dsh-pocket 1.11.0 → 1.11.1

package/README.en.md

@@ -94,6 +94,7 @@ On the same page click "**Enable anywhere**" → wait for the tunnel (first run
 - **DSH can execute code on your computer.** **LAN** QR/URL plus its own **8-digit PIN** is the key (PIN **on by default**, switchable off — then LAN scans connect directly, same-network devices only) — **never share the LAN QR, URL or PIN**.
 - **Public** access is protected by an **8-digit PIN**: the link is random, the PIN rotates on every tunnel start by default, and old links die instantly — even a leaked link can't get in. **A custom PIN is never auto-rotated** (your value stays stable).
 - Phone login state is tied to the computer's dsh web process: **no re-entry while dsh web stays up; one re-entry after a restart/update**.
+- **Login rate limiting** (anti brute-force): **5** consecutive wrong PINs from the same IP lock it for **60s**; a global failure threshold briefly locks everyone (blocks distributed IP-rotation scans); a successful login resets the counter.
 - The public URL is randomly assigned by cloudflared and **changes on every restart** (old links die automatically — a natural key rotation).
 - LAN mode exposes nothing publicly; only devices on the same network can reach it.
 - Built for personal use; the public PIN lives in `$DSH_HOME/dsh-pocket/token` (re-rolled per tunnel start unless customized), the LAN PIN in `$DSH_HOME/dsh-pocket/token-lan` (refreshed manually in Settings), and switches/custom flags in `$DSH_HOME/dsh-pocket/settings.json`.

package/README.md

@@ -94,6 +94,7 @@ npx @deepseek-ai/dsh web
 - **DSH 能执行你电脑上的代码**。**局域网**二维码/URL 配上独立 **8 位数字密码**才是钥匙（密码**默认开启**，可关——关闭后局域网扫码直连，仅同一网络设备可访问），**请勿把局域网二维码、URL 或密码发给别人**
 - **公网**有 **8 位数字密码**保护：链接随机分配、默认每次开启换新密码、旧链接立即作废——泄露了也进不来，改密码/重开即可作废；**自定义密码后不再自动换新**（你设的值即稳定密码）
 - 手机登录状态与电脑上的 dsh web 进程绑定：**电脑 dsh web 一直开着就不用重复输入；重启/更新后需重新输入一次**
+- **登录限速**（防暴力破解）：同一 IP 连续输错 **5 次**锁定 **60 秒**；全局失败超阈值时短暂全锁（防换 IP 分布式扫描）；输对密码后计数清零
 - 公网 URL 由 cloudflared 随机分配，**每次重启会变化**（旧链接自动失效，相当于天然轮换）
 - 局域网模式不暴露公网，只有同一网络内的设备能访问
 - 适合个人自用；公网密码存本机 `$DSH_HOME/dsh-pocket/token`（默认每次开启公网自动换新，**自定义后不换**），局域网密码存 `$DSH_HOME/dsh-pocket/token-lan`（设置页手动刷新），开关/自定义标记存 `$DSH_HOME/dsh-pocket/settings.json`

package/lib/proxy.mjs

@@ -79,6 +79,67 @@ function cookieFor(token, sessionKey) {
   return createHash('sha256').update(`${token}:${sessionKey}`).digest('hex');
 }
 
