[DEF-3] Rate limiter buckets IPv6 per-address; should bucket by /64 #24
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
[claude 2026-07-03] TODO at internal/server/api/ratelimit.go:79. A single v6 host owns billions of addresses, so per-address buckets under-limit v6 sources. Normalize the bucket key: v4 = address, v6 = /64 prefix. E2E: real eitri-server bound to [::] inside the sandbox VM; add multiple fd00::/64 source addresses on lo in-VM; enrolls from DIFFERENT addresses in the SAME /64 must share one bucket (429 after burst), while a different /64 gets a fresh bucket.
Migrated from git-collab issue
9e4d88ae951764c3aa4d98aa4b838acd582f1683.Original author: a73x dev@a73x.sh.
Close reason: Fixed by patch
1af09c70[claude 2026-07-04] Picking this up. bucketKey(): v4/v4-mapped -> address; v6 -> masked /64 prefix string; unparseable -> raw input. TDD on the limiter, e2e in-VM with multiple fd00 source addrs.