hivemind-websocket-protocol 0.2.8a1__tar.gz → 0.2.8a2__tar.gz

{hivemind_websocket_protocol-0.2.8a1 → hivemind_websocket_protocol-0.2.8a2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hivemind-websocket-protocol
-Version: 0.2.8a1
+Version: 0.2.8a2
 Summary: websocket network protocol for hivemind-core
 Author-email: jarbasAi <jarbasai@mailfence.com>
 License-Expression: Apache-2.0

{hivemind_websocket_protocol-0.2.8a1 → hivemind_websocket_protocol-0.2.8a2}/hivemind_websocket_protocol/__init__.py

@@ -1,11 +1,13 @@
 import asyncio
 import dataclasses
+import hashlib
 import math
 import os
 import os.path
 import random
 import threading
 import time
+from collections import OrderedDict
 from os import makedirs
 from os.path import exists, join
 from socket import gethostname
@@ -18,7 +20,7 @@ from OpenSSL import crypto
 from ovos_bus_client.session import Session
 from ovos_utils.log import LOG
 from ovos_utils.xdg_utils import xdg_data_home
-from poorman_handshake import PasswordHandShake
+from poorman_handshake import PasswordHandShake, check_password_strength
 from tornado import ioloop
 from tornado import web
 from tornado.platform.asyncio import AnyThreadEventLoopPolicy
@@ -56,6 +58,56 @@ DEFAULT_WEBSOCKET_PING_INTERVAL = 30.0
 DEFAULT_WEBSOCKET_PING_TIMEOUT = 20.0
 
 
+#: Passwords already checked against a given policy, most recent last.
+#:
+#: ``PasswordHandShake(password, min_bits=N)`` runs the credential through
+#: zxcvbn on construction. That is the right thing to do, but it is ~2.2 ms
+#: and Core builds one per admission on the single Tornado IOLoop, so a fleet
+#: reconnecting at once serialises behind it: 400 satellites is ~0.87 s of
+#: event loop spent re-deciding that the same handful of passwords are still
+#: strong.
+#:
+#: Entries are keyed on a *keyed* blake2s digest and the policy that accepted
+#: it. The key is per-process and never persisted, so this is an LRU lookup
+#: key, not a stored password hash; rotating a password or tightening
+#: ``min_bits`` misses the cache and re-validates.
+_PASSWORD_STRENGTH_LOCK = threading.Lock()
+_PASSWORD_STRENGTH_CACHE: "OrderedDict[Tuple[bytes, float], None]" = OrderedDict()
+_PASSWORD_STRENGTH_CACHE_KEY = os.urandom(32)
+_PASSWORD_STRENGTH_CACHE_SIZE = 4096
+
+
+def _password_handshake(password: str,
+                        min_bits: Optional[float] = None) -> PasswordHandShake:
+    """Build a PasswordHandShake, validating each password once per policy.
+
+    Raises ``WeakPasswordError`` exactly as the plain constructor does -- a
+    weak password is never cached, so it is rejected on every attempt.
+    """
+    if min_bits is None:
+        min_bits = runtime_password_min_bits()
+
+    if min_bits > 0:
+        digest = hashlib.blake2s(
+            password.encode("utf-8"),
+            key=_PASSWORD_STRENGTH_CACHE_KEY,
+        ).digest()
+        cache_key = (digest, min_bits)
+        with _PASSWORD_STRENGTH_LOCK:
+            if cache_key in _PASSWORD_STRENGTH_CACHE:
+                _PASSWORD_STRENGTH_CACHE.move_to_end(cache_key)
+            else:
+                # Outside the cache-hit branch on purpose: a rejection must
+                # propagate and must not be remembered as a pass.
+                check_password_strength(password, min_bits=min_bits)
+                _PASSWORD_STRENGTH_CACHE[cache_key] = None
+                while len(_PASSWORD_STRENGTH_CACHE) > _PASSWORD_STRENGTH_CACHE_SIZE:
+                    _PASSWORD_STRENGTH_CACHE.popitem(last=False)
+
+    # Already validated above; min_bits=0 skips the duplicate zxcvbn run.
+    return PasswordHandShake(password, min_bits=0)
+
+
 def _split_csv(value: Any) -> Tuple[str, ...]:
     if not value:
         return ()
@@ -430,7 +482,7 @@ class HiveMindTornadoWebSocket(WebSocketHandler):
         self.client.is_admin = user.is_admin
         if user.password:
             # pre-shared password to derive aes_key
-            self.client.pswd_handshake = PasswordHandShake(user.password, min_bits=runtime_password_min_bits())
+            self.client.pswd_handshake = _password_handshake(user.password)
 
         self.client.node_type = HiveMindNodeType.NODE  # TODO . placeholder
 

{hivemind_websocket_protocol-0.2.8a1 → hivemind_websocket_protocol-0.2.8a2}/hivemind_websocket_protocol/version.py

