PR #76322: security: bootstrap token path exposes mutex-stall DoS — no rate limit, no lockout, no alert

• Repository: openclaw/openclaw
• Author: fede-kamel
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/76322

Description (problem / solution / changelog)

Closes #77980

Summary

• Bootstrap token auth path had no rate limiting, unlike the device-token path which has full `rateLimiter.check()` + `rateLimiter.recordFailure()` protection
• An attacker opening N WebSocket connections with bogus bootstrap tokens serialises all through the shared `verifyDeviceBootstrapToken` mutex, stalling legitimate device pairing with no IP lockout or alert
• Fix mirrors the existing device-token pattern: check before verify, record failure on reject, reset on success
• Deferred failure accounting: bootstrap `recordFailure` is only flushed if the entire handshake fails. A device with a stale bootstrap token + valid device token is a legitimate connection — the pending failure is discarded when device-token succeeds

Proof of concept (confirmed)

Real WebSocket server using the actual `verifyDeviceBootstrapToken` mutex + disk I/O:

``` Baseline (no attacker): 21.6ms 5 attacker conns: 23ms (x1) 20 attacker conns: 47ms (x2) 50 attacker conns: 134ms (x6) 100 attacker conns: 210ms (x10) 200 attacker conns: 366ms (x17) ← no rate limit fired ```

Zero knowledge of the real token required — attacker only needs to reach the gateway WS port.

Changes

`src/gateway/auth-rate-limit.ts`

• Added `AUTH_RATE_LIMIT_SCOPE_BOOTSTRAP_TOKEN = "bootstrap-token"` constant

`src/gateway/server/ws-connection/auth-context.ts`

• Bootstrap path: check rate limit → skip verify if limited → verify → reset on success
• Failure accounting is deferred: `pendingBootstrapFailure` flag set on rejection; `recordFailure` called only after all fallback paths (device-token) complete and auth is still false
• If device-token succeeds, the pending bootstrap failure is silently discarded

Test plan

17/17 passing (`pnpm test src/gateway/server/ws-connection/auth-context.test.ts`):

Unit (mock limiter)

• Bootstrap path blocked before `verifyBootstrapToken` when rate-limited
• `recordFailure` called on rejected bootstrap token (no device-token fallback)
• `reset` called on successful bootstrap token
• Scope isolation: `check` called with `"bootstrap-token"`, never `"device-token"`
• Stale bootstrap + valid device token → auth succeeds, bootstrap `recordFailure` NOT called ← covers the deferred-failure invariant

Integration (real `AuthRateLimiter`)

• 5 failed attempts → 6th blocked before `verifyBootstrapToken` runs (mutex never acquired)
• Locked attacker IP does not affect a clean IP
• Legitimate device with correct token from a clean IP succeeds after attacker is locked out

PoC scripts removed from `scripts/` before merge review.

Changed files

• src/gateway/auth-rate-limit.ts (modified, +1/-0)
• src/gateway/server/ws-connection/auth-context.test.ts (modified, +256/-1)
• src/gateway/server/ws-connection/auth-context.ts (modified, +51/-17)

PR #78015: Rate-limit bootstrap and device signature auth

• Repository: openclaw/openclaw
• Author: bryce-d-greybeard
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/78015

Description (problem / solution / changelog)

Summary

• add dedicated auth rate-limit scopes for bootstrap-token and device-signature
• check bootstrap-token lockout before serialized bootstrap token verification
• record bootstrap-token failures and reset on success
• check device-signature lockout before repeated signature verification work
• record device-signature failures and reset on success

Fixes #77980.

Verification

• Local workflow batch verification passed before PR branch extraction.
• Targeted regressions cover bootstrap-token limiter behavior and repeated invalid device signatures.

Changed files

• src/gateway/auth-rate-limit.ts (modified, +2/-0)
• src/gateway/server.auth.default-token.suite.ts (modified, +48/-0)
• src/gateway/server/ws-connection/auth-context.test.ts (modified, +36/-0)
• src/gateway/server/ws-connection/auth-context.ts (modified, +37/-17)
• src/gateway/server/ws-connection/message-handler.ts (modified, +35/-1)