Conrad Ludgate e5c50bb12b proxy: rate limit authentication by masked IPv6. (#7316) ...

## Problem

Many users have access to ipv6 subnets (eg a /64). That gives them 2^64
addresses to play with

## Summary of changes

Truncate the address to /64 to reduce the attack surface.

Todo:
~~Will NAT64 be an issue here? AFAIU they put the IPv4 address at the
end of the IPv6 address. By truncating we will lose all that detail.~~
It's the same problem as a host sharing IPv6 addresses between clients.
I don't think it's up to us to solve. If a customer is getting DDoSed,
then they likely need to arrange a dedicated IP with us.

2024-04-16 14:16:34 +00:00

..

backend

proxy: report metrics based on cold start info (#7324)

2024-04-05 16:14:50 +01:00

backend.rs

proxy: rate limit authentication by masked IPv6. (#7316)

2024-04-16 14:16:34 +00:00

credentials.rs

proxy: replace prometheus with measured (#6717)

2024-04-11 16:26:01 +00:00

flow.rs

proxy: simplify password validation (#7188)

2024-03-21 13:54:06 +00:00

password_hack.rs

proxy: add newtype wrappers for string based IDs (#6445)

2024-01-24 16:38:10 +00:00