@@ -2,7 +2,7 @@
 VERSION_MAJOR = 0
 VERSION_MINOR = 2
 VERSION_BUILD = 8
-VERSION_ALPHA = 1
+VERSION_ALPHA = 2
 # END_VERSION_BLOCK
 
 __version__ = f"{VERSION_MAJOR}.{VERSION_MINOR}.{VERSION_BUILD}" + (f"a{VERSION_ALPHA}" if VERSION_ALPHA else "")

{hivemind_websocket_protocol-0.2.8a1 → hivemind_websocket_protocol-0.2.8a2}/hivemind_websocket_protocol.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hivemind-websocket-protocol
-Version: 0.2.8a1
+Version: 0.2.8a2
 Summary: websocket network protocol for hivemind-core
 Author-email: jarbasAi <jarbasai@mailfence.com>
 License-Expression: Apache-2.0

{hivemind_websocket_protocol-0.2.8a1 → hivemind_websocket_protocol-0.2.8a2}/hivemind_websocket_protocol.egg-info/SOURCES.txt

@@ -15,5 +15,6 @@ tests/test_client_ip.py
 tests/test_close_diagnostics.py
 tests/test_decode_auth.py
 tests/test_health.py
+tests/test_password_strength_cache.py
 tests/test_protocol_unit.py
 tests/test_trusted_proxy_config.py

hivemind_websocket_protocol-0.2.8a2/tests/test_password_strength_cache.py

@@ -0,0 +1,105 @@
+"""Admission must not re-run zxcvbn for every connecting satellite.
+
+``PasswordHandShake`` validates the credential on construction, and Core builds
+one per admission on the single Tornado IOLoop. Validating the same password
+400 times costs ~0.87 s of event loop that no satellite can use.
+"""
+import threading
+from unittest.mock import patch
+
+import pytest
+from poorman_handshake import WeakPasswordError
+
+import hivemind_websocket_protocol as hwp
+
+STRONG = "correct-horse-battery-staple-9271"
+
+
+@pytest.fixture(autouse=True)
+def _clear_cache():
+    hwp._PASSWORD_STRENGTH_CACHE.clear()
+    yield
+    hwp._PASSWORD_STRENGTH_CACHE.clear()
+
+
+def test_repeated_admissions_validate_once():
+    with patch.object(hwp, "check_password_strength") as check:
+        for _ in range(400):
+            hwp._password_handshake(STRONG, min_bits=64)
+
+    assert check.call_count == 1, (
+        "each admission re-ran the strength check; a reconnecting fleet pays "
+        "this on the IOLoop"
+    )
+
+
+def test_handshake_is_not_shared_between_connections():
+    """Only the verdict is cached — handshake state is per connection."""
+    first = hwp._password_handshake(STRONG, min_bits=64)
+    second = hwp._password_handshake(STRONG, min_bits=64)
+
+    assert first is not second
+
+
+def test_weak_password_is_rejected_every_time():
+    """A rejection must never be remembered as a pass."""
+    for _ in range(3):
+        with pytest.raises(WeakPasswordError):
+            hwp._password_handshake("123456", min_bits=64)
+
+    assert len(hwp._PASSWORD_STRENGTH_CACHE) == 0
+
+
+def test_a_tightened_policy_revalidates():
+    hwp._password_handshake(STRONG, min_bits=40)
+
+    with patch.object(hwp, "check_password_strength") as check:
+        hwp._password_handshake(STRONG, min_bits=64)
+
+    assert check.call_count == 1, "min_bits is part of the cache key"
+
+
+def test_a_rotated_password_revalidates():
+    hwp._password_handshake(STRONG, min_bits=64)
+
+    with patch.object(hwp, "check_password_strength") as check:
+        hwp._password_handshake(STRONG + "-rotated", min_bits=64)
+
+    assert check.call_count == 1
+
+
+def test_disabled_policy_does_not_validate_or_cache():
+    with patch.object(hwp, "check_password_strength") as check:
+        hwp._password_handshake(STRONG, min_bits=0)
+
+    assert check.call_count == 0
+    assert len(hwp._PASSWORD_STRENGTH_CACHE) == 0
+
+
+def test_cache_is_bounded():
+    limit = hwp._PASSWORD_STRENGTH_CACHE_SIZE
+    with patch.object(hwp, "check_password_strength"):
+        for i in range(limit + 50):
+            hwp._password_handshake(f"{STRONG}-{i}", min_bits=64)
+
+    assert len(hwp._PASSWORD_STRENGTH_CACHE) <= limit
+
+
+def test_concurrent_admissions_are_safe():
+    """Admission runs from Tornado's loop and executor threads alike."""
+    errors = []
+
+    def admit():
+        try:
+            for _ in range(50):
+                hwp._password_handshake(STRONG, min_bits=64)
+        except Exception as e:  # noqa: BLE001
+            errors.append(e)
+
+    threads = [threading.Thread(target=admit) for _ in range(8)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+
+    assert errors == []