From patchwork Sun Apr 22 09:37:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Pritz X-Patchwork-Id: 498 Return-Path: Delivered-To: patchwork@archlinux.org Received: from apollo.archlinux.org (localhost [127.0.0.1]) by apollo.archlinux.org (Postfix) with ESMTP id 5048E376396F for ; Sun, 22 Apr 2018 09:37:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on apollo.archlinux.org X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=DKIM_SIGNED=0.1, DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_MED=-2.3 autolearn=ham autolearn_force=no version=3.4.1 X-Spam-BL-Results: [127.0.9.2] Received: from orion.archlinux.org (orion.archlinux.org [IPv6:2a01:4f8:160:6087::1]) by apollo.archlinux.org (Postfix) with ESMTPS for ; Sun, 22 Apr 2018 09:37:49 +0000 (UTC) Received: from orion.archlinux.org (localhost [127.0.0.1]) by orion.archlinux.org (Postfix) with ESMTP id DECF39FDACC34; Sun, 22 Apr 2018 09:37:38 +0000 (UTC) Received: from luna.archlinux.org (luna.archlinux.org [IPv6:2a01:4f8:160:3033::2]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by orion.archlinux.org (Postfix) with ESMTPS; Sun, 22 Apr 2018 09:37:38 +0000 (UTC) Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id B6FDD2CE11; Sun, 22 Apr 2018 09:37:38 +0000 (UTC) Authentication-Results: luna.archlinux.org; dkim=pass (4096-bit key) header.d=xinu.at header.i=@xinu.at header.b=LZTwR+p7 Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id 90DED2B999 for ; Sun, 22 Apr 2018 09:37:35 +0000 (UTC) Received: from orion.archlinux.org (orion.archlinux.org [IPv6:2a01:4f8:160:6087::1]) by luna.archlinux.org (Postfix) with ESMTPS for ; Sun, 22 Apr 2018 09:37:35 +0000 (UTC) Received: from orion.archlinux.org (localhost [127.0.0.1]) by orion.archlinux.org (Postfix) with ESMTP id 013EA9FDACC30 for ; Sun, 22 Apr 2018 09:37:25 +0000 (UTC) Received: from karif.server-speed.net (karif.server-speed.net [78.46.56.141]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by orion.archlinux.org (Postfix) with ESMTPS for ; Sun, 22 Apr 2018 09:37:24 +0000 (UTC) Received: from localhost (karif.server-speed.net [127.0.0.1]) by karif.server-speed.net (Postfix) with ESMTP id D2463145240 for ; Sun, 22 Apr 2018 11:37:24 +0200 (CEST) Received: from karif.server-speed.net ([127.0.0.1]) by localhost (karif.server-speed.net [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id fRKZO94i4u3x for ; Sun, 22 Apr 2018 11:37:17 +0200 (CEST) Received: from localhost (masked-submission-client.localhost [127.0.0.1]) by karif.server-speed.net (Postfix) with ESMTPSA id B5EA414523C for ; Sun, 22 Apr 2018 11:37:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=xinu.at; s=main; t=1524389837; bh=hmzV+ogsQwbUnsXLc7yqpv8OM0RmrKpWZDaNAUMe/bA=; h=From:To:Subject:Date; b=LZTwR+p78R6G3X2+DnxnCTpNYNxosTGfxWv4A8pnzfOeIfCH/qGuHoz4wquDyPl/b kLiBbVOaxRhu0Nss9LEfH7dM/yK7e9RKX3d3jmAJGpd2T9m/czoji3qTu9gFGB4YB1 wfBcf6JKA70aB2sB3DIQaFtx8BeoR014lyGB65BzYqlM1pPXXDH0Z0GHdKiJqlfiU2 +4n8skSBauHfvIVg0nl3lov9Nx0OO4U+VMhUxzCH7+sb2OgMQNzXiLzqUSvZjshVkr 8XjW5RN0U4hUu/WbeG0u3qxghC2Loimh+hVIq+FSgpSg6oeUoXcGNCR5oqsWSY/Zz2 XHmYIT2qkzYmlRDLe2lyiWzq2QZPEugVd4CiM7IVH4Sw4fDfg5IxCyg010jvV3AUvJ uNJP9omVLIzeoAeMnQK1bIJEs96110BpaEJV/nsDR+M42tKw0o5lvKlOl1cnKYQbSO j4dpnIVF4T+pxvH4nDK85qhz7WLTZU28Cgb9+ul797+DmPDGy4QF+ZKkZSY/4BWnBu sikvUpT7l5Zzfkhwav4rwyF9sTKyjT+jEU+78g2U96F75pWN1X7wyvqdaAmcdkaYUy c/joj2HeKncxwic5xcH4KQMgiRb54+54nt5tXTW0csIgCfyA9+pU3EGDENXg4/5yqJ ++xH5igKiTIl48rniFzqUlpk= From: Florian Pritz To: aur-dev@archlinux.org Subject: [PATCH] Hash IP for API rate limit Date: Sun, 22 Apr 2018 11:37:17 +0200 Message-Id: <20180422093717.5751-1-bluewind@xinu.at> X-Mailer: git-send-email 2.17.0 X-BeenThere: aur-dev@archlinux.