+// ---------- 登录速率限制（issue #40，改进版方案 A） ----------
+// 8 位数字密码（10^8 组合）本身可接受，真正风险是「无限制重试」让穷举可行。
+// 这里做三层防护（内存态，随进程生命周期，与 sessionKey 一致）：
+//   1) 单 IP 滑动窗口：60 秒内失败 ≥5 次 → 锁 60 秒（429）
+//   2) 全局滑动窗口：1 分钟全局失败 > 50 次 → 全局锁 30 秒（防分布式扫描换 IP 绕过）
+//   3) 成功登录清空该 IP 计数
+// IP 识别：优先 cf-connecting-ip（Cloudflare 在隧道入口设置的**真实**客户端 IP，
+// 可信）；无则回退 socket remoteAddress。**不信任客户端 x-forwarded-for**（可伪造）。
+export const DEFAULT_RATE_LIMIT = {
+  windowMs: 60_000,      // 失败计数滑动窗口
+  maxFailures: 5,        // 窗口内失败阈值 → 触发单 IP 锁
+  lockMs: 60_000,        // 单 IP 锁定时长
+  globalMaxFailures: 50, // 全局失败阈值（同窗口）→ 触发全局锁
+  globalLockMs: 30_000,  // 全局锁定时长
+};
+function createRateLimiter(cfg = {}) {
+  const c = { ...DEFAULT_RATE_LIMIT, ...cfg };
+  const failCounts = new Map(); // ip -> { count, windowStart }
+  const ipLocks = new Map();    // ip -> lockedUntil
+  const global = { count: 0, windowStart: 0, lockedUntil: 0 };
+  return {
+    /** 该 IP 当前是否被锁；返回 { locked, retryAfter }。 */
+    status(ip) {
+      const now = Date.now();
+      if (global.lockedUntil > now) return { locked: true, retryAfter: Math.ceil((global.lockedUntil - now) / 1000) };
+      const until = ipLocks.get(ip) ?? 0;
+      if (until > now) return { locked: true, retryAfter: Math.ceil((until - now) / 1000) };
+      return { locked: false, retryAfter: 0 };
+    },
+    /** 记一次失败：维护滑动窗口计数，达阈值触发单 IP / 全局锁。 */
+    record(ip) {
+      const now = Date.now();
+      let rec = failCounts.get(ip);
+      if (!rec || now - rec.windowStart > c.windowMs) rec = { count: 0, windowStart: now };
+      rec.count++;
+      failCounts.set(ip, rec);
+      if (now - global.windowStart > c.windowMs) { global.count = 0; global.windowStart = now; }
+      global.count++;
+      if (rec.count >= c.maxFailures) ipLocks.set(ip, now + c.lockMs);
+      if (global.count >= c.globalMaxFailures) global.lockedUntil = now + c.globalLockMs;
+      // 防内存膨胀：超过 2000 条记录时清掉已过窗口期的条目
+      if (failCounts.size > 2000) {
+        for (const [k, v] of failCounts) {
+          if (now - v.windowStart > c.windowMs) failCounts.delete(k);
+        }
+      }
+    },
+    /** 成功登录：清空该 IP 计数与锁。 */
+    clear(ip) {
+      failCounts.delete(ip);
+      ipLocks.delete(ip);
+    },
+  };
+}
+/** 客户端真实 IP：cf-connecting-ip（隧道，可信）优先，否则 socket 地址；不信 XFF。 */
+function clientIp(req) {
+  const cf = String(req.headers['cf-connecting-ip'] ?? '').trim();
+  if (cf) return cf;
+  return String(req.socket?.remoteAddress ?? 'unknown');
+}
+
 function parseCookies(header) {
   const out = {};
   for (const part of String(header ?? '').split(';')) {
@@ -88,10 +149,13 @@ function parseCookies(header) {
   return out;
 }
 
