pairing-daemon typed-error -> HTTP mapping, remove permissive CORS, Host/Origin/Referer allowlist + 421, 64 KiB body + depth-16 + 4 KiB string caps, tiered per-IP rate limit w/ lookup-miss backoff + uniform-time floor

Author: bordumb

Cargo.lock

@@ -5,7 +5,7 @@ use std::time::Duration;
 
 use tokio_util::sync::CancellationToken;
 
-use auths_pairing_daemon::{PairingDaemonBuilder, PairingDaemonHandle};
+use auths_pairing_daemon::{HostAllowlist, PairingDaemonBuilder, PairingDaemonHandle};
 use auths_sdk::pairing::{CreateSessionRequest, SubmitResponseRequest};
 
 /// Detect the LAN IP address of this machine.
@@ -34,9 +34,12 @@ impl LanPairingServer {
         let daemon = PairingDaemonBuilder::new().build(session)?;
         let pairing_token_b64 = daemon.token().to_string();
 
-        let (router, handle) = daemon.into_parts();
+        // Bind FIRST so we know the port, then build the router with
+        // a Host/Origin/Referer allowlist scoped to the bound
+        // `SocketAddr`. Reversing this order would either leave the
+        // port unknown (fail-closed allowlist → 421 for every request)
+        // or require mutable state in the middleware.
         let cancel = CancellationToken::new();
-
         let listener = tokio::net::TcpListener::bind(SocketAddr::new(bind_ip, 0))
             .await
             .map_err(|e| {
@@ -48,6 +51,8 @@ impl LanPairingServer {
                 )
             })?;
         let addr = listener.local_addr()?;
+        let allowlist = HostAllowlist::for_bound_addr(addr, None);
+        let (router, handle) = daemon.into_parts(allowlist);
 
         let cancel_clone = cancel.clone();
         let task = tokio::spawn(async move {

crates/auths-cli/src/commands/device/pair/lan_server.rs

@@ -15,15 +15,20 @@ auths-core = { workspace = true }
 thiserror.workspace = true
 serde = { version = "1", features = ["derive"] }
 tokio = { workspace = true, features = ["sync"] }
-# fn-128.T7 startup entropy / CRNG-init probe.
+# Startup entropy / CRNG-init probe.
 rand.workspace = true
-# fn-130.T1: structured server-side error logging from DaemonError::into_response.
+# Structured server-side error logging from DaemonError::into_response.
 tracing = "0.1"
 
 # Server feature deps
 axum = { version = "0.8", optional = true }
 tower = { version = "0.5", features = ["util"], optional = true }
-tower-http = { version = "0.6", features = ["trace", "cors"], optional = true }
+# `cors` feature intentionally NOT enabled — this daemon is strictly
+# app-to-daemon on the LAN; a browser hitting it is DNS rebinding or
+# a bug. See router.rs for the full rationale.
+# `limit` feature enables `RequestBodyLimitLayer`.
+tower-http = { version = "0.6", features = ["trace", "limit"], optional = true }
+serde_json = { version = "1", optional = true }
 ring = { workspace = true, optional = true }
 base64 = { workspace = true, optional = true }
 subtle = { workspace = true, optional = true }
@@ -34,7 +39,7 @@ mdns-sd = { version = "0.18.0", optional = true }
 
 [features]
 default = ["server", "mdns"]
-server = ["dep:axum", "dep:tower", "dep:tower-http", "dep:ring", "dep:base64", "dep:subtle", "dep:if-addrs"]
+server = ["dep:axum", "dep:tower", "dep:tower-http", "dep:ring", "dep:base64", "dep:subtle", "dep:if-addrs", "dep:serde_json"]
 mdns = ["dep:mdns-sd"]
 # Pass-through to auths-crypto's FIPS / CNSA builds via auths-core (direct dep).
 fips = ["auths-core/fips"]

crates/auths-pairing-daemon/Cargo.toml

@@ -1,4 +1,4 @@
-//! Startup RNG health probe (fn-128.T7).
+//! Startup RNG health probe.
 //!
 //! Refuses to run if the kernel CRNG is not initialised or if `OsRng`'s
 //! output fails a lightweight NIST SP 800-90B-style health check. Catches

crates/auths-pairing-daemon/src/entropy_probe.rs

@@ -1,12 +1,11 @@
 //! Typed errors for the pairing daemon + the HTTP status-code mapping.
 //!
-//! fn-130.T1 centralized the error → HTTP boundary here: every handler
-//! returns `Result<Json<T>, DaemonError>` and every status code in the
-//! daemon is emitted from a single `IntoResponse` impl. Prior to T1, eight
-//! handlers in `handlers.rs` hand-mapped codes inline; any future
-//! middleware (421 from Host-allowlist, 413 from body-limit, 503 from
-//! CPU-budget, etc.) had to either invent its own mapping or wait for
-//! this consolidation.
+//! Every handler returns `Result<Json<T>, DaemonError>` and every
+//! status code in the daemon is emitted from a single `IntoResponse`
+//! impl. Centralizing this mapping is what lets new middleware (421
+//! from the Host allowlist, 413 from the body-limit, 503 from the
+//! CPU-budget semaphore, etc.) share one error path instead of
+//! hand-rolling its own status-code translation.
 //!
 //! # Error body shape
 //!
@@ -57,14 +56,14 @@ pub enum DaemonError {
     #[error(transparent)]
     Pairing(#[from] auths_core::pairing::PairingError),
 
