ospab 51b947e6ff fix(server): rate-limit the (currently unwired) open UDP DNS listener ... DnsServer::run_local_udp_listener binds 0.0.0.0 and answers every UDP datagram by resolving it and replying to the packet's (unverified, spoofable) source address - a textbook DNS reflection/amplification primitive. An attacker spoofing a victim's IP as the query source turns any server with this listener running into a free amplifier against that victim, with zero authentication gating it (unlike the main OSTP port, there's no Noise handshake here). Nothing in the codebase currently calls this function - the live DNS path is router.route_dns(), reached only through the authenticated OSTP tunnel relay (relay.rs). But the doc comment describes this as an intended, not-yet-wired entry point for clients that point their OS resolver directly at the server, so it's a real latent risk for whoever connects it without realizing the implication. Added a global (not per-source-IP - per-IP limiting doesn't help against a reflection attack, since the attacker never sees the replies and can spread queries across arbitrary spoofed sources) token bucket capping total replies/sec, so connecting this later can't silently reintroduce unbounded amplification.		2026-07-18 17:42:49 +03:00
..
src	fix(server): rate-limit the (currently unwired) open UDP DNS listener	2026-07-18 17:42:49 +03:00
Cargo.toml	fix(server): constant-time comparison for Management API secrets	2026-07-18 17:38:09 +03:00