Network Security

# Nginx rate limiting for SysManage
# /etc/nginx/conf.d/rate-limiting.conf

# Define rate limiting zones
limit_req_zone $binary_remote_addr zone=sysmanage_login:10m rate=5r/m;
limit_req_zone $binary_remote_addr zone=sysmanage_api:10m rate=100r/m;
limit_req_zone $binary_remote_addr zone=sysmanage_web:10m rate=10r/s;

# Connection limiting
limit_conn_zone $binary_remote_addr zone=addr:10m;

# Geographic rate limiting (using GeoIP)
map $geoip_country_code $geo_rate_limit {
    default 10r/s;
    CN 1r/s;    # Stricter limits for certain countries
    RU 1r/s;
    KP 0r/s;    # Complete block
}

limit_req_zone $binary_remote_addr zone=geo_limited:10m rate=$geo_rate_limit;

server {
    listen 443 ssl http2;
    server_name sysmanage.company.com;

    # Apply connection limits
    limit_conn addr 10;

    # Rate limiting for different endpoints
    location /api/auth/login {
        limit_req zone=sysmanage_login burst=3 nodelay;
        limit_req_status 429;
        proxy_pass http://backend;
    }

    location /api/ {
        limit_req zone=sysmanage_api burst=20 nodelay;
        limit_req zone=geo_limited burst=5 nodelay;
        limit_req_status 429;
        proxy_pass http://backend;
    }

    location / {
        limit_req zone=sysmanage_web burst=50 nodelay;
        limit_req_status 429;
        proxy_pass http://backend;
    }

    # Error page for rate limiting
    error_page 429 @rate_limit_error;

    location @rate_limit_error {
        return 429 '{"error": "Rate limit exceeded", "retry_after": 60}';
        add_header Content-Type application/json always;
    }
}

# Application-level rate limiting in SysManage
from fastapi import FastAPI, HTTPException, Request
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address
from slowapi.errors import RateLimitExceeded
import redis

# Initialize rate limiter with Redis backend
redis_client = redis.Redis(host='localhost', port=6379, db=0)
limiter = Limiter(
    key_func=get_remote_address,
    storage_uri="redis://localhost:6379"
)

app = FastAPI()
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

# Advanced rate limiting with user-based limits
class UserBasedLimiter:
    def __init__(self, redis_client):
        self.redis = redis_client
        self.default_limits = {
            'admin': '1000/hour',
            'operator': '500/hour',
            'viewer': '100/hour',
            'anonymous': '10/hour'
        }

    async def check_rate_limit(self, user_id: str, user_role: str, endpoint: str):
        """Check rate limit for specific user and endpoint"""
        key = f"rate_limit:{user_id}:{endpoint}"
        limit = self.default_limits.get(user_role, self.default_limits['anonymous'])

        # Parse limit (e.g., "100/hour" -> 100 requests per 3600 seconds)
        count, period = limit.split('/')
        count = int(count)

        if period == 'minute':
            window = 60
        elif period == 'hour':
            window = 3600
        elif period == 'day':
            window = 86400
        else:
            window = 3600  # Default to hour

        # Check current usage
        current = await self.redis.get(key)
        if current is None:
            current = 0
        else:
            current = int(current)

        if current >= count:
            raise HTTPException(
                status_code=429,
                detail=f"Rate limit exceeded. Limit: {limit}"
            )

        # Increment counter
        pipe = self.redis.pipeline()
        pipe.incr(key)
        pipe.expire(key, window)
        await pipe.execute()

        return True

# Apply rate limiting to endpoints
@app.post("/api/auth/login")
@limiter.limit("5/minute")
async def login(request: Request, credentials: UserCredentials):
    """Login endpoint with strict rate limiting"""
    # Authentication logic here
    pass

@app.get("/api/hosts")
@limiter.limit("100/minute")
async def get_hosts(request: Request, current_user: User = Depends(get_current_user)):
    """Host listing with user-based rate limiting"""
    # Check user-specific rate limit
    limiter = UserBasedLimiter(redis_client)
    await limiter.check_rate_limit(
        current_user.id,
        current_user.role,
        "get_hosts"
    )

    # Host retrieval logic here
    pass

@app.post("/api/hosts/{host_id}/packages/install")
@limiter.limit("10/minute")
async def install_package(
    request: Request,
    host_id: str,
    package_data: PackageInstallRequest,
    current_user: User = Depends(get_current_user)
):
    """Package installation with conservative rate limiting"""
    # Additional security checks for sensitive operations
    if not current_user.has_permission("packages:install"):
        raise HTTPException(403, "Insufficient permissions")

    # Package installation logic here
    pass