Rate limit login attempts and request for debugging help

Hi all:

I added rate limiting code based on GCRA
(https://en.wikipedia.org/wiki/Generic_cell_rate_algorithm) to roundup
and deployed it to rate limit login attempts on the web interface
(addressing https://issues.roundup-tracker.org/issue2550949).

The default config allows three attempts to log in a minute. After
that the user needs to wait 20 seconds before another attempt.  The
data needed to implement this is stored (indexed by username) in the
one time token database. I can't store it in the user object in the
regular database since the login name may not be valid. If the user is
invalid there is no user object in the database to record this
info. Once the data stops being updated, it expires an hour later to
prevent the disk space from being consumed forever. The admin can
change the number of attempts per minute, but the period is fixed to 1
minute. So this reduces the number of attempts from hundreds/minute to
180/hour. I think this is a reasonable win.

However this code broke one test for Password Migration. The test
takes a password stored with an insecure encryption method and updates
it using a more secure method. I spend a couple of hours trying to
figure out how that was failing, but I ended up more confused then
when I started.

I really could use some help in figuring out what happened here. From
what I can tell it appears to be a problem with data for the same db
object returning different values when read from different places in
the code. There are 4 old methods that are checked. The first two
succeed but the third and fourth test fail to migrate the password. I
can reorder the list of 4 methods in any order (so every method passes
the test if it is first in the list). In testing the first two always
succeed but the last two fail. Bern, Ralf any ideas?

If anybody else wants to try to use their skills the test can be
invoked with:

  python ./run_tests.py -v -k testPasswordMigration  test/test_cgi.py

it fails under both python2 and python3.

Thanks for any idea, attempts to analyze the code.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.