-/** 登录页：按访问来源显示提示（局域网 / 公网）。 */
-function loginPageHtml(error, isPublic) {
+/** 登录页：按访问来源显示提示（局域网 / 公网）；error: false|true|'locked'（locked 带剩余秒数）。 */
+function loginPageHtml(error, isPublic, retryAfter = 0) {
   const where = isPublic ? '此公网地址' : '此局域网地址';
   const whereEn = isPublic ? 'This public address' : 'This LAN address';
+  const errMsg = error === 'locked'
+    ? `尝试次数过多，请 ${retryAfter} 秒后再试 | Too many attempts — try again in ${retryAfter}s`
+    : error ? '密码错误，请重试 | Wrong PIN, try again' : '';
   return `<!doctype html><html lang="zh"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>DSH Pocket · 访问验证</title>
@@ -107,7 +171,7 @@ button{width:100%;padding:10px;font-size:15px;background:#4f6ef7;color:#fff;bord
 </style></head><body><div class="card">
 <h1>🔐 DSH Pocket</h1>
 <p>${where}受访问密码保护，请输入 8 位数字密码 | ${whereEn} is password-protected — enter the 8-digit PIN</p>
-<div class="err">${error ? '密码错误，请重试' : ''}</div>
+<div class="err">${errMsg}</div>
 <form method="post" action="/pocket-login">
 <input name="token" type="password" inputmode="numeric" maxlength="8" autocomplete="one-time-code" autofocus required>
 <button type="submit">进入 | Enter</button>
@@ -152,12 +216,14 @@ function loopbackAuthority(headers, upstream) {
  * @param {string} [opts.host]      监听地址（默认 0.0.0.0：LAN 与隧道都能到）
  * @param {{host:string,port:number}} [opts.upstream] 上游 dsh web（默认 127.0.0.1:3080）
  * @param {string} [opts.injectHtml] 注入 HTML 的内容（默认 polyfill + 移动端适配；传 '' 关闭）
- * @param {object} [opts.auth]       可选访问令牌认证（issue #13）：{ getToken, isProtected }
+ * @param {object} [opts.auth]       可选访问令牌认证（issue #13）：{ getToken, isProtected, sessionKey }
+ * @param {object} [opts.rateLimit]  登录速率限制参数覆盖（issue #40；测试用短窗口）
  * @returns {Promise<{server:import('node:http').Server, close:()=>Promise<void>}>}
  */
-export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null } = {}) {
+export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DEFAULT_UPSTREAM, log = null, injectHtml = DEFAULT_INJECT, auth = null, rateLimit = null } = {}) {
+  const limiter = auth ? createRateLimiter(rateLimit ?? {}) : null;
   const server = createServer((req, res) => {
-    // 访问令牌认证（issue #13 + #18 + #33）：局域网与公网按开关/来源要求密码
+    // 访问令牌认证（issue #13 + #18 + #33 + #40）：局域网与公网按开关/来源要求密码
     if (auth) {
       const host = String(req.headers.host ?? '');
       const isPublic = /trycloudflare\.com$/i.test(host);
@@ -165,13 +231,25 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
       const token = protectedHost ? (auth.getToken?.(host) ?? null) : null;
       const sessionKey = auth.sessionKey ?? null;
       if (protectedHost && token) {
-        // 登录提交：校验密码 → 种持久 HttpOnly cookie（30 天，绑定进程会话密钥）→ 回首页
+        const ip = clientIp(req);
+        // 登录提交：速率限制（issue #40）→ 校验密码 → 种持久 HttpOnly cookie（30 天，绑定进程会话密钥）→ 回首页
         if (req.method === 'POST' && req.url?.startsWith('/pocket-login')) {
+          const rl = limiter?.status(ip) ?? { locked: false, retryAfter: 0 };
+          if (rl.locked) {
+            res.writeHead(429, {
+              'content-type': 'text/html; charset=utf-8',
+              'cache-control': 'no-store',
+              'retry-after': String(rl.retryAfter),
+            });
+            res.end(loginPageHtml('locked', isPublic, rl.retryAfter));
+            return;
+          }
           let body = '';
           req.on('data', (c) => { body += c; if (body.length > 1024) req.destroy(); });
           req.on('end', () => {
             const submitted = String(new URLSearchParams(body).get('token') ?? '');
             if (submitted === token) {
+              limiter?.clear(ip);
               res.writeHead(302, {
                 location: '/',
                 'set-cookie': `${TOKEN_COOKIE}=${cookieFor(token, sessionKey)}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${COOKIE_MAX_AGE}`,
@@ -179,6 +257,8 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
               });
               res.end();
             } else {
+              limiter?.record(ip);
+              log?.(`dsh-pocket: login failed from ${ip} | 登录失败 IP: ${ip}`);
               res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
               res.end(loginPageHtml(true, isPublic));
             }
@@ -187,8 +267,10 @@ export function createPocketProxy({ port = 3081, host = '0.0.0.0', upstream = DE
         }
         if (!authCheck(req, token, sessionKey)) {
           if (isHtmlRequest(req)) {
+            // 锁定期间打开登录页也给提示（HTTP 200 + 锁定文案；429 语义留给 POST 拒绝）
+            const rl = limiter?.status(ip) ?? { locked: false, retryAfter: 0 };
             res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
-            res.end(loginPageHtml(false, isPublic));
+            res.end(loginPageHtml(rl.locked ? 'locked' : false, isPublic, rl.retryAfter));
           } else {
             res.writeHead(401, { 'content-type': 'application/json', 'cache-control': 'no-store' });
             res.end('{"error":"unauthorized"}');

package/package.json

@@ -76,5 +76,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.11.0"
+  "version": "1.11.1"
 }