-    /// RNG health check at startup failed (fn-128.T7). The daemon refuses
-    /// to bind a listener if the OS CSPRNG appears unhealthy — this catches
-    /// the early-boot entropy-starvation window that has produced real-world
-    /// key-collision incidents.
+    /// RNG health check at startup failed. The daemon refuses to
+    /// bind a listener if the OS CSPRNG appears unhealthy — this
+    /// catches the early-boot entropy-starvation window that has
+    /// produced real-world key-collision incidents.
     #[error("RNG health check failed: {0}")]
     EntropyCheckFailed(String),
 
-    // --- fn-130.T1: HTTP-boundary variants -----------------------------------
+    // --- HTTP-boundary variants ----------------------------------------------
     /// Resource not found (404). Emitted for unknown session_id /
     /// short_code lookups. Carries no detail to avoid enumeration.
     #[error("not found")]
@@ -77,9 +76,9 @@ pub enum DaemonError {
     #[error("conflict")]
     Conflict,
 
-    /// Missing / invalid `X-Pairing-Token` (401). Legacy bootstrap path
-    /// — will be replaced by `UnauthorizedHmac` / `UnauthorizedSig` as
-    /// later fn-130 tasks land.
+    /// Missing / invalid `X-Pairing-Token` (401). Legacy bootstrap
+    /// path — will be replaced by `UnauthorizedHmac` /
+    /// `UnauthorizedSig` once the hybrid-auth middleware lands.
     #[error("unauthorized")]
     Unauthorized,
 

crates/auths-pairing-daemon/src/error.rs

@@ -4,15 +4,15 @@
 //! methods on [`DaemonState`]. Handlers only map between HTTP and domain
 //! types — every error path returns a typed [`DaemonError`] and the
 //! status-code mapping lives in a single `IntoResponse` impl (see
-//! `src/error.rs`). Pre-fn-130.T1 the codes were hand-mapped inline at
-//! every handler; keeping them centralized is what unblocks the 421 /
-//! 413 / 429 / 503 middleware that fn-130 tasks T3-T9 install.
+//! `src/error.rs`). Centralizing that mapping is what lets the
+//! middleware stack (421 / 413 / 429 / 503) share one error path.
 
 use std::sync::Arc;
+use std::time::Instant;
 
 use axum::{
     Json,
-    extract::{Path, State},
+    extract::{ConnectInfo, Path, State},
     http::HeaderMap,
 };
 
@@ -23,6 +23,8 @@ use auths_core::pairing::types::{
 
 use crate::DaemonState;
 use crate::error::DaemonError;
+use crate::rate_limiter::{TieredRateLimiter, uniform_time_floor};
+use crate::request_limits::LimitedJson;
 use crate::token::validate_pairing_token;
 
 /// Health check endpoint.
@@ -47,12 +49,21 @@ pub async fn handle_health() -> &'static str {
 pub async fn handle_lookup_by_code(
     Path(code): Path<String>,
     State(state): State<Arc<DaemonState>>,
+    axum::extract::Extension(limiter): axum::extract::Extension<Arc<TieredRateLimiter>>,
+    ConnectInfo(addr): ConnectInfo<std::net::SocketAddr>,
 ) -> Result<Json<GetSessionResponse>, DaemonError> {
-    state
-        .lookup_by_code(&code)
-        .await
-        .map(Json)
-        .ok_or(DaemonError::NotFound)
+    // Equal-time: compute the floor deadline at the top of the
+    // handler and sleep until it on both the hit and the miss paths.
+    // Otherwise an attacker can enumerate short codes by measuring
+    // response time.
+    let start = Instant::now();
+    let floor = limiter.config().uniform_miss_floor;
+
+    let result = state.lookup_by_code(&code).await;
+    limiter.record_lookup_outcome(addr.ip(), result.is_some());
+    uniform_time_floor(start, floor).await;
+
+    result.map(Json).ok_or(DaemonError::NotFound)
 }
 
 /// Get session details by ID.
@@ -90,7 +101,7 @@ pub async fn handle_submit_response(
     Path(id): Path<String>,
     State(state): State<Arc<DaemonState>>,
     headers: HeaderMap,
-    Json(request): Json<SubmitResponseRequest>,
+    LimitedJson(request): LimitedJson<SubmitResponseRequest>,
 ) -> Result<Json<SuccessResponse>, DaemonError> {
     if !validate_pairing_token(&headers, state.pairing_token()) {
         return Err(DaemonError::Unauthorized);
@@ -118,7 +129,7 @@ pub async fn handle_submit_confirmation(
     Path(id): Path<String>,
     State(state): State<Arc<DaemonState>>,
     headers: HeaderMap,
-    Json(request): Json<SubmitConfirmationRequest>,
+    LimitedJson(request): LimitedJson<SubmitConfirmationRequest>,
 ) -> Result<Json<SuccessResponse>, DaemonError> {
     if !validate_pairing_token(&headers, state.pairing_token()) {
         return Err(DaemonError::Unauthorized);