4d9a26498e
Paste a secret, get a link, send it. The first person to open it and press
Reveal sees the secret; the link dies at that moment. The recipient needs a
browser and nothing else — no account, no client, no installed tooling.
The server cannot read what it stores. AES-256-GCM happens in the browser and
the key lives in the URL fragment, which browsers never transmit, so hushd
holds ciphertext and no key material. That is a property of where the key sits
rather than a promise about our conduct, which is why there is deliberately no
endpoint accepting a plaintext secret and no server-side-encryption fallback:
two guarantees behind one URL would be worse than one honest guarantee.
Three decisions carry the design:
* GET /s/{id} touches NO storage, not even to check existence. Slack, Teams,
WhatsApp, iMessage and Outlook Safe Links all fetch a URL before a human
sees it, so destroying on GET would destroy most secrets in transit and the
recipient's "already used" would be indistinguishable from interception.
Only POST /reveal consumes. Bot user-agent detection is an arms race;
removing the side effect from GET is not. Pinned by
TestGettingTheRevealPageNeverConsumesTheSecret.
* Destruction is one Redis GETDEL, which is atomic. GET-then-DEL has a window
where two simultaneous readers both win, and for a one-time secret that
window is the product. The store contract demands atomicity and the same
concurrency test runs against both implementations.
* Missing, already-revealed, expired and evicted are ONE indistinguishable
410. Separating them would confirm to a prober that a given link was real.
The secret id IS the capability, so secret.ID is a struct whose every
accidental path — %v, %s, String(), slog, json.Marshal — emits a redacted
handle or refuses, and the raw value needs an explicit Value(). The first
version tried to prevent leaks by implementing no String() at all; its own test
caught that Go's fmt prints unexported fields anyway, so forbidding the method
had removed the control rather than the leak.
Operationally: structured JSON on stdout in the fleet's wire format, which
Vector already collects with no annotation; six hush_* metrics on the chassis
registry with no id, IP or path in any label; five alert rules wired into
vmalert. The public Ingress enumerates /, /s/ and /api/ so /metrics, /healthz
and /readyz share the port but are unreachable from the internet — no
basic-auth middleware to maintain and get wrong.
Dependencies are vendored because go-chassis is private: the Woodpecker test
step and the in-cluster Kaniko build both run -mod=vendor with GOPROXY=off and
hold no git credential.
cmd/hush-mcp is a stdio MCP server doing the same client-side crypto locally,
so using hush from an agent preserves the same guarantee as using it from a
browser.
90 lines
2.8 KiB
Go
90 lines
2.8 KiB
Go
package chassis
|
|
|
|
import (
|
|
"context"
|
|
"math"
|
|
"net"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
// RateLimiter decides whether a key may proceed now. Back it with a Redis token
|
|
// bucket in shared/adapters/redis (tiered by actor). retryAfter hints when to
|
|
// retry; it is surfaced as the Retry-After header on a 429.
|
|
type RateLimiter interface {
|
|
Allow(ctx context.Context, key string) (allowed bool, retryAfter time.Duration, err error)
|
|
}
|
|
|
|
// RateLimit rejects requests over the limit with 429 + Retry-After. keyFn maps a
|
|
// request to a bucket key (default: authenticated subject, else client IP). The
|
|
// limiter is best-effort: a backend error fails open (request proceeds) so a
|
|
// degraded Redis can't take down the API.
|
|
func RateLimit(limiter RateLimiter, keyFn func(*Context) string) Middleware {
|
|
if keyFn == nil {
|
|
keyFn = DefaultRateKey
|
|
}
|
|
return func(next HandlerFunc) HandlerFunc {
|
|
return func(c *Context) error {
|
|
allowed, retryAfter, err := limiter.Allow(c.r.Context(), keyFn(c))
|
|
if err != nil {
|
|
c.Log().Warn("ratelimit.failed", "category", "ratelimit", "error_msg", err.Error())
|
|
return next(c)
|
|
}
|
|
if !allowed {
|
|
if retryAfter > 0 {
|
|
c.w.Header().Set("Retry-After", strconv.Itoa(int(math.Ceil(retryAfter.Seconds()))))
|
|
}
|
|
return TooManyRequests("rate limit exceeded")
|
|
}
|
|
return next(c)
|
|
}
|
|
}
|
|
}
|
|
|
|
// DefaultRateKey buckets by authenticated subject when present, else by client
|
|
// IP. It does NOT trust X-Forwarded-For (trustedHops=0), so a spoofed XFF can't
|
|
// mint a fresh bucket per request. Behind N trusted proxies/LBs, use RateKey(N).
|
|
func DefaultRateKey(c *Context) string { return rateKey(c, 0) }
|
|
|
|
// RateKey returns a key function for a deployment behind trustedHops proxies/LBs
|
|
// (the IP is taken trustedHops entries from the right of X-Forwarded-For).
|
|
func RateKey(trustedHops int) func(*Context) string {
|
|
return func(c *Context) string { return rateKey(c, trustedHops) }
|
|
}
|
|
|
|
func rateKey(c *Context, trustedHops int) string {
|
|
if id, ok := c.Identity(); ok && id.Subject != "" && id.Subject != "anonymous" {
|
|
return "sub:" + id.Subject
|
|
}
|
|
return "ip:" + clientIP(c.r, trustedHops)
|
|
}
|
|
|
|
// clientIP derives the client address. With trustedHops<=0 it uses the connection
|
|
// RemoteAddr (XFF is attacker-controlled and ignored). Behind trustedHops trusted
|
|
// proxies it takes the entry that many hops from the right of X-Forwarded-For —
|
|
// the first address the trust boundary did not append.
|
|
func clientIP(r *http.Request, trustedHops int) string {
|
|
host, _, err := net.SplitHostPort(r.RemoteAddr)
|
|
if err != nil {
|
|
host = r.RemoteAddr
|
|
}
|
|
if trustedHops <= 0 {
|
|
return host
|
|
}
|
|
xff := r.Header.Get("X-Forwarded-For")
|
|
if xff == "" {
|
|
return host
|
|
}
|
|
parts := strings.Split(xff, ",")
|
|
idx := len(parts) - trustedHops
|
|
if idx < 0 || idx >= len(parts) {
|
|
return host
|
|
}
|
|
if v := strings.TrimSpace(parts[idx]); v != "" {
|
|
return v
|
|
}
|
|
return host
|
|
}
|