. - Captured logs/exceptions contain no credentials, tokens, raw endpoint data, or hostile markup.
Kyuubi commented 2026-07-16 11:51:35 +02:00
Author
Owner
Copy Link
Copy Source

Starting implementation on a stacked branch from verified integration-harness commit 2ff7cd6.

I will first inventory existing isolation, replay, parser, amplification, and capacity controls against every acceptance criterion; then fill the missing rate/concurrency/shedding and hostile-input paths, add deterministic property/fuzz/burst recovery suites and security-safe diagnostics, document budgets, run adversarial review, and execute full Debug/Release hardening gates.

Starting implementation on a stacked branch from verified integration-harness commit `2ff7cd6`. I will first inventory existing isolation, replay, parser, amplification, and capacity controls against every acceptance criterion; then fill the missing rate/concurrency/shedding and hostile-input paths, add deterministic property/fuzz/burst recovery suites and security-safe diagnostics, document budgets, run adversarial review, and execute full Debug/Release hardening gates.
Kyuubi self-assigned this 2026-07-16 11:51:36 +02:00
Kyuubi commented 2026-07-16 12:38:01 +02:00
Author
Owner
Copy Link
Copy Source

Implemented issue #15 on codex/issue-15-hostile-input-hardening at commit 88ef946 (stacked on #14).

Delivered:

  • bounded two-stage HTTP and UDP admission across global, operation, IPv4 /24 / IPv6 /56, tenant, principal/capability, source+resource, scoped resource, health, and concurrency dimensions;
  • lease-critical global/source/tracker reserves plus separate HTTP/UDP locks and cardinality partitions;
  • default-deny, exact-IP, single-hop trusted proxy forwarding;
  • 16 KiB Kestrel/body enforcement, stable typed 413/429 responses, bounded Retry-After in body/header, and generated OpenAPI coverage;
  • raw UDP admission before parsing, independent frozen/LiteNet operation budgets, silent shedding, verified-source-only mediation, and retained amplification/private-candidate controls;
  • deterministic hostile corpora (seeds 0x152026, 0x154A50, 0x1557A7E), 20k concurrent burst, 10k steady-state allocation gate, 1k mutated state transitions, proxy spoofing, rotating-credential, cross-scope, tracker exhaustion/recovery, malformed/oversized, replay/role/rotation, and raw UDP tests;
  • operator configuration and security guidance in docs/security/abuse-protection.md.

Verification:

  • dotnet format Rendezvous.slnx --verify-no-changes --no-restore: pass
  • Debug build + full tests: 237/237 pass
  • Release build + full tests: 237/237 pass
  • generated OpenAPI compatibility: pass
  • real HTTP/UDP/process and always-on integration suites: pass
  • adversarial correctness/security, API/architecture, and test/performance re-audits: no remaining P0-P2 findings
  • git diff --check: pass

The issue remains open until the dependency stack is landed on the default branch and reconciled.

Implemented issue #15 on `codex/issue-15-hostile-input-hardening` at commit `88ef946` (stacked on #14). Delivered: - bounded two-stage HTTP and UDP admission across global, operation, IPv4 /24 / IPv6 /56, tenant, principal/capability, source+resource, scoped resource, health, and concurrency dimensions; - lease-critical global/source/tracker reserves plus separate HTTP/UDP locks and cardinality partitions; - default-deny, exact-IP, single-hop trusted proxy forwarding; - 16 KiB Kestrel/body enforcement, stable typed 413/429 responses, bounded Retry-After in body/header, and generated OpenAPI coverage; - raw UDP admission before parsing, independent frozen/LiteNet operation budgets, silent shedding, verified-source-only mediation, and retained amplification/private-candidate controls; - deterministic hostile corpora (seeds `0x152026`, `0x154A50`, `0x1557A7E`), 20k concurrent burst, 10k steady-state allocation gate, 1k mutated state transitions, proxy spoofing, rotating-credential, cross-scope, tracker exhaustion/recovery, malformed/oversized, replay/role/rotation, and raw UDP tests; - operator configuration and security guidance in `docs/security/abuse-protection.md`. Verification: - `dotnet format Rendezvous.slnx --verify-no-changes --no-restore`: pass - Debug build + full tests: 237/237 pass - Release build + full tests: 237/237 pass - generated OpenAPI compatibility: pass - real HTTP/UDP/process and always-on integration suites: pass - adversarial correctness/security, API/architecture, and test/performance re-audits: no remaining P0-P2 findings - `git diff --check`: pass The issue remains open until the dependency stack is landed on the default branch and reconciled.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#15
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?