Pavlo TkachandGitHub 0c79414a31 Harden EPP connection limits and idle timeouts (#3179) ...

This change hardens the EPP GKE entry point against a connection hoarding Denial of Service (DoS) vulnerability (b/534930905).
We resolve this by restricting pre-login connections to a short idle timeout and enforcing pod-local connection caps:
1. Removed certificate-based connection quota tracking. IP limits are now enforced pre-login, and authenticated Registrar ID limits are enforced post-login.
2. Implemented a 10-second scheduled timeout task during the pre-login phase. If the client does not successfully authenticate within 10 seconds of TLS handshake completion, they are disconnected.
3. Added a new response header 'Nomulus-Logged-In-Registrar' set by the backend EppRequestHandler upon successful login. EppServiceHandler monitors this header inline to perform registrar quota upgrades and cancel the pre-login timeout task.
4. Hardened EppProxyProtocolHandler to validate incoming IPs from the PROXY protocol header to prevent IP spoofing and smuggling, falling back to the TCP source IP on validation failures.

2026-07-28 19:59:51 +00:00

..

src

Harden EPP connection limits and idle timeouts (#3179)

2026-07-28 19:59:51 +00:00

build.gradle

Complete Joda-Time to java.time migration (#3039)

2026-05-13 16:07:19 +00:00

buildscript-gradle.lockfile

Upgrade to Gradle 7.0 (#1712)

2022-07-26 11:41:27 -04:00

gradle.lockfile

Move testcontainers out of prod deps (#3152)

2026-07-14 19:10:21 +00:00