mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-08-03 13:56:12 +00:00
Code Issues Releases Wiki Activity

Harden EPP connection limits and idle timeouts (#3179)

Browse Source 
This change hardens the EPP GKE entry point against a connection hoarding Denial of Service (DoS) vulnerability (b/534930905).
We resolve this by restricting pre-login connections to a short idle timeout and enforcing pod-local connection caps:
1. Removed certificate-based connection quota tracking. IP limits are now enforced pre-login, and authenticated Registrar ID limits are enforced post-login.
2. Implemented a 10-second scheduled timeout task during the pre-login phase. If the client does not successfully authenticate within 10 seconds of TLS handshake completion, they are disconnected.
3. Added a new response header 'Nomulus-Logged-In-Registrar' set by the backend EppRequestHandler upon successful login. EppServiceHandler monitors this header inline to perform registrar quota upgrades and cancel the pre-login timeout task.
4. Hardened EppProxyProtocolHandler to validate incoming IPs from the PROXY protocol header to prevent IP spoofing and smuggling, falling back to the TCP source IP on validation failures.
This commit is contained in:
Pavlo Tkach
2026-07-28 19:59:51 +00:00
committed by GitHub
parent ea7d5d4a5e
commit 0c79414a31
11 changed files with 336 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
util/src/main/java/google/registry/util/ProxyHttpHeaders.java
+4 -7
View File
@@ -33,14 +33,11 @@ public final class ProxyHttpHeaders {
/** HTTP header name used to pass the Registrar Id from the proxy to Nomulus. */
public static final String REGISTRAR_ID = "Nomulus-Registrar-Id";
/**
* Fallback HTTP header name used to pass the client IP address from the proxy to Nomulus.
*
* <p>Note that Java 17's servlet implementation may inject some seemingly unrelated addresses
* into this header. We only use this as a fallback so the proxy can transition to use the above
* header that should not be interfered with.
*/
/** Fallback HTTP header name used to pass the client IP address from the proxy to Nomulus. */
public static final String FALLBACK_IP_ADDRESS = HttpHeaders.X_FORWARDED_FOR;
/** HTTP header name used to pass the authenticated Registrar Id from Nomulus to GKE. */
public static final String LOGGED_IN_REGISTRAR = "Nomulus-Logged-In-Registrar";
private ProxyHttpHeaders() {}
}