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: "Arch User Repository \(AUR\) Development" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: aur-dev-bounces@archlinux.org Sender: "aur-dev" The hash uses the start of a fixed window as an HMAC key. Therefore the windows stored in the DB also use this so that there can only be one active window for each IP. Signed-off-by: Florian Pritz --- schema/aur-schema.sql | 2 +- upgrading/4.7.0.txt | 2 +- web/lib/aurjson.class.php | 12 +++++++----- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index 79de3f2..45f8993 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -403,7 +403,7 @@ CREATE TABLE AcceptedTerms ( -- Rate limits for API -- CREATE TABLE `ApiRateLimit` ( - IP VARCHAR(45) NOT NULL, + IP VARCHAR(255) NOT NULL, Requests INT(11) NOT NULL, WindowStart BIGINT(20) NOT NULL, PRIMARY KEY (`ip`) diff --git a/upgrading/4.7.0.txt b/upgrading/4.7.0.txt index 820e454..fcdbb4d 100644 --- a/upgrading/4.7.0.txt +++ b/upgrading/4.7.0.txt @@ -2,7 +2,7 @@ --- CREATE TABLE `ApiRateLimit` ( - IP VARCHAR(45) NOT NULL, + IP VARCHAR(255) NOT NULL, Requests INT(11) NOT NULL, WindowStart BIGINT(20) NOT NULL, PRIMARY KEY (`ip`) diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index c51e9c2..168c6b7 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -153,6 +153,9 @@ private function check_ratelimit($ip) { } $window_length = config_get("ratelimit", "window_length"); + $hmac_key = floor(time() / ($window_length)); + $ip = hash_hmac("sha256", $ip, $hmac_key); + $this->update_ratelimit($ip); $stmt = $this->dbh->prepare(" SELECT Requests FROM ApiRateLimit @@ -181,14 +184,13 @@ private function check_ratelimit($ip) { private function update_ratelimit($ip) { $window_length = config_get("ratelimit", "window_length"); $db_backend = config_get("database", "backend"); - $time = time(); + $window_start = floor(time() / ($window_length)); // Clean up old windows - $deletion_time = $time - $window_length; $stmt = $this->dbh->prepare(" DELETE FROM ApiRateLimit WHERE WindowStart < :time"); - $stmt->bindParam(":time", $deletion_time); + $stmt->bindParam(":time", $window_start); $stmt->execute(); if ($db_backend == "mysql") { @@ -198,7 +200,7 @@ private function update_ratelimit($ip) { VALUES (:ip, 1, :window_start) ON DUPLICATE KEY UPDATE Requests=Requests+1"); $stmt->bindParam(":ip", $ip); - $stmt->bindParam(":window_start", $time); + $stmt->bindParam(":window_start", $window_start); $stmt->execute(); } elseif ($db_backend == "sqlite") { $stmt = $this->dbh->prepare(" @@ -206,7 +208,7 @@ private function update_ratelimit($ip) { (IP, Requests, WindowStart) VALUES (:ip, 0, :window_start);"); $stmt->bindParam(":ip", $ip); - $stmt->bindParam(":window_start", $time); + $stmt->bindParam(":window_start", $window_start); $stmt->execute(); $stmt = $this->dbh->prepare("