AMI: auth_timeout & auth_limit are configured but never enforced; no login rate-limit/backoff

[ryanmurf]

Summary

AmiServerConfig exposes auth_timeout (default 30s) and auth_limit (default 50 unauthenticated sessions), but neither is enforced anywhere. Unauthenticated AMI connections live forever and are unbounded, and Login has no failed-attempt rate-limit / backoff.

Location

• crates/asterisk-ami/src/server.rs:37-39,51-52 — fields defined + defaulted.
• crates/asterisk-ami/src/server.rs:212-219 — handle_connection(..., _config: AmiServerConfig): the config is received but the parameter is unused (_config). No auth deadline task, no cap on concurrent pre-auth sessions.

  $ grep -rn 'auth_timeout\|auth_limit' crates/asterisk-ami/src
  # only the struct fields, the defaults, and a test asserting the default — no enforcement
  

• handle_login (actions.rs:227) has no per-source failed-attempt counter / delay.

Attack / impact

• A client can open the AMI port, send the banner, and hold the connection open indefinitely without authenticating; many such connections exhaust sessions/FDs (pre-auth resource exhaustion). Related to the unbounded pre-auth read buffer in AMI: unbounded pre-auth read buffer (memory-exhaustion DoS) #110 — this is the same trust boundary (unauthenticated session lifecycle) from the timeout/limit angle.
• No rate-limit means unlimited online password guessing against Login (bounded only by network throughput). With the constant-time compare in PR harden(ami): constant-time credential compare + single-use MD5 challenge #123 the per-guess timing oracle is closed, but raw guess volume is still unthrottled.

Recommended fix

• Enforce auth_timeout: spawn a per-connection deadline that drops the socket if !authenticated when it fires (cancel on successful Login).
• Enforce auth_limit: track unauthenticated session count; refuse/After-limit new connections.
• Add a simple per-source failed-Login counter with exponential backoff or temporary block (mirror the SIP rate_limit.rs approach already in-tree).

[github-actions]

🤖 Auto-triage: Automated evaluation failed. A human should review this issue.

Error

GitHub Models API returned 401: {"error":{"code":"unauthorized","message":"Bad credentials","details":"Bad credentials"}}