pulse

mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-11 14:00:29 +00:00

Files

T

rcourtman 885a62e96b feat(security): Implement range-based rate limiting

Prevents multi-UID rate limit bypass attacks from containers. Previously,
attackers could create multiple users in a container (each mapped to
unique host UIDs 100000-165535) to bypass per-UID rate limits.

Implementation:
- Automatic detection of ID-mapped UID ranges from /etc/subuid and /etc/subgid
- Rate limits applied per-range for container UIDs
- Rate limits applied per-UID for host UIDs (backwards compatible)
- identifyPeer() checks if BOTH UID AND GID are in mapped ranges
- Metrics show peer='range:100000-165535' or peer='uid:0'

Security benefit: Entire container limited as single entity, preventing
100+ UIDs from bypassing rate controls.

New metrics:
- pulse_proxy_limiter_rejections_total{peer,reason}
- pulse_proxy_limiter_penalties_total{peer,reason}
- pulse_proxy_global_concurrency_inflight

Related to security audit 2025-11-07.

Co-authored-by: Codex <codex@openai.com>

2025-11-07 17:08:45 +00:00

audit_test.go

Make pulse-sensor-proxy resilient to read-only filesystems

2025-11-06 00:18:51 +00:00

audit.go

Make pulse-sensor-proxy resilient to read-only filesystems

2025-11-06 00:18:51 +00:00

auth_test.go

Automate sensor proxy container mount and auth

2025-10-14 12:41:48 +00:00

auth.go

feat(security): Implement range-based rate limiting