nixevol/NixMsg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 统一对话密码锁键为发送方加对方不含 IP

Browse Source
This commit is contained in:
Nixevol
2026-09-30 16:23:25 +08:00
parent b7c8b6ffd6
commit e294b5db71
17 changed files with 449 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/app/message/submit.go
+8 -8
View File
@@ -118,12 +118,12 @@ func (a *App) Submit(ctx context.Context, senderID string, conn port.ConnInfo, r
}
passwordVerified := false
if needPassword {
if locked, _ := a.talkLocked(senderID, req.To.ID, conn.RemoteIP); locked {
return SubmitResult{}, errCode(protocol.CodeRateLimited, "talk password locked")
}
if req.TalkPassword == "" {
return SubmitResult{}, errCode(protocol.CodeTalkPasswordRequired, "talk password required")
}
if locked, _ := a.talkLocked(senderID, req.To.ID); locked {
return SubmitResult{}, errCode(protocol.CodeRateLimited, "talk password locked")
}
if a.hash == nil {
return SubmitResult{}, fmt.Errorf("message: hash pool required")
}
@@ -132,7 +132,7 @@ func (a *App) Submit(ctx context.Context, senderID string, conn port.ConnInfo, r
return SubmitResult{}, vErr
}
if !ok {
a.talkFail(senderID, req.To.ID, conn.RemoteIP)
a.talkFail(senderID, req.To.ID)
return SubmitResult{}, errCode(protocol.CodeTalkPasswordInvalid, "talk password invalid")
}
passwordVerified = true
@@ -572,11 +572,11 @@ func bytesEqual(a, b []byte) bool {
return v == 0
}
func (a *App) talkLocked(senderID, targetID, ip string) (bool, error) {
func (a *App) talkLocked(senderID, targetID string) (bool, error) {
if a.locks == nil {
return false, nil
}
if locked, _ := a.locks.Check(auth.LockKey{Kind: auth.LockTalkPair, EndpointID: senderID, PeerID: targetID, IP: ip}); locked {
if locked, _ := a.locks.Check(auth.LockKey{Kind: auth.LockTalkPair, EndpointID: senderID, PeerID: targetID}); locked {
return true, nil
}
if locked, _ := a.locks.Check(auth.LockKey{Kind: auth.LockTalkTarget, EndpointID: targetID}); locked {
@@ -585,11 +585,11 @@ func (a *App) talkLocked(senderID, targetID, ip string) (bool, error) {
return false, nil
}
func (a *App) talkFail(senderID, targetID, ip string) {
func (a *App) talkFail(senderID, targetID string) {
if a.locks == nil {
return
}
a.locks.Fail(auth.LockKey{Kind: auth.LockTalkPair, EndpointID: senderID, PeerID: targetID, IP: ip})
a.locks.Fail(auth.LockKey{Kind: auth.LockTalkPair, EndpointID: senderID, PeerID: targetID})
a.locks.Fail(auth.LockKey{Kind: auth.LockTalkTarget, EndpointID: targetID})
}
internal/app/message/submit_test.go
+42
View File
@@ -4,6 +4,7 @@ import (
"context"
"database/sql"
"errors"
"fmt"
"math"
"path/filepath"
"testing"
@@ -519,3 +520,44 @@ WHERE m.id='late-1' AND d.endpoint_id='bob'`).Scan(&bobN); err != nil {
}
})
}
func TestU03SubmitTalkLockNoIP(t *testing.T) {
t.Parallel()
lim := defaultTestLimits()
dir := t.TempDir()
db, err := store.Open(filepath.Join(dir, "data"), "FULL")
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() { _ = db.Close() })
fixed := time.UnixMilli(1_700_000_000_000)
locks := auth.NewLoginLocks()
locks.SetClock(func() time.Time { return fixed })
app := New(db, lim, auth.NewStubHashPool(),
WithNow(func() time.Time { return fixed }),
WithLocks(locks),
)
insertEndpoint(t, db, "alice", "", 1, 0)
insertEndpoint(t, db, "bob", "secret", 1, 0)
ctx := context.Background()
for i := 0; i < 10; i++ {
bad := baseSend(fmt.Sprintf("w%d", i), "bob")
bad.TalkPassword = "wrong"
_, err := app.Submit(ctx, "alice", port.ConnInfo{RemoteIP: fmt.Sprintf("10.0.0.%d", i+1)}, bad)
if protoCode(err) != protocol.CodeTalkPasswordInvalid {
t.Fatalf("i=%d got %v", i, err)
}
}
empty := baseSend("empty", "bob")
_, err = app.Submit(ctx, "alice", port.ConnInfo{RemoteIP: "8.8.8.8"}, empty)
if protoCode(err) != protocol.CodeTalkPasswordRequired {
t.Fatalf("empty while locked want required got %v", err)
}
okReq := baseSend("ok1", "bob")
okReq.TalkPassword = "secret"
_, err = app.Submit(ctx, "alice", port.ConnInfo{RemoteIP: "9.9.9.9"}, okReq)
if protoCode(err) != protocol.CodeRateLimited {
t.Fatalf("correct password while locked want rate_limited got %v", err)
}
}