#79 findings 2+3 (HIGH): global cross-MXID rate limiting + fair pending-table admission #84

New issue

Closed

opened 2026-07-11 09:08:05 +00:00 by robocub · 1 comment

robocub commented

2026-07-11 09:08:05 +00:00

Collaborator

From the #79 review. Partially addressed: validate_management now REQUIRES max_tenants_per_owner / max_tenants_per_guild / max_link_attempts when open_registration is on (commit 40135f6), closing the "knobs off = zero limiting" footgun and bounding a single MXID. Residual (not fixed): the remaining budgets are all keyed on the sender MXID, so a federated-MXID Sybil swarm gets fresh budget per identity and can still (a) fill the global 16-slot PENDING_LINK_CAP to freeze all honest onboarding, and (b) accumulate link-probe joins / DM invites without bound on the single shared process (memory/sync growth).

Fix

A GLOBAL (not per-sender) rate limit + hard cap on link-probe joins and invite auto-joins.
Fair pending-table admission: reserve headroom so no single owner / source homeserver-domain can occupy the whole PENDING_LINK_CAP; expire idle-unapproved entries faster when near-full.
Consider a per-source-homeserver-domain budget (federated MXIDs are cheap; domains are less so).

Severity HIGH (DoS). Related: #77, and the process-per-tenant isolation item from #47.

From the #79 review. **Partially addressed:** validate_management now REQUIRES max_tenants_per_owner / max_tenants_per_guild / max_link_attempts when open_registration is on (commit 40135f6), closing the "knobs off = zero limiting" footgun and bounding a single MXID. **Residual (not fixed):** the remaining budgets are all keyed on the sender MXID, so a federated-MXID Sybil swarm gets fresh budget per identity and can still (a) fill the global 16-slot PENDING_LINK_CAP to freeze all honest onboarding, and (b) accumulate link-probe joins / DM invites without bound on the single shared process (memory/sync growth). ## Fix - A GLOBAL (not per-sender) rate limit + hard cap on link-probe joins and invite auto-joins. - Fair pending-table admission: reserve headroom so no single owner / source homeserver-domain can occupy the whole PENDING_LINK_CAP; expire idle-unapproved entries faster when near-full. - Consider a per-source-homeserver-domain budget (federated MXIDs are cheap; domains are less so). Severity HIGH (DoS). Related: #77, and the process-per-tenant isolation item from #47.

robocub referenced this issue

2026-07-11 09:08:28 +00:00

Pre-launch adversarial security + abuse review of the open-registration surface (run on Fable) #79

robocub referenced this issue from a commit

2026-07-11 16:19:23 +00:00

fix(mgmt,config): #83/#84/#85 open-registration hardening (core)

robocub referenced this issue from a commit

2026-07-11 16:26:35 +00:00

fix(mgmt,config): #83/#84/#85 open-registration hardening (core)

robocub referenced this issue

2026-07-11 16:51:02 +00:00

#84 residual: per-homeserver-domain fair-pending sub-cap #88

robocub referenced this issue

2026-07-11 16:51:02 +00:00

#85 residual: per-sender invite cooldown + idle DM-room TTL leave #89

robocub commented

2026-07-11 16:51:31 +00:00

Author

Collaborator

Core fixed + shipped in v0.3.0-alpha.18 (deployed 2026-07-11). New [limits] max_global_link_attempts (+ global_link_window_secs, default 60s) — a single cross-MXID sliding window on link-probes + invite auto-joins, required when open_registration is on, so federated-MXID churn can't reset the budget. The per-owner cooldown/link-attempt maps are now swept to bound memory. Residual (per-homeserver-domain fair-pending sub-cap) tracked in #88.

Core fixed + shipped in **v0.3.0-alpha.18** (deployed 2026-07-11). New `[limits] max_global_link_attempts` (+ `global_link_window_secs`, default 60s) — a single cross-MXID sliding window on link-probes + invite auto-joins, **required when open_registration is on**, so federated-MXID churn can't reset the budget. The per-owner cooldown/link-attempt maps are now swept to bound memory. Residual (per-homeserver-domain fair-pending sub-cap) tracked in #88.

robocub closed this issue

2026-07-11 16:51:31